CAPA Example: A Clinical Trial Deviation Walked Through Step by Step

A CAPA example shows what corrective and preventive action looks like in practice: one quality event, traced from the moment someone spots it to the moment the record closes with proof the fix held. The process runs through seven stages: detection, triage, investigation, root cause analysis, action planning, effectiveness verification, and closure. This guide walks a single clinical trial deviation through all seven, with dates, named artefacts, and the judgement calls a QA Lead has to make along the way.

The scenario below is illustrative. It describes a hypothetical Phase II study at an NHS teaching hospital. The stage sequence is the same for most deviations that warrant a CAPA.

Key Takeaways

• A deviation and a CAPA are two separate records. The deviation describes what happened. The CAPA addresses why it happened.
• Correction fixes the single instance. Corrective action removes the cause of an event that has occurred. Preventive action removes the cause of an event that has yet to occur.
• Corrective action reaches as far as the realised cause reaches, which is often wider than the study that surfaced it.
• Root cause analysis carries the weight of the whole record. A CAPA built on a shallow cause closes cleanly and then reopens as a repeat finding.
• Effectiveness verification is easy to record as a completion tick. It is also the only stage that proves the fix worked.
• ICH-GCP E6(R3) frames quality management as proportionate to risk. The risk the event carries sets the depth of the response.

What Is a CAPA in Clinical Research?

Corrective and Preventive Action (CAPA) is the structured response a research organisation makes to a quality event once the event has been assessed as significant enough to require one. The event itself is recorded as a deviation, a finding, or a complaint. The CAPA is the record of the reasoning and the work that follows.

Three terms do distinct work, and teams lose CAPAs at inspection by treating them as synonyms.

• Correction removes the immediate problem. It repairs the instance in front of you and makes no claim about the cause.
• Corrective action eliminates the cause of an event that has already occurred, so the event stops recurring.
• Preventive action eliminates the cause of a potential event, one that has yet to occur in the process it addresses.

Scope is a separate question from type. Corrective action reaches wherever the realised cause reaches, which is frequently wider than the single study that surfaced the event. A departmental cause calls for a departmental corrective action.

ICH E6(R3) sets proportionate, risk-based quality management expectations, and the depth of a CAPA is expected to match the risk of the event that triggered it. The three-term distinction itself comes from general quality management practice rather than from GCP. E6(R3) has been adopted in the EU, with UK implementation set out by the MHRA.

A worked example is the fastest route into all three. For the underlying concepts and the full lifecycle, read our guide to CAPA management in clinical trials. For the system that holds the record, see AQ CAPA management.

The Deviation: What Happened?

A pharmacy technician dispensed investigational medicinal product to a study participant fourteen days before his delegated authority for that task took effect. The product was correct, the dose was correct, and the participant came to no harm. The activity was performed without effective delegated authority, and the site’s procedures classify that as a protocol deviation requiring documentation and notification to the sponsor.

Stage 1. How Was the Deviation Detected and Logged?

The CRA ran source data verification on 12 March and compared the pharmacy dispensing log against the site delegation of authority log. The dispensing entry for 4 March named a technician. The delegation log recorded an effective date of 18 March 2026 for that individual against the task “IMP dispensing”. The two dates did not reconcile, and the gap was fourteen days.

ICH-GCP requires the investigator to maintain a list of appropriately qualified persons to whom significant trial duties are delegated. Effective dates are the operational convention that makes the list testable on any given day, and they are what a monitor reconciles against.

The deviation was logged the same day. A deviation entry earns its place by carrying enough detail for someone who was not there to reconstruct the event.

• A factual description of what was done, by whom, and under which task.
• The date of occurrence and the date of detection, recorded separately.
• The participant or participants affected.
• An immediate assessment of participant safety and data integrity impact.
• The person who detected it and the activity that surfaced it.

A weak entry: “Dispensing error by pharmacy. Under investigation.”

A strong entry: “On 4 March 2026, IMP for participant 1042 (Visit 3) was dispensed by a pharmacy technician whose delegation for ‘IMP dispensing’ carries an effective date of 18 March 2026. The activity was performed 14 days before delegated authority took effect. Correct product, correct dose, correct participant, confirmed against the prescription. Detected 12 March 2026 during monitoring visit MV-03.”

The judgement call at this stage: how much to write before the facts are established. The strong entry states only what was checked and found. An early theory of the cause, recorded here, anchors the investigation before it starts.

The weak entry describes a feeling about the event. The strong entry describes the event.

Stage 2. How Was the Deviation Triaged?

The QA Lead triaged DEV-2026-088 on 13 March, one working day after detection. Triage answers four questions in order.

• Did participant safety suffer? The PI reviewed the dispensing record against the prescription and the protocol. Correct product, correct dose, correct visit. No safety impact.
• Is data integrity affected? The dispensing data itself is accurate and contemporaneous. The defect sits in the authority behind the activity.
• Is this isolated or systemic? Unknown at triage. That question is what the investigation exists to answer.
• Does it warrant a CAPA? Yes. ICH-GCP requires the investigator to maintain a list of appropriately qualified persons to whom significant trial duties are delegated, which makes delegation a core GCP control.

The event was classified major and CAPA-2026-014 was opened the same day. The risk the event carries to participant safety and to the reliability of results sets the depth of everything that follows, which is the proportionate quality management principle in ICH-GCP E6(R3) applied at the point it matters.

Many deviations close without a CAPA. A single, low-impact, non-recurring event can close with a correction and a documented rationale. Four triggers push an event across the line into a CAPA.

• Participant safety or the reliability of results is affected.
• The same event has occurred before at the site or in the study.
• The event points at a process or system weakness rather than a one-off circumstance.
• The event touches a core GCP control, such as delegation, consent, or IMP accountability.

The QA Lead also assessed the event against the sponsor’s serious breach criteria and identified no impact on participant safety or the reliability of results. The assessment went to the sponsor with the notification, because the duty to report a serious breach to the MHRA sits with the sponsor.

Also Read: Clinical Research Audits: Types, Process, Checklist, and Audit Readiness Guide

Stage 3. What Did the Investigation Establish?

The investigation ran from 16 to 23 March. Its scope was set at the start and written into the record, so the boundaries of the search are as visible as its findings.

• Record review. Every dispensing event for the study since site activation, checked against delegation effective dates. The review widened to the department’s other two interventional studies once the first repeat appeared.
• Interviews. The pharmacy manager, the technician, the rota author, and the Principal Investigator.
• Document review. Site SOP PHARM-04 (IMP dispensing), the delegation SOP, and the pharmacy staffing rota for February and March.

The investigation established four facts.

• The technician was competent and trained. His GCP certificate and IMP dispensing training predated 4 March. The delegation paperwork lagged behind a competency that was already in place.
• Three further dispensing events were performed by two staff members before their respective effective dates: one in this study, and two in the department’s other interventional studies. Four events across three studies. The failure was systemic.
• The pharmacy rota is built from departmental staffing availability. The rota author had no visibility of study delegation status when assigning the 4 March shift.
• SOP PHARM-04 requires PI signature on the delegation log before activity begins. It places no authority check at the dispensing step itself.

The three further events are three further deviations, and the record treats them that way. Each was logged separately (DEV-2026-091 to DEV-2026-093), assessed for participant safety and data impact, and linked to CAPA-2026-014 as the parent record. The sponsors of both other studies were notified of the systemic finding.

The judgement call at this stage: how far to widen the review, and when to stop. The trigger to widen was evidence, specifically the first repeat. The stopping point was the boundary of the cause: the rota process is departmental, so the review covered the department. A review that widens on anxiety rather than evidence never finds a stopping point.

Stage 4. What Was the Root Cause?

The QA Lead ran a Five Whys analysis on 23 March with the pharmacy manager and the rota author present. The rota author is the material witness for the middle of the chain. An analysis of a scheduling failure without the person who builds the schedule is guesswork.

Root cause statement: the site’s delegation process operates as a start-up event rather than a continuous control. Delegation status lives in a document disconnected from the systems that assign work, so staff can be scheduled onto trial tasks with no check on whether their authority is effective on the day.

The staff changed. The system assumed they never would.

Two false endings end shallow CAPAs, and both were available here.

• “Human error.” The analysis stops at the person who performed the task. The action becomes retraining, and the same event recurs with a different name attached.
• “Staff did not follow the SOP.” The technician followed the rota, which is what his job asked of him. An SOP that permits the failure has a design problem.

Our guide on how to build a CAPA action plan that actually addresses root cause covers the analysis methods in more depth.

Stage 5. Which Actions Were Corrective and Which Were Preventive?

The CAPA plan was approved on 27 March. It separates the three action types explicitly, because an inspector reads them as three different claims about the site. COR-1 and COR-2 were taken immediately at triage on 13 March and recorded into the plan when it was approved.

Four details in that table carry most of the weight.

