This is a ready-to-use CAPA triage risk assessment worksheet. It operationalizes the severity x recurrence decision into numeric scores so two reviewers looking at the same event reach the same gate, and so the rationale is on the record rather than in someone’s head. Replace every <<FILL: ...>> placeholder with your own specifics. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Document title | CAPA Triage Risk Assessment Worksheet |
| Document number | <<FILL: RA-ID, e.g. RA-QA-031>> |
| Version | <<FILL: version, e.g. 1.0>> |
| Effective date | <<FILL: effective date>> |
| Document owner | <<FILL: role, e.g. Head of Quality Assurance>> |
| Applies to | <<FILL: sites / departments in scope>> |
| Governing SOP | <<FILL: SOP-ID for CAPA management>> |
1. Purpose
This worksheet scores a candidate quality event on two axes, potential impact and likelihood of recurrence, and converts the score into a triage decision: no CAPA, trend and reassess, standard-timeline CAPA, or expedited CAPA with immediate containment. It exists because an unscored, purely qualitative triage call ages badly: two reviewers drift apart over time with no record of why, and a quality system that cannot explain its own triage decisions looks arbitrary to an inspector.
2. Scope
This worksheet applies to any quality event that could plausibly warrant a CAPA: a deviation, an OOS or OOT result, an internal or external audit finding, a complaint, a supplier nonconformance, a trend identified at management review, or a regulatory observation. It is completed once triage is needed, referenced from the source record, and attached to the CAPA record if a CAPA is opened.
3. Responsibilities
| Role | Responsibility |
|---|---|
| Initiator / quality reviewer | Completes the worksheet at the time the event is identified as a triage candidate |
| Subject matter expert | Provides input on the technical severity and the process history behind the recurrence score |
| Quality Assurance | Reviews and approves the score and the resulting triage decision; escalates disagreements |
| Quality head | Reviewed for any event scoring in the highest risk band |
4. Methodology
Score the event on two independent scales, potential impact and likelihood of recurrence, each 1 to 4. Multiply the two scores to get a risk number from 1 to 16. The risk number maps to a triage gate in section 6. This is a quality risk management tool in the sense of ICH Q9: it makes the triage decision proportionate to risk rather than uniform across every event, and it documents the basis for that decision. It supplements, and does not replace, the qualitative judgment described in the CAPA management procedure.
5. Scoring scales
5.1 Potential impact
| Score | Level | Definition | Example |
|---|---|---|---|
| 1 | Negligible | No effect on any product quality attribute, no patient or animal contact, an internal process or administrative matter only | A formatting inconsistency in a non-GxP working log |
| 2 | Minor | A contained non-conformance with no effect on released product; caught and corrected before the affected material or data was used for a decision | An in-process check performed slightly outside its routine timing window, with the result confirmed unaffected |
| 3 | Major | Potential effect on a critical quality attribute, on data used for a release decision, or a data integrity gap affecting the reconstructability of a GxP record; product may already be in distribution | An OOS result later invalidated for an assignable cause, where the original investigation did not fully review supporting data |
| 4 | Critical | Confirmed or credible effect on patient or animal safety, on product identity, strength, purity, or sterility, or a systemic control failure affecting multiple batches or products already in distribution | A confirmed sterility assurance breach, a mislabeling event, or a confirmed cross-contamination |
5.2 Likelihood of recurrence
| Score | Level | Definition | Example |
|---|---|---|---|
| 1 | Isolated | A single occurrence with a cause specific to this instance (one operator, one lot, one date); no similar event in the trending period reviewed | A single transcription error traced to one analyst on one day, with no similar finding in the prior <<FILL: 12>> months |
| 2 | Occasional | A similar root cause type has appeared once before in the trending period, but not on a repeating pattern | The same instrument had a comparable calibration lapse once in the prior year |
| 3 | Frequent | The same root cause type has appeared <<FILL: 3 or more>> times in the trending period, or the cause is shared across multiple similar systems or processes | The same audit trail configuration gap found on three of twelve chromatography systems |
| 4 | Systemic | The root cause is embedded in a shared procedure, system configuration, training program, or design used across multiple sites, products, or processes; left unaddressed it will keep recurring by design | A change control SOP gap that affects every computerized system that goes through the same change process |
6. Risk grid and triage gate
| Impact \ Recurrence | 1 Isolated | 2 Occasional | 3 Frequent | 4 Systemic |
|---|---|---|---|---|
| 1 Negligible | 1 | 2 | 3 | 4 |
| 2 Minor | 2 | 4 | 6 | 8 |
| 3 Major | 3 | 6 | 9 | 12 |
| 4 Critical | 4 | 8 | 12 | 16 |
| Risk number | Triage gate |
|---|---|
| 1 to 3 | No CAPA required. Resolve in the source record with documented corrective action; record the no-CAPA rationale on this worksheet. |
| 4 to 6 | Trend it. Open a CAPA if the trend confirms a pattern, or if this single event is a major, isolated occurrence, open a standard-timeline CAPA. |
| 8 to 9 | Open a CAPA with an expedited timeline. |
| 12 to 16 | Open a CAPA with an expedited timeline, immediate containment, and escalation per <<FILL: escalation policy reference>>. |
Override rule: any event scoring Critical (4) on the impact scale requires immediate containment regardless of the computed risk number, before triage scoring is finished. Containment is never gated behind completing this worksheet.
