To write or not to write: CAPA reports

Non-systemic issues are typically addressed without going through the whole 'root cause analysis + action plan development' rigmarole (that's my grown-up word of the day). However, please note the bolding of the word 'typically'. Further to that, define 'systemic'...systemic in what sense (i.e., within a process, within a department, within a common theme/category, etc.).

Without meaning to make this sound too daunting, I've seen trigger matrices for managing nonconformances - where events where listed as needing either a correction or a corrective action. This was reviewed and updated annually (at a minimum). For example, we would look at our downtime and, based upon our analysis, set up triggers such as:

• Correction | 2-10 minutes of unplanned downtime
• Corrective Action | >10 minutes of unplanned downtime

This type of set-up helped us to keep our management of nonconformances to practical level (i.e., we didn't get bogged down in paperwork) and, over time and with proper corrections and corrective actions, our annual analysis had us revising the triggers to become tighter and tighter.

In my experience, other variables that can determine if we go corrective action or simply the route of a correction can include, but are not limited to:

• Process results (i.e., the trigger concept I outlined above)
• Level of risk - to the client, to the business...to any stakeholder, actually
• Client requirement - you may think it's a minor issue, but your Client may require a full-blown root cause analysis and action plan
• Repeat occurrences - they "fixed" that non-systemic issue, but now it's happened again

 

You actually are in good company Colin. This also happened to...my boss. The only difference was when he was put into his position (Quality Manager with zero credentials in QA) he had a CQM/OE and Internal Auditor with 20 years in QA to draw on - me, LOL. We really do live in a Dilbert world don't we?

The one advantage you have is the lack of "But we have always done it this way" baggage that comes from years of managing systems via the old methods and past standards. Now you can ask "Why are we doing this?" and "What is the most important thing?" because a) it is the right way and b) it is now actually written into the standard.

So: since everything is based on risk and ISO 9001:2015 requires risk to be included in all processes and Corrective Action is a process, our responses to nonconformity can be based on risk but also must have a focus on customer satisfaction. Do keep in mind that 10.2.2 requires retained documented information - but it does not say how that will be done. I know an Environmental Engineer who insisted on keeping a separate log of actions from the site's official Corrective Action process that I maintained. Once I studied his log I was convinced because it made so much sense. He permitted me to post its format so I put a version of it in the QMS Audit Program Manager tool. The 3 factors can be set based on your site's prerogatives. Having the term record replaced by retained documented information frees us to use such logs, but I advise you keep such a tool in a file with restricted access in order to prevent loss of control.

It helps to list even the little things so we can notice if they keep cropping up and representing "death by a thousand cuts," in which case an upgrade to corrective action might be decided on. This tool is meant to help track such things.

I hope this helps!