• CA-3 and CA-4 are corrective actions. The cause had already produced four events across three studies, so the fix that reaches those studies is corrective action at its true scope. The label “preventive” would understate what the site had found.
• PA-1 is the only preventive action here. The research nursing rota carries the same structural disconnect, and no event has been detected there. An action aimed at a cause that has yet to produce an event is preventive. That is the distinction the two labels exist to draw.
• COR-2 forbids back-dating. A signature applied later does not make an activity retrospectively authorised. An entry altered to show authority that was absent on the day misrepresents the record, which moves the issue into data integrity under the MHRA’s GxP data integrity guidance. The gap is recorded as a fact and explained in a file note.
• CA-4 answers the root cause. CA-1 and CA-2 fix the SOP and the people. CA-4 removes the disconnect that let the rota and the delegation log drift apart.

Continuous delegation control is the structural fix. It requires delegation status to be held where the systems that assign work can read it, which a signed PDF in the site file cannot do. Sites addressing this move delegation into a Digital Delegation of Authority record, with training evidence and SOP versions alongside it in the quality management system.

Sponsor oversight: the sponsor received the root cause statement and action plan on 27 March, and its acceptance of the root cause was recorded before the corrective and preventive actions began. The site owns the CAPA and the sponsor owns oversight of it. The closed record names both.

Also Read: What is QMS (Quality Management System) in Clinical Research?

Stage 6. How Was Effectiveness Verified?

The verification criteria were written into the plan on 27 March, before a single action started. That ordering is the whole point. Criteria set after the actions complete describe whatever happened to occur.

Result in the illustrative record: 68 dispensing events reviewed. Zero performed before the effective date. Rota authors demonstrated the delegation view in use. Effectiveness verified and signed on 4 August 2026.

The distinction that matters at inspection sits here.

• A weak effectiveness check: “SOP revised and training complete. CAPA effective.” That statement confirms the actions were done. It says nothing about whether they worked.
• A strong effectiveness check: a measurement of the outcome the CAPA existed to produce, taken after enough time has passed for the failure to recur, against a criterion fixed in advance.

Completion is an input. Effectiveness is an outcome.

Stage 7. What Does the Closed Record Contain?

CAPA-2026-014 closed on 7 August 2026. The closed record holds a connected chain rather than a folder of documents.

• The deviation record DEV-2026-088 and the three linked deviations, connected to the CAPA rather than filed beside it.
• The triage assessment and risk rationale, dated and attributed.
• The investigation scope, the records reviewed, and the four established facts.
• The Five Whys and the root cause statement, with the sponsor’s acceptance of it.
• Seven actions with owners, due dates, completion dates, and the evidence for each: SOP PHARM-04 v3.0, the training records with quiz results, and a screenshot of the live delegation view.
• The effectiveness criteria, the 68-event review, and the signed verification.
• The closure approval, with the QA Lead named and the sponsor’s oversight record attached.

The judgement call at this stage: whether the record is complete enough to sign. A filled field set is a weak test. The real test is whether a reader with no knowledge of the event can answer five questions from the record alone: what happened, how you found it, why it happened, what you did about it, and how you know it worked. A record that answers all five is what inspection readiness means at the level of a single event.

Also Read: Drug Accountability Logs: What Auditors Actually Check

How Does AQ CAPA Support This Workflow?

AQ CAPA holds the record structure that the workflow above depends on, and it connects that record to the modules where the evidence already lives.

• Deviation records link to the CAPA they triggered, which gives the closed record a traceable origin instead of a cross-reference typed into a field.
• Root cause analysis is captured as a structured step with the method named, which keeps the reasoning in the record where an inspector reads it.
• Actions carry owners and due dates with escalation on overdue, which surfaces a stalling CAPA while there is still time to act.
• Effectiveness verification is a gated step, which blocks closure on completion alone where the gate is configured.
• Delegation records, training evidence, and pharmacy documentation are linked from the CAPA, so the evidence chain assembles as the work happens.

The honest limits matter as much as the mechanisms.

• AQ does not classify the event. The QA Lead assesses the risk and owns the judgement. The system records the decision and who made it.
• AQ does not find the root cause. It structures the analysis and holds the evidence. A Five Whys that stops at “human error” is a shallow analysis in a tidy template.
• AQ does not write the effectiveness criteria. It requires that criteria exist before closure and holds the team to them. The quality of the criterion belongs to the QA Lead.

Structure makes a good CAPA provable. Judgement makes it good.

See how AQ connects deviations, CAPA, delegation, and quality records on one governed study record. Book a 30-minute product tour and walk a CAPA of your own through the system.