Non-conformities and CAPA: structuring deviation handling through to closure

A badly handled non-conformity costs twice: once when it happens, and again when it happens again. Yet deviation handling is often split between emails, a shared spreadsheet and verbal exchanges. Here is how to structure a single process, from detection to effectiveness check.

1. Make reporting immediate

The later a deviation is reported, the harder it is to analyze. The operator who spots it must be able to report it from their workstation, in a few seconds, with a photo and a description. A simple report is a report that actually gets made.

2. Rate criticality with shared rules

Assessing severity case by case leads to uneven handling. Define a few criticality levels with explicit criteria (product, safety, customer or regulatory impact), and attach a process to each one: who is notified, how fast, and who decides.

3. Look for the cause, not the culprit

A corrective action without root-cause analysis treats the symptom. Always document the analysis — 5 whys, Ishikawa diagram or any method that suits your context — and keep it with the deviation: that is what will let you recognize a recurring problem.

4. Tell corrective from preventive

• Remedial action: deal with the deviation found (isolate, rework, scrap).
• Corrective action: remove the cause so the deviation does not happen again.
• Preventive action: extend the fix to similar situations before they drift.

Every action has an owner and a due date. A missed due date should trigger an alert, not be discovered at the next review.

5. Check effectiveness before closing

This is the step most often forgotten. A CAPA is only closed once you have checked, after a set period, that the deviation has not come back. Without that check, the closure rate flatters the indicators without guaranteeing any progress.

6. Make use of the history

When every deviation follows the same process, deviations become comparable. Recurring ones stand out, action plans can be prioritized and lessons learned are shared across teams and sites. That is where non-conformity handling becomes a driver of continuous improvement.