Regulatory Open Forum

This message was posted by a user wishing to remain anonymous

Hello everyone,

Seeking some guidance regarding Preventive Actions.

A recent finding from an audit determined our Preventive Actions (PA) should be launched independently from a Corrective Action (CA).  Our current practice is to document PAs concurrently with a CA. For example, if a nonconformance occurs within one product, our preventive action is to prevent nonconformance in all other products as well; the documentation is recorded in one place.  Our current practice was deemed acceptable by multiple previous auditors.

With the recent finding, we are struggling to figure out when independent PAs are launched.  It seems like many actions we are taking as a company could be determined as preventive in some way, but adding extra documentation as PA seems unnecessary.  For example: process improvement, implementation of new software, creating more robust training programs etc.)

When launching a PA independently from a CA, how does one determine what should be documented as a PA?

Any advice is appreciated.

Thanks!

​

For the medical device arena (my area of expertise; not sure of your industry), I'll say that, to realize successful corrective and preventive actions, I can't think of a topic more relevant than establishing at the outset a clear distinction between the formal FDA / ISO definitions for corrective action (CA) vs. preventive action (PA). Specifically, CA are aimed to prevent REcurrence of a problem that has, somewhere in your system, already happened.  In stark contrast, PA are aimed to prevent OCcurrence of a problem that has NOT YET happened anywhere in your system.  I think this approach can be applied universally across industries.

 

Did you know that CA can be in full compliance with regulatory requirements even though it includes no PA? How can I make such a bold assertion?  The key to understanding this concept lies in the aforementioned definitions for CA and PA.  Notice that both definitions include a preventive aspect.  In my opinion, this is a leading cause of the confusion that often arises between CA vs. PA.  Moreover, further confounding the issue, many CAPA practitioners (me included), and also agencies like the FDA typically use the full acronym "CAPA" in reference to any action taken under the corrective and preventive action system, even if an action is only a CA, or only a PA.  Case in point:  In a recent FDA 483 I helped remediate for one of my clients, the FDA investigator refers to a particular CA as a "CAPA".

 

Indeed, this discussion would not be the first time such confusion has arisen. In its CAPA guidance document, the GHTF elected to abandon use of the "CAPA" acronym altogether because "…the concept of corrective action and preventive action has been incorrectly interpreted to assume that a preventive action is required for every corrective action..."

 

So my strong recommendation is that CAPA practitioners very simply categorize all improvement actions based on the ISO / FDA / GHTF / AdvaMed definitions of CA and PA. That is to say, if the improvement action is aimed to correct and prevent REcurrence of an actual nonconformity that happened anywhere in the system, then it is a CA.  But if the improvement action is to prevent OCcurrence of a nonconformity when no nonconformity has yet been logged anywhere, then it is a PA.  When these definitions are always applied to filter and categorize improvement actions, then a CA is always a CA, and a PA is always a PA, and they remain starkly distinct. Try not to get ensnared by the fact that both CA and PA have inherent preventive features.  I recommend that CAPA forms have a check box at the top requiring designation as either CA or PA, but not both.  Separate tracking numbers should be assigned for CA vs. PA.

 

Here's a brief case study from a prior commentary I wrote: If, in response to a single failed valve, we fix other valves that haven't yet failed, then these actions are still part of the CA for the first valve.  In contrast, valve improvements would be a PA if no valves had failed anywhere yet, but where we intervene because we see a metric drifting toward a failure threshold. 

 

Here is a basic decision-tree that may help clarify the proper process flow:

 

1. Has an actual nonconformity occurred somewhere? If yes, then commensurate with risk, initiate CA to prevent recurrence anywhere else. But if no actual nonconformity has occurred yet, then go to the next question.
2. Does the potential exist for a nonconformity? If yes, then commensurate with risk, initiate PA to prevent occurrence. If no potential nonconformity is evident, then you simply continue monitoring the data sources to survey for future actual or potential nonconformities.

