Regulatory Requirements and CAPA

An inspector asks a simple question: "Show me what you did when this preventive control failed last March." Your answer has to come from records, not memory, and those records must show correction, a step to stop recurrence, a safety evaluation of affected food, and a decision that kept unsafe food out of commerce. Regulatory CAPA expectations are concrete, and they are tested exactly like that — on a past event, under time pressure.

Requirements differ by country, sector, and customer standard, so you need to know which rules bind your site. What follows covers the main frameworks food businesses meet most often, and how to read them without confusing one regime with another.

Preventive Controls: 21 CFR 117.150

In the United States, the Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls rule for human food sits in 21 CFR Part 117. Section 117.150 deals with corrective actions and corrections when preventive controls are not properly implemented.

In practical terms, procedures must be established and implemented so that, when a failure occurs, the facility identifies and corrects the problem, reduces the likelihood the problem will recur, evaluates all affected food for safety, and prevents affected food from entering commerce if it is adulterated or otherwise cannot be shown to be safe. Related provisions cover verification of corrective actions and the records that document them. Monitoring records, corrective action records, and verification records are part of how FDA judges whether a food safety plan works in practice.

Notice the shape: correction, recurrence prevention, product evaluation, and product disposition. A CAPA record that covers only the first two will look incomplete to an FDA investigator, because the safety of food made during the failure window is a separate question from fixing the equipment or process.

ISO 22000 and clause 10.1

ISO 22000 is a voluntary management system standard that many food companies adopt directly or meet through certification schemes built on it. Clause 10.1, titled nonconformity and corrective action, requires the organisation, when a nonconformity occurs, to react to it, evaluate the need for action to eliminate the causes, review similar nonconformities that exist or could occur, implement needed action, review the effectiveness of corrective action taken, and make changes to the food safety management system if necessary.

Clause 10.1 also expects documented information as evidence: the nature of the nonconformities, their causes, and the actions and results that followed. Certification auditors test this by sampling closed cases and tracing them forward and backward — from finding to cause to action to effectiveness evidence, and from a shop-floor change back to the CAPA that authorised it.

Customer and certification scheme expectations

Retailer and scheme requirements often go further than law. GFSI-benchmarked schemes expect root cause analysis for significant nonconformities, defined timescales for action plans, and evidence that major findings are addressed before certification decisions. Major customers may require notification within their own timescales when a supplied product is affected, and may impose their own CAPA forms and closure criteria.

You should map these obligations in one place: legal duties, certification clauses, and customer contracts, each with its notification route and deadline. During a serious incident, nobody should be searching contracts to learn who must be told. That map is part of regulatory readiness, not administration.

A warning about 21 CFR 820.100

You will often see FDA’s CAPA regulation, 21 CFR 820.100, quoted in training material and software marketing. Read it carefully: Part 820 is the Quality System Regulation for medical devices. Section 820.100 sets CAPA duties for device manufacturers, not for food businesses.

Device CAPA practice is still a useful benchmark. Its emphasis on analysing processes, complaints, and other quality data to detect existing and potential causes, investigating, acting, verifying effectiveness, and disseminating information to responsible personnel is sound thinking, and many food CAPA procedures borrow that structure. Borrowing the structure is legitimate. Citing 820.100 as a legal requirement for a food plant is not — it misleads staff, weakens your credibility in front of a knowledgeable inspector, and can send your procedure-writing in the wrong direction.

How to reference it correctly

• Acceptable: "Our procedure follows the CAPA logic used in FDA’s medical device rule, 21 CFR 820.100, as a benchmark."
• Not acceptable: "FDA requires food manufacturers to comply with 21 CFR 820.100."
• For food, cite Part 117 and the specific duties that apply to your operation.

Building compliance into daily practice

Regulatory readiness is mostly habit. Write procedures that mirror the actual sequence your team follows. Train supervisors to start a record at the moment of failure, not at the end of the week. File evidence as you go. Review open actions in a routine meeting so deadlines are managed, not discovered during an inspection.

Record retention and access matter too. If the only person who can find a closed CAPA file is on leave, your system has a gap an auditor will find quickly. Store records predictably, name them consistently, and test retrieval: pick an old event at random and time how long it takes to assemble the full story.

Finally, keep requirements current. Regulations and scheme versions change; assign ownership for checking updates and revising procedures. A CAPA procedure citing a superseded clause tells an auditor that document control, as well as CAPA, may be drifting.

Key points

• 21 CFR 117.150 requires correction, recurrence prevention, safety evaluation of affected food, and keeping unsafe food out of commerce.
• ISO 22000 clause 10.1 requires reaction, cause elimination, checks for similar issues, action, and review of effectiveness, all evidenced in documented information.
• Customer and GFSI-benchmarked scheme rules may add root cause, timescale, and notification duties beyond the law.
• 21 CFR 820.100 is a medical device CAPA rule — a useful benchmark, never a food requirement.
• Keep a single map of notification duties and deadlines for use during incidents.
• Test record retrieval regularly; a record you cannot find does not protect you.