Root cause analysis and CAPA: a practical guide to strong actions

Root cause analysis finds causes; CAPA fixes them

Root cause analysis (RCA) finds the system reasons an event happened. An OSHA and EPA fact sheet calls a root cause a fundamental system reason that points to correctable failures. Fixing only the immediate cause removes a symptom, not the problem. See root cause analysis.

Corrective and preventive action (CAPA) is what you do with the findings. A corrective action removes the cause of this event. A preventive action stops the same weakness elsewhere. See corrective and preventive action.

CMS gives a surgery center example. Confusing emergency drug storage in one operating room is corrected in that room, and prevented by reviewing the others.

The patient safety field calls the process RCA2 (root cause analyses and actions), because analysis without action prevents nothing. The CAPA label comes from manufacturing. FDA's device rule is now the quality management system regulation, which incorporates ISO 13485.

The old section 820.100 is gone from the current eCFR. The logic carries over unchanged.

Match investigation depth to risk

Triage every event. A full team analysis of every near miss would collapse under its weight. A five-minute review of a serious event would miss the point.

A common triage tool is the VA National Center for Patient Safety's Safety Assessment Code matrix, reproduced in RCA2. It pairs severity with probability and returns 3 (highest risk), 2 or 1. It covers actual events and close calls.

Some analyses are required. The Joint Commission expects a comprehensive analysis of every sentinel event. For events reported to it, the analysis and action plan are due within 45 business days of the event or of becoming aware of it.

RCA2 recommends starting within 72 hours, using 4 to 6 people not involved in the event, and finishing in 30 to 45 days. OSHA's process safety standard requires covered employers to investigate any incident that did, or could reasonably have, caused a catastrophic release.

Start within 48 hours. A near miss can trigger this duty.

Use the simplest method that finds the cause

Combine methods for complex events. OSHA and EPA say their listed tools are ideally combined. Brainstorming and checklists may do for simple incidents. Complicated ones need logic trees backed by timelines and causal factor analysis.

OSHA and EPA build every analysis on four questions: what happened, how, why, and what needs correcting. See five whys vs fishbone vs fault tree.

Write causes that point to systems, not people

Write each cause as a chain: something led to something, which made the event more likely. RCA2 and the VA use five rules, adapted from an FAA study of maintenance errors.

Human error is not an acceptable root cause, says RCA2. If a well-trained person erred in a typical setting, system factors helped. Retraining one person does nothing for the next.

Define blameworthy events, such as deliberately unsafe acts, in advance and route them to HR, not RCA.

Stronger actions change the system, not memory

Rank every action by how little it relies on memory. Stronger actions change the system. Weaker ones ask people to try harder. The ranking comes from the VA National Center for Patient Safety (2001) and follows NIOSH's hierarchy of controls. See hierarchy of controls.

Two points surprise people. Double checks are weaker, because they rely on someone remembering to look. Training and policy are weaker too, though they are the most common fixes. RCA2 says they are often needed to set expectations but unlikely to be enough alone.

IHI's action hierarchy tool shows one case. A patient slid off a shower chair. The stronger action: a chair with secure straps. The intermediate action: find patients at risk of falling and add staff for showering. The weaker action: retrain staff.

Seven steps to a CAPA that works

1. Tie each action to one causeAn action that answers no stated cause is a good idea, not a corrective action.
2. Choose the strongest action you can doLog a weaker action as interim if the stronger one needs time or capital.
3. Name one owner and a dateRCA2 says assign a person, not a committee, with authority and resources.
4. Write the measure nowState what, who, target and date. Use a process measure (was it done) and, where possible, an outcome measure (did it work).
5. Get leadership approvalRCA2 recommends the CEO or another top leader approve or reject each action. Record why if rejected.
6. Pilot before rolloutCMS advises testing in one area first. Some changes have unintended effects.
7. Extend the fixAsk where else the weakness exists: other rooms, units, shifts, sites. That is the preventive half of CAPA.

