Corrective and Preventive Actions (CAPA)

Part of Good Clinical Practice (GCP) — ICH E6(R3): Audits, Inspections and Compliance.

About 7 minutes. Free, in your language, no account needed.

Why this matters

Retraining one coordinator is the most common corrective action in clinical research. It is also the most common failed one. If the real cause was an unworkable visit schedule, retraining changes nothing and the same deviation returns next month. ICH E6(R3), the current revision of the Good Clinical Practice (GCP) guideline, does not accept an action without a cause. It requires root cause analysis, and it requires you to confirm that the action worked.

Deviations first: recording and classifying

A corrective and preventive action starts with a recorded deviation.

Section 2.5.3 states that the investigator "should document all protocol deviations". Some the investigator finds; others the sponsor communicates to them. Either way, the investigator reviews the deviations. For those deemed important, the investigator explains the deviation and implements appropriate measures to prevent recurrence. Section 2.5.4 allows deviation from the protocol "only where necessary to eliminate an immediate hazard(s) to trial participants", and the investigator informs the sponsor promptly.

What counts as important is not left to each site's judgment. Section 3.9.3 defines important protocol deviations as "a subset of protocol deviations that may significantly impact the completeness, accuracy and/or reliability of the trial data or that may significantly affect a participant's rights, safety or well-being." The sponsor sets the trial-specific criteria. Read them at site initiation. Do not invent your own.

Sites also use a severity ladder in day-to-day practice. Use it as a working tool, and keep the sponsor's criteria as the authority.

The definition in the third row is not a house definition. It comes from section 3.12.2.

What E6(R3) actually requires

Section 3.12.1 sets the general rule. Noncompliance with the protocol, standard operating procedures (SOPs), GCP or applicable regulatory requirements, whether by the investigator, the institution or the sponsor's own staff, "should lead to appropriate and proportionate action by the sponsor to secure compliance." A one-day visit window deviation does not need a trial-wide re-training program.

Section 3.12.2 is the CAPA anchor:

"If noncompliance that significantly affects or has the potential to significantly affect the rights, safety or well-being of trial participant(s) or the reliability of trial results is discovered, the sponsor should perform a root cause analysis, implement appropriate corrective and preventive actions and confirm their adequacy unless otherwise justified."

Three obligations sit in that sentence, and all three are commonly missed:

1. Root cause analysis. Not a description of the event. An analysis of why it happened.
2. Corrective and preventive actions. Corrective fixes what happened. Preventive stops it happening again, here and elsewhere.
3. Confirm their adequacy. You must go back and check that the action worked. A CAPA closed on the day it is written has not been confirmed.

Section 3.12.2 continues: where the sponsor identifies issues likely to significantly impact participants' rights, safety or well-being, or the reliability of results, that is serious noncompliance. The sponsor then notifies the regulatory authority and/or the IRB/IEC, in accordance with applicable regulatory requirements, and/or the investigator, as appropriate.

Section 3.12.3 handles failed remediation. If significant noncompliance by an investigator, institution or service provider "persists despite efforts at remediation", the sponsor should consider terminating that party's participation. The sponsor promptly notifies the regulatory authorities and the IRB/IEC of the serious noncompliance, as appropriate, and acts to minimize the impact on participants and on the reliability of the results.

Finding the root cause

A single deviation may be an accident. A pattern is a system fault. Five indicators tell you that you are looking at a systemic problem:

• The same deviation category recurs across several participants.
• The same staff member is repeatedly involved.
• Deviations increase after staff turnover.
• Deviations are linked to a workflow, a piece of equipment or a training gap.
• The issue appears across multiple visits and multiple monitoring cycles.

When any of these is present, "retrain the coordinator" is almost certainly the wrong action. Ask what in the process made the error easy and the correct action hard.

Escalating

Escalate deviations that involve safety, eligibility, informed consent, investigational product, or primary endpoint data. These five categories map onto the two things section 3.12.2 protects: participants' rights, safety and well-being, and the reliability of the results.

Approach deviations as learning opportunities, not punishments. A site that hides deviations produces a clean log and unreliable data. A site that reports them produces a busy log and a trial that can be defended.

In practice

At Dr. Sarah's site, centralized monitoring at ABC Pharmaceuticals flags that four participants had week-12 laboratory samples drawn outside the protocol window. Week 12 carries a secondary endpoint.

The weak response would be to record four deviations and retrain the phlebotomist.

Instead the sponsor's quality lead, Priya, runs a root cause analysis with the site. The site's scheduling system calculates visit windows from the date of consent. The protocol calculates them from the date of first dose. For most participants the two dates are the same day. For these four, dosing was delayed by a pharmacy supply issue, so the dates diverged and the calendar produced the wrong target date.

The root cause is a system configuration error, not a person.

• Corrective action — recalculate all upcoming visit windows from first dose; document each corrected date.
• Preventive action — reconfigure the scheduling template to anchor on first dose; add first-dose date as a required field; brief all sites using the template.
• Confirming adequacy — three months later Priya re-reviews window compliance at this site and at the others using the template. Compliance is 100%. Only then is the CAPA closed, with the verification evidence attached.

Had Priya closed the CAPA the day she wrote it, section 3.12.2 would not have been met.

A CAPA without a confirmed cause is a guess with paperwork attached.

Key takeaways

• ICH E6(R3) section 3.12.2 requires the sponsor to perform a root cause analysis, implement corrective and preventive actions, and confirm their adequacy, unless otherwise justified.
• Section 3.12.2 defines serious noncompliance as noncompliance that significantly affects, or may significantly affect, participants' rights, safety or well-being, or the reliability of trial results.
• Section 3.12.1 requires action that is appropriate and proportionate, so the response must match the severity of the noncompliance.
• Section 3.12.3 requires the sponsor to consider terminating an investigator's, institution's or service provider's participation where significant noncompliance persists despite remediation, and to notify the authorities and IRB/IEC.
• Section 2.5.3 requires the investigator to document all protocol deviations and, for important ones, to explain them and implement measures to prevent recurrence.
• Under section 3.9.3 the sponsor sets the trial-specific criteria for classifying a deviation as important, so sites must apply the sponsor's criteria rather than their own.
• Escalate any deviation involving safety, eligibility, informed consent, investigational product or primary endpoint data.