Most CAPAs are closed. Far fewer are proven effective. That single gap - between an action that is marked complete in a tracker and an action that has demonstrably eliminated a hazard - is where the majority of repeat incidents in oil, gas, and chemical operations originate.
Walk into any major-hazard facility on the morning after an audit and you will find the same artefact on a manager's screen: a CAPA register with a healthy green bar. Closure rates of 92, 95, even 98 percent. The numbers look like operational discipline. They are usually something else: a record of administrative compliance. Closure dates were met. Sign-offs were obtained. The spreadsheet was tidied. Whether the original hazard scenario can recur - that question is rarely answered with evidence.
The U.S. Chemical Safety Board has documented this pattern repeatedly. Its investigations into BP Texas City (2005), Tesoro Anacortes (2010), and Chevron Richmond (2012) each identified prior incidents, prior near misses, and prior recommendations that had been formally closed in the years before the catastrophic event. The corrective actions existed. They had been signed off. They had not changed the underlying conditions.
The cost of that gap is not theoretical. OSHA's Process Safety Management standard, 29 CFR 1910.119, requires employers to address and resolve PHA findings and incident investigation recommendations, with documentation retained for the life of the process. ISO 45001 Clause 10.2 requires not only that corrective actions be taken, but that their effectiveness be reviewed. API RP 754 sets process safety performance metrics that depend on the integrity of incident learning. None of these standards accept a closure date as proof of effectiveness.
This article is for HSE professionals and process safety engineers who already know what a CAPA is, who already run an RCA process, and who suspect - correctly - that their CAPA system is closing more tickets than it is closing risks. It introduces a single operating concept, the CAPA Effectiveness Loop, and walks through the five failure modes that quietly defeat most CAPA programs long before an auditor or an investigator arrives.
What CAPA Management Actually Means in Practice
A CAPA - Corrective Action and Preventive Action - is the documented response to a deviation. The deviation may be an incident, a near miss, a PHA finding, an audit observation, an MOC review outcome, or a regulatory inspection item. The corrective component addresses what already happened. The preventive component addresses how the same scenario, or a related scenario, will be prevented in future operations.
In practice, CAPA management in a regulated process facility involves four operational layers running in parallel: incident and near-miss capture under OSHA 1910.119(m) and equivalent jurisdictional rules; root cause analysis using a defensible method such as TapRooT, Apollo, or 5-Whys with causal factor mapping; assignment of actions to accountable owners with realistic, scenario-specific due dates; and - the layer most programs underbuild - verification that the action, once implemented, actually reduced the relevant risk.
That fourth layer is where corrective action becomes preventive action. Without it, a CAPA program is a logging exercise. With it, the program becomes a feedback mechanism into the facility's risk register, its operating procedures, its MOC discipline, and its SIMOPS planning. The difference shows up not in the closure rate but in the recurrence rate.
Why Most CAPAs Are Closed - Not Proven Effective
There is a structural reason CAPA closure is over-reported and effectiveness is under-measured. Closure is administratively cheap. Effectiveness is operationally expensive.
Closing a CAPA requires a date, a comment, and a signature. Proving effectiveness requires a defined success criterion set at the point of assignment, a verification method (observation, audit, leading-indicator data, performance test), a verifier independent of the action owner, and time - usually one to two operating cycles - for the corrective change to be exposed to real production conditions. Most CAPA registers cannot describe what 'effective' would look like for a given action, let alone whether that condition has been met.
Consider a routine scenario. A contractor working on a flare knockout drum receives a near-miss report for opening a line without confirming isolation. The RCA identifies a procedural ambiguity. A CAPA is raised: 'Revise LOTO procedure SOP-IS-014 to include flare-system clarification.' Sixty days later the SOP is reissued. The CAPA is closed. The closure rate ticks up by one. Nothing in the system confirms that contractors at the site actually saw the revised SOP, were trained on the change, or have since worked through a flare isolation without recurrence of the original behaviour. Six months later a similar event occurs on a different unit. The investigation team discovers the previous CAPA. They also discover that effectiveness was never verified.
HSE UK's investigation into the 2005 Buncefield explosion made the same observation at a strategic level: the recommendations from prior incidents existed in the records of the operators involved. The mechanisms to verify that those recommendations had taken hold in day-to-day operations did not.
The Five Most Common CAPA Failures
Across operational audits and CSB case studies, the failures cluster into five recurring patterns. Each is recognisable. Each is fixable. None is fixed by a better spreadsheet.
1. The action does not address the root cause
A CAPA assigned to 'retrain operator' when the RCA identified a defective interlock is not a corrective action. It is a deflection. Retraining is the most over-assigned CAPA category in process industries because it is fast, cheap, and visible. It is also the category with the lowest verified effectiveness in CCPS reviews of incident investigations.
2. There is no defined effectiveness criterion
If the CAPA does not specify what success looks like - a measurable change in leading indicators, a passed audit, a confirmed procedural compliance rate, a successful performance test of a safety-critical element - then 'closed' will eventually be the only evidence available. Effectiveness criteria must be written at assignment, not retrofitted at closure.
3. Ownership is institutional, not personal
CAPAs assigned to 'Operations' or 'HSE Department' rather than a named accountable individual drift. They are everyone's responsibility and therefore no one's. Mature CAPA programs assign a single named owner, a single named verifier, and a single named approver. The three roles are never combined.
4. The action is closed before the operating cycle has tested it
A procedural change implemented during a turnaround cannot be verified effective until the unit has returned to normal production and the procedure has been used in anger. A hardware change on a safety-critical instrument cannot be verified effective until the proof-test cycle defined by IEC 61511 has been completed. Closing CAPAs to meet a quarterly KPI deadline destroys the very feedback the system is supposed to generate.
