Templates and records · ISO 13485 · Clause 8.5.2 y 8.5.3

ISO 13485 CAPA template: corrective and preventive action

The record that closes the quality loop at a medical device manufacturer: from an actual or potential failure to an understood cause and an action shown to be effective.

In one sentence

A CAPA under ISO 13485 records the nonconformity or potential problem, the investigation and its cause, the evaluation of the need for action, the action with its plan and the documentation it updates, the verification that it does not affect safety, performance or regulatory requirements, and the review of its effectiveness, because clauses 8.5.2 and 8.5.3 require this to be done without undue delay and those records to be kept.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 13485 · Clause 8.5.2 y 8.5.3 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information: Mandatory record Records of investigation and actions taken (8.5.2 and 8.5.3)
Who fills it in: Quality and the process owner Design or regulatory take part when the action affects the device or its technical documentation
When: On detecting the nonconformity or the risk Effectiveness is reviewed once enough time or volume has passed to see whether the problem returns
How long it is kept: Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires

What ISO 13485 demands and what it leaves to your judgement

ISO 13485 keeps preventive action as a requirement in its own right, unlike ISO 9001. It requires documented procedures to review nonconformities, complaints included, determine their causes, evaluate the need for action, plan, document and implement the action, updating the documentation affected, and review its effectiveness.

It also requires verification that the action does not adversely affect the ability to meet regulatory requirements or the safety and performance of the device: a poorly conceived corrective action can introduce a new risk.

Actions must be proportionate to the effects and taken without undue delay. The notified body usually looks at the average closure time and at CAPAs that have been open for months.

Read it in context: Measurement, analysis and improvement, in the ISO 13485 Academy

Structure

Fields the template should include

Number, type (corrective or preventive) and source
Description of the actual or potential problem and its extent
Investigation and root cause analysis
Evaluation of the need for action and proportionality criterion
Action plan, owner and date
Documents updated by the action
Verification that safety, performance and regulatory requirements are not affected
Impact on risk management
Effectiveness review: criterion, date and result
Closure and approval

Example

Example: CAPA for low tensile strength

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Number	CAPA-2026-015 · corrective · source: serious incident NI-26-0451
Problem	Catheter tip with tensile strength below specification in batch UF12-26-0390
Root cause	Ishikawa: tip mould temperature outside the window for 3 hours due to a probe failure; the alarm was not enabled
Action	Enable alarm and machine lock-out outside the window; add the alarm check to shift start-up · Engineering · 15 July
Documents	PF-04 rev. H and start-up record RA-02 updated
Safety and regulations	No change to the design or the validated window: no revalidation or notified body report needed
Risk	The cause is added to risk file RMF-UF-03
Effectiveness	30 October: 12 batches with conforming tensile strength and 2 automatic lock-outs recorded · effective

At the audit

Mistakes auditors commonly flag

No preventive actions at all: the whole system is reactive.
CAPAs open for months with no justification for the delay.
The root cause stops at "human error".
Nobody checks whether the action affects validation or technical documentation.
Effectiveness reviewed on the day of closure.

In Kimobox

How this record is kept in Kimobox

1Each nonconformity is opened with a mandatory root cause and verification of effectiveness.
2The action is assigned to an owner with a date, and the system warns you if it slips.
3Complaints are recorded with their analysis, root cause and associated action.
4Recurring nonconformities feed the risk map.

Frequently asked questions

What people ask us before getting started

Why does ISO 13485 keep preventive action?

Because it did not adopt the 2012 common structure that replaced it with risk-based thinking. In ISO 13485 preventive action remains a requirement with its own procedure (8.5.3).

Does every complaint open a CAPA?

No. The standard asks you to evaluate the need for action with a criterion proportionate to risk. What must be recorded is the decision and its justification, and trends across similar complaints often justify a CAPA even when each one on its own would not.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring