Definition
Corrective action eliminates the cause of an existing non-conformity to stop it recurring. Preventive action eliminates the cause of a potential non-conformity before it occurs. Both are core CAPA activities, defined in ISO 9001 and FDA 21 CFR Part 820.100.
The two are most often confused in audits because both eliminate a cause of a non-conformity. The distinction is timing: corrective action responds to an event that has already happened, preventive action responds to a potential event identified through trend analysis, risk assessment or near-miss data.
Corrective action starts after a non-conformity is recorded: a defect, a deviation, a customer complaint, an audit finding, or a failed inspection. The workflow runs through identification, root cause analysis using methods like 5-Why or 8D, action plan, implementation and verification of effectiveness.
Preventive action starts before any non-conformity occurs. The trigger is a signal that one is likely if nothing changes: a rising defect trend, a process FMEA risk score above threshold, a near-miss in a safety system, or a control chart drift. The investigation method is the same root cause analysis, but the cause being eliminated has not yet produced a recorded event.
Both processes must be documented separately, per the American Society for Quality CAPA guidance.
Triggered by a recorded non-conformity: a defect, a deviation, an audit finding or a failed inspection. Eliminates the cause of the existing event so it does not recur. Verified by absence of recurrence over a defined observation window.
Triggered by a forward signal: a defect trend, an FMEA risk score above threshold, a near-miss or a control chart drift. Eliminates the cause of a potential event before it occurs. Verified by the disappearance of the leading indicator.
Audits regularly cite confused CAPA records as a top finding. When a corrective action is labelled preventive, the auditor cannot tell whether the underlying non-conformity was actually resolved. When a preventive action is labelled corrective, it appears the organisation is reacting only to events it has already caused, with no forward-looking risk control.
ISO 9001:2015 reduced the explicit preventive-action requirement and folded it into risk-based thinking under clause 6.1, but the distinction remains a regulatory expectation in FDA-regulated and ISO 13485 environments, and a standard practice in mature quality systems.
The simplest test is whether the event has already occurred. If a non-conformity has been recorded against a specific batch, line, supplier or product, the response is a corrective action. If the response is triggered by a trend, a risk score, or a near-miss with no actual defect, it is a preventive action.
The same root cause analysis tools apply to both, but they are filed separately and verified with different evidence: corrective action by absence of recurrence of the original non-conformity, preventive action by the disappearance of the leading indicator that triggered it.
References