Understanding CAPA requirements in a software context.

Abstract

Biomedical Instrumentation & Technology 221 Section 820.100 of the Food and Drug Administration (FDA) Quality System Regulation requires that: “(a) Each manufacturer establish and maintain procedures for implementing corrective and preventive action.” It further states that these procedures shall include: requirements for analyzing processes, using appropriate statistical methodology to detect recurringquality problems investigating the cause of non-conformities relating to both products and processes identifying actions needed to correct and prevent recurrence of problems verifying or validating the effectiveness of the corrective and preventive action implementing and recording changes in methods and procedures needed to correct and prevent quality problems ensuring that information related to quality problems is disseminated submitting relevant information on quality problems and their corrective and preventive actions for management review and documenting all of these activities. No specific mention is made in this section of the regulation regarding software. However, looking at the FDA’s intent and enforcement actions, it is clear that the requirements for corrective and preventive action (CAPA) apply to software products and processes. As such, one could ask: why discuss software corrective and preventive action as a topic in itself? From one perspective the answer to this question is that there is no need to discuss it separately since the requirements for corrective and preventive action apply to software and software development in exactly the same way as they apply to all other regulated activities. On the other hand, it can be helpful to discuss the corrective and preventive action from a software-specific perspective to emphasize those aspects that are either particularly important, or sometimes overlooked. As a starting point, a useful exercise would be to take the bulleted list of requirements provided above, or the more detailed numbered list of requirements in 820.100 of the regulation itself, and ask a few questions in the context of your company’s quality system: