ASTM D8229-19

Standard Guide for Corrective Action and Preventive Action (CAPA) for the Cannabis Industry

SIGNIFICANCE AND USE
3.1 The ability to identify and respond to opportunities before issues become systemic or are a risk to consumer health and safety is vital to maintaining compliance and achieving consumer expectations. The CAPA process is a systematic approach for documenting, identifying, and correcting existing and potential quality issues from various data sources. The CAPA subsystem analyzes and trends data inputs from quality systems and processes to identify if a quality issue is recurring, systemic in nature, or impacts consumer health and safety (see Fig. 1).
FIG. 1 CAPA Process versus CAPA Subsystem
SCOPE
1.1 This guide applies to all entities that cultivate, process, manufacture, test, and distribute cannabis products.  
1.2 This guide defines corrective action and preventive action (CAPA) and the significance of an effective CAPA process and CAPA subsystem.  
1.3 This guide defines instruction on the establishment of adequate processes and procedures for the identification, analysis, measurement, and correction of quality issues.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

General Information

• Status: Published
• Publication Date: 31-May-2019
• ICS: 11.120.99 - Other standards related to pharmaceutics
• ICS: 65.020.20 - Plant growing
• Technical Committee: D37 - Cannabis
• Drafting Committee: D37.02 - Quality Management Systems

Relations

• Referred By: ASTM D8308-21 - Standard Practice for Cannabis/Hemp Operation Compliance Audits
• Effective Date: 01-Jun-2019
• Referred By: ASTM D8403-21 - Standard Practice for Certificate Programs within the Cannabis and Hemp Industries
• Effective Date: 01-Jun-2019
• Referred By: ASTM D8477-22 - Standard Practice for Cannabis or Hemp Supplier Lifecycle Management
• Effective Date: 01-Jun-2019
• Referred By: ASTM D8346-21a - Standard Guide for Requirements for Quality Related Professions Within the Cannabis and Hemp Industries
• Effective Date: 01-Jun-2019
• Referred By: ASTM D8222-21a - Standard Guide for Establishing a Quality Management System (QMS) for Consumer Use of Cannabis/Hemp Products
• Effective Date: 01-Jun-2019
• Referred By: ASTM D8244-21a - Standard Guide for Analytical Laboratory Operations Supporting the Cannabis/Hemp Industry
• Effective Date: 01-Jun-2019

Overview

ASTM D8229-19: Standard Guide for Corrective Action and Preventive Action (CAPA) for the Cannabis Industry establishes guidelines for identifying, analyzing, and correcting existing or potential quality issues within cannabis operations. This international standard applies to all entities that cultivate, process, manufacture, test, or distribute cannabis products. The CAPA process outlined in ASTM D8229-19 is essential for maintaining regulatory compliance, ensuring consumer safety, and supporting quality management throughout the product lifecycle. By implementing systematic approaches for documenting and resolving quality issues, the cannabis industry can meet consumer expectations, reduce risk, and continuously improve operational effectiveness.

Key Topics

• Corrective and Preventive Action (CAPA): Defines the systematic process for addressing nonconformities and potential quality problems. Corrective action targets the root cause of detected quality issues to prevent recurrence, while preventive action addresses potential issues to avoid their occurrence.
• Quality Issue Management: Establishes requirements for identifying, documenting, analyzing, classifying, correcting, and monitoring quality issues. Emphasizes the importance of a data-driven approach and ongoing trending to catch systemic or recurring problems.
• Risk-Based Assessment: Introduces the use of risk analysis and impact assessment to prioritize the investigation and resolution of issues based on their potential impact on product safety and consumer health.
• Root Cause Analysis (RCA): Highlights the use of root cause analysis for major and critical quality issues, ensuring that true causes are identified and addressed rather than just symptoms.
• Timeliness and Effectiveness: Stresses the importance of timely execution and closure of CAPA activities, along with the verification and validation of their effectiveness.
• Documentation and Dissemination: Requires comprehensive documentation of findings, actions taken, and results, with dissemination of relevant information to responsible parties.
• Training: Includes guidance for proper CAPA execution and technical writing, with ongoing assessment and periodic retraining.

Applications

ASTM D8229-19 finds application across the entire cannabis supply chain, including:

• Cultivation: Monitoring and correcting deviations in environmental controls, pest management, or fertilization practices that might impact product quality.
• Processing & Manufacturing: Addressing and preventing nonconformities in extraction, formulation, packaging, or labeling operations.
• Testing Laboratories: Applying CAPA procedures to handle issues like failed batches, aberrant test results, or discrepancies in laboratory controls and audits.
• Distribution: Ensuring quality is maintained throughout shipping and storage, and rapidly responding to consumer complaints or returned products.
• Quality Management Systems: Integrating CAPA as a core component of broader QMS frameworks to facilitate compliance, continuous improvement, and risk management.
• Regulatory Compliance: Supporting the documentation and evidence required to demonstrate adherence to legal and industry quality standards in cannabis.

