The distinction is about purpose, not how quickly you act or which document you revise. Replacing an incorrect reference can be a complete correction. Changing a procedure can be a corrective action, but only if the change addresses a supported cause. Neither a revised procedure nor a training attendance sheet proves, on its own, that the problem will not recur.
This guide helps you turn an assessed finding and an investigation into clear action and evidence fields. It focuses on EU medical-device findings, with two illustrative worksheets you can adapt to your own records.
What belongs under correction vs corrective action?
Start with the object of the action. Are you fixing the problem you found, or changing the conditions that caused it?
| Response element | What it does | Evidence that helps demonstrate it |
|---|---|---|
| Containment | Limits exposure while you assess and resolve the problem | Hold records, access restrictions or an interim review control, with scope and release criteria |
| Correction | Resolves the detected nonconformity | A controlled amendment, completed assessment or documented product disposition tied to the affected item |
| Corrective action | Addresses an established cause to prevent recurrence | An implemented process change linked to the investigation and its supported cause |
| Implementation verification | Checks that you completed the action as specified | Approved revisions, deployment checks, completed training and functional checks where applicable |
| Effectiveness evaluation | Checks whether the action achieved its intended result | Results against predefined criteria using appropriate records, observations or process challenges |
Containment and correction can overlap, but they answer different questions. Blocking access to an obsolete checklist limits further use. It does not resolve incomplete release evidence for devices already processed with that checklist.
Likewise, a correction need not be temporary. Correcting an erroneous technical-documentation reference may permanently resolve that specific error. The separate question is whether your investigation identifies a cause requiring further action across the process.
Preventive action concerns potential nonconformities rather than recurrence of an existing one. Do not label a cause-directed action “preventive” simply because you intend it to prevent the same finding happening again.
What does the MDR support?
The MDR provides a basis for distinguishing actions and checking their effectiveness, rather than treating a document update as the whole response.
In the official reproduction of MDR Article 10 as adopted, paragraph 9(l) includes management of corrective and preventive actions and verification of their effectiveness within the manufacturer's quality management system. The adopted Annex VII, section 4.10, separately refers to corrections, corrective actions and, where applicable, preventive actions in the context of surveillance audits.
That surveillance provision does not mean every technical-review clarification automatically requires the same corrective and preventive action (CAPA) response. Read the finding, the requirement it identifies and the Notified Body's response instructions before deciding which fields apply. Annex VII section 4.7 also addresses the completeness and sufficiency of supporting documentation concerning resolution of nonconformities before the final decision.
These links reproduce the adopted text, rather than a verified current EU consolidation. Check the provisions applicable to your assessment and your Notified Body's requirements. The worksheets below are practical organising tools, not prescribed forms or a promise of acceptance.
Also keep the terminology in context. This article uses correction and corrective action as quality-system concepts. A finding affecting devices already on the market may require separate assessment of product safety, vigilance, withdrawal or recall obligations. An internal CAPA record does not replace those decisions.
Decide what the finding actually requires
A missing reference and a missing verification activity can look similar in a response tracker. They require very different work.
First, establish whether the evidence exists and applies to the device configuration under assessment. If the reviewer cannot locate an approved report that already supports the relevant requirement, you may need a clarification or reference correction. If the report does not exist, covers a different configuration or does not support the claimed result, better navigation will not resolve the evidence gap.
Next, check extent. A single error in the sampled document does not establish that the issue is isolated. Review other records exposed to the same preparation, transfer or approval process, and explain why you selected that scope. Conversely, do not invent a systemic failure simply to fill a corrective-action box.
Finally, connect the response to your QMS procedure and the assessment route. If your evaluation concludes that no separate corrective action is needed, retain the evidence and rationale for that decision. Where the Notified Body explicitly requests cause analysis or corrective action, clarify any disagreement rather than leaving the field blank or silently substituting a correction.
