Incidents, Nonconformities & CAPA: A Practical SOP for Reporting, Root Cause, and Preventive Actions

Purpose: Provide a clear, repeatable system to capture incidents and nonconformities, analyze root causes, implement corrective and preventive actions (CAPA), and prove effectiveness to auditors.
Applies to: All personnel, contractors, and visitors on site.
Outcomes: Faster containment, fewer repeat issues, stronger audit evidence, safer operations.

1) Definitions (plain-English)

Incident: Any unplanned event that affects safety, environment, security, or operations (e.g., battery smoke, chemical spill, near-miss, injury, data-wipe station outage).
Nonconformity (NC): A failure to meet a requirement—internal SOP, customer requirement, certification clause, legal requirement, or contract. Includes documentation gaps (e.g., missing signature on log).
Containment: Immediate actions to control or mitigate the impact (e.g., isolate affected pallets, stop shipment, place hold tags).
Corrective Action (CA): Action to eliminate the root cause of a detected nonconformity to prevent recurrence.
Preventive Action (PA): Action to eliminate the cause of a potential nonconformity to prevent occurrence (proactive).
Verification of Effectiveness (VoE): Evidence that the action worked over time (e.g., trend data shows reduction, sample audits pass for 90 days).

2) Roles & Responsibilities

All Employees: Stop unsafe work, report incidents/NCs immediately, assist with containment, record facts.
Area Supervisor: Open the report, classify severity, lead containment, assign temporary controls, notify the CAPA Owner.
CAPA Owner (often QA/EHS/Operations Lead): Drive root-cause analysis, set actions, deadlines, and metrics; track completion; verify effectiveness.
EHS Lead (if safety/environmental): Oversee legal reporting, medical response, spill kits, waste handling, and training.
Quality Manager: Maintains CAPA log, trends KPIs, escalates overdue items, prepares audit evidence.
Senior Management: Review monthly CAPA dashboard, approve major corrective/preventive actions, remove barriers.

3) Reporting & Intake (how to capture the issue)

When to report: Immediately for incidents; by end of shift for minor NCs.
How to report: Use a single Incident/NC Report Form (paper or digital). Keep reporting simple and non-punitive.

Minimum fields to capture

Date/time and location (station/line/zone).
Reporter name + contact.
Type: Incident / Near-miss / Nonconformity (minor/major).
Description (facts only; what was observed, not opinions).
Assets/materials involved (IDs, batch, serials).
Immediate actions taken (containment/first aid/shutdown).
Photos or attachments (if applicable).
Initial severity (S1–S4; see below).
Supervisor notified (name/time).
Temporary hold/isolation tag numbers.

Severity classification (for prioritization)

S4 Critical: Injury requiring hospitalization, fire, major spill, data breach, illegal shipment, repeated failure affecting customers/regulators.
S3 Major: Medical treatment beyond first aid, equipment damage, batch scrap, shipment recall risk, repeated log gaps.
S2 Moderate: First aid case, isolated process deviation, small contained spill, single log defect without impact.
S1 Minor: Cosmetic/documentation detail, readily corrected on the spot, no safety/quality impact.

Escalation timing

S4: Notify CAPA Owner and senior management immediately.
S3: Notify CAPA Owner within 2 hours, management by end of day.
S2/S1: Log within shift; supervisor review within 24 hours.

4) Containment (stop the bleeding)

Perform before analysis to prevent spread/recurrence while you investigate.

Standard containment toolkit

Quarantine/hold: Red “HOLD” tags; move items to a designated hold area.
Stop & check: Halt affected line; initiate 100% check on last good lot.
Administrative controls: Temporary sign-offs, additional checks each hour.
PPE/safety: Spill kit deployment, ventilation, isolation of power, fire watch if battery thermal risk occurred.
Communication: Post a brief shift note and toolbox talk next day for awareness.

Record: what was contained, by whom, when, and scope (lot numbers, quantities).

5) Root Cause Analysis (RCA) that actually works

Use structured, quick-to-execute methods. Pick one:

A) 5-Whys (fast)

Why did the event happen?
Why was that possible?
Why did the enabling condition exist?
Why wasn’t it detected/prevented?
Why is the system designed that way?
Stop when you land on a controllable system cause (not “human error”).

B) Fishbone (Ishikawa) for complex issues
Consider People, Process, Equipment, Materials, Environment, Measurement. Brainstorm causes in each branch, then test the most plausible with data.

C) Evidence checklist

Interviews with operators/supervisors (use neutral, non-blaming questions).
Review recent changes (new staff, new supplier, revised SOP).
Check records (training logs, maintenance, calibration, DDQ approvals).
Sampling/inspection of affected stock.
Time series or control charts if you track process metrics.

Avoid blame. “Operator forgot” is rarely the root cause; look for missing visual controls, unclear SOP steps, insufficient training, or poor workstation design.

6) Corrective & Preventive Actions (how to fix and future-proof)

Convert root causes into specific, testable actions. Use the Action Definition Rule: One action = one owner = one due date = one measurable outcome.

Common corrective actions

SOP update with clearer steps, photos, and acceptance criteria.
Retraining + competency check (quiz or observed demo).
Tooling or fixture change; poka-yoke/physical guide to prevent mis-assembly.
Additional inspection step with sampling plan for the next 30–90 days.
Supplier corrective action (when vendor cause is confirmed).
Software/label template change to remove ambiguous fields or enforce required ones.
Maintenance/calibration schedule update.

Preventive actions (proactive)

Risk assessment (FMEA-lite) on similar lines or product families.
Addons to checklists (e.g., battery intake checklist adds state-of-charge check).
Visual management (color coding, floor markings, signage).
Change request process to evaluate impacts before implementation.
Internal audit focus on the new/changed process next cycle.

Action prioritization matrix (Impact vs. Effort)

Quick wins: low effort, high impact—do immediately.
Projects: high impact, high effort—assign project owner and timeline.
Fillers: low impact—batch into periodic improvements.
Avoid: high effort, low impact—justify only if required.

7) Documentation & Records (what auditors expect)

Maintain a single CAPA Log and a case file for each record.

CAPA Log (master)

Unique ID, date opened, type (incident/NC), severity, area.
Short description, containment done (Y/N, date).
Root cause summary.
Action list (owner/due date/status).
Verification of effectiveness plan & date.
Date closed, management sign-off.
Trend tags (battery, data wipe, downstream vendor, EHS, documentation).

Case File (per CAPA)

Incident/NC report, photos, interviews.
RCA notes (5-Whys/fishbone).
Updated SOPs/checklists (redline + final).
Training records for affected staff (attendance + competency).
Inspection results or sampling data (before/after).
VoE evidence (metrics, audit results).
Closure approval.

Retention: Keep for minimum 3 years (or per your certification/legal requirement); serious cases (S4) for 5+ years.

8) Verification of Effectiveness (prove it worked)

Plan VoE before you close the CAPA.

Typical VoE methods

Trend analysis: e.g., zero repeats for 90 days; defect rate below control limit for 3 months.
Targeted internal audit: sample the changed process; zero major findings.
Sampling: inspect 30 consecutive lots with 0 critical defects and ≤ defined minors.
Field feedback: no related customer complaints for the defined period.

Define success criteria upfront (e.g., “< 0.5% log errors for 12 weeks”), gather data, and attach graphs/screenshots to the case file.

9) Timeframes & Escalation (keep momentum)

Open report: same day (S4/S3); within 24 hours (S2/S1).
Containment: immediate for S4/S3; within 24 hours for S2; within 48 hours for S1.
RCA start: within 2 business days (S4/S3); within 5 days (S2/S1).
Actions due: 14 days (S4), 30 days (S3), 45 days (S2), 60 days (S1) unless justified.
Overdue escalation: CAPA Owner → Quality Manager → Plant Manager in weekly review.
Closure: after VoE evidence meets success criteria.

10) Integration with Training & Change Control

Training: Any SOP change triggers a targeted training event; record attendance and competency (short quiz or observed task).
Change Control: Major corrective actions that alter equipment, software, or layout require a documented change request and, where applicable, risk review prior to implementation.
Communication: Post concise “What changed & why” notes on the work area board; include photos of new steps/labels.

11) KPIs & Dashboard (what to track monthly)

# of Incidents / Near-misses / NCs (by area and severity).
Average days to containment and to closure.
% CAPAs on time (by severity).
Top 5 root causes (trend quarter over quarter).
Repeat rate for the same NC category.
Training effectiveness (post-change audit pass rate).
Supplier-related NCs (by vendor, action status).

Use a simple stacked bar for counts and a line for closure time. Highlight overdue S3/S4 items in red on the management review.

12) Example, End-to-End (makes it real)

Event: Drive-wipe station produced 7 drives without verification logs for 2 hours (S3 Major).
Containment: Quarantine all 42 drives from that period; stop station; assign temporary manual verification step.
RCA:

5-Whys reveals a new label template removed the “Verified by” required field; operator proceeded without prompt.
Measurement branch shows the verification script didn’t block completion on missing signature.
Corrective actions:

Reinstate required field with a hard stop in software (Owner: IT; Due: 3 days).
Update SOP with screenshot of correct label; add “verify & sign” checklist step (Owner: QA; Due: 5 days).
Retrain all data-wipe operators; competency sign-off (Owner: Supervisor; Due: 7 days).
100% audit of quarantined drives; re-wipe and relabel where needed (Owner: Ops; Due: 2 days).
Preventive actions:
Add change-control checklist for any template/software change impacting required fields (Owner: Quality; Due: 10 days).
VoE plan: 8-week sampling—daily random check of 20 drives; target 0 missing verification signatures.
Closure: After 8 weeks of zero misses and a passed internal audit, CAPA closed with management sign-off.

13) Audit Readiness Tips (make your file audit-proof)

Use consistent IDs on reports, hold tags, action items, and training events to show linkage.
Put a summary sheet on top of each case file: timeline + key decisions + VoE results.
Redline SOPs to show exactly what changed; keep both before/after.
Keep meeting minutes for management reviews where CAPAs were discussed (bullet decisions and owner/dates).
Ensure frontline staff can explain what changed and where to find the checklist.

14) SOP—Condensed Procedure (copy into your document)

Report & Log: Employee reports; supervisor logs Incident/NC within shift.
Classify & Escalate: Assign severity; notify per matrix.
Contain: Quarantine/stop line; temporary controls; document.
Assign CAPA Owner: Quality/EHS/Operations lead.
RCA: Complete within defined timeframe using 5-Whys or fishbone; gather evidence.
Plan Actions: Define corrective/preventive actions with owners, due dates, and success metrics.
Implement & Train: Update SOPs, train affected staff, update change control if needed.
Verify Effectiveness: Monitor metrics/audits; record VoE.
Close & Review: Management sign-off; capture lessons learned; update risk registers if applicable.
Trend & Improve: Monthly KPI review; reprioritize systemic fixes.

15) Forms & Templates (fields you can replicate)

A) Incident/Nonconformity Report

ID, date/time, area, reporter, type, severity, description, assets/batches, immediate actions, photos, supervisor notified, signatures.

B) CAPA Action Plan

CAPA ID, RCA summary, actions (owner, due date, status), resources needed, training required, affected documents.

C) Verification of Effectiveness Log

CAPA ID, metric, target, data source, sampling frequency, results, pass/fail, date closed, approver.

Final Notes

Keep the process simple, fast, and non-punitive so people report issues early. Tie every action to a measurable result and verify over time. When auditors arrive, a clean log, clear files, and confident operators are the best proof your CAPA system works.

R2 & ITAD Practical Guides | decideagree.com