In early 2023, an Ohio law firm attracted negative attention when a text message from a senior attorney threatening a former associate’s future career and characterizing her maternity leave as “collecting salary from the firm while sitting on [her] [expletive]” went viral on social media.

The firm then issued a statement addressing the matter, promising to take “corrective action” against the attorney, but with a tone more apologetic to the harasser than the victim. The next day, they issued a formal apology with news that the attorney no longer worked for the firm.

All of this could’ve been avoided if the firm had created a CAPA plan for responding to the harassment. They’d have known right away what type of corrective action to take against the harasser, what to say in their statement, and specific preventive steps they could share about avoiding this behavior in the future.

A CAPA plan is a corrective and preventive action plan, designed to identify and rectify issues and ensure they aren’t repeated.

How do I create a CAPA plan? What should I include? This guide will answer these questions, helping you build an effective CAPA process that’s easy to implement and follow, so you can spend less time dealing with defects and less money on penalties.

Who Needs CAPA?

If you’ve ever had a workplace incident, you should know how to create a CAPA plan.

When it’s time to address the real issue, whether it’s harassment, fraud, or breaking your company’s code of ethics, where do you begin?

If you don’t have a formalized CAPA plan, how will you identify the root cause or fix the issue? If you do have a formalized CAPA plan, all of your next steps will be laid out so you can resolve the issue as quickly and smoothly as possible.

Legally, companies that specialize in medical device manufacturing and pharmaceuticals must have “adequate” CAPA procedures. The FDA reviews CAPA systems during inspections, premarket approval applications, and recalls.

While CAPA is a compliance requirement for these industries, it’s simply a smart process for all others. Logically, experts and guidelines in most countries recommend implementing a CAPA system simply for the maintenance and upkeep of your own company.

What Should Be Included in a CAPA Plan?

For your company’s CAPA procedure to be effective, you need a robust process that will address issues quickly and thoroughly, with as little disruption as possible.

The plan should be precise, with assigned owners and timelines for each stage. It should be clear and easy for the reader to understand. When writing your plan, consider, who the audience is and how much they know going in.

So, what are the steps in CAPA planning? Specifically, the procedure should include clear guidelines for:

• Identifying an issue
• Evaluating the criticality of an issue
• Investigating the root cause of an issue
• Developing resolution plans
• Implementing resolution plans
• Measuring efficacy of resolution plans
• Updating and recording procedural changes
• Communicating CAPA-related information

Simply stating that your employees should “evaluate the severity and impact of the issue” is not robust or effective, and it will not be useful to a person handling an issue.

Here’s a deeper look into each step of writing your CAPA plan.

1. Identify the Issue

In this first phase, you’ve just received a complaint or report and you’re trying to collect more information about the issue. This includes information such as:

• Type of misconduct
• Who allegedly committed the wrongdoing
• Who is the victim? (if applicable)

An issue is identified when an employee reports wrongdoing. They might informally complain to their manager, submit a complaint through your hotline or other reporting tool, or go directly to the relevant department (e.g. HR or compliance).

This initial step aims provide some context around the issue. If your review and complaint processes are comprehensive and consistent, a significant amount of this information should already be documented and available.

Questions to Ask

• What/who is involved?
• What happened and what should have happened?
• Where was the event observed? In what room or business unit did the issue occur?
• When did the event occur? At what time or on what day was the issue discovered?

2. Evaluate the Severity of the Issue

In phase two, your main objective is to determine the seriousness of the issue for triaging purposes.This will help you decide if the issue requires a CAPA plan to resolve, or if a milder strategy is appropriate.

This step is key because over- and under-escalating issues to CAPA are equally ineffective. Treating every issue as CAPA-worthy will make you overwhelmed and under-resourced, whereas escalating zero issues runs the risk of warning letters, fines, and extensive harm to staff or customers.

Evaluate the severity, harm, and complexity of the issue. Knowing this information will help you decide if a simple change could keep the issue under control or if the following CAPA steps are necessary.

(The best way to evaluate harm and likelihood is by conducting a risk assessment. If you haven’t done that yet, get started by downloading your risk assessment template here.)

Are CAPA Steps Necessary?

CAPA is typically reserved for systemic issues in which the same complaint is reported continuously. This could mean a culture of discrimination or one where safety violations are often ignored.

While there’s no right threshold for when an issue becomes CAPA-worthy, the amount of time between complaints or the circumstances around them must be considered.

A single complaint rarely requires a CAPA response, unless it puts the victim or your organization at risk. For example, if an employee complains that their coworker is stalking them, they could be in physical danger. Or, in the example above, the company was exposed for their toxic culture and needed to address it for both employee wellness and PR reasons.

Quantity and severity are the two key factors to determine the CAPA’s necessity. A severe issue that’s only reported one time (i.e. sexual assault) and a minor issue that’s reported often (i.e. accepting too-large gifts from clients) should be held to similar standards.

Questions to Ask

To ensure the best possible complaint evaluation, ask:

• Has employee safety/health/wellbeing been affected?
• Has this issue occurred before? If yes, how many times? Were any of the same people involved?
• Does this impact the safety/health/wellbeing/performance of any other employees?

Your answers to these questions will make it easier to categorize the event as low-, medium-, or high-risk. If you determine that an event is a low risk and a CAPA plan is not needed, continue to monitor the issue informally, such as checking in weekly with the reporter. If you determine the event is medium- or high-risk, follow the next step of CAPA.

