Does ISO 9001 require a CAPA system?

ISO 9001:2015 does not use the term 'CAPA' but clause 10.2 ('Nonconformity and corrective action') sets equivalent requirements: react to the nonconformity, evaluate the need to eliminate the cause, implement action, review effectiveness, and retain documented information. Many organizations use the CAPA acronym to describe how they meet this clause.

What is the difference between corrective action and preventive action?

Per ISO 9000:2015 vocabulary, corrective action eliminates the cause of a detected nonconformity to prevent recurrence, while preventive action eliminates the cause of a potential nonconformity to prevent occurrence. ISO 9001:2015 reframed preventive action under the broader 'risk-based thinking' approach in clause 6.1, but FDA 21 CFR 820.100 still names both explicitly.

Are ticket-system audit trails enough for a regulated environment?

It depends on the regulation. For FDA-regulated electronic records, 21 CFR Part 11.10(e) requires secure, computer-generated, time-stamped audit trails covering operator entries and actions that create, modify, or delete records. A generic ticket log without immutable field-level history typically does not meet this. I cannot confirm conformance for any specific product without reviewing its validation documentation.

Why Complaints and Corrective Actions Need Traceability

An insight on why complaints and corrective actions need traceability from CodeCraft Enterprise.