FDA 483 Citation 21 CFR 820.100: CAPA Procedures Not Established
If your Form FDA 483 contains the sentence "Procedures for corrective and preventive action have not been [adequately] established," you are in large company. In fiscal year 2025, FDA investigators cited 21 CFR 820.100(a) 279 times on system-generated 483s, more than any other medical device observation. A related citation under 820.100(b), "Corrective and preventive action activities and/or results have not been [adequately] documented," appeared another 63 times.
CAPA is cited so often because investigators use it as the hub of the inspection. Complaints, nonconformances, audit findings, returned product and service records all feed into it. When the CAPA system is weak, every other quality subsystem looks weak too, and the observation often leads to further questions about management responsibility.
This guide explains what the citation means, what the regulation requires, how the requirement reads now that the Quality Management System Regulation (QMSR) is in effect, and how to structure a response FDA will take seriously.
What the citation actually says
The FDA citation text comes from FDA's standard observation library. The bracketed word "adequately" tells you which version the investigator selected:
"Have not been established" means FDA found no documented CAPA procedure at all, or a procedure so incomplete it does not function as one.
"Have not been adequately established" means a procedure exists but does not meet one or more of the regulation's specific requirements, or the firm does not follow it.
The words after "Specifically" on your 483 are the part that matters most. Investigators typically describe examples such as:
Quality data sources (complaints, nonconformances, service records) that are not analyzed to detect recurring problems
CAPAs closed without a documented root cause investigation
No verification or validation that the corrective action worked and did not harm the device
CAPA records that show actions were planned but not completed, or completed without evidence
No trending, so the same failure appears in many separate records without being linked
Your response must address each specific example the investigator listed, and also the system weakness behind it.
What 21 CFR 820.100 required
Until February 2, 2026, the Quality System Regulation at 21 CFR 820.100(a) required each manufacturer to establish and maintain procedures for implementing corrective and preventive action. The procedures had to include requirements for:
Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product and other sources of quality data to identify existing and potential causes of nonconforming product or other quality problems, using appropriate statistical methods where necessary
Investigating the cause of nonconformities relating to product, processes and the quality system
Identifying the actions needed to correct and prevent recurrence of nonconforming product and other quality problems
Verifying or validating the corrective and preventive action to ensure it is effective and does not adversely affect the finished device
Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems
Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of that product or the prevention of such problems
Submitting relevant information on identified quality problems, and on corrective and preventive actions, for management review
Section 820.100(b) added that all activities required under the section, and their results, must be documented.
What changed under QMSR
FDA's Quality Management System Regulation took effect on February 2, 2026. It incorporates ISO 13485:2016 by reference, so CAPA requirements now come from two ISO 13485 clauses:
Clause 8.5.2, Corrective action: take action to eliminate the cause of nonconformities to prevent recurrence, without undue delay. The documented procedure must cover reviewing nonconformities (including complaints), determining causes, evaluating the need for action, planning and documenting the action (including updating documentation), verifying that the action does not adversely affect the ability to meet requirements or the safety and performance of the device, and reviewing the effectiveness of the action taken.
Clause 8.5.3, Preventive action: determine action to eliminate the causes of potential nonconformities, with the same steps applied to potential problems.
ISO 13485 also ties CAPA to data analysis (clause 8.4), to complaint handling (8.2.2) and to management review inputs (5.6.2). In practice, a CAPA procedure that met the old 820.100 requirements will cover most of the substance. The gaps firms usually find are explicit effectiveness review, proportionality to risk, and the link to ISO 13485 data analysis.
One more change matters for your response. Under the old regulation, FDA did not routinely review internal audit reports and management review records. QMSR removed that exception, so investigators can now ask to see management review records that show CAPA information reaching top management.
How to respond to the 483
A 483 is not a final agency decision, but your response heavily influences whether FDA escalates to a warning letter. FDA generally considers responses it receives within 15 business days of the end of the inspection before it decides on further action. Plan to meet that window, even if some actions will finish later.
A credible response to a CAPA observation usually contains these parts:
1. Acknowledge the observation without arguing
State that you understand the observation and are taking it seriously. If you disagree with a factual point, say so briefly and provide evidence, but do not spend the response defending the old system.
2. Fix the specific examples
For each example after "Specifically," describe what you did: reopened the CAPA, completed the root cause investigation, verified effectiveness, or documented the action. Attach the evidence or describe where it is.
3. Fix the system
This is the part many responses miss. FDA wants to know that the problem cannot happen again. Typical system fixes include:
Revising the CAPA procedure so it covers every required element
Defining criteria for when a CAPA must be opened, and how risk determines the depth of investigation
Adding a documented effectiveness check with defined criteria and timing
Establishing trending of quality data sources on a set schedule
Adding CAPA status as a standing management review input
4. Look back
Review a defined set of past records, such as all CAPAs closed in the last two or three years, against the revised procedure. Report how many you reviewed, what you found and what you did about it. A retrospective review shows FDA the problem is understood across the system, not just in the records the investigator sampled.