By utilizing this standard, cannabis businesses can detect adverse trends early, perform thorough root cause investigations, and implement targeted solutions to protect consumers and preserve brand reputation.

Related Standards

Entities using ASTM D8229-19 may also refer to the following related standards and guidelines:

• 21 CFR Part 820.100: Corrective and Preventive Action requirements for medical device manufacturers (relevant for equipment and process controls).
• ICH Q9: Quality Risk Management, providing a framework for risk analysis within pharmaceutical and life sciences industries.
• GHTF/SG3/N18: Global harmonization guidance on CAPA processes in quality management systems for medical devices.
• Quality System Inspection Technique (QSIT): US FDA's guidelines on quality system inspections.
• ISO 9001: Quality Management Systems - general requirements applicable to a wide range of industries, including cannabis.

Keywords

cannabis industry, ASTM D8229-19, CAPA, corrective action, preventive action, quality management, root cause analysis, risk-based assessment, nonconformity, consumer safety, process improvement, compliance

Standards Content (Sample)

This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the
Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
Designation: D8229 − 19
Standard Guide for
Corrective Action and Preventive Action (CAPA) for the
Cannabis Industry
This standard is issued under the fixed designation D8229; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 2.1.6 consumer, n—person or organization that receives a
product or service anywhere within a product’s life cycle.
1.1 This guide applies to all entities that cultivate, process,
2.1.7 consumer product, n—any tangible product for sale
manufacture, test, and distribute cannabis products.
that is used for personal, family, household, or non-business
1.2 This guide defines corrective action and preventive
purposes.
action (CAPA) and the significance of an effective CAPA
2.1.8 correction, n—immediate action to eliminate a de-
process and CAPA subsystem.
tected nonconformity.
1.3 This guide defines instruction on the establishment of
2.1.8.1 Discussion—Corrections are typically one-time
adequate processes and procedures for the identification,
fixes. Corrections are also known as remedial or containment
analysis, measurement, and correction of quality issues.
actions.
1.4 This standard does not purport to address all of the
2.1.9 corrective action, n—action to eliminate the causes of
safety concerns, if any, associated with its use. It is the
a detected nonconformity or other undesirable situation.
responsibility of the user of this standard to establish appro-
2.1.9.1 Discussion—Corrective action is taken to prevent
priate safety, health, and environmental practices and deter-
recurrence of the issue.
mine the applicability of regulatory limitations prior to use.
2.1.10 corrective action and preventive action, CAPA,
1.5 This international standard was developed in accor-
n—systematicapproachthatincludesactionsneededtocorrect,
dance with internationally recognized principles on standard-
avoid occurrence, and eliminate the cause of potential noncon-
ization established in the Decision on Principles for the
forming product and other quality problems.
Development of International Standards, Guides and Recom-
mendations issued by the World Trade Organization Technical
2.1.11 corrective action and preventive action (CAPA) plan,
Barriers to Trade (TBT) Committee.
n—encompasses the identification of corrective or preventive
actions or both, the verification and validation of corrective or
2. Terminology
preventive actions or both, and the evaluation of the plan’s
effectiveness.
2.1 Definitions:
2.1.1 aberrant results, n—aberrant results
2.1.12 data analysis, n—analyzing processes, work
operations, concessions, quality audit reports, quality records,
2.1.2 active failure, n—errors made by frontline workers
service records, complaints, returned product, and other
such as manufacturing technicians, machine operators, drivers,
sources of quality data to identify existing and potential causes
and so forth.
of nonconforming product or other quality problems.
2.1.3 adverse trend, n—trend of deficiencies (issues) that
2.1.12.1 Discussion—Appropriate statistical methodology
may negatively impact quality if not corrected.
should be used when necessary to detect recurring quality
2.1.4 change management system, n—formal process used
problems.
to ensure that changes to a product or system are introduced in
2.1.13 data sources, n—processes within a quality manage-
a controlled and coordinated manner.
mentsystem(QMS)thatprovidequalityinformationthatcould
2.1.5 closed-loop system, n—system that an operation,
be used to identify nonconformities or potential nonconformi-
process, or mechanism is regulated by feedback.
ties.
2.1.14 deviation, n—departure from an approved
instruction, procedure, specification, or standard.
This guide is under the jurisdiction ofASTM Committee D37 on Cannabis and
is the direct responsibility of Subcommittee D37.02 on Quality Management
2.1.15 harm, n—physical injury or damage to the health of
Systems.
people or damage to property or the environment.
Current edition approved June 1, 2019. Published July 2019. DOI: 10.1520/
D8229-19 2.1.16 hazard, n—potential source of harm.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
D8229 − 19
