Complaint and CAPA automation for MedTech that fixes what is in the queue before making the queue move faster.
The CAPA process is usually the only mechanism in a quality system with real authority: a record, an owner, a due date and visibility at management review. So everything ends up in it. A single-unit correction that fixed itself. An audit observation. A customer who wanted to see something formal. A problem somebody wanted tracked and could not track anywhere else. None of these is a corrective action addressing a systemic cause, and each consumes the same process, the same approvals and the same attention as the ones that are. The backlog grows, closure rate becomes the metric everybody manages, and the genuinely systemic problems queue behind administrative work.
Automating that queue makes misrouted work move faster. Fixing what enters it is where the time actually is.
Two things are wrong before any workflow runs. The first is composition: the CAPA queue contains a mixture of systemic problems, individual corrections, administrative commitments and things routed there because no other process would hold them. Quality systems distinguish between a correction and a corrective action, and most organizations apply that distinction loosely, because routing something to CAPA is safe and routing it elsewhere requires a defensible judgement that somebody has to make and own. Over several years the safe choice becomes the default and the queue becomes a mixture nobody can prioritise within.
The second is the clock. Every CAPA and complaint metric starts at record creation, which is when the organization found out, not when the event happened. A complaint that reached a distributor in March, a regional office in April and the quality system in May shows a cycle time measured from May, and the two months before that are invisible in every report. Teams then work hard on the visible part, compressing the investigation while intake latency sits unmeasured and frequently larger than everything downstream of it.
Everything routes to CAPA because CAPA has authority
It is the only process with an owner, a date and management visibility, so it absorbs work it was not designed for.
Intake latency is invisible
Metrics start at record creation, so the delay before the organization knew is excluded from every figure.
Most elapsed time is queue time
Records wait for an approver, a reviewer or a meeting far longer than anybody works on them.
The same investigation runs more than once
Nobody can find the previous occurrences, so each one starts from an empty page.
Evidence is assembled by hand every time
Device history, service records, lot data and prior complaints are collected manually for each investigation.
Closure is the measured outcome
So the process optimises for closing records rather than for the problem stopping.
The order reflects where the time actually goes. Triage decides what enters the process at all. Evidence assembly is the largest manual cost inside it. Workflow automation is the visible part and the smallest of the three, which is why it is usually the only one scoped.
Step 1
Classify the existing queue
Step 2
Define triage with your quality function
Step 3
Measure the real clock
Step 4
Map cycle time by stage
Step 5
Connect the systems that already hold the answer
Step 6
Automate evidence assembly
Step 7
Structure intake and classification
Step 8
Automate the routing, not the judgement
Step 9
Instrument recurrence
Step 10
Validate proportionate to risk
A large share of complaint and CAPA effort is finding things, chasing people and assembling records. That work automates cleanly and carries no regulatory argument. What sits on top of it is judgement, and the capability list below is organised around that line because the line is where both the value and the risk are.
Intake and triage
Multi-channel intake from support, service, distributors, portals, email and connected products, normalised on entry
Automated classification of free-text narrative, with the confidence exposed and low-confidence items routed to a person
Duplicate and related-event detection at the point of entry, before two investigations start on one problem
Triage support against your criteria, proposing the route and recording why, with the decision owned by a qualified person
Intake latency measurement from event date, which usually requires capturing a field nobody captures today
Reportability screening support, surfacing the criteria and the evidence for the determination your regulatory function makes
Investigation and root cause
Automated evidence assembly before a human opens the record: device history, lot, supplier, service records, prior complaints
Similarity search across historical investigations, so a recurring problem is recognised as one
Field service and returns integration, so what the technician already concluded reaches the investigator
Structured root cause support, including prompts for the layer beneath the first fixable cause
Timeline reconstruction across systems, assembled automatically rather than compiled by hand
Connected product data where it exists, so device behaviour before the event is available to the investigation
CAPA, effectiveness and analytics
CAPA workflow with risk-proportionate paths, so a low-risk item does not follow the heaviest route by default
Action tracking across the functions that own implementation, which is usually not quality
Effectiveness criteria captured at approval rather than invented at closure
Recurrence monitoring across records, which is the measure that shows whether the action worked
Cycle time analytics by stage, separating worked time from queue time, including in Power BI where that is your environment
Validation of the workflows we build, scoped with your quality function and with regression testing automated
The workflow looks similar everywhere and the bottleneck is not. The third column is where the time goes, which is where the automation should start rather than at the front of the process.
| Organization type | Intake character | Where the time goes |
|---|---|---|
| Direct-sales manufacturer | Complaints arrive through service and support | Evidence assembly, since the answer is in service records nobody connected |
| Distributor-led manufacturer | Complaints arrive through partners, in batches | Intake latency, which is frequently larger than everything downstream |
| SaMD company | Support tickets, defect reports, app feedback | Triage, because the volume is high and most of it is not a complaint |
| Digital health platform | User contacts, clinician escalations, support | Deciding what counts as a complaint at all, which is often undefined |
| Connected device manufacturer | Complaints plus device-reported events | Reconciling what the device says against what the user reported |
The eQMS should remain the system of record for complaints and CAPAs, and it is rarely where the effort goes. The effort goes into finding information held elsewhere, and that is where automation belongs: an orchestration and evidence layer around the eQMS rather than a replacement for it.