7. Mitigations and containment
| Field | Entry |
|---|---|
| Immediate containment taken (if any) | <<FILL>> |
| Containment owner and date | <<FILL>> |
| Affected scope (boundary of “affected”) | <<FILL: one instrument / whole lab; one batch / all since last known-good>> |
8. Residual risk and approval
| Field | Entry |
|---|---|
| Impact score (1 to 4) | <<FILL>> |
| Recurrence score (1 to 4) | <<FILL>> |
| Risk number (impact x recurrence) | <<FILL>> |
| Triage gate reached | <<FILL: no CAPA / trend / standard CAPA / expedited CAPA>> |
| Rationale (required if the gate departs from the table, in either direction) | <<FILL>> |
| Completed by (name, role, date) | <<FILL>> |
| QA approval (name, signature, date) | <<FILL>> |
References
ICH Q9, Quality Risk Management (risk-based triage). ICH Q10, Pharmaceutical Quality System (CAPA as a core element). 21 CFR 211.192 (investigation of discrepancies and failures, drugs). 21 CFR 820.100 (corrective and preventive action, devices; for devices now read through the Quality Management System Regulation incorporating ISO 13485:2016). EudraLex Volume 4, Chapter 1, clause 1.4(xiv), and Chapter 8, clauses 8.16 to 8.19 (root cause analysis and CAPA).
Confirm the current version and clause numbers of each reference before issue.
Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author | <<FILL>> | ||
| Reviewer (QA) | <<FILL>> | ||
| Approver (Quality Head) | <<FILL>> |
Filled specimen
The following shows the worksheet completed for an example internal audit finding, so you can see the level of detail an inspector expects. The company, system, and numbers are illustrative; replace them with your own.
| Field | Entry |
|---|---|
| Event | Internal audit finding IA-2026-09: audit trail disabled on chromatography instrument LC-04 for sequence integration events, 47 sequences affected |
| Impact score | 3, Major (31 of 47 sequences supported released batches; risk to data reconstructability, no confirmed OOS) |
| Recurrence score | 4, Systemic (root cause is a change control SOP gap shared by all 12 computerized lab systems) |
| Risk number | 3 x 4 = 12 |
| Triage gate reached | Expedited CAPA with immediate containment and escalation |
| Rationale | Score sits at the top of the grid; matches the standard gate, no departure |
| Containment | LC-04 taken out of GMP service same day; data review of the 47 sequences initiated |
| Completed by | A. Patel, QA Auditor, 18 June 2026 |
| QA approval | R. Gomez, 18 June 2026 |
This is the same event used as the worked example in the CAPA article and the CAPA management SOP. Scoring it here shows how the numeric grid reproduces the qualitative call the article walks through by hand, with the arithmetic on the record.
Common inspection findings this worksheet prevents
- Triage decisions that cannot be reconstructed: an event was handled without a CAPA and no one can explain why, months later.
- Two similar events triaged differently with no documented reason, suggesting an inconsistent or favor-driven process.
- Containment delayed while a full triage discussion happens, rather than acting immediately on an obviously critical event.
- A “systemic” root cause scored and triaged as if it were isolated, understating the real risk.
- No record of the recurrence trending review that should have driven a higher score.
How to adapt this worksheet
- Set your document number, owner, and effective date in the header.
- Set the trending window and the “frequent” threshold in section 5.2 to match your own deviation and CAPA volume; a low-volume site may set a shorter window or a lower count.
- Adjust the risk-number bands in section 6 if your quality risk management procedure uses different cut points, but keep the override rule for critical impact events.
- Point the escalation reference in section 6 to your actual escalation policy or procedure.
- If you run CAPA in an electronic quality management system, build this scoring grid as a guided form so the risk number calculates automatically and cannot be typed in freehand.