A pharmaceutical manufacturer receives a recurring deviation pattern in tablet hardness during the final compression step of a commercial product. The deviation is investigated. A root cause is identified — operator inconsistency in machine setup parameters during shift turnover. A CAPA is opened. The corrective action is implemented: revised setup SOPs, mandatory retraining for all line operators, addition of a setup verification checklist, and a six-month monitoring period.
Six months pass. The monitoring data is reviewed. The hardness deviation has not recurred. A QA manager reviews the data, concludes the corrective action has been effective, and signs the effectiveness check section of the CAPA record. The CAPA is closed. The quality system shows the loop has been completed.
Eight months later, the FDA arrives for a routine inspection. The CAPA is one of the records the inspector requests in the first hour.
The inspection that follows is not about the original deviation. It is about the effectiveness determination.
The CAPA file was complete by every internal measure. The deviation pattern was characterized. The root cause analysis was documented. The corrective action was scoped, implemented, and trained out. The monitoring period was defined and observed. The effectiveness check section of the form was completed. A QA manager signature was on the closure. The record was thorough, organized, and closed within the corporate target timeframe.
When the inspector pulled the CAPA file, the quality team had no concerns. The corrective action had worked. The data showed it. The hardness deviation had not recurred during the monitoring period or the eight months since. The QA manager who closed the CAPA was still at the company and could explain her reasoning if asked.
The inspector did not ask the QA manager to explain her reasoning. The inspector asked for the authorization record.
The investigator did not question whether the corrective action had worked. He did not challenge the monitoring data. He did not dispute that the deviation pattern had stopped recurring.
"Who authorized the determination that this CAPA was effective — and what is the record of that authorization decision?"
The QA manager pointed to her signature on the effectiveness check section. The investigator looked at the signature. Then he asked the question differently:
"I'm not asking who signed the effectiveness check. I'm asking who made the decision that this CAPA had restored the process to a controlled state. What evidence demonstrated effectiveness — not absence of recurrence, but evidence of effectiveness. What monitoring period was sufficient for this deviation type and why. What residual risk was accepted and on what basis. And where is the record of that determination."
The QA manager went back to the file. The monitoring data was there. The retraining records were there. The signed effectiveness check was there. The closure signature was there.
The authorization record for the effectiveness determination was not there.
The monitoring data showed no recurrence. That was a fact. What the file could not establish was the decision: who evaluated that data against a defined effectiveness standard, considered whether the monitoring period was adequate for this deviation class, assessed residual risk, and formally concluded the CAPA had restored the process to a state of control sufficient to close the corrective action loop.
- The identity of the individual who made the effectiveness determination and the basis of their authority to authorize that conclusion
- The effectiveness standard applied — what the monitoring data needed to show, in what volume, over what duration, to support an effectiveness conclusion for this deviation type
- The residual risk assessment performed at the moment of effectiveness determination
- The basis for concluding the monitoring period was sufficient — and the rationale for not extending it
- The Quality Unit's independent review and formal authorization of the effectiveness determination as the basis for closing the corrective action
The QA manager had reviewed the monitoring data. She had concluded the CAPA was effective. She had signed the closure. None of those things — not even all three together — constituted an authorization record for the effectiveness determination.
A signature on an effectiveness check section proves the section was completed. It does not prove that an effectiveness determination was made, by an identified individual, against a documented standard, with residual risk evaluated, and the conclusion formally authorized as the basis for closing the CAPA.
"Corrective and preventive actions were closed without documented authorization of the effectiveness determination. No record exists demonstrating that a qualified individual evaluated effectiveness against a defined standard, assessed residual risk at the moment of closure, and formally authorized the conclusion that the corrective action had restored the process to a state of control."
The observation was not issued because the CAPA was ineffective. The investigator did not conclude the corrective action had failed. The observation was issued because the record did not demonstrate that the effectiveness determination had been formally authorized — which meant every CAPA closed under the same effectiveness review pattern carried the same exposure.
The absence of the effectiveness authorization record did not stay contained to one CAPA file. The investigator pulled CAPA closures across multiple product lines and quality areas. The pattern was consistent: corrective actions were closed when the assigned monitoring period ended and no recurrence had been observed. Effectiveness was inferred from absence of failure. It was not documented as an authorized determination against a defined standard.
What began as one CAPA file became a systemic finding. The 483 cited the CAPA program as a whole. The remediation plan that followed required retrospective effectiveness reauthorization for every CAPA closed in the prior twenty-four months — and a procedural rebuild of the effectiveness determination process going forward.
21 CFR 820.100 · Inspection-Ready Format
An effectiveness determination is a decision. The decision is: this corrective action — implemented in this form, monitored over this period, evaluated against this standard — has restored the process to a state of control sufficient to close the corrective action loop, with this residual risk accepted on this basis, by this individual, on this date.
That decision requires an authorization record. Not the effectiveness check section. Not the monitoring data. Not the closure signature. A separate artifact that captures the determination itself — who made it, what they reviewed, what standard they applied, what residual risk they accepted, and why the evidence was sufficient to authorize closure.
The effectiveness authorization record serves a second purpose the CAPA form cannot: it becomes the foundation for every audit, inspection, and quality system review that follows. If a deviation recurs after closure, the effectiveness determination is the first record an investigator will examine. If a related CAPA on a similar process is later closed using the same monitoring approach, the original effectiveness authorization is the basis for the precedent. If the quality system itself is reviewed for systemic adequacy, effectiveness determinations are evaluated in aggregate. The investigator does not evaluate CAPAs as isolated records. She follows the authorization standard across them.
The authorization record is producible at the moment the effectiveness determination is reached. It captures what is already known — the data reviewed, the standard applied, the residual risk evaluated, the reasoning behind the determination — in a form that is immediately inspection-ready. That moment is the only moment it can be produced authentically. After the CAPA closes, the determination cannot be reconstructed. What can be produced is a recreation, and any experienced investigator will recognize the difference.
Discussion opens when you join. Login with LinkedIn to participate.
Join to Comment →