5. Train and verify
Train everyone who opens, investigates, approves or closes CAPAs on the revised procedure, and keep the training records. State when you will verify that the new process is working, for example through an internal audit of the CAPA system in 90 days.
6. Give dates and keep FDA updated
Give a realistic completion date for each action. If actions extend past the response date, commit to monthly or periodic updates and keep that commitment.
What a compliant CAPA procedure must contain
Whether you are answering a 483 or preparing for your first inspection, check your procedure against this list:
Scope and inputs: every quality data source that can trigger a CAPA, including complaints, nonconformances, audits, service, returned product, supplier issues, process monitoring and post-market data
Criteria for opening a CAPA: when an issue becomes a CAPA rather than a simple correction, based on risk and recurrence
Investigation and root cause: required methods (for example 5 Whys, fishbone, fault tree), and how depth depends on risk
Action planning: corrections, corrective actions and preventive actions, with owners and due dates
Verification and validation: proof the action works and does not adversely affect the device
Effectiveness review: criteria, timing and who decides
Documentation updates: how procedure, drawing and process changes are controlled
Communication: how information reaches the people responsible for the affected product or process
Management review: how CAPA data, trends and status are reported to top management
Records: what the CAPA file must contain and how long it is retained
Common mistakes in CAPA responses
Responding only to the examples the investigator listed and not to the system
Promising a new procedure without describing what it will contain
Treating retraining as the only corrective action, which FDA rarely accepts on its own
Closing CAPAs before the effectiveness check is complete
Opening so many CAPAs for minor issues that the system cannot keep up, then letting important ones go overdue
Example: how one response section might read
Below is an illustration of the structure, not wording to copy. Every response must describe your own facts.
Observation 1: Procedures for corrective and preventive action have not been adequately established. Specifically, CAPA records reviewed did not include verification of effectiveness.
Response:
Correction: All 14 CAPAs closed since January 2024 were reopened. Effectiveness checks with defined criteria were completed for 9; the remaining 5 have checks scheduled, the last due on a stated date.
Root cause: The CAPA procedure did not require an effectiveness check or define criteria, so closures depended on individual judgment.
Corrective action: The CAPA procedure was revised (revision and effective date given) to require an effectiveness plan at approval, measurable criteria, a minimum review period and quality approval before closure. A copy is attached.
Retrospective review: All CAPAs opened in the last three years (42 records) were reviewed against the revised procedure. Findings and actions are summarized in an attachment.
Training: Twenty-three employees who own or approve CAPAs were trained; records attached.
Verification: An internal audit of the CAPA process is scheduled 90 days after the effective date, and results will be sent to FDA in the next update.
Notice that every statement is specific and can be checked. Vague commitments such as "we will improve our CAPA process" give FDA nothing to evaluate.
Frequently asked questions
Is a 483 the same as a warning letter?
No. A Form FDA 483 lists an investigator's observations at the end of an inspection. It is not a final agency determination. A warning letter is a formal notice from FDA that it considers the firm to be in significant violation. A weak or late 483 response is one of the most common reasons a 483 becomes a warning letter.
Do we have to rewrite our CAPA procedure for QMSR?
Not necessarily rewrite it, but you should review it against ISO 13485 clauses 8.5.2 and 8.5.3 and update references from 21 CFR 820.100. Most procedures need an explicit effectiveness review and a clearer link to data analysis.
How many CAPAs should we have?
There is no target number. FDA looks for a system that opens CAPAs for significant and recurring problems, investigates them in proportion to risk and closes them with evidence. Too few CAPAs can suggest problems are being missed; too many open, overdue CAPAs suggest the system is overloaded.
How A.P. Lyon documents help
A.P. Lyon's Corrective and Preventive Action Procedure for ISO 13485 and FDA QMSR covers the elements above, with forms for the CAPA request, investigation, action plan and effectiveness review. It is written in editable Word format so you can adapt it to your organization and include it in your 483 response as the revised procedure. If you also make devices under ISO 9001, the dual-standard CAPA procedure covers both standards in one document.
CAPA observations rarely travel alone. If your 483 also cites complaints or nonconforming product, the complaint handling procedure and nonconforming material procedure connect directly to the CAPA process.
Any purchased procedure must be adapted to your products, processes and organization, and your staff must be trained on it and follow it. FDA evaluates what you actually do, not only what the document says.
Next steps
Read your 483 carefully and list every example after "Specifically"
Map each example to a correction, a system fix and a retrospective review
Revise or replace your CAPA procedure, then train and audit against it
Send your response within 15 business days
To build a complete set of procedures at a volume discount, use Build Your QMS. For help preparing a 483 response, see A.P. Lyon consulting services.
Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.
Comments