Most quality leaders in medical device companies struggle with recurring NCs, failing CAPAs, and constant overload.

Findings on NC & CAPA systems dominate every year (483s, Warning Letters, and Notified Bodies reports).

Processes are too complex, timelines drag, and ownership sits only with QA.

Each review reveals that CAPAs are opened for minor issues or lack clarity about what issue is solved. On top:

1. Investigations miss root causes, and effectiveness fails
2. Records are neglected, and actions are overdue
3. Metrics are red, and leadership is frustrated

This means you as the person responsible for quality get all the pressure.

Imagine a CAPA system that actually works. 

One that spots issues early, runs smoothly, and earns confidence from auditors and leadership alike.

I help quality managers, directors, and VPs redesign their NC&CAPA systems:

- simplifying processes,
- strengthening root cause analysis, and
- building effective governance.

I focus on practical fixes that fit your reality, not theoretical frameworks.

Let’s make your CAPA system your strongest asset ... not your biggest headache.

Things I do with my clients:

- Train their organization so investigations identify root causes, not symptoms
- Simplify procedures so CAPAs are initiated for high-risk issues, not minor problems
- Analyze process health and propose a realistic improvement plan (+ help you with implementation)

Some results (check below for more):

- Created dashboards that manage 500+ open records and visualize each status and risk in seconds
- Trained 400+ people on NC/CAPA execution that led to stopping 'human error' as the root cause
- Redesigned procedures to stop opening CAPA for trivial, no-risk matters (reduced # of CAPA by 30%)

If you're a quality leader in the medical devices industry (ISO 13485) looking to remove complexity from your processes, book a call with me or send me a message.

I'm not sure what happened in the last 2 weeks.

But I see posts left and right in my LinkedIn feed saying "a CAPA must close within 30 days".

Or maybe it's a similar take like:

→ no, you need to identify the root cause in 15 days
→ you have to present an action plan after 30 days
→ a CAPA must be proven effective by day 90

And I get you.

You're under pressure to keep timelines green and your management happy.

But what I believe you'll create by this behavior:

An organization that focuses on the timeline only, no matter the consequences.

So, to hit the deadline, people will pull every trick:

1. CAPA fails, but is still closed. Open a new CAPA to "reset" the timer and handle the same issue again.

2. Reframe and handle it as an "improvement project". "No need" to document it as an NC or CAPA.

3. "Finetune" the effectiveness criteria so that it will pass no matter what. Don't challenge the logic behind.

Here's what I think matters when it comes to timelines:

→ How fast you identify and escalate the issue
→ How fast you are with containment

(Containment means preventing the issue from becoming bigger than it already is.)

That's what I would track, because how fast you are here has a DIRECT impact on how many patients are potentially exposed to whatever happened.

Once the hazard is under control, you can plan a realistic timeline. 

Yes, ideally it's risk-based. 

But it should also match the issue complexity.

Let's normalize CAPAs that take longer than 30 days when there's a good (!) reason, like:

• Product design issues. You need to update almost everything, including process & test method validation

• Multiple sites are affected, and you don't have a harmonized QMS yet. The change takes longer because the impact assessment is performed 10 times.

• Your effectiveness criteria are linked to complaint rate improvements. You can't expect to see real change within a few weeks.

Sometimes, Quality takes the time it takes.

Don't let anyone talk you into doing the wrong thing.
____
Follow Georg Digel​​ for more MedTech NC and CAPA posts like this one.

Georg Digel

I help medical device Quality leaders prevent ISO 13485 findings on NC/CAPA

Yesterday, I had my first coaching call after spending 7 days drinking at least 13 café cortados in Valencia.

The company I'm working with is a SaMD.

They got a finding in an external audit.

Nothing too dramatic, but enough to realize that their process needs work, so we teamed up to improve their NC/CAPA performance.

Yesterday's topic was CAPA initiation criteria.

Their SOP says: 

"Every critical bug shall be followed by a CAPA."

Sounds rigorous.

Until the head of QA/RA told me:

"The assessment is really inconsistent. It mostly depends on whether Sally or Tom makes the assessment."

