What is the difference between a correction, a corrective action and a preventive action?

1Three actions, three targets.

ISO 9000:2015, the vocabulary behind ISO quality management standards, defines a nonconformity as the “non-fulfilment of a requirement”. It then separates three ways of acting on one.¹

ISO’s notes add that a nonconformity can have more than one cause, that corrective action prevents recurrence while preventive action prevents occurrence, and that a correction “can be made in advance of, in conjunction with or after a corrective action”. Rework and regrade are its examples of corrections.¹

FDA’s CDRH Learn course on CAPA uses a misspelled word on a slide. Changing the word is a correction. Finding out why misspellings reach your slides, then adding spell-check to the way you prepare presentations, is a corrective action. Adding spell-check before any of your own slides go wrong, because you have seen misspellings cause problems for another group, is a preventive action.²

2Where the definitions apply.

For medical devices the definitions now carry the force of regulation. When the CDRH course was recorded, under the former Quality System Regulation, these terms were not defined in 21 CFR Part 820 and FDA took them from ISO.² Since 2 February 2026, Part 820, now the Quality Management System Regulation, applies “the definitions in ISO 13485 and in Clause 3 of ISO 9000”, and incorporates Clause 3 of ISO 9000:2015 by reference.³⁴ ISO has since replaced that edition with ISO 9000:2026, but Part 820 names the 2015 text.⁵³

ISO 13485 puts corrective action in Clause 8.5.2 and preventive action in Clause 8.5.3. In the final rule, FDA said it had incorporated both and had not combined them, and that adopting ISO 13485’s meaning of preventive action did not change its expectations.⁶ Part 820 keeps the two ideas apart in complaint records too, which must show “any correction or corrective action taken”.³

For medicines the definitions come from guidance. ICH Q10 takes its definitions of corrective and preventive action from ISO 9000:2005, with the same note on recurrence and occurrence.⁷ FDA’s 2006 quality systems guidance for drug CGMP defines a correction as “repair, rework, or adjustment relating to the disposition of an existing discrepancy”, and gives corrective and preventive action the same split between an existing and a potential discrepancy.⁸

The drug CGMP regulations in 21 CFR Part 211 do not use the words. Section 211.192 requires a thorough investigation with a written record of “the conclusions and followup”, and FDA reads into that requirement “the need to implement corrective actions and preventive actions”.⁹¹⁰ EU GMP Chapter 1 asks for “appropriate corrective actions and/or preventative actions (CAPAs)” in response to investigations.¹¹

3How one problem uses all three.

A typical sequence after a problem is found:

1. Contain it. Identify or segregate the nonconforming product so it is not distributed.⁸
2. Correct it. FDA’s 2006 guidance lists the options: correct the non-conformity; with proper authorisation, let the product proceed with a justified conclusion on its impact; use it for another application where the deficiency does not matter; or reject it. Corrected product should be re-examined for conformance.⁸
3. Investigate the cause. ICH Q10 asks for “a structured approach” aimed at the root cause, with effort in proportion to the risk.⁷
4. Act on the cause. If the non-conformity is significant, the 2006 guidance says “it is important to evaluate how to prevent recurrence”.⁸ That is the corrective action.
5. Look for the same cause elsewhere. Removing it from another product, line or site where it has not yet produced a problem is preventive action, because there the nonconformity is still only potential.¹
6. Check the result. In commercial manufacturing, Q10 asks that “the effectiveness of the actions should be evaluated”.⁷

Not every problem needs all three. FDA’s CDRH course lists the choices as no further action, a correction alone, a corrective action, or a preventive action, and says that not every nonconformity goes into the CAPA system.² For devices, FDA says the degree of action should be “appropriate to the magnitude of the problem and commensurate with the risks encountered”.⁶

4Where teams go wrong.

• Recording a correction as the corrective action. Reworking a lot removes the nonconformity, not its cause, so the next lot can fail the same way.
• Calling a corrective action “preventive” because it stops the problem coming back. Under ISO 9000, action on the cause of an actual nonconformity is corrective; preventive action is for potential ones.¹
• Retraining by default. The FDA trainer says that seeing training used “over and over” as the corrective action would lead the trainer to question how much investigation was done.² EU GMP asks that a finding of human error be justified, having made sure that process, procedural or system-based errors have not been overlooked.¹¹
• Treating completion as proof. A finished action shows it was implemented, not that the cause has gone, which is why Q10 asks for effectiveness to be evaluated.⁷

5How it runs in Seal.

In Seal’s CAPA blueprint, a corrective action addresses a problem that has occurred, with a check that it does not recur, and a preventive action addresses a potential problem identified from risk assessment or trend analysis before it occurs. Each CAPA links to the deviation, audit finding or complaint that prompted it, and different CAPA types can have different workflows, so a simple correction can need less rigour than a systemic corrective action.

On a deviation, containment and correction are recorded beside the original observation, and an immediate correction neither replaces it nor closes the investigation. For a nonconformance, each disposition, such as rework, use as is, return or scrap, is recorded as a plan with instructions, quantities and owners, and with evidence of completion.