CAPA originated in quality management, particularly in regulated manufacturing and medical devices, and has become standard vocabulary in security and compliance programs. The central idea is simple and often ignored: fixing the specific problem you found is not enough. You also need to find out why it happened and stop it from happening again.
Three actions people confuse
Many CAPA logs stop at correction. The accounts get disabled, the ticket is closed, and the process that let them stay active is untouched. Auditors spot this quickly, because the same kind of finding reappears the following year, often on a different system with the same underlying cause.
A CAPA from finding to closure
The example below follows a single internal audit finding through a complete CAPA record. Note that correction and corrective action are recorded separately, the root cause explains a mechanism rather than blaming a person, and the record is not closed until a later sample shows the fix actually worked.
Example CAPA record
Getting to the root cause
The most common technique is five whys: keep asking why until you reach a cause that, if removed, would prevent recurrence. In the example, why did leavers keep access? The ticket was not raised. Why? HR processed leavers late. Why did that matter? The CRM depends on a manual ticket. Stopping at the first answer would have produced remind HR to be faster, which is not a durable fix. Human error is rarely a root cause on its own; ask what made the error possible.
What ISO 27001 expects
ISO/IEC 27001:2022 clause 10.2 covers nonconformity and corrective action. When a nonconformity occurs, you must react and deal with its consequences, evaluate the need to eliminate its causes, implement any action needed, review the effectiveness of that action, and keep documented information as evidence. The standard no longer has a separate clause for preventive action; since the 2013 edition, prevention is handled through risk assessment and treatment in clause 6.1.
Signs a CAPA process is not working
- Actions closed on the date the fix was deployed, with no effectiveness check.
- Root cause fields that restate the finding in different words.
- Owners assigned to teams instead of individuals.
- Repeat findings on the same control across consecutive audits.
- CAPAs tracked in email, so nobody can report how many are overdue.
An internal audit plan is where most findings originate, and each CAPA should update the relevant control and evidence. Asurvo's Audit product tracks findings through remediation and CAPA, and the audit remediation use case covers the workflow in more detail.