Quality events and CAPAs
tracked to closure

A corrective and preventive action is a structured process for dealing with quality problems. Corrective action investigates a problem that has happened and fixes its root cause so it doesn’t recur; preventive action looks for potential problems, often spotted through trends, and puts controls in place before they happen. ISO 13485 requires documented procedures for both (clauses 8.5.2 and 8.5.3), including the investigation, the actions taken and a review of their effectiveness. FDA 21 CFR 820 has equivalent requirements, EU MDR and UK MDR rely on your ISO 13485 quality system to meet them, and ISO 27001 and ISO 9001 have similar corrective action requirements, which Assuric maps across frameworks.

Anything that shows a product, process or system isn’t meeting its requirements. That includes nonconformities found internally, complaints and incidents from the field, user feedback that points to a problem, audit findings and supplier issues. Each is logged, assessed for risk and either closed with a recorded rationale or escalated to an investigation and CAPA.

A complaint, as defined in ISO 13485, is any written, electronic or oral communication alleging a deficiency in a device’s identity, quality, durability, reliability, usability, safety or performance after it has been released. An incident, under UK MDR and EU MDR, is a malfunction or deterioration in a device’s performance, including use errors caused by its design or instructions; a serious incident is one that led, or might have led, to death or a serious deterioration in health. Feedback is broader: any information about whether you’re meeting user requirements, which ISO 13485 asks you to gather and monitor whether or not it alleges a problem. The categories often overlap, for example a complaint that describes an incident, so in Assuric they can be linked to the same investigation.

Each is logged with its source, date received, owner and status. Complaints are acknowledged, investigated and closed with an outcome, with response deadlines tracked throughout, and incidents are assessed against the MHRA reporting threshold with the decision and reasoning recorded either way. Feedback is reviewed for trends and escalated where it points to a real issue. Where several records relate to the same event, such as an incident and the complaint that reported it, they share one investigation so you don’t duplicate work, while each keeps its own record and reporting decision.

No. Each event is assessed for risk, recurrence and impact, and a CAPA is raised where that assessment justifies it. Low-risk, one-off events can be corrected and closed without one. Either way, the decision and the reasoning behind it are recorded, which is what auditors look for.

When you plan a CAPA, you set an effectiveness check with clear criteria and a date, for example no recurrence of the issue over three months. When the check is due, the result and supporting evidence are recorded. If it passes, the CAPA can close; if it fails, the CAPA stays open and the root cause is revisited.

Raise a change request from a quality event or CAPA, or on its own. Assess its impact on your risks, documents and releases, route it through your approval gates, and record how and when it was implemented. Every change traces back to the issue that prompted it, so you can show an auditor why a document, process or product changed.

Yes. Approvals at each gate, from investigation through to closure, are compliant e-signatures that record who signed, what they were signing for and when. Every action sits in an audit trail that can’t be edited or deleted, so the full history of each CAPA stays on the record.

AI can draft investigations and suggest likely root causes and actions, drawing on the event itself and your existing records, such as similar past events, linked risks and relevant procedures. Events can also be raised automatically through integrations, or created and updated from Claude, ChatGPT, Copilot or Cursor through MCP. Every AI suggestion is a tracked change that a named person reviews and accepts.

Complaints and incidents captured through post-market surveillance↗ can raise quality events and CAPAs directly, so issues from the field follow the same investigation, approval and closure process. What you learn also feeds your trend analysis and PMS reports, closing the loop between the field and your quality system.

Yes. As part of free migration, we bring your existing quality events, investigations and CAPAs across from spreadsheets or your current system, with their history, owners and status intact, so you don’t lose the record auditors will ask to see.