CAPA Record Requirements: Retention, Signatures, and Closure

A CAPA record documents how a medical device manufacturer identified a quality problem, investigated its root cause, planned and carried out fixes, verified those fixes worked, and closed the file. Under 21 CFR 820.100, the record must capture the nonconformance, the investigation and its data, the corrective and preventive actions taken, verification of effectiveness, and management review, and it must be retained for the design and expected life of the device with a two-year floor.¹ As of February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference, so manufacturers now work from a single international standard, though the underlying CAPA obligations carry forward largely intact.² One practical change: the old exemption at 820.180(c) that shielded internal audit reports, supplier audits, and management reviews from routine FDA review is gone, so if your CAPA references those documents, inspectors can now follow the trail to the source.³

When a CAPA Record Is Required

Not every defect opens a CAPA. A single out-of-spec unit caught at final inspection and properly dispositioned under your nonconforming product procedures may need nothing more than a documented evaluation under 21 CFR 820.90.⁴ A CAPA becomes necessary when the data points toward a recurring or systemic issue, or when the risk to patients is high enough that a single event demands root cause elimination.

The regulation identifies the data streams that feed the decision: process outputs, quality audit reports, service records, complaints, returned product, and other quality data.¹ Common triggers include:

Recurring nonconformances, such as the same tolerance failure across multiple production lots.
Customer complaints and Medical Device Reports filed under 21 CFR Part 803 when a device may have caused or contributed to a death or serious injury.⁵
Audit findings from internal quality audits or third-party inspections that reveal deviations from procedures.
Trend analysis showing a control is degrading, even before individual results technically fail.
Software failures or logic errors in device firmware affecting safety or performance.

The distinction that matters is between an isolated incident and a signal. Open a CAPA for every minor deviation and the quality team drowns; open one for none and the regulation is being ignored.

Intake and Containment Fields

Every CAPA record starts with the same set of preliminary fields that establish traceability: a unique identification number, the date the problem was discovered, and the name or role of the person initiating the record. A clear description of the nonconformance follows, stating what happened, where it happened, and which products or lots are affected.

The record must also document immediate containment. Before the investigation begins, the quality team often needs to quarantine suspect inventory, stop shipment on affected lots, or segregate nonconforming product already in the field. The nonconforming product regulation requires procedures for identifying, documenting, evaluating, and segregating product that fails specifications, and those containment steps become the first documented layer of the CAPA.⁴ An investigator reading the record cold should be able to see the scope, the detection date, and what the company did in the first hours to limit patient exposure.

Root Cause Investigation

The investigation phase is where most records either prove their value or fall apart. The regulation requires manufacturers to investigate the cause of nonconformities relating to product, processes, and the quality system, and to document both the activities and their results.¹ Investigators commonly use structured methodologies like 5 Whys analysis or fishbone diagrams, and the record should reflect that logical chain from symptom to underlying cause.

This section runs on evidence. Equipment calibration logs, operator training records, raw material certificates of analysis, and process parameter data get attached or referenced. The identified root cause must explain the full scope of the reported problem. A cause that accounts for some of the defective units but not others is incomplete, and an auditor will catch the gap.

Statistical Methodology

The regulation explicitly requires appropriate statistical methodology to detect recurring quality problems.⁶ The FDA has stated that misusing statistics to minimize a problem rather than address it violates this requirement. A trend analysis that conveniently shows an “acceptable” failure rate cannot be used to avoid corrective action when the underlying controls are clearly inadequate. The record should show the methodology, the data set, and the conclusions drawn.

The Action Plan

Once the root cause is established, the record shifts to what the company will do about it. The corrective action plan details the specific changes to manufacturing processes, equipment, software, or procedures needed to eliminate the identified cause. The regulation requires manufacturers to identify the actions needed to correct and prevent recurrence of nonconforming product and other quality problems.¹

A well-documented plan includes:

Specific actions: exactly what will change, whether a revised work instruction, a retooled fixture, a software update, or a new incoming inspection requirement.
Responsibility assignments identifying which department or individual owns each item.
Completion timelines with target dates that support accountability during follow-up audits.
Training updates and competency verification if the change alters how operators perform a task.
Preventive actions applied to related product lines, processes, or suppliers that share similar risk factors, even where no failure has yet occurred.

The preventive component is where experienced quality teams distinguish themselves. Fixing the broken process is not enough; the record needs to show the organization looked at analogous processes and addressed the same vulnerability before it produced a second failure.