2.1.17 human error, n—departure from acceptable or desir- 2.1.35 root cause, n—gap in a process input or supporting
able practices on the part of an individual resulting in an business system that is responsible or partially responsible for
unacceptable or undesirable result. an issue.
2.1.36 root cause analysis, RCA, n—analysis necessary to
2.1.18 human factor, n—discipline concerned with design-
determine the original or true cause of a system, product, or
ing machines, operations, and work environments to match
human capabilities, limitations, and needs. process nonconformity.
2.1.37 root cause analysis tools, n—tools used to conduct
2.1.19 in-conformance data, n—data that meet the estab-
root cause analysis for a problem or situation.
lished acceptance criteria.
2.1.37.1 Discussion—RCA tools identify many possible
2.1.20 initial impact assessment, n—preliminary evaluation
causes for an effect or problem and sort ideas into useful
of the impact of a detected situation/event based on the initial
categories.
data and evidence available.
2.1.38 scope creep, n—changes,continuous,oruncontrolled
2.1.21 latent failure, n—errors made by individuals, includ-
growthinaproject’sscopeatanypointaftertheprojectbegins.
ing mangers and engineers, who are involved in the develop-
2.1.39 severity, n—measure of the possible consequences of
ment and modification of the daily processes performed by
a hazard.
frontline workers.
2.1.40 symptom, n—sign or the existence of something,
2.1.22 metrics, n—quantitative measurement that is
especially of an undesired situation.
collected, recorded, and analyzed to determine whether quality
2.1.41 timeliness, n—time frame commensurate with the
goals and objectives have been met, exceeded, or failed
risk and magnitude of the issue.
specified requirements.
2.1.42 trend, n—sequence or pattern of data.
2.1.23 nonconformance, n—nonfulfillment of a require-
ment.
2.1.43 trending, v—monitoring data over time.
2.1.24 nonconformity, n—deficiency in a characteristic, 2.1.44 validation, n—confirmation through provision of ob-
product specification, process parameter, record, or procedure
jective evidence that the requirements for a specified intended
that renders the quality of a product unacceptable, use or application have been fulfilled.
indeterminate, or not according to required specifications.
2.1.45 verification, n—confirmation through the provision
of objective evidence that specified requirements have been
2.1.25 objective evidence, n—data that demonstrate some-
thing exists or is true. fulfilled.
2.1.25.1 Discussion—Objective evidence can be collected
3. Significance and Use
by means of observations, measurements, tests, or any other
suitable method. 3.1 The ability to identify and respond to opportunities
before issues become systemic or are a risk to consumer health
2.1.26 preventive action, n—action taken to eliminate the
and safety is vital to maintaining compliance and achieving
cause of a potential nonconformity or other undesirable con-
consumer expectations. The CAPA process is a systematic
dition.
approach for documenting, identifying, and correcting existing
2.1.26.1 Discussion—Preventive action is taken to prevent
and potential quality issues from various data sources. The
occurrence of a potential issue.
CAPA subsystem analyzes and trends data inputs from quality
2.1.27 product life cycle, n—sequence or stages a new
systems and processes to identify if a quality issue is recurring,
product progresses through from the birth of the product until
systemic in nature, or impacts consumer health and safety (see
its final withdrawal from the market.
Fig. 1).
2.1.28 quality, n—degree to which a set of inherent charac-
4. CAPA Process
teristics fulfills requirements.
4.1 Organizations should establish a process and procedure
2.1.29 quality issue, n—any issue that may negatively im-
to routinely analyze internal and external data generated to
pact product quality.
identify and address quality issues.
2.1.30 quality management, n—coordinated activities to
4.2 Organizations should decide what terms best describe
direct and control an organization in regard to quality.
quality issues within their operation.
2.1.31 risk, n—combination of the probability of occurrence
4.3 Organizations should decide what terms best describe
of harm and the severity of that harm.
quality issues within their operation.
2.1.32 risk analysis, n—systematic use of available infor-
4.4 Quality issues can occur in any process involved in the
mation to identify hazards and estimate the risk.
product life cycle. Key data sources of quality issues are:
2.1.33 risk assessment, n—overall process comprising a risk
4.4.1 Product complaints,
analysis and a risk evaluation.
4.4.2 Laboratory controls,
2.1.34 risk evaluation, n—process of comparing the esti- 4.4.3 Audits (internal and external),
mated risk against given risk criteria to determine the accept- 4.4.4 Supply chain, and
ability of risk. 4.4.5 Nonconforming product.
D8229 − 19
FIG. 1 CAPA Process versus CAPA Subsystem
4.5 The same workflow should be followed no matter when 4.11 Unplanned events, or incidents, may also occur within
orwhereaqualityissueoccurs.AnyCAPAprocessinvolves,at quality processes. Incidents are errors or occurrences during
minimum, five basic steps: execution of an activity that do not impact product quality.
4.5.1 Define the quality issue, Incidents should be documented as data may be retrieved and
