An audit finding is cheap. What it costs is determined entirely by what happens next. Inspectors across GMP, GDP, pharmacovigilance and medical device frameworks pay close attention to a company’s corrective and preventive action system, because it is the clearest available signal of whether an organisation learns from its own findings or simply processes them.
The repeat finding is the finding that matters
A deficiency observed once may be a lapse. The same deficiency observed at the next inspection is evidence that the quality system did not work. That is why a moderate finding raised for the second time is frequently graded more severely than a new finding of similar substance — and why a long list of overdue CAPAs from previous audits damages an inspection outcome more than the original observations ever did.
Root cause, honestly
The most common failure in CAPA is a root cause that stops at the first plausible explanation. Human error is a description of what happened, not a cause. It leads directly to retraining, which is the weakest available corrective action and the one most likely to precede recurrence.
A more useful analysis asks why the system allowed the error to occur and to go undetected:
- Was the procedure ambiguous, outdated, or impossible to follow as written?
- Did the system design permit the error — a field that accepted an invalid entry, a step with no verification?
- Was the workload or staffing such that the shortcut was predictable?
- Why did no existing control detect it before the auditor did?
Where the answer points to system design, the corrective action should change the system. Controls built into the process outperform controls that depend on people remembering.
Corrective and preventive are different things
The two are routinely merged, and the preventive half is routinely omitted. Correction fixes the instance. Corrective action addresses the cause so it does not recur in that process. Preventive action asks where else the same cause could produce the same outcome — other products, other lines, other sites, other affiliates using the same procedure. A finding at one site that is never assessed for applicability across the network is a finding waiting to reappear.
Effectiveness verification is not closure
Completing an action is not the same as demonstrating it worked. Effectiveness checks should be defined at the point the CAPA is raised, not improvised at closure: what evidence, measured over what period, against what threshold. Common approaches include sampling records after implementation, monitoring the relevant deviation or complaint rate over a defined interval, or re-auditing the process.
Verification needs enough elapsed time to be meaningful. A check performed the week after implementation demonstrates that people are paying attention, which they always are immediately after an audit.
Managing the system, not just the records
Senior management should be looking at the CAPA population as a whole, not at individual records. The useful indicators are the age profile of open items, the proportion of extensions granted, the share of actions consisting solely of retraining or document revision, the rate of effectiveness check failures, and recurring themes across sources. Those numbers describe the health of the quality system more accurately than any single audit report.
How PQRA helps
PQRA supports companies in responding to audit and inspection findings across regulatory, quality, pharmacovigilance and medical device areas: root cause analysis, CAPA design and prioritisation, response drafting to competent authorities, effectiveness verification, and remediation of backlogged CAPA systems before the next inspection.
If you are responding to findings or want an independent view of your CAPA system before a regulator forms one, contact PQRA.
No responses yet