I used to think CAPA was a tidy, audit-friendly treadmill: non-conformance logged, root cause found, correction and verification recorded, move on. The IVDR transition showed me how brittle that assumption is when surveillance expectations change under you.
I support CE-marked Class IIa/IIb devices under MDR and have had to bring the same muscle memory to IVDs shifting to IVDR. To be fair, MDR already nudged CAPA toward closer links with post-market data; IVDR simply raised the bar on performance evaluation and ongoing follow-up. In practice this means CAPA is no longer just a corrective loop — it’s an integral data source for performance evaluation, PMPF planning, and notified-body scrutiny.
What's different for CAPA under IVDR vs MDR (practical view)
- Terminology shift you must respect: MDR uses "post-market clinical follow-up (PMCF)"; IVDR uses "post-market performance follow-up (PMPF)". The goal is the same — ongoing collection of real-world evidence — but IVDR explicitly frames it as performance data rather than clinical endpoints for many devices.
- Greater emphasis on continuous performance evaluation. Where MDR-focused PMCF often looked for predictable clinical gaps, IVDR expects tighter monitoring of analytical and clinical performance metrics as part of the manufacturer’s performance evaluation process.
- Notified bodies expect CAPA evidence to feed directly into performance evaluation. A closed CAPA that reduced sensitivity in an assay must be visible in the device’s PER/PMPF plan and the Technical Documentation traceability chain.
- Supplier non-conformances matter more. For many IVDs, critical reagents and calibrators are intrinsic to performance. A supplier CAPA may effectively be a device CAPA for regulatory purposes.
How I changed our CAPA workflow (concrete steps)
We made five practical edits that reduced audit friction and improved product safety in real-world use:
-
Link CAPA to performance metrics up front
- Every CAPA has a “performance impact” field: sensitivity, specificity, stability, lot-to-lot variation, etc.
- That field maps to the Performance Evaluation or PMPF indicators in the Technical File.
-
Make trend analysis part of triage
- Small, repetitive complaints trigger an automated trend review before being closed as “local”.
- Trends feed a formal risk re-evaluation (ISO 14971 alignment) and may trigger a PMPF amendment.
-
Tighten containment and evidence timelines
- For issues affecting analytical performance we shortened containment evidence deadlines from 30 to 14 days.
- Containment records include data snapshots used later in the PMPF.
-
Treat supplier deviations as cross-functional CAPAs
- Supplier non-conformances create linked CAPAs assigned jointly to supplier-quality and RA.
- Supplier corrective actions must include demonstrable impact testing before closure.
-
Record effectiveness using real-world indicators
- Effectiveness checks require the metric used to detect the issue (e.g. control chart limits) and follow-up data points.
- Passing a paper effectiveness check is no longer sufficient; we require quantitative evidence where possible.
Documentation and Technical File implications
Notified bodies are increasingly asking to see the chain from vigilance/complaint to CAPA to performance evaluation to change control. That means:
- Traceability is non-negotiable. The Technical File should show how a complaint led to a CAPA, how the CAPA influenced risk assessment (ISO 14971), and whether the PER/PMPF was updated.
- Version control and change impact analysis must be clear. If a CAPA drives a design change, the justification and verification must sit beside the risk-benefit analysis.
- Periodic reporting needs to reference CAPA-derived trends. If your PSUR/PER/periodic report omits those trends, expect questions.
Tools and features that actually help
We adjusted how we use our eQMS to support these processes. Features that mattered in practice:
- Connected workflow: CAPA, change control, risk assessment and post-market surveillance dashboards must be linked so one action surfaces required updates elsewhere.
- Traceability and reviewability: every CAPA action should be reviewable with a clear audit trail — who decided what and why.
- Change impact mapping: engineers need a clear view of which device elements a CAPA touches (software, reagent, labelling).
- Automated CAPAs for trend triggers: automated CAPA creation or at least task creation from statistical triggers reduces latency.
- Controlled, AI-assisted assistance is helpful for draft root-cause suggestions and for surfacing similar past CAPAs — but keep the review step human and traceable.
If your eQMS only has isolated modules for CAPA and PMS, you’ll spend audit time stitching evidence together. If it supports connected workflow and automated CAPA-driven risk assessment, your audits become shorter and your PMPF work less painful.
Common mistakes I've seen
- Closing CAPAs without updating performance evaluation documents. That creates huge gaps at audit time.
- Treating IVD supplier deviations as "supplier-only" and not linking them into device risk and PMPF.
- Using qualitative "effectiveness verified" statements without backing data, especially for performance-related issues.
- Failing to pre-define what constitutes a trend that escalates to PMPF — then arguing in an audit why you should have escalated.
What I now measure quarterly
- Time-to-containment for performance-impacting events
- Percent of CAPAs with explicit linkage to PER/PMPF
- Number of supplier-driven CAPAs affecting device performance
- Trend-triggered CAPAs vs single-event CAPAs
Reporting these metrics in Management Review makes it harder to ignore structural gaps.
I’m still mildly annoyed that the EU made two regimes that use slightly different language for essentially the same concept — but granted, the IVDR’s focus on performance data forced us to mature our CAPA practice in ways that actually benefit patients.
How have you changed CAPA to meet IVDR expectations — and which part of the workflow still trips you up?