(They obviously have different names, but let's pretend it's them.)

Which means:

• Same bug (issue)
• Same product (software)
• Same SOP

But still a different rating.

And now you have two things happening:

One person overclassifies to be safe:

→ Too many CAPAs
→ Everything overdue
→ Instead of rigorous investigation, it "just gets done"

The other underclassifies to avoid the paperwork:

→ Real issues slip through
→ No deep-dive investigation
→ No continual improvement

Both scenarios are potential audit findings.

The rule looks solid on paper. 
But the execution introduces problems.

Here's what I suggested:

Separate your issues into two categories.

Category 1: Always a CAPA. No discussion.

Some events are so significant that it doesn't matter if they happened "just" once:

→ Data security breaches
→ External audit findings
→ Breakdown of major functions

N = 1 is enough.
Define these explicitly in your SOP.

Category 2: Let the data decide.

Everything else? Don't trigger a CAPA based on one person's gut feeling.

Look at severity. Look at occurrence rates. Look at trends. Look at how many customers are affected.

A "minor" issue that shows up 50 times is not "minor" anymore.
A "critical" issue that happened once on one site might just need a correction.

The goal isn't fewer CAPAs or more CAPAs.

It's the right ones ... based on criteria that your whole team applies the same way.

Enjoy posts like these?
Consider following Georg Digel
​
PS - This is not a one-time exercise. Regularly review and revise your initiation criteria.

Training your teams on ISO 13485 NC/CAPA if you don’t have the capacity to do it yourself

It's been 190 days now since I left a good-paying job as a global principal quality engineer.

I almost had my dream role:

→ Coached and trained 100s on NC/CAPA
→ Built up a dedicated self-service community
→ Even hosted an internal podcast on this topic

I could be certain that my salary always arrived on the 25th of each month.

And now ... I won't lie - some days are tough.

But it's not only about receiving money less predictable than before.

It's more about the fact that I am still figuring out like 17 things at the same time:

- how I attract clients (MedTech quality professionals)
- an offer that actually delivers a transformation
- tax, administration, invoices, NDAs, other legal stuff

And doing all of that without burning out, as I have 2 little kids at home, aging parents who need more and more help ... and my wife has a demanding job, too.

But I'm neither blind nor naive.

I know the people I support have challenging lives, too.

Some deal with insane stress due to audit and inspection prep or findings. Others have health issues.

I needed a little break from all of that, so 2 weeks ago my family and I  traveled to Spain, Valencia.

We spent most of our time sitting in the sun, watching the children play.

I've been sipping on café cortados all day long.

(Which I don't recommend to anyone, btw. Stop after 2)

And that's when it became even clearer to me why I'm doing this:

I just love doing things my way.

I love creating and delivering a service I stand behind, focusing on outcomes for my clients.

I love bringing my daughter to ballet on Monday at 2 PM without "asking for permission".

I love that I am the "only stakeholder" in my company, so I don't have a hard time "aligning" on initiatives.

As long as you, as my client, are happy and you get the results you want ... and I can spend time with my family whenever I want ...

Everything feels right for me.

Does this freedom come with downsides? Sure.
But there were downsides before, too.

I'm in it for the journey, and I'm eternally grateful that so many of you follow me.

That's it ✌️

undefined undefined

Thursday, 2 weeks ago, I had a HUGE post.

It was about LinkedIn posts in my feed that highlighted arbitrary closure timelines for NC and CAPA.

My take was that whatever number you pick (30, 60, 90 days) ... that you'll always optimize for hitting the timeline rather than focusing on what matters:

Investigation quality and elimination of the causes.

The post resonated with many of you:

- 60.991 impressions
- 555 likes + 211 comments
- 113 people viewed my profile & 83 started following

Then I did what I haven't done since May 2025:

I haven't posted for 11 days. I even left 26 comments unanswered ... which I normally never do.

(I try to respond to everyone who isn't using AI, because I appreciate you taking the time to leave a thoughtful comment.)

And guess what?

No one cared that I hadn't been posting.

So whatever you think is so important going on right now in your life:

Most likely, it won't matter in the long run.

