Corrective Action Procedure (CAPA) Template: Free Download & ISO 9001 Guide

Auditors love CAPA. Not because they enjoy watching you squirm — but because the corrective action process is the single clearest indicator of whether your quality management system actually learns from its mistakes. A company with a robust CAPA process demonstrates that problems get investigated, root causes get eliminated, and the system gets stronger over time. A company without one is just fighting the same fires on repeat.

Here's what separates organizations that pass audits from those that collect findings: the ones that pass treat CAPA as a problem-solving discipline. The ones that fail treat it as paperwork. They fill in forms, write "retrain the operator" in the corrective action field, and close the record as fast as possible. Then the same nonconformity shows up six months later, and the auditor pulls up the previous CAPA and asks, "So what exactly did retraining accomplish?"

This guide breaks down what ISO 9001 Clause 10.2 actually requires, walks you through a proven CAPA procedure step by step, and gives you a free template you can drop directly into your QMS. Whether you're building a CAPA process from scratch or tightening up one that's not working, this is the practical playbook.

What ISO 9001 Clause 10.2 Actually Requires

Clause 10.2 is titled "Nonconformity and Corrective Action." It's one of the most audited clauses in the standard, and for good reason — it's where you prove your QMS is a living system, not a shelf decoration.

When a nonconformity occurs (including customer complaints), the standard requires you to:

• React to the nonconformity: Take action to control and correct it. Deal with the consequences.
• Evaluate the need for corrective action: Determine whether action is needed to eliminate the cause so it doesn't recur or occur elsewhere.
• Determine the root cause: Not just what happened, but why it happened.
• Implement corrective action: Take action to eliminate the root cause.
• Review effectiveness: Verify the corrective action actually worked.
• Update risks and opportunities: Revisit your risk assessments if needed.
• Make changes to the QMS: If the system itself needs to change, change it.

Auditors look for evidence at every step. They'll pull a CAPA record and trace it from the initial nonconformity report through root cause analysis, implementation, and effectiveness verification. If any link in that chain is missing — especially root cause analysis or effectiveness verification — you'll get a finding.

The standard also requires you to retain documented information as evidence of the nature of the nonconformities, actions taken, and the results of corrective action. In practice, this means your CAPA records need to tell the complete story.

The 8D Methodology

The 8D (Eight Disciplines) methodology originated in the automotive industry but has become one of the most widely used frameworks for CAPA across all sectors. It provides a structured, team-based approach to problem solving that maps cleanly onto Clause 10.2 requirements.

• D1 — Establish the Team: Assemble a cross-functional team with the knowledge and authority to solve the problem.
• D2 — Describe the Problem: Define the nonconformity in specific, measurable terms. What, where, when, how big, how often?
• D3 — Containment: Implement interim containment actions to protect the customer from further impact while you investigate.
• D4 — Root Cause Analysis: Identify all potential causes. Use 5 Whys, Fishbone, or Fault Tree to determine the true root cause.
• D5 — Choose Corrective Actions: Select permanent corrective actions that address the root cause. Verify they won't introduce new problems.
• D6 — Implement Corrective Actions: Execute the plan. Document what was done, by whom, and when.
• D7 — Prevent Recurrence: Modify systems, procedures, and controls to prevent the problem from happening again. Update training as needed.
• D8 — Recognize the Team: Acknowledge the team's effort. Share lessons learned across the organization.

You don't need to use 8D for every CAPA. A minor documentation error doesn't need a cross-functional team and eight formal disciplines. But for significant nonconformities — customer complaints, recurring defects, safety issues — the structure ensures nothing gets missed.

5 Common CAPA Mistakes Auditors See Constantly

1. No Root Cause Analysis

The most common mistake. The CAPA record describes the nonconformity, jumps straight to a corrective action, and skips the root cause entirely. Or worse, the "root cause" field says something like "operator error" — which is a symptom, not a root cause. Why did the operator make the error? That's what auditors want to see.

2. Containment Confused with Corrective Action

Containment stops the immediate impact. Corrective action eliminates the root cause. They're different things. "We quarantined the affected lot" is containment. "We redesigned the fixture to prevent misalignment" is corrective action. When organizations record containment as their corrective action, the root cause remains unaddressed and the problem recurs.

3. Closing CAPAs Too Early

A CAPA isn't done when the corrective action is implemented. It's done when you've verified the corrective action was effective. That means monitoring for a reasonable period — typically 30, 60, or 90 days — to confirm the nonconformity hasn't recurred. Closing a CAPA the same day the corrective action was implemented is a red flag for any auditor.

