Procedure
Corrective and Preventive Action (CAPA) Procedure
This procedure governs the identification, recording, assessment, treatment, verification, and closure of nonconformities and opportunities for improvement across all GRC domains.
- Type
- Procedure
- Version
- 1.1.1
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Compliance Management
- Review frequency
- Annual and upon material audit methodology or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Table of contents
- 1. Purpose and scope
- 2. Governance
- 3. Nonconformity identification and recording
- 4. Root cause analysis requirements
- 5. CAPA classification
- 6. Corrective action planning
- 7. Implementation and verification
- 8. CAPA register
- 9. CAPA escalation
- 10. Preventive action
- 11. Relationship to continual improvement
- 12. Evidence retention
- 13. Framework alignment
Frameworks it maps to
- ISO 9001:2015
- ISO/IEC 27001:2022
- ISO 37301:2021
- ISO 19011:2026
- COBIT 2019
- CSA Cloud Controls Matrix
- BASC International Norm V6-2022
- BASC International Norm Implementation Guide V6-2022 (Version 06, effective 2022-03-02)
- NIST Cybersecurity Framework 2.0
Related documents
- Internal Audit Standardcompliance
- Audit Planning Procedurecompliance
- Compliance, Audit, and CAPA Management Policycompliance
Next
All Documents