How to score CAPA priority in a QMS

Quality teams do not have a CAPA shortage. They have a prioritization problem. Every complaint, incoming inspection failure, and audit finding can be written up. Not every one should open a full corrective and preventive action record on the same day.

ISO 13485:2016 asks for corrective actions that are proportionate to the effects of the nonconformities encountered and taken without undue delay. It does not prescribe a scoring method. A severity × occurrence × detectability product is a common convention borrowed from FMEA. It is useful when the scales, thresholds, and resulting actions live in your CAPA procedure.

Use the free CAPA priority scorer to get a first-pass product on a 1–5 scale for each factor. This article works three complaint intakes through that scorer, separates CAPA priority from reporting, and ties the result back to risk management and change control.

What ISO 13485 and 21 CFR 820 actually ask for

ISO 13485:2016 clause 8.5.2 (corrective action) requires a documented procedure that covers reviewing nonconformities, including complaints; determining causes; evaluating the need for action to ensure nonconformities do not recur; planning and implementing action; verifying that the action does not adversely affect regulatory compliance or device safety and performance; and reviewing effectiveness. Records are kept. Clause 8.5.3 covers preventive action for potential nonconformities.

FDA’s Quality Management System Regulation in 21 CFR Part 820 incorporates ISO 13485:2016 by reference (see 21 CFR 820.7), along with Clause 3 of ISO 9000:2015 for definitions. The older standalone CAPA section at 21 CFR 820.100 is reserved. FDA-specific requirements in the revised Part 820 still apply, and where ISO 13485 conflicts with the FD&C Act or other FDA regulations, those control.

ISO 9000:2015 vocabulary, which the QMSR also uses, distinguishes a correction (action to eliminate a detected nonconformity), a corrective action (action to eliminate the cause and prevent recurrence), and a preventive action (action to eliminate the cause of a potential nonconformity). Many low-priority items are closed with a correction and trended, with a documented justification for not opening a CAPA.

None of that text requires an RPN. If you use one, your SOP has to say what the numbers mean.

How the scorer is built

The CAPA priority scorer multiplies three integers from 1 to 5:

• Severity of harm if the problem is not corrected
• Occurrence, or how often the problem shows up
• Detectability, with 1 meaning the problem is always caught and 5 meaning it is likely missed

The product runs from 1 to 125. On this page the bands are:

• 60 and above: Priority 1 — open CAPA now
• 24 to 59: Priority 2 — CAPA or documented justification
• Below 24: Priority 3 — trend; may close as a correction

Those thresholds are teaching defaults. They are not in ISO 13485. If your procedure uses 40 and 80, or a 1–10 scale, use your procedure.

Detectability is oriented so that a higher number is worse, matching severity and occurrence. If your FMEA uses the opposite convention (high detectability number means easy to detect), do not mix the two scales in one sentence.

Worked example: three complaint intakes

Case A. A home pulse-oximeter accessory cracks at the clip. No injury is reported. Incoming inspection has seen two similar cracks this quarter. In-process visual inspection usually catches a crack before packing.

Try severity 2 (minor injury or nuisance is plausible if a clip fails in use, but this report is a cracked accessory with no injury), occurrence 2 (seen a few times, not a flood), detectability 2 (usually caught). Product = 8. The scorer labels that Priority 3. A reasonable procedure response is a correction (replace the unit, quarantine the lot if indicated), a trend entry, and a documented decision that a CAPA is not required yet. If the next two months add more of the same, occurrence goes up and the decision should be reviewed.

Case B. A software update to a Class II vital-signs app dropped a trend arrow on the review screen. Clinicians still see the numeric value. No known mis-treatment is reported. The defect escaped two verification cycles and reached a limited release.

Try severity 3 (information used in monitoring could be incomplete, harm is possible but not demonstrated), occurrence 3 (every user on that build sees it), detectability 4 (verification missed it twice). Product = 36. The scorer labels that Priority 2. Your procedure should force a choice: open a CAPA, or write why a correction plus a contained software fix is enough. Either way, run the change through a design-change assessment. The change-control classifier is a first pass for whether you are looking at design, process, labeling, or software, and whether a regulatory impact review belongs on the calendar. We also wrote Change control in medtech: classifying design and process changes for that conversation.

Case C. A sterile disposable’s seal fails in a way that can reach a sterile field. Several hospitals reported it in a week. Your release testing does not detect the seal defect.

Try severity 5 (serious infection risk if a non-sterile device is used), occurrence 4 (clustered reports, not a single unit), detectability 5 (escaped release testing). Product = 100. The scorer labels that Priority 1. Open the CAPA now. In parallel, evaluate reporting. Do not wait for the score to finish before you ask whether 21 CFR Part 803 Medical Device Reporting in the United States or serious-incident reporting under EU MDR Article 87 applies. ISO 13485 clause 8.2.3 requires documented procedures for notifying regulatory authorities.

These three numbers are teaching cases. Your complaint file, your risk file, and your counsel decide the live case.

Reporting is a parallel decision

CAPA priority and regulatory reporting are different questions. A high RPN often lines up with a reportable event, but a low RPN does not make an event non-reportable, and a high RPN is not itself a report. Run the reporting evaluation on the statutory criteria, not on the product of three slider values.

The same is true for recalls and field actions. A Priority 1 score can support urgency inside the QMS. The decision to remove product from the field follows its own procedure.

Connect the score to risk and change control

Complaints and nonconformities are production and post-production information. ISO 14971 expects you to review that information against the risk management file. If a problem shows a hazard, a hazardous situation, or a probability of harm the file does not reflect, update the analysis. Check, under ISO 13485 clause 8.5.2, that the corrective action does not introduce new risks to safety or performance.

A first visual for that discussion is the ISO 14971 risk matrix, and the longer note ISO 14971 risk thinking: a practical severity and probability matrix. Severity on a CAPA intake and severity in the risk file should be reconcilable. They do not have to use the same 1–5 anchors, but someone should be able to explain the mapping.

If you are still standing up the QMS, the ISO 13485 gap self-score is a clause-level rehearsal. Weak scores on 8.5.2 / 8.5.3, complaint handling, and change control are usually the same story: intake is informal, thresholds live in someone’s head, and effectiveness checks are a calendar reminder with no acceptance criteria.

Put the thresholds in the procedure

Write down the scale anchors. “Severity 4” should mean the same thing on Tuesday and on the day before an inspection.

Write down what each band triggers: who is notified, whether a CAPA record opens automatically, how long you have to assign an owner, and what a documented justification looks like when you stay at correction only.

Write down how you review trends. Priority 3 items that share a root cause are how Priority 1 events are born.

Write down how you check effectiveness. ISO 13485 wants a review that the action worked and that it did not harm compliance, safety, or performance. A closed CAPA with no effectiveness criterion is a records problem waiting for an auditor.

Do not paste a web tool’s default bands into an SOP unless you have reviewed them. The scorer is an educational product, not your quality system.

Use the CAPA priority scorer

Score the next complaint on severity, occurrence, and detectability in the CAPA priority scorer. Read the band as a prompt for your procedure. Cross-check the hazard in the ISO 14971 risk matrix, and if the fix changes the device or the process, run Change control in medtech: classifying design and process changes before you call the work done.

A proportionate CAPA system is visible in the records: high-severity escaped problems move immediately, low-severity detected problems are trended, and the score is never a substitute for reporting or for engineering judgment.