CAPA and nonconformance management software for medical devices

Auditors rarely cite companies for having nonconformances. They cite them for CAPAs that never closed, root causes that were never proven, and effectiveness checks that were never done. HAVGATE turns an audit finding, a complaint or a nonconformance into a traceable CAPA, from containment to verified effectiveness.

The CAPA lifecycle

A nonconformance is the fact that something did not meet a requirement. A correction is the immediate fix, such as segregating a batch or rewriting a sentence in a record. A corrective action is the change that removes the cause so the same failure is less likely to return. A preventive action addresses a potential failure you have evidence to expect. HAVGATE separates those ideas so a closed correction is not reported as a closed CAPA. The lifecycle on the record is: capture the nonconformance, contain the issue, investigate, record root cause with a named method, define the action and the owner, implement it, and verify effectiveness against a criterion you set in advance.

Sources are explicit. An internal audit finding can open the nonconformance so the MDSAP task or ISO clause stays attached. A supplier issue can open it from the supplier record. A training gap can be the action, not the cause, when people were never shown the revised SOP. Complaint and post-delivery product problems belong in the same trail because ISO 13485 8.3 and 8.2.2 do not end when the product has left the building. The record should show dates, owners and the evidence file, not a status color with no history.

Root-cause tools: 5 Whys and Fishbone

The product includes 5 Whys and Fishbone (cause-and-effect) so the investigation is structured instead of a single line that says 'human error'. Five Whys is useful when the chain is mostly sequential: the label was wrong because the template was wrong because the change request never reached document control. Fishbone is useful when people, method, material, equipment, measurement and environment can all contribute, which is common on a production nonconformance. The software can assist the drafting of a cause statement. A person still accepts the cause. An AI suggestion is not a root cause, and it is not a record until the owner approves it.

Write the effectiveness check when you write the action. 'Retrain the team' is not an effectiveness check. A check is a later observation: the next two lots had no label mix-up, or the next internal audit found the revised procedure in use. HAVGATE keeps that check on the CAPA so it cannot be forgotten when the action is marked done. If the check fails, the CAPA stays open or a new investigation starts. Closing on the implementation date is the pattern auditors write up.

Linked to audits, suppliers and training

CAPA software that cannot see the audit, the supplier file and the training matrix recreates the spreadsheet problem inside a nicer screen. In HAVGATE the audit module is the usual source of internal findings. Supplier management holds qualification and performance, so a purchased-product nonconformance updates the supplier story. Training management holds the assignment that proves a revised SOP was read. Document control holds the revision itself. You do not need all of those modules on day one. Starter and Pro are audit-centered, and the CAPA workflow is included from Pro upward. Enterprise is where the full set is packaged. The links are the product decision: a finding should know its CAPA, and a CAPA should know its procedure change.

What auditors look for

ISO 13485:2016 clause 8.5.2 requires the organization to act to eliminate the causes of nonconformities in order to prevent recurrence. The action must be proportionate to the effects. The procedure must define requirements for reviewing nonconformities including complaints, determining causes, evaluating the need for action, planning and documenting the action, and reviewing the effectiveness of the corrective action taken. Clause 8.5.3 is the parallel requirement for potential nonconformities. Clause 8.3 requires control of nonconforming product, including actions after delivery when you detect the problem late. Clause 8.2.2 requires a complaint-handling procedure that feeds this system. MDSAP Chapter 3 tasks 3.3 through 3.9 walk the same ground in the audit approach: investigation, correction, corrective and preventive action, design or process change that results from the action, and control of nonconforming product before and after delivery.

EU MDR Article 10 requires the QMS to cover resource management, risk, clinical evaluation, product realization, UDI, post-market surveillance, communication with authorities, incident reporting, corrective actions and the field safety process. A CAPA record is often the evidence that a complaint investigation actually changed the device or the process. It is not a substitute for a vigilance report when the event is reportable. Keep the regulatory report and the CAPA linked, and do not let the CAPA close the vigilance clock. FDA QMSR expects the same corrective-action discipline because it incorporates ISO 13485. Inspectors still ask to see the investigation, not the software brand.

The knowledge base has a longer CAPA guide. Use it when you are writing the procedure, and use this module when you are running the procedure. The procedure still has to exist. Software does not replace clause 4.2.1. It is the place the procedure's records live so the next auditor does not have to reconstruct them from inboxes.

A practical sequence for a small team

Start with the sources you already have. Import or re-type open nonconformances, even if the history is short. Turn on the link from internal audit so the next audit does not create a parallel list. Agree the severity words you will use and keep them stable. Define one effectiveness-check pattern for product issues and one for process issues. Review overdue CAPAs in the same meeting that looks at complaints, so management review inputs under clause 5.6 are a filter of live records rather than a yearly scramble. If a CAPA changes a form, route the form through document control and assign the training before you claim the action is implemented.

Contract manufacturers should be careful about ownership. If your customer owns the CAPA and you own the correction on the line, the record should say so. Supplier quality pages cover the purchasing side. This page covers the investigation and the effectiveness check. Do not duplicate the same action in two systems with two due dates.