Does every deviation need a CAPA?

Why

ICH Q10 says the effort, formality and documentation of an investigation should be commensurate with risk, in line with ICH Q9. EU GMP Chapter 1 asks for an appropriate level of root cause analysis, determined using risk management, and appropriate CAPAs in response to investigations. Neither says every deviation must spawn a CAPA.

Consider a balance printout that failed to print once, with the value captured electronically and no recurrence in two years. Correcting the record and documenting the assessment may be enough. Now consider the third printer failure this quarter on the same balance.

The single event is minor, but the trend is a signal that needs a CAPA. Some companies open a CAPA for everything, which floods the system and buries the serious items. Others close deviations with correction only and never notice patterns.

The workable approach is a documented rule: the deviation record decides, based on risk and recurrence, whether a CAPA is needed, and a trending review catches minor deviations that cluster. Whatever is decided, the rationale must be recorded, because an inspector will ask why a deviation did not lead to action. US regulation also requires that unexplained discrepancies be thoroughly investigated, so "no CAPA" never means "no investigation" when the cause is unknown.