A few missed posts.
A few missed workouts.
A few missed root causes. 

Can happen. Will happen.
But don't let it ruin your day, month, or year.

That's it for today.

But feel free to follow Georg Digel​ because I post about how to have NCs & CAPAs that solve issues rather than creating new ones.

PS - I know it's been 26 unanswered comments because I answered them all yesterday.
PPS - I took time off and traveled to Valencia. 🙏Recharged and now I'm back with new ideas for 2026.

Quick reminder on what the verification of effectiveness - VoE - phase of a CAPA is for:

(At least in the medical device industry)

You want to prove that the nonconformity doesn't recur or occur at all. By that, you "technically" also prove that the underlying causes are eliminated or at least mitigated.

Why do I say technically?

Because a problem's absence doesn't mean it's solved.

I see 2 major problems within the records of the companies I support when it comes to effectiveness:

1. They have either super weak pass criteria or,
2. They confuse it with verifying that actions are done

One of my clients got an ISO 13485 audit finding on clause 8.5.2 due to exactly these 2 reasons.

In 1 CAPA, they just checked whether any new problems surfaced after the action was implemented. There were none, so they closed it as "effective".

In another CAPA, they "proved effectiveness" because the document that caused the underlying NC was "effectively revised" during the CAPA process.

Guess which CAPAs the auditor reviewed?

Exactly these 2.

For example 1, the auditor sampled a newly created record after the CAPA closure. The very first document had the same issues that they've "effectively" solved.

For example 2, they've basically just done a correction. They closed a CAPA without implementing corrective action or monitoring for effectiveness.

We're reworking the requirements for their VoEs now. This is what we'll do:

• Include specific steps in the CAPA procedure
• Revise their eQMS templates so they can follow the process steps without workarounds
• Allow the use of a variety of verification methods
• Give them an option to deviate from the "standard approach" with a good rationale (e.g., for cases where sampling or 100% review will not work)
• Create and deliver a supplemental training 

Good questions to ask whether the criteria are robust:

1. Is the check tied to the problem statement?
2. Are the criteria measurable or observable?
3. Is there a defined timeframe?
4. Why this timeframe?
5. Will the results support a clear conclusion?
6. If there's a sample-based approach, why this size?

There are no magic bullets to prove effectiveness.
You'll still need to put in the work.

But asking the right questions will lead to the right path.

Until then, consider following Georg Digel​ for more tips like these on NC and CAPA.

I am currently supporting a SaMD startup with fewer than 15 people by training their teams to identify and separate symptoms from root causes.

The company's QA/RA lead did a great job with:

- procedures and templates
- raising awareness for quality
- adjusting to the quirks of software engineers 😄

But still, most CAPAs end with short-term fixes.

And if you do a meta-analysis, you'll see the issues come back in a similar form after a few weeks.

One thing we identified early in our improvement project:

While teams use Ishikawa and 5 Whys in all investigations, they treat them like something "they must do".

What I mean by that:

1 Ishikawa had 3 potential causes. Only the most obvious ones. At least 4 categories were empty.

For the 5 Whys, it was clear they already "agreed" upfront on what the cause was, and then engineered the why chain backward so they could "identify" the root cause they wanted.

There are different challenges to tackle here, but the way I see it:

This happens if there is no data analysis outside of the investigation meetings.

(I talk about other challenges related to investigations here: https://lnkd.in/eKvqfyEB )

Which means people come to the session unprepared and "brainstorm" on a whiteboard.

The easiest way to prepare for investigations is:

1. Review the problem statement & CAPA scope
2. Collect background information - as needed
3. Define the current condition (measurable)
4. Define the target condition (measurable)
5. Analyze the gap between conditions
6. Explore (potential) root causes
7. Identify the true root cause

Doing that will create many more questions. 

And the new questions will point you in the direction you need to dive deeper for more data.

So TLDR:

Come prepared to the investigation sessions.

Otherwise, you'll just identify "human error" or "inadequate procedure".
_____
Enjoy posts like these? Follow Georg Digel​ for more content on NC & CAPA in medical devices.

