Who this is for: quality engineers and managers who own corrective action. The pattern below survives FDA, ISO 13485, and CAP scrutiny because each step produces the evidence the next one needs.
Separate the correction from the corrective action
The correction is what you did about the instance: rejected the lot, repeated the run, retrained the tech. The corrective action is what you changed so the class of failure stops occurring. Records that conflate them produce CAPAs that "close" while the failure keeps recurring under new record numbers — a pattern inspectors chart across your log in minutes.
Root cause: keep asking why past the person
"Operator error" is where investigation starts, not where it ends. Why did the operator err? The look-alike label, the ambiguous SOP step, the training that never covered the edge case, the workload spike at shift change. A root cause you can act on is one where the person is the symptom and the system is the cause.
Attach the evidence to the analysis — photos, records, the timeline — rather than asserting conclusions alongside it. An investigation signed before actions open is the sequence auditors check first.
Actions with owners, dates, and teeth
Every action needs a named owner, a due date, and escalation when it slips. "Revise the SOP" is not an action; "Revision D of SOP-114 effective by March 15, training assigned to all mapped staff before work proceeds" is. The action list is also where preventive scope shows up: what other products, lines, or sites share the failure mode?
The effectiveness check that means something
Define the criteria before you close the actions: what metric, over what interval, proves the fix worked? Ninety days of deviation data showing zero recurrence is evidence. A checkbox dated the same day the action completed is an admission — and one of the most common 483 patterns in the CAPA subsystem.
Closure gates on the check. If your system allows closure without it, the system is documenting the citation.
What good looks like on the record
Event, investigation signed, actions owned and verified, effectiveness checked against criteria after a real interval, closure signed — in that order, with timestamps that prove the order. When the sequence is enforced by the workflow rather than remembered by the team, the aging column stops growing.