4. Not Verifying Effectiveness

Related to closing too early, but distinct. Some organizations let CAPAs sit open indefinitely without ever going back to check whether the fix worked. Clause 10.2.1(f) explicitly requires you to "review the effectiveness of the corrective action taken." No effectiveness review = nonconformity against the standard.

5. CAPAs That Just Say "Retrain Employees"

This is the auditor's favorite punching bag. "Retrain employees" as a corrective action tells the auditor two things: you didn't do a proper root cause analysis, and you're relying on human behavior change instead of system improvement. Training can be part of a corrective action — especially when procedures have been updated and people need to learn the new process. A proper training tracking system ensures that retraining is documented and verified. But training alone, without a system change, is almost never sufficient.

Step-by-Step CAPA Procedure

Here's a complete CAPA procedure you can adapt to your organization. Each step maps to the template included below.

Step 1: Identify and Record the Nonconformity

Every CAPA starts with a nonconformity report. The report should capture what happened, when, where, and who identified it. Categorize the source: customer complaint, internal audit finding, process failure, supplier issue, or product nonconformity. Assign a unique CAPA number and enter it in your CAPA log.

Good nonconformity descriptions are specific. "Product defective" is useless. "Lot 2024-0847: 12 of 200 units failed dimensional inspection at Station 3 — OD measured 25.4mm vs. specification of 25.0 ± 0.1mm" gives you something to investigate.

Step 2: Containment

Take immediate action to limit the impact. Quarantine suspect product. Stop the affected process. Notify downstream customers if nonconforming product may have been shipped. Containment buys you time to investigate properly without the problem getting worse.

Step 3: Root Cause Analysis

This is where most CAPAs succeed or fail. Use a structured method — 5 Whys for straightforward problems, Fishbone/Ishikawa when multiple factors may contribute, Fault Tree for complex safety-critical failures. Document your analysis. The goal is to identify the systemic cause, not assign blame.

A good root cause analysis answers: Why did this happen? Why didn't our existing controls catch it? Could this happen in other processes or products?

Step 4: Corrective Action Plan

Develop specific actions that address the root cause. For each action, document: what will be done, who owns it, when it's due, and what resources are needed. Prioritize system-level fixes (error-proofing, design changes, automation) over human-dependent fixes (additional inspections, retraining).

Step 5: Implementation & Verification

Execute the plan and document completion. Then verify effectiveness: monitor the relevant metrics for 30–90 days, review complaint data for recurrence, audit the affected process. Define your close-out criteria upfront so there's no ambiguity about what "effective" means.

Step 6: Preventive Measures & Lessons Learned

Update procedures, training materials, and risk registers based on what you learned. Share lessons learned with other teams. This is where a single CAPA improves the entire system — not just the one process that failed.

Step 7: CAPA Record Closure

The Quality Manager reviews the complete record: root cause analysis, corrective actions, implementation evidence, effectiveness verification. If everything checks out, the CAPA is closed and filed. If not, it goes back for further investigation. Update your document control records accordingly.

Free CAPA Template

Below is a complete corrective action procedure template you can copy into your QMS. It follows the same format as our other Training Tiger templates — document number, title, and control line. All revision history, approvals, and metadata are managed in Training Tiger.

How Training Tiger Helps

Here's where CAPA connects directly to training management. When a corrective action requires updated procedures — and most significant CAPAs do — you need to retrain the affected employees and prove they completed the training. That's not optional under Clause 7.2 (Competence).

Training Tiger closes the loop. Upload the updated procedure, assign training to affected personnel, track completion with timestamps, and export records for your auditor. When the auditor pulls your CAPA and asks "How do you know the team was retrained on the new procedure?" you pull up the training record in seconds — who completed it, when, on which revision.

Better yet, when you publish a revised procedure in Training Tiger, the system automatically flags affected employees for retraining. No manual tracking. No spreadsheets to update. No one working from an outdated procedure because they didn't get the memo.

Key Takeaways

• CAPA is how your QMS proves it learns from mistakes. Treat it as a problem-solving discipline, not paperwork.
• Clause 10.2 requires root cause analysis and effectiveness verification — skipping either one is an audit finding.
• Containment is not corrective action. Containment stops the bleeding. Corrective action eliminates the root cause.
• "Retrain employees" alone is almost never a sufficient corrective action. Fix the system first, then train on the change.
• Use structured methods (5 Whys, Fishbone, 8D) for root cause analysis. Document everything.
• Don't close CAPAs until effectiveness is verified — typically 30–90 days of monitoring after implementation.
• When CAPAs result in procedure changes, ensure affected employees are retrained and the training is documented.
• A strong CAPA process is your best defense in any ISO 9001 audit. Invest in getting it right.

Related Articles