| System | What it contributes to an investigation | Why it is usually absent |
|---|---|---|
| Field service | What the technician found and did, with the diagnosis | Different system, different function, handoff is a free-text field |
| Returns and repair | Confirmed failure mode with the unit examined | Arrives weeks later and after the record was already written |
| CRM and support | First contact, the customer account and the history | Commercially owned, and complaint-relevant content is unstructured |
| ERP and manufacturing | Lot, supplier, build date, process data at the time | Joined by part number, which rarely matches the complaint record |
| PLM | Design records, risk controls, specification at that revision | Revision at time of manufacture is hard to reconstruct |
| Connected product | Device behaviour before, during and after the event | Owned by engineering, and quality has usually never had access |
Automating complaint handling and CAPA raises a reasonable question from any quality function: if a system is doing more of this, who is answerable when it is wrong. The answer has to be that nothing about accountability moves. Every determination remains with a qualified person who owns it, and the automation is required to make that ownership more visible rather than less, by recording what was presented to the decision-maker, what the automated steps contributed and what the person concluded.
Frameworks the controls may need to support
- FDA QMSR and ISO 13485 as the frameworks the complaint and CAPA processes are configured against
- 21 CFR Part 11 for electronic records and signatures, where these records fall within scope
- EU MDR obligations, including the connection between complaint handling and post-market surveillance
- ISO 14971, so an investigation that reveals a new hazard reaches the risk file rather than only the CAPA record
Where automation touches a regulated step
- Automated classification recorded as a proposal with its confidence, never as the classification of record
- Triage decisions attributable to a person, with the criteria applied and the reasoning retained
- Extracted document values presented as candidates with the source linked, confirmed before entering the record
- Agent actions logged distinctly from human actions, so the audit trail shows who did what
- An audit trail treated as a record of change, not as evidence that an investigation was adequate or a root cause correct
Traceability
- Complaint traceable to the device, lot, design record, risk control and any resulting change
- Root cause traceable to the evidence supporting it, including evidence considered and set aside
- CAPA traceable to its implementation across the functions that carried it out, not only to its approval
- Effectiveness traceable to criteria set at approval and the measurement that tested them
Validation
- Workflow validation scoped with your quality function and proportionate to what each path does
- Validation of the classification and extraction models against human-reviewed samples, with performance monitored over time
- Regression testing automated, so improving a workflow later costs hours rather than weeks
- Periodic review of automated rules, since a rule that encodes an old process will quietly keep enforcing it
A complaint and CAPA system can be fast, well-governed, fully validated and still fail at the thing it exists for, which is stopping problems from happening again. The measures below exist to separate process performance from actual effect, because the first improves easily and the second is what the organization is paying for.
| Failure | How it presents |
|---|---|
| Closure rate improves and recurrence does not | The process got faster at closing records and no problem stopped |
| Root cause stops one layer short | The same cause reappears under new record numbers months later |
| Effectiveness criteria written at closure | The evidence satisfies criteria that were chosen to be satisfied |
| Classification drifts without notice | A model degrades, categories shift, and trends move with no process cause |
| Duplicate detection merges distinct events | Two different incidents become one record and one of them stops existing |
| Effectiveness criteria change after approval | The basis for judging success is altered without the control that approved it |
| A workflow update removes a required step | A configuration change quietly drops an approval nobody noticed was gone |
| A drafted summary omits contrary evidence | The narrative reads well and does not reflect what the records actually show |
| Triage tightens informally under load | The bar for opening a CAPA rises quietly when the backlog grows |
| Intake latency grows unobserved | A channel slows and nothing in the reporting reflects it |
| An agent action is indistinguishable from a human one | The audit trail cannot show who actually made a determination |
| Actions close before implementation lands | The CAPA record is closed on approval, not on the change being in place |
Complaint and CAPA programmes are reported as workflows digitized and cycle time reduced. The outcomes that matter are whether the right work is in the system, whether investigations start with what is already known, and whether the problems come back.
| Category | What we measure | Why it matters |
|---|---|---|
| Queue composition | Share of open records that are genuinely systemic corrective actions | Shows whether triage works, which no other measure reveals |
| Recurrence rate | Root causes reappearing after a CAPA closed as effective | The only honest test of whether the process achieves its purpose |
| Intake latency by channel | Event date to record creation, reported per route and partner | The part of the timeline nobody measures and nobody owns |
| Queue time share | Proportion of elapsed time spent waiting rather than being worked | Identifies the single approval step holding most of the delay |
| Evidence assembly time | Hours to gather what an investigation needs before work begins | The largest manual cost inside the process and the easiest to remove |
| Classification agreement | Automated classification against human review, trended | Detects model drift, which is a validated control failing silently |
| Implementation confirmation | CAPAs closed on evidence of implementation rather than on approval | An approved action nobody implemented is an open risk in a closed record |
We will classify what is actually in your queue, measure intake latency from event date rather than record date, separate queue time from worked time, connect the systems that already hold the answer, and automate the clerical work while leaving every determination exactly where it belongs.
CaliberFocus is a MedTech engineering partner delivering complaint and CAPA automation that fixes what enters the queue before making it move faster. From triage designed with your quality function and intake latency measured from the event date, to automated evidence assembly from service, manufacturing and product systems, recurrence tracking and governed AI agents, we take the clerical work out and leave every determination with a qualified person.
- Triage designed before any workflow is automated
- Evidence assembled automatically before an investigator opens the record
- Effectiveness criteria set at approval and recurrence tracked across records
- Every determination kept with your quality and regulatory functions
Security & Compliance
