There is no universal maximum time that a CAPA can stay open before escalation. The escalation trigger has to be defined in your quality system and justified by risk, process complexity, and resource reality. Regulators will expect you to follow your own procedure consistently and explain why it makes sense.
Typical timeframes used in regulated environments
While numbers vary by company and product risk, many sites use time-based triggers like:
- Low/medium risk CAPAs: 60 to 90 days to implementation, with earlier checkpoints.
- High risk / patient safety / regulatory impact CAPAs: 30 to 60 days for containment and critical actions, sometimes with formal weekly review.
- Effectiveness checks: Often scheduled 30 to 180 days after implementation; these have their own aging rules.
The exact numbers should be documented in your CAPA SOP, not improvised case by case.
Use tiered escalation instead of a single deadline
Rather than one “max age,” most mature systems define staged escalation based on target due dates:
- Planned due date: Set per CAPA step (investigation, root cause, implementation, effectiveness check), aligned to risk.
- Early warning (e.g., 14 days before due date): Reminder to owner and functional manager.
- First escalation (e.g., at due date missed): Escalate to department head; documented justification and revised plan required in the CAPA record.
- Second escalation (e.g., 30 days late or crossing a defined “max age” threshold): Escalate to site quality leadership and possibly management review.
- Critical escalation (for high risk CAPAs or repeated slippage): Escalate to executive leadership, with explicit risk assessment of operating with CAPA open.
This approach recognizes that a complex, multi-site CAPA may legitimately take longer than a simple local corrective action, while keeping visibility on aging items.
Risk-based timelines are expected
Escalation criteria should be explicitly tied to risk, not just calendar age. Consider:
- Severity of the underlying issue (e.g., safety, regulatory, business continuity).
- Detectability and occurrence (e.g., how likely is recurrence while the CAPA is open).
- Scope and complexity of changes (multiple lines, suppliers, or software/automation changes usually need longer and more formal change control).
High risk CAPAs generally warrant shorter timelines, stricter monitoring, and faster escalation than low risk, localized issues.
What auditors and regulators actually look for
Auditors rarely look for a specific “number of days” as a rule that applies everywhere. Instead, they assess whether:
- Your CAPA procedure defines clear expectations and escalation rules.
- You follow your own rules and document deviations and justifications.
- Risks are controlled while CAPAs are open (containment, interim controls, additional inspection or testing).
- Chronic aging CAPAs are visible in management review and trigger systemic fixes (e.g., resourcing, prioritization, training).
Inconsistent behavior is usually a bigger problem than a long but justified and documented CAPA timeline.
Handling long-duration or complex CAPAs
In industrial and aerospace-grade environments, some CAPAs legitimately take many months because they involve:
- Changes to qualified equipment or validated software.
- Updates across multiple plants, suppliers, or ERP/MES/QMS integrations.
- Customer approvals, contract changes, or formal requalification.
Closing these too quickly to “hit a date” can create new nonconformances. For long, complex CAPAs, you can mitigate aging by:
- Breaking work into phased CAPAs or sub-actions with their own due dates.
- Maintaining strong interim controls (e.g., 100% inspection, additional signoffs, temporary process limits).
- Documenting why a longer timeline is necessary (e.g., shutdown windows, validation testing, supplier lead times).
- Reviewing progress in formal governance forums like CAPA review boards or management review.
This is particularly important in brownfield sites where changing legacy MES/ERP, test equipment, or automation carries downtime, validation, and integration risk.
Practical minimums for defining your own rules
When you write or refine your CAPA