I spent 12 hours last week developing a solution for medical device quality professionals to identify weaknesses in their CAPA records before the auditor does.

Because let's be honest:

Most of what I do can be standardized and learned.

So every time a client asks me how to review their critical CAPAs before an inspection or the next external audit, I basically tell and teach the same thing:

1. Why is this a CAPA?
2. How clear is the problem statement?
3. Do initial containment and correction make sense?
4. How thorough was the root cause investigation?
5. Do actions actually eliminate or mitigate the cause?
6. Are the investigation and actions adequate to the risk?
7. Does the effectiveness phase prove that actions worked?

(And then a few other things, like negative effect check and objective evidence or documentation)

I share templates and checklists in my trainings, too. 

But sometimes it's hard to think of everything and to define the next steps to improve the red flags.

So I created a big old Excel overview, and asked my newsletter readers whether they wanted to test it ...

For free.

248 read the mail, and 37 replied with yes.

(To the other 211 - you're seriously missing out!!!)

I got amazing feedback, which will flow into the next version. 

I'm considering launching this as a product later this year, so if you want to be informed as one of the first, you can get a first glance here:

https://lnkd.in/esQzmaNn

Until then, make sure to follow Georg Digel to stay up to date on NCs & CAPAs for medical devices.

I'm preparing a workshop this week for a medical device company so they can easily identify what works vs. what doesn't with their NC & CAPA system.

They didn't receive any audit findings or 483s, but they still want to see how they can be better.

Which I love.

Isn't that the spirit of continual improvement ... 
To prevent problems before they happen?

3 things that I always do before workshops:

1. Review your NC/CAPA procedures
2. Review your IT system or eQMS
3. Sample 5 - 10 NCs and CAPAs

I rarely find any "big red flags" in procedures.

Writing procedures is easy for most quality teams.
But what's much harder to control is the execution.

(If you want to see how I evaluate the execution, you can get early access here:
 https://lnkd.in/esQzmaNn)

For a trained eye, it's easy to identify weaknesses.

Let's see whether you can spot the difference:

Corrective action A:
"Raise awareness for the inspection process."

vs. Corrective action B:
"Redesign the final inspection step to introduce an automated check against the specification for measurements."

If you're still guessing what's wrong, you should ask for training on the NC/CAPA methodology.

Corrective action A is not sufficient. Period.

It's unclear what "raising awareness" even means or at what point you've successfully raised it. It also creates the question of "why was there no awareness before?".

4 questions that I always ask when I come up with CA:

1. Is the action linked to a verified root cause?
2. Does it address the fact of why it happened?
3. Is the action specific enough to implement?
4. What objective evidence will show it's done?

If the answer to any of these is unclear, then it's time to redesign the action.

So when you're training your owners and coordinators on NC & CAPA, teach them how to define and phrase actions.

You will prevent downstream problems, like:

• phasing the CAPA back to rewrite actions
• wasting time to get a reapproval because the process requirements changed
• struggling to explain to the auditor how "raising awareness" eliminated the cause

Promised.

A few weeks ago, Subhi Saadeh and I met to discuss NCs, CAPAs, and their common challenges.

He asked some amazing questions, like:

→ What's the most difficult CAPA I ever worked on?
→ Is it better to have 2 separate processes or just 1?
→ What are the big challenges with investigations?
→ What goes wrong with problem statements?
​→ How to find your CAPA inputs and triggers?

... and many more.

Feel free to check the episode out here:

https://lnkd.in/dyEBCDKq

And don't forget to follow Subhi Saadeh

He has many more interesting episodes and much better guests than me. 😁

Happy weekend y'all ✌️

PS - He could have used a more flattering thumbnail, couldn't he? 😅

taplio

Georg Digel's Linkedin Analytics

Georg Digel

Performance ScoreGeorg Digel's LinkedIn Performance

Georg Digel's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Georg Digel's Linkedin Analytics

Georg Digel

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Georg Digel's LinkedIn Performance

Georg Digel's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Georg Digel's Linkedin Analytics

Performance ScoreGeorg Digel's LinkedIn Performance

Georg Digel's Best Posts (last 30 days)