Health Hazard Evaluations

When the corrective action involves product already distributed, the record may need to document or reference a Health Hazard Evaluation (HHE). The FDA uses HHEs to assess severity of risk, considering the probability of failure, the seriousness of potential injury, and whether vulnerable populations such as infants, elderly patients, or critically ill individuals face elevated risk.⁷ The HHE outcome can determine whether a field correction escalates to a formal recall and at what classification level. Linking it to the CAPA creates a complete picture of how patient risk was evaluated alongside the manufacturing fix.

Verification, Effectiveness, and Closure

Implementing the plan is not the finish line. The regulation requires verifying or validating that the corrective and preventive actions are effective and do not adversely affect the finished device.¹ This effectiveness check is one of the most scrutinized parts of the record during inspections, because a CAPA closed without evidence that it actually worked is barely better than no CAPA at all.

Verification typically involves post-implementation data collected over a defined observation period and compared against the pre-CAPA baseline. If the action was intended to reduce a defect rate, the record should show the rate before and after with enough data points for statistical confidence. Sample sizes need to be large enough to be meaningful; using a binomial probability approach, roughly 99 units at a 95% confidence level is a common starting point, though the right number depends on the defect rate and the risk involved.

A quality manager or other authorized individual then performs a final review and sign-off, confirming actions were completed, effectiveness data supports closure, and no new risks were introduced. The record documents any ongoing monitoring, such as continued data collection for a specified number of production lots after closure. Only then is the CAPA formally closed and submitted for management review.⁶

How Long CAPA Records Must Be Kept

Completed CAPA records must be retained for a period equal to the design and expected life of the device, with a minimum of two years from the date the device is released for commercial distribution.⁸ For implantable devices or products with long service lives, records may need to remain accessible for a decade or more.

Records must be stored at the manufacturing facility or another location reasonably accessible to responsible company officials and to FDA investigators. They must stay legible, be stored in a way that minimizes deterioration, and be backed up if maintained in automated data processing systems.⁸ When an FDA investigator requests records during an inspection, they must be made readily available for review and copying. “Readily available” does not mean eventually; if your team cannot produce a record on short notice, the inspector will note it.

Electronic Records and Signatures

Most manufacturers now manage CAPA records through digital Quality Management Systems, which brings 21 CFR Part 11 into play. The most operationally significant requirement is the audit trail: the system must generate secure, computer-generated, time-stamped entries that independently record who made each change, when, and what was modified. Previously recorded information cannot be obscured by edits, and the audit trail itself must be retained at least as long as the underlying CAPA record.⁹

Electronic signatures on CAPA records must display the signer’s printed name, the date and time of signing, and the meaning of the signature, such as “approval,” “review,” or “authorship.”¹⁰ These elements must appear in any human-readable display, on screen or in a printout.

The FDA issued updated guidance in February 2026 on Computer Software Assurance for production and quality management system software, replacing earlier validation guidance with a risk-based approach.¹¹ The level of testing and documentation your QMS software needs now depends on the risk that software poses to product quality. A module that controls batch release decisions warrants more rigorous assurance than one that generates internal notifications.

What Weak Records Cost

CAPA deficiencies are consistently among the most frequently cited observations on FDA Form 483s during medical device inspections. When an investigator finds no functioning CAPA system, or records that are incomplete, missing, or closed without evidence of effectiveness, the consequences escalate in a predictable sequence: a Form 483 at the close of the inspection, then a Warning Letter if the response is inadequate, and, in serious cases, a federal court injunction restricting or halting manufacturing until compliance is demonstrated. In the Philips Respironics matter, a consent decree restricted the company from manufacturing and distributing devices at multiple facilities until it completed remediation and received written FDA confirmation of compliance.¹² Halted production, mandatory retention of independent experts, and supervised remediation can run to tens of millions of dollars and take years to resolve, which is why the record itself, built completely and closed with evidence, is the point of the exercise.

1
eCFR. 21 CFR 820.100 – Corrective and Preventive Action
2
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)
3
U.S. Food and Drug Administration. Quality Management System Regulation – Frequently Asked Questions
4
eCFR. 21 CFR 820.90 – Nonconforming Product
5
U.S. Food and Drug Administration. Medical Device Reporting (MDR) – How to Report Medical Device Problems
6
U.S. Food and Drug Administration. Corrective and Preventive Action Subsystem Cultivating Compliance Conference
7
U.S. Food and Drug Administration. Health Hazard Evaluations (HHEs) and Health Risk Assessments (HRAs)
8
eCFR. 21 CFR 820.180 – General Requirements
9
eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
10
eCFR. 21 CFR 11.50 – Signature Manifestations
11
U.S. Food and Drug Administration. Computer Software Assurance for Production and Quality Management System Software
12
U.S. Food and Drug Administration. Federal Court Enters Consent Decree Against Philips Respironics