CAPA Under EU GMP Chapter 1: Root Cause, Human Error and Effectiveness

CAPA — corrective and preventive action — is where most GMP inspection findings end up, and the reason is rarely that a site has no CAPA system. It is that the system cannot show the three things EU GMP Chapter 1 actually asks for: root cause analysis proportionate to risk, a justified position when human error is blamed, and documented evidence that the actions worked.

How deep root cause analysis has to go

Paragraph 1.4(xiv) requires an appropriate level of root cause analysis when investigating deviations, suspected product defects and other problems — and it says the level should be determined using Quality Risk Management. There is no single prescribed depth. A minor documentation deviation and a sterility excursion do not warrant the same investigation, and Chapter 1 expects you to be able to explain which you treated as which, and why.

It also handles the case every quality manager has met: what if you genuinely cannot establish the root cause? Chapter 1 does not require you to invent one. Where the true root cause cannot be determined, the most likely cause or causes should be identified and addressed. The obligation is to act on the probable cause, not to close the record with "root cause not determined" and no action.

Paragraph 1.8(vii) sets the floor for the serious end: significant deviations must be fully recorded and investigated to establish root cause, with corrective and preventive action implemented.

The human error clause, and why it matters most

This is the single most useful sentence in Chapter 1 for anyone reviewing CAPA records. Where human error is suspected or identified as the cause, paragraph 1.4(xiv) requires that position to be justified — and requires care that process, procedural or system-based causes have not been overlooked.

In practice that reverses the burden. "Operator error, retrained" is not a closed investigation under Chapter 1; it is an assertion that needs defending, and the defence has to show you looked for the procedural or system cause and ruled it out. A retraining action attached to a deviation whose procedure was ambiguous, whose equipment invited the mistake, or whose shift pattern made it likely is precisely the finding an inspector is looking for. It is also why a training record is weak evidence of an effective CAPA — the point made in a different regulatory frame by the competence requirements now in force under the FDA QMSR, where effectiveness rather than attendance is the test.

Effectiveness is a requirement, in four separate places

Chapter 1 does not mention CAPA effectiveness once. It builds it into the system at four points:

Paragraph 1.4(xiv) requires CAPA effectiveness to be monitored and assessed, again under Quality Risk Management principles. Paragraph 1.4(xiii) requires an evaluation after any change, to confirm the quality objectives were achieved and that there was no unintended harmful impact. Paragraph 1.10(iv) brings the effectiveness of resultant corrective and preventive actions into the periodic product quality review. And paragraph 1.11 requires the effectiveness of the CAPA management procedures themselves to be verified during self-inspection.

Those are four different questions: did this action work, did this change cause harm elsewhere, are our actions working across the product, and does our CAPA process itself work. A site that answers only the first has a gap.

Where CAPA meets the product quality review

The product quality review, normally annual, is the formal place CAPA gets examined. Paragraph 1.10(iii) brings in failed batches and their investigations. 1.10(iv) covers significant deviations and the effectiveness of the resulting CAPAs. 1.10(viii) covers complaints, returns and recalls. And 1.10(ix) asks a question that catches sites out — the adequacy of previous corrective actions. A recurring deviation that was closed last year with an action that plainly did not hold is visible at exactly this point.

Paragraph 1.11 then requires the manufacturer, and the marketing authorisation holder where that is a different party, to evaluate the review and decide whether corrective and preventive action or revalidation is needed — with management procedures tracking those actions. The review is not a report that gets filed; it is a decision point with consequences.

Senior management cannot delegate this

Paragraph 1.5 places ultimate responsibility for an effective and adequately resourced pharmaceutical quality system with senior management, including clearly defined roles and authorities. Paragraph 1.6 requires periodic management review with senior management participating, aimed at continual improvement of products, processes and the system itself. Paragraph 1.4(xvii) requires regular self-inspection or quality audit appraising the system's effectiveness, and 1.7 requires the system to be defined and documented, normally in a quality manual.

Read together, those place CAPA performance on the management agenda rather than in the quality department alone — the same structural logic that runs through the Chapter 2 personnel obligations and the Annex 1 personnel qualification regime.

On the device side, the ground has just moved

For medical devices the comparable framework changed recently. The FDA's Quality Management System Regulation became effective on 2 February 2026, amending 21 CFR Part 820 and incorporating ISO 13485:2016 by reference, together with clause 3 of ISO 9000:2015 for terms and definitions. Where an incorporated ISO clause conflicts with the FD&C Act or its implementing regulations, the Act and the regulations control. From the same date the FDA moved to Compliance Program 7382.850 and stopped using QSIT for device inspections. Device manufacturers should read their CAPA obligations through the incorporated standard rather than the former Part 820 text — and should note the FDA described no phase-in period.

What a defensible CAPA file contains

Six things, on the Chapter 1 reading: a documented basis for the investigation depth you chose, tied to risk; a root cause, or an identified most-likely cause with action taken on it; where human error is cited, a justification plus evidence that process and system causes were considered; defined effectiveness checks with results and dates; the CAPA visible in the product quality review including a look back at previous actions; and self-inspection evidence that the CAPA procedure itself was tested. Root cause discipline of this kind is not unique to pharma — the same expectation appears in financial services, where the FCA's approach to complaints root cause analysis asks firms to identify and rectify the underlying harm rather than the individual case. Structured CPD courses are one route to building that discipline into a quality team, alongside the data integrity expectations that underpin the records all of this depends on.