The two cases below start after the relevant checks or investigation. All identifiers, quantities and situations are illustrative. They do not describe a customer, an actual audit outcome or a Notified Body-approved response.
Case one fixes a reference without inventing missing evidence
An illustrative technical-review correction
A reviewer cannot locate the verification evidence cited in a technical-documentation matrix. The entry points to report VR-017, but the approved report is VR-071 revision 2. The verification lead confirms that VR-071 covers the configuration and requirement under review and that the report predates the submission.
In this illustrative case, the team checks all 18 verification references in the same matrix against the controlled source records. It finds no further mismatch. That check supports a bounded assessment, but it does not by itself prove that every document-control process is effective.
| Response field | Illustrative populated entry |
|---|---|
| Finding and stage | During technical-documentation review, the cited report cannot be located using the submitted matrix |
| Immediate assessment | Verification lead checks report identity, approval, configuration and requirement coverage before treating the issue as a reference error |
| Correction | Amend the matrix from VR-017 to VR-071 revision 2 and provide the report location and relevant section |
| Affected scope | Check all 18 references in the submitted matrix and record the source used to verify each one |
| Cause and decision reference | Assessment CR-04 records the reference transposition, the scope review and the rationale for proposing correction without a separate corrective action under the applicable QMS procedure |
| Controlled evidence | Matrix revision 4, amendment history, approved VR-071 revision 2 and the completed reference-check record |
| Implementation status | Correction recorded as complete only after approval and verification of the revised submission package |
| Effectiveness or follow-up | Confirm the corrected reference resolves to the appropriate approved evidence. Keep any separate review of the preparation process distinct from correction verification |
The weak response would be “Report added. Staff retrained.” It leaves the reviewer to determine whether the evidence existed, whether it applies and why training addresses anything.
A stronger illustrative response would say that the original matrix contained an incorrect identifier, identify the corrected entry and report section, and explain the 18-reference scope check. It would reference CR-04 for the action decision and state whether the revised package has actually been approved and submitted.
This is not a shortcut for every citation finding. If the scope check finds repeated mismatches, or the report does not cover the assessed configuration, the assumptions behind this response no longer hold. Reassess the cause, extent and necessary action instead of preserving the smaller response because it is easier to finish.
Case two separates affected records from the process failure
An illustrative QMS audit response
An audit identifies repeated use of an obsolete release checklist. The supported investigation conclusion is that a shared folder retained an editable copy after the controlled template changed, and the release workflow did not require confirmation of the template revision. This example takes that investigation as established input rather than teaching how to establish the cause.
The obsolete checklist omitted a recently introduced verification field. The missing field does not automatically prove that the verification never occurred. Equally, a later signature cannot establish that it occurred before release. You need to evaluate the underlying evidence and preserve the historical record.
| Response field | Illustrative populated entry |
|---|---|
| Finding and stage | A QMS audit identifies the obsolete checklist in three sampled release records |
| Containment | Restrict the obsolete editable copy and require an interim QA check of checklist revision before further release |
| Affected scope | Review all 24 release records created since the template change, including the three sampled records. Six used the obsolete version |
| Correction | Assess the six affected releases against the applicable requirements using contemporaneous evidence. Document gaps, risk assessment and disposition separately for each release, and complete any resulting correction or product action |
| Supported cause reference | Investigation INV-08 links continued use to the retained editable copy and the missing revision check in the release workflow |
| Corrective action | Remove uncontrolled template access points, establish a controlled retrieval route and introduce a revision check in the release workflow. Assign ownership for template withdrawal and train affected users in the changed process |
| Implementation evidence | Access-change record, controlled retrieval checks, revised release procedure, withdrawal responsibilities and training records, all linked to INV-08 |
| Implementation status | Process changes remain planned until deployed and checked. Affected-release assessment remains open until each disposition has supporting evidence |
| Effectiveness measure | Test whether ordinary users can still obtain the obsolete template through known working routes, and review subsequent release records for current revision use and completion of required checks |
| Review point | Set the review after representative use by each affected role and workflow. Retain interim controls until their removal criteria are met |
The correction stream resolves the detected nonconformities across the six affected releases, including any necessary product action. Assessment alone does not complete that work. The corrective action changes the mechanism that allowed obsolete forms to remain in use. Updating the six records alone would leave that mechanism intact.