The Joint Commission says an acceptable plan names the responsible title, the start date including any pilot, how effectiveness will be evaluated and sustained, and when alternatives apply if targets are missed. The corrective action plan template and root cause analysis worksheet follow that structure.

Prove the action worked with two measures

An effectiveness check is a planned re-measure that shows the problem is smaller and stays smaller. Closing the task is not closing the loop. See effectiveness review.

RCA2 gives a worked pair for new hand-hygiene technology. Process measure: watch 100 staff-patient encounters over seven days, expecting 95 percent compliance. Outcome measure: a 20 percent drop in hospital-acquired infections spread by staff contact. Process data comes fast. Outcome data takes longer. Use both.

Sustainment matters as much as the first result. CMS tells surgery centers to keep collecting data after a fix. AAAHC's model says plan more than one re-measure and return to the cause if the goal is missed.

IncidentKit does not close a corrective action until it is verified.

Six signs of a weak analysis

RCA2 lists conditions that mean a review needs redoing. The Joint Commission reviews each sentinel event analysis for thoroughness, credibility and acceptability.

• No contributing factors, or factors with no supporting data.
• Individuals named as the cause, or causes that point to blame.
• No stronger or intermediate actions.
• Causal statements that break the five rules.
• No actions, or actions that miss the stated vulnerabilities.
• Follow-up assigned to a committee, not a person.

The Joint Commission also expects a credible analysis to be precise, complete, systematic, and deep and broad enough to cover systemic factors. It should include a process owner, a patient or family member when fitting, and people close to the process.

A sentinel event alone does not affect the accreditation decision. Willful failure to respond appropriately could.

Industrial and OSHA context

The same logic works on the plant floor. In OSHA and EPA's example, a worker slips on oil. A traditional investigation says oil was spilled, cleans it up and tells the worker to be careful.

Root cause analysis asks why the oil was there, where it came from, why it stayed, and whether anyone reported it. It may find a missing mechanical integrity program, a system cause.

OSHA's process safety standard (29 CFR 1910.119(m)) also requires covered employers to:

• Use a team that includes someone who knows the process.
• Report the date, description, contributing factors and recommendations.
• Resolve and document findings, and review them with affected staff.
• Keep the report for five years.

See process safety incident investigation. NIOSH's hierarchy of controls runs from elimination and substitution through engineering and administrative controls to personal protective equipment. RCA2 modeled its action hierarchy on it, so safety and risk managers can share the same logic.

How IncidentKit supports RCA and CAPA

Lauren drafts the investigation from what reporters and others said, with a timeline and a first pass at contributing factors and five whys. Every drafted field shows "Lauren · draft" until a person reviews, edits and signs. The team decides the root cause.

Human-authored RCA templates are rolling out.

Investigations hold contributing factors, five whys and the disposition. Corrective actions carry an owner, due date, evidence and effectiveness check, and nothing closes until verified. See the root cause analysis and close corrective actions use cases.

Frequently asked questions

Sources

• IHI and NPSF, RCA2: Improving Root Cause Analyses and Actions to Prevent Harm (full report)
• IHI, Patient Safety Essentials Toolkit: Action Hierarchy Tool
• Joint Commission, Sentinel Event Policy (SE chapter, CAMH Update 1, July 2026)
• Joint Commission, National Performance Goals effective January 2026, Hospital Program (NPG.02.03.01)
• CMS, QAPI at a Glance (Steps 11 and 12)
• CMS State Operations Manual, Appendix L: Ambulatory Surgical Centers
• OSHA and EPA, The Importance of Root Cause Analysis During Incident Investigation (fact sheet)
• 29 CFR 1910.119, Process safety management of highly hazardous chemicals (eCFR)
• CDC NIOSH, Hierarchy of Controls
• 21 CFR 820.10, Requirements for a quality management system (eCFR)
• AAAHC, Documenting a Quality Improvement Study Using the Six-Component Criteria

Reviewed against the sources above on Oct 5, 2026. Rules change: confirm current requirements with the issuing body or your counsel before relying on any summary.