4.5.2 Asses risk/impact, used as part of a larger investigation.
4.5.3 Investigate the cause of the quality issue,
4.5.4 Correct the quality issue, and 5. CAPA Subsystem
4.5.5 Trend/monitor.
5.1 The CAPA subsystem is a critical component of any
4.6 All quality related issues should be defined, quality management system (QMS). It is one of the most
investigated, and corrected with a documented plan to prevent importantimprovementactivitieswithintheQMSanditisvital
recurrence of the quality issue. The extent of the investigation to the success and sustainability of an effective QMS.
into the cause of a quality issue is determined by the initial
5.2 CAPA subsystems shall be data driven. It is difficult to
impactassessmentandthelevelofriskidentified.Implemented
draw conclusions about systems, processes, or product quality
actions may include a correction, corrective action, or a
issues without sufficient, relevant data.
preventive action.
5.3 The CAPA subsystem collects, trends, and monitors
4.7 Quality issues may be classified as minor, major, or
information and data from quality systems and processes to
critical.
detect recurring or systemic product and quality problems (see
4.8 Minorissuestypicallydonotaffectanyqualityattribute, Fig. 2). Corrective or preventive actions should be used when
a critical process parameter, or an equipment or instrument issues are identified as recurring, systemic, or as a serious risk
critical for process or control. Minor issues do not necessarily toconsumers.Correctionsorcontainmentactionsoftenaccom-
require an investigation aimed at identifying the root cause and pany corrective or preventive action implementation.
are typically resolved by implementing corrections.
5.4 The effectiveness of implemented corrective or preven-
4.9 Major issues affect a quality attribute, a critical process tive actions is monitored through a change management
parameter,oranequipmentorinstrumentcriticalforprocessor system. The change management system is used to: validate
control.Therisktoconsumersismoderatelyhigh.Majorissues corrective and preventive actions before implementation; prop-
may result from recurring minor issues. Major issues require a erly disseminate information regarding corrective and preven-
root cause investigation and the identification and implemen- tive actions; and document all CAPA-related activities essen-
tation of appropriate corrective action(s) or preventive ac- tial to ensuring the CAPA subsystem is effective.
tion(s).
6. Trending and Monitoring
4.10 Critical issues affect a quality attribute, a critical
process parameter, or an equipment or instrument critical for 6.1 Trendingdetectsshiftsindatathatmayindicatealossof
process or control. The risk to consumers is very high. Critical process control effectiveness. These shifts may require further
issues require a root cause investigation and the identification investigation to determine necessary process changes, addi-
and implementation of appropriate corrective action(s) or tional training requirements, and other changes required to
preventive action(s). maintain or regain process control. Nonconformance data (data
D8229 − 19
FIG. 2 Inputs and Outputs of the CAPA Subsystem
requiring corrective action) and in-conformance data (data that 8. CAPA Timeliness
are the basis for preventive action) should be evaluated.
8.1 Timeliness of CAPAexecution in any quality process is
6.2 Trending and monitoring activities should be conducted a critical element of the CAPA subsystem.
on a frequent basis. Organizations should establish a trending
8.2 Organizations should establish timeliness criteria for the
and monitoring process and procedure. The procedure should
completion of all CAPA-related activities based on the risk of
capture and analyze data, define adverse trends, and outline the
the situation under investigation.
process for escalation of issues to prevent distribution of
8.3 Timeliness requirements are particularly important
nonconforming product.
when investigating recurring or systemic issues and issues
6.3 Data analysis should include the use of statistical and
involving nonconforming product. Timeliness requirements
non-statistical techniques. Statistical techniques may include
should be established for each step of the CAPA process to
pie charts, statistical process control strategies, and Pareto
ensure appropriate planning and execution.
charts. Non-statistical techniques may include quality review
8.4 CAPA procedures should provide instruction on proper
committees and quality review boards.
notification and documentation of a required adjustment to a
project timeline. This may be achieved through an established
7. CAPA and Risk-Based Assessment
interim report process and the creation of a CAPA Review
7.1 CAPA strategies require a risk-based analysis in which
Board (CRB). These processes provide oversight of CAPA
risk is defined as the combination of the probability of
progress and timely completion.
occurrence of harm and the severity of that harm.
7.2 Risk prioritization should correlate to the risk and is
9. Problem Detection to Effectiveness Check Planning
based on the criticality and magnitude of the situation.
9.1 Sufficient controls should be in place to ensure the
7.3 The protection and safety for the end user of any
CAPA process runs through all required steps to completion
consumer product by managing risk to quality should be
and resolution of quality issues (
...