What Level 2 CAPA Maturity Looks Like in Medical Device Organizations

The Plateau Nobody Talks About

You have the procedure. You have the tracking system. Your CAPAs close on time. So why did the same contamination issue generate three separate CAPAs in eighteen months?

This is the defining question of Level 2 CAPA maturity. The organization has done the hard work of building infrastructure — SOP published, eQMS module configured, root cause analysis training delivered, management review slide deck created — and the results have not followed. CAPAs open. CAPAs close. The metrics look reasonable. And the same categories of problems cycle back through the system on a cadence that nobody tracks because recurrence rate is not a metric anyone has thought to measure.

Level 2 is the most populated maturity level in medical device quality systems. It is where organizations land after their first serious investment in CAPA capability, and it is where many stay for years because the surface indicators suggest the system is working. The plateau is invisible from inside.

The Difference Between Having a CAPA Process and Having It Work

The distinction is analytical depth. Level 2 has the tools. It does not have the rigor to use them well.

A 5 Whys analysis in a Level 2 organization typically stops at the second or third why — the precise point where the investigation would need to shift from describing the proximate event to questioning the system that allowed it. Why did the operator deviate from the procedure? Because the procedure was unclear. Why was the procedure unclear? The investigation stops. The corrective action is "revise the procedure for clarity." The underlying question — why unclear procedures survive validation and training cycles, whether the procedure development process itself has a gap — remains unexamined.

Fishbone diagrams are completed because the SOP requires a root cause tool. But the team populates one or two branches, selects the most accessible cause, and moves to corrective action. The diagram exists in the file. The analysis it was designed to produce does not.

Cross-functional participation is the most consequential gap. CAPAs are quality's problem. Manufacturing provides information when asked. Engineering reviews the corrective action if it touches design. Supply chain is rarely involved even when the root cause traces to incoming material. The investigation team is one person — the assigned quality engineer — and that person's perspective determines the depth and direction of the entire analysis.

Level 2 Tells: What a Two-Day Site Visit Reveals

An experienced assessor can identify Level 2 CAPA maturity within hours. Five observable signals appear consistently.

First, root cause statements cluster around three to four categories. "Inadequate procedure," "training deficiency," "human error," and "equipment malfunction" dominate the population. This clustering does not reflect reality — it reflects the limited analytical vocabulary of a system that defaults to familiar explanations.

Second, corrective actions and preventive actions are functionally identical. The corrective action addresses the specific product or process. The "preventive action" extends the same fix to analogous products or processes. True prevention — identifying and eliminating conditions that have not yet produced a failure — does not exist.

Third, effectiveness checks verify implementation, not effectiveness. The check confirms that the procedure was revised, that training was completed, that the equipment was repaired. It does not confirm that the problem stopped recurring. The distinction between "we did the thing" and "the thing worked" is the sharpest diagnostic boundary between Level 2 and Level 3.

Fourth, CAPA metrics in management review focus on volume and timeliness. How many opened, how many closed, how many overdue, average days to closure. These are activity metrics. They tell leadership how busy the CAPA system is, not whether it is accomplishing anything.

Fifth, there is no formal investigation quality review. CAPAs are approved through a workflow that checks procedural compliance — required fields completed, required signatures obtained, timeline met — without evaluating whether the root cause analysis is logically sound. The approval process certifies format, not substance.

Why the Plateau Persists

Level 2 persists because it is comfortable. The system satisfies routine surveillance audits. Management review has CAPA data to discuss. The quality team has a workflow to follow. Nobody is failing — the process runs, CAPAs close, metrics exist.

The discomfort arrives with a CAPA subsystem audit under FDA's QSIT methodology, when the investigator samples closed CAPAs and traces the logic from problem statement to root cause to corrective action to effectiveness verification. At Level 2, that logic chain frays under scrutiny. The root cause does not fully explain the failure. The corrective action addresses a symptom rather than a cause. The effectiveness check confirms activity rather than outcome.

The discomfort also arrives internally when a quality leader finally asks: how many of our closed CAPAs addressed problems that came back? At Level 2, no one knows the answer because recurrence is not measured. When someone does the manual analysis, the number is almost always higher than expected. Twenty to thirty percent recurrence rates are common at Level 2 — meaning one in four or five CAPAs accomplished nothing lasting.

Breaking Through to Level 3

The transition from Level 2 to Level 3 requires two structural changes and one cultural shift.

The first structural change is investigation quality review. Before any CAPA proceeds to effectiveness verification, an experienced reviewer evaluates whether the root cause is logically supported by evidence, whether the corrective action specifically addresses that root cause, and whether the effectiveness check will genuinely detect recurrence. This single intervention — one person, applied consistently — raises analytical quality across the entire CAPA population within two quarters.

The second structural change is recurrence measurement. Define recurrence operationally: same failure mode, same process area, within twelve months of CAPA closure. Report it in every management review. When leadership sees that a quarter of closed CAPAs recur, the conversation shifts from throughput to effectiveness. That shift changes investment decisions.

The cultural shift is harder to mandate. It requires the organization to accept that a CAPA taking longer because the investigation went deeper is better than a CAPA closing on time with a shallow root cause. Speed and depth are in tension at Level 2, and every incentive — closure rate targets, backlog pressure, resource constraints — favors speed. Breaking the plateau means changing which outcome the organization rewards.

Take the CAPA maturity assessment to see where your structural and analytical capabilities diverge — and build a targeted plan to close the gap.