3. Investigate the Root Cause

In this third phase of your CAPA plan, the objective is to investigate the issue and determine its root cause.

The root cause is the source of the identified problems or risks, and it’s a crucial bit of information in the battle to prevent their occurrence or reoccurrence.

Don’t point fingers without a proper investigation, even if the cause and effect appear to be obvious. Assumptions like this can lead to frustrations if you’re wrong, or, in a worst-case scenario, a wrongful discipline lawsuit.

(Also, check out our step-by-step guide for more information on conducting investigations.)

Identifying root causes can be intimidating because a) there could be many potential causes and b) it’s tough to be certain that one cause is more responsible than another. Thankfully, experts have developed a few methods for root cause analysis.

The 5 Whys

The first technique is the “5 Whys.” The aim of this method is simple: identify root causes by exhausting the question “why?”.

Brainstorm answers to questions like, “why did the event occur?” and “why were the conditions as such?”

Drill down further to sub-causes, asking why they occurred too, until you’ve asked “why?” five times. The logic is that you’ll make your way through all of the potential causes and end up identifying the one that doesn’t have a proper answer to “why?”

Here’s an example:

1. Why did Sam harass Mary?
   1. Because he knew she wouldn’t report him
2. Why would she not report him?
   1. Because she feared retaliation
3. Why did she fear retaliation?
   1. Because the company didn’t address another manager who retaliated against an employee who reported him last year
4. Why did the company not address that?
   1. Because ethics isn’t prioritized in the culture
5. Why isn’t ethics prioritized?
   1. Because policies need to be updated

The Fishbone Diagram

Another technique is the fishbone diagram. It’s so named because of the rough shape of the completed diagram, with a “head” and “spine” with small “bones” poking off of it.

To use this technique, start by drawing the fish. Where the head would be, write the issue or incident. Then, label the “bones” using the major categories of potential causes.

4. Determine Resolution Options

In the fourth phase of the CAPA plan, use the information gathered from steps one, two, and three to develop a plan to resolve both the immediate issue and its root cause.

There are three categories of actions to fix an incident: a correction, a corrective action, or a preventive action.

• A correction is a “Band-Aid fix.” Its main purpose is to quickly resolve a problem that arises. For a harassment incident, this could mean allowing the victim to work from home full-time.
• Corrective actions are fixes to the root cause to prevent the reoccurrence of a problem. This might be moving the harasser to another department or office, for the example above.
• Preventive action is a form of risk management—it seeks to prevent the occurrence of a problem. For instance, updating your anti-harassment training module and requiring all employees to complete it annually could prevent further harassment incidents.

5. Implement Corrective Actions

Phases five and six are all about implementing your resolution plan, whether that consists of corrective actions, preventive actions, or both.

If you’re looking to implement corrective actions, you will have first already identified systemic or cultural issues plaguing your company. Corrective actions can be knee-jerk at times, but a quick and reactionary measure is an important step in correcting and containing an issue.

In HR, corrective actions are measures related to disciplinary behavior, including:

• Written warnings
• Verbal warnings
• Moving the employee to another desk, floor, department, or office
• Leave with or without pay
• Demotion
• Termination

Be sure to take the least drastic measure possible before completing an investigation, or you might be hit with a wrongful discipline lawsuit.

Whichever corrective actions you take, carry them out promptly and entirely. Remember they may not be a permanent solution to the issue, but should reduce its severity and the impact on both employees and the organization.

6. Implement Preventive Actions

Preventive actions are prediction-based, proactive measures that seek to prevent or monitor potential risks before they escalate into major, potentially harmful issues.

Common preventive actions include:

• Monitoring and analyzing negative trends
• Conducting risk analysis
• Conducting regular performance reviews
• Establishing/refreshing training programs
• Conducting employee surveys about your culture
• Setting up a hotline and/or other reporting mechanisms

7. Monitor Efficacy of Actions

The next step of your procedure is monitoring and documenting the effectiveness of the corrective or preventive actions you’ve implemented.

This effectiveness check is the most important step, as it ensures the actions are not only appropriate, but that they will actually resolve the issue and stop it from occurring (or reoccurring).

There are many ways to report on effectiveness, depending on the measures you chose to implement.

For example: analyze trends of behavior, noting the frequency of a certain type of incident (say, harassment) both before and after you implemented the corrective action can help to determine if it’s working.

Surprise audits are another great option for efficiency checks. The audit will ensure that all machinery, people, and processes are acting according to the prescribed corrective action. This method can be used to spot compliance with any policy, from cybersecurity to safety protocols to anti-bullying.

8. Modify the Procedures

Finally, track the effectiveness of the CAPA plan itself. After its first use, ask: was it easy to understand and follow?

Clear, concise writing that’s free of jargon is critical to your CAPA process, as it ensures your plan and reports are impartial, easy-to-understand, and complete.

To go one step further, hold training sessions on the draft version of your CAPA plan. You can do this with your executive team, the relevant department for the type of incident, or a random mix of employees from all departments and levels. Use the feedback to revise the procedure and clarify difficult, confusing, or vague steps.

This involvement gives employees a feeling of ownership over the CAPA process and gives them the necessary tools to carry out the procedure right when the need arises.