5. Recurrence is invisible across sites
Multi-site operators frequently close the same CAPA at three different facilities for the same underlying hazard scenario, each handled as a local event. Without cross-site visibility, a recurring failure mode looks like three isolated incidents. This is the single most consequential failure in portfolio-scale operations and the one that auditors under API RP 754 and ISO 45001 increasingly probe.
What Verified CAPA Closure Looks Like
Verified closure is not a higher standard of bureaucracy. It is a different artefact. A verified-closed CAPA has six attributes that an administratively closed CAPA does not.
- A causal link to a specific finding from a defensible RCA, traceable to the original incident or near-miss record.
- An action description that names a change to a barrier, a procedure, a safety-critical element, or a competency - not 'review' or 'remind' language.
- An effectiveness criterion written at assignment, expressed as something observable or measurable within a defined operating window.
- Evidence of implementation: redlined procedure, updated drawing, signed training matrix, test record, MOC reference, photograph.
- Evidence of effectiveness: a leading-indicator trend, an audit pass, a successful proof test, a documented absence of the original deviation across a defined exposure period.
- A risk register update reflecting the residual risk after the action, including any new hazards introduced by the change itself.
An auditor requests all CAPAs from contractor incidents in the last 12 months, filtered by those that resulted in procedural changes, sorted by effectiveness verification status. A mature CAPA system answers that request in minutes. A spreadsheet-based system answers it in days, and then incompletely. The difference is not software preference. It is whether the organisation can demonstrate, under regulatory scrutiny, that it learns from its incidents.
The CAPA Effectiveness Loop
The CAPA Effectiveness Loop is a closed-loop operating model for corrective and preventive action in major-hazard facilities. It is not a workflow diagram and it is not a maturity model. It is the minimum set of linkages that must exist for a CAPA program to convert incidents into reduced future risk rather than into closed tickets.
The loop has six stages. Each one is operational, not conceptual - each carries a named artefact that must exist before the stage is complete and the next stage can begin. The output of Stage 06 feeds Stage 01.
STAGE 01 Incident / Near Miss Timestamped record captured under the facility reporting standard - no discretionary filtering. |
| STAGE 02 Root Cause Analysis Defensible method applied (TapRooT, Apollo, 5-Whys with causal mapping); causal factor chart retained. |
| STAGE 03 CAPA Assigned Named owner, named verifier, written effectiveness criterion, due date tied to the operating cycle. |
|
|
|
|
|
STAGE 04 Evidence Captured Implementation artefacts on record: redlined procedure, drawing, training matrix, test record, MOC reference. |
| STAGE 05 Effectiveness Verified Independent verifier confirms the criterion has been met under real operating conditions, not on paper. |
| STAGE 06 Risk Register Updated Residual risk re-scored; any new hazards introduced by the change are documented and owned. |
↻ Stage 06 feeds Stage 01. Each new incident enters a system that has already absorbed the last one - that is what makes the loop a loop, not a queue.
Each stage carries a non-negotiable artefact, shown above. When all six artefacts exist and the linkages between them hold, the program produces something a tracker cannot: a defensible chain of evidence from a single near-miss report to a measurable reduction in the facility's risk profile. When any one linkage breaks - and the most common break is between Stage 04 and Stage 05, evidence and verification - the loop becomes a queue, and the queue becomes a closure-rate metric.
This is one of the operational principles behind SOAPBOX.CLOUD™.
How Connected Systems Improve CAPA Performance
The CAPA Effectiveness Loop fails when its stages live in separate systems. Incidents are recorded in one tool, RCAs in a second, CAPAs in a third, evidence in a shared drive, verification in an email thread, and the risk register in a controlled Excel workbook on a different server. Each handoff is a place where ownership, context, and effectiveness criteria are lost in translation. The loop is not actually closed; it is reassembled by a coordinator on request.
Connected systems address this by making the linkages structural rather than procedural. An incident record carries its RCA, its CAPAs, its evidence, its verification status, and its risk register impact as one object, accessible across sites and roles. A contractor incident raised at a remote terminal can be linked, in real time, to a similar incident raised six months earlier at a different terminal - turning two isolated near misses into a recognised recurring failure mode before the third one becomes a recordable injury.
This is the operational difference that mature CAPA programs depend on. It is also what makes PSM CAPA requirements under 1910.119(m) and ISO 45001 Clause 10.2 demonstrable to an auditor without a two-week scramble. The same architecture allows facility leadership to answer leading-indicator questions - How many CAPAs from contractor incidents in the last 12 months remain unverified? Which units have the highest ratio of repeat findings? - without commissioning a special report.
Related reading
One Question Your CAPA System Should Be Able to Answer
Every CAPA program eventually meets the same diagnostic moment. An auditor, an inspector, a regulator, or - in the worst case - an investigator after a serious incident asks a question that requires the loop to have been closed across the entire portfolio, not just at the site of the day.
That question, in some variant, is this:
“Can you instantly show all CAPAs linked to recurring incidents - across every site?”
A spreadsheet cannot answer that question. Not because spreadsheets are deficient, but because they have no concept of a recurring incident across sites, no enforced linkage between an RCA and its downstream CAPAs, no structural memory of which actions were verified effective and which were merely closed. The data is present in fragments. The relationships are held in someone's head, or in a coordinator's monthly report, or - too often - in an auditor's eventual finding.
Closure rates are the lagging metric of a CAPA program. Verified effectiveness is the leading metric. The organisations that prevent recurrence are the ones that have built the difference between those two metrics into how their systems work, not into how their coordinators report.
SOAPBOX.CLOUD™ is live.
Enroll for Early Adopter Program.
