ISO 13485 · Expert · 14 min lesson
Follow-up: verifying corrective actions and CAPA effectiveness
ISO 13485:2016 clauses 8.2.4, 8.5.2, 5.6.2 and 4.2.5, ISO 19011 clause 6.7, GHTF SG3 N18 (2010)
What you will learn
- Verify implementation and effectiveness of corrective action separately, each with its own evidence.
- Spot CAPA closure without evidence, closure on the report date, same-person approval and backdating.
- Feed CAPA verification results into management review under clauses 5.6.2 and 5.6.3.
Key takeaways
- Implementation asks whether the action was done; effectiveness asks whether the problem stopped, and clause 8.5.2 f) requires both reviews.
- Set a measurable effectiveness criterion and window before acting, and take the data from the source, not from the action owner.
- Closure on the report date, missing attachments, impossible dates and one person signing everything are the classic warning signs.
- Independence matters: the person who raised or owns the action should not alone verify and close it (clause 8.2.4).
- Report opened, overdue, reopened and verified-effective numbers to management review under clause 5.6.2.
Free practice question
Halden CAPA-0412 was raised by the quality manager on 3 March, approved by the same person on 4 March and closed on 14 March, the date of the internal audit report. The effectiveness field reads 'done'. No data is attached.
What is the main weakness?
No evidence of an effectiveness review, and no independence between raising, approving and closing.
Correct. Clause 8.5.2 f) requires an effectiveness review and clause 8.2.4 expects objectivity, and this record shows neither.
The record was closed too quickly to be accepted by any customer.
Not quite. Customers are not the test; clause 8.5.2 f) concerns evidence of effectiveness, not speed alone.
The word 'done' should be written as 'completed'.
Not quite. Wording is cosmetic; the gap against clause 8.5.2 f) is the missing data behind the word.
The audit report should have been issued later.
Not quite. Report timing is not the issue; clause 8.2.4 asks that actions be verified and the results reported.
Key terms
- correction: Action to eliminate a detected nonconformity; it fixes the item, not necessarily the cause.
- corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence (ISO 13485 clause 8.5.2).
- implementation verification: Confirming that the planned action was actually carried out, with dated records.
- effectiveness review: Reviewing, with data over a defined period, whether the action prevented recurrence (clause 8.5.2 f).
- effectiveness criterion: A measurable pass condition and window defined before the action is taken.
- backdating: Entering or changing a date so a record appears to have been made earlier than it was; a records integrity failure.
- follow-up: Verification of actions taken after an audit and reporting of the results (clause 8.2.4; ISO 19011 clause 6.7).
- management review: Planned review by top management of the QMS suitability, adequacy and effectiveness, with defined inputs (clause 5.6.2).
Official sources
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- ISO 19011 Guidelines for auditing management systems (fourth edition, 2026; replaces the 2018 edition)
- GHTF SG3 N18:2010 Quality management system - Medical devices - Guidance on corrective action and preventive action and related QMS processes
- MDSAP AU P0002.011 MDSAP Audit Approach (measurement, analysis and improvement chapter covers corrective and preventive action)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.