Avoid replacing historical checklists with clean copies that imply the current form was used at the time. Add a traceable, dated assessment linked to the original record. Where evidence is missing, record the gap and decide what further action is necessary rather than recreating a result from memory.
A weak response would be “Updated checklist issued and everyone trained.” The stronger response identifies both action streams, links each to its evidence, and keeps outstanding dispositions visible. Training can support the new workflow, but it does not remove the uncontrolled file or introduce the missing revision check by itself.
Make the effectiveness check capable of finding failure
An effectiveness measure should test the failure mechanism you intended to change. “No further complaints” is a poor measure for an internal template-control failure if complaints would rarely reveal which checklist a release operator used.
For the second illustrative case, combine a challenge of the retrieval routes with observation of real release records. Check whether users can reach an obsolete editable template through bookmarks, local copies or shared folders identified during the investigation. Then check whether the changed workflow leads users to the current template and catches revision mismatches before release.
Define the acceptance criteria before reviewing the results. For this example, a proposed criterion could require all reviewed release records to use the current approved revision and contain the required verification evidence, with no obsolete template available through the tested working routes. Explain how the selected records represent the affected roles, workflows and opportunities for recurrence.
The number of records and the observation period need a rationale. A calendar month with no releases provides little evidence about a release process. A large sample from one operator may miss a route used by another. Neither a fixed “30 days” nor a standard “three batches” is automatically suitable.
Record the denominator as well as the result. “No recurrence” becomes more informative when you show which releases, roles and retrieval routes you checked. If the check fails, reassess the cause and action, maintain or adjust containment, and document the next decision. Do not lower the criterion after seeing an inconvenient result.
Keep completed work separate from future evidence
Your response should let the reader distinguish planned, implemented and effectiveness-verified actions without interpreting an optimistic summary.
For each action, identify its owner, controlled record, revision or evidence location, and current status. A useful evidence entry names what the record proves. “Release procedure revision 6 approved” proves approval of that procedure; it does not establish that every user follows it or that obsolete copies are inaccessible.
Where effectiveness evaluation will occur later, state the criterion, observation basis and planned review point. Do not report the action as effective merely because you completed implementation. Whether that staged evidence is sufficient for the current assessment milestone depends on the finding and the Notified Body's requirements.
Questions that come up when completing the response
Can one action be both a correction and a corrective action?
A change may contribute to both purposes. Describe each purpose and its evidence separately. Correcting an erroneous configuration value fixes that instance; a validated input control may also address the cause of similar errors. The shared implementation does not remove the need to explain both effects.
Does every finding need a full CAPA?
Do not decide from the label alone. Evaluate the requirement, significance, extent, cause and applicable procedure. A technical clarification may call for a precise evidence reference, while a recurring QMS failure calls for cause-directed action. Document the rationale and follow the Notified Body's response instructions.
Is training enough?
It can be appropriate when the supported cause concerns knowledge or competence and the training addresses it. Show how you assessed competence or changed performance. An attendance record alone cannot demonstrate that the person can perform the task, and training cannot substitute for fixing a defective workflow.
When can you call the response complete?
Use the relevant completion criteria for each action and assessment stage. Correction completion, corrective-action implementation, effectiveness verification and the Notified Body's finding-closure decision are distinct events. Keeping them separate makes the remaining work visible without understating what you have already done.
A useful response gives every action a clear purpose and every completion claim a traceable basis. If you cannot say what an attachment proves, improve the connection before adding more attachments.