 

Hope this helps,

------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Canada, Europe)
Principal Consultant
ComplianceAcuity, Inc.
Golden CO
United States
www.complianceacuity.com
Copyright 2018 by ComplianceAcuity, Inc. All rights reserved.
------------------------------

Original Message:
Sent: 31-Mar-2018 15:53
From: Anonymous Member
Subject: Preventive Action

This message was posted by a user wishing to remain anonymous

Hello everyone,

Seeking some guidance regarding Preventive Actions.

A recent finding from an audit determined our Preventive Actions (PA) should be launched independently from a Corrective Action (CA).  Our current practice is to document PAs concurrently with a CA. For example, if a nonconformance occurs within one product, our preventive action is to prevent nonconformance in all other products as well; the documentation is recorded in one place.  Our current practice was deemed acceptable by multiple previous auditors.

With the recent finding, we are struggling to figure out when independent PAs are launched.  It seems like many actions we are taking as a company could be determined as preventive in some way, but adding extra documentation as PA seems unnecessary.  For example: process improvement, implementation of new software, creating more robust training programs etc.)

When launching a PA independently from a CA, how does one determine what should be documented as a PA?

Any advice is appreciated.

Thanks!

Dear A:

Based on your description, your current practice is reactive (e.g., CA triggers PA concurrently).  In other words, your current practice reveals that only when there is an actual fire, you take a CA and then PA.  

The auditor is suggesting you implement a proactive PA.  If there is any potential fire hazard, you should proactively implement a PA to prevent occurrence of the fire. 

In practice, it is a PA that could/would significantly save serious potential consequences/liabilities. 

s/ D

------------------------------
Dr. David Lim, Ph.D., RAC, ASQ-CQA
REGULATORY DOCTOR
http://www.RegulatoryDoctor.US
http://www.GlobalComplianceSeminar.com
Phone (Toll-Free): 1-(800) 321-8567
E-mail: David@RegulatoryDoctor.US
------------------------------

Original Message:
Sent: 31-Mar-2018 15:53
From: Anonymous Member
Subject: Preventive Action

This message was posted by a user wishing to remain anonymous

Hello everyone,

Seeking some guidance regarding Preventive Actions.

A recent finding from an audit determined our Preventive Actions (PA) should be launched independently from a Corrective Action (CA).  Our current practice is to document PAs concurrently with a CA. For example, if a nonconformance occurs within one product, our preventive action is to prevent nonconformance in all other products as well; the documentation is recorded in one place.  Our current practice was deemed acceptable by multiple previous auditors.

With the recent finding, we are struggling to figure out when independent PAs are launched.  It seems like many actions we are taking as a company could be determined as preventive in some way, but adding extra documentation as PA seems unnecessary.  For example: process improvement, implementation of new software, creating more robust training programs etc.)

When launching a PA independently from a CA, how does one determine what should be documented as a PA?

Any advice is appreciated.

Thanks!

This is an area of great confusion. The problem often arises because people don't understand that there are technical terms that don't align with colloquial language. First, you need the dictionary. The current document is ISO 9000:2015, but I think the definitions in ISO 9000:2005 are better.

A correction eliminates a detected nonconformity.

A corrective action eliminates the cause of a detected nonconformity.

A preventive action eliminates the cause of potential nonconformity.

Each of them operates independently, meaning that performing one, doesn't require either of the others. For example, I could correct a nonconforming product through rework, but decide not to take corrective action. I could take corrective action on a late delivery but cannot (without a time machine) correct it. Notice that both of them operate on detected nonconformities.

This leads to, what I call, the language trap. If I have a nonconformance and want to "prevent" it from happening again, I do corrective action. Colloquial language suggests it should be preventive action, but that is not the technical language. 

The correct pairing is correction and corrective action. Some people want to eliminate the detected nonconformance with "corrective action", which leads to "preventive action" to keep it from happening again. This is the wrong pairing.

QSR exacerbated the problem by putting them together in the same section. The various versions of 13485 have them in separate section with different steps.

To address your first question, a corrective action and a preventive action cannot, by definition, apply to the same nonconformance, since it cannot be both potential (has not happened) and detected (has happened) at the same time.

To address your second question, preventive actions apply to nonconformances that have not happened, and you want to keep it that way. A good analogy comes from equipment maintenance. In preventive maintenance, you take actions (regular oil changes for your car) so that the equipment does not break down (the nonconformance).

As you look around your QMS you might say, "If I don't do something, then X problem will happen." X problem is the potential nonconformity and the "do something" is the preventive action. Chances are, you do something, don't document it, and don't take credit for the preventive action.

------------------------------
Dan O'Leary
Swanzey NH
United States
------------------------------

Original Message:
Sent: 31-Mar-2018 15:53
From: Anonymous Member
Subject: Preventive Action

This message was posted by a user wishing to remain anonymous

Hello everyone,

Seeking some guidance regarding Preventive Actions.

A recent finding from an audit determined our Preventive Actions (PA) should be launched independently from a Corrective Action (CA).  Our current practice is to document PAs concurrently with a CA. For example, if a nonconformance occurs within one product, our preventive action is to prevent nonconformance in all other products as well; the documentation is recorded in one place.  Our current practice was deemed acceptable by multiple previous auditors.

With the recent finding, we are struggling to figure out when independent PAs are launched.  It seems like many actions we are taking as a company could be determined as preventive in some way, but adding extra documentation as PA seems unnecessary.  For example: process improvement, implementation of new software, creating more robust training programs etc.)

When launching a PA independently from a CA, how does one determine what should be documented as a PA?

Any advice is appreciated.

Thanks!

Already posts providing great advice on different between Corrective Action and Preventive Action - this is one of those areas that still confounds people today (like verification and validation).  One additional comment I can make is that some regulatory agencies and definitely Notified Bodies look at these as DISTINCT different processes - as stated to "correct" recurrence and to "prevent" occurrence.  I have seen many Notified Body audits with observations in the preventive action section ... and increasing ... because companies need to take a proactive approach to their quality system.  As a side note, Preventive Action as a section was removed from ISO 9001:2015 as they want companies to use risk-based thinking, planning, knowledge, and organisation to know proactively what is going on with their company, processes, and systems in order to address issues before they occur ... a la preventive action.

I talked to a couple FDA investigators over the years and I liked the way they explained it:

- Correction is to fix something immediately
- Corrective action is to correct issue from recurring (short term)
- Systematic corrective action is to correct issue from happening again (long term) --- what many now call preventive action

For preventive action, you just replace the "corrective" in the above with "preventive" the only difference being you see a trend, spike in activities, a movement, or risks to the company, you initiate preventive action before it happens (and initiate corrective action after it happens).

------------------------------
Richard Vincins RAC
Vice President Regulatory Affairs
------------------------------

Original Message:
Sent: 31-Mar-2018 15:53
From: Anonymous Member
Subject: Preventive Action

This message was posted by a user wishing to remain anonymous

Hello everyone,

Seeking some guidance regarding Preventive Actions.

A recent finding from an audit determined our Preventive Actions (PA) should be launched independently from a Corrective Action (CA).  Our current practice is to document PAs concurrently with a CA. For example, if a nonconformance occurs within one product, our preventive action is to prevent nonconformance in all other products as well; the documentation is recorded in one place.  Our current practice was deemed acceptable by multiple previous auditors.

With the recent finding, we are struggling to figure out when independent PAs are launched.  It seems like many actions we are taking as a company could be determined as preventive in some way, but adding extra documentation as PA seems unnecessary.  For example: process improvement, implementation of new software, creating more robust training programs etc.)

When launching a PA independently from a CA, how does one determine what should be documented as a PA?

Any advice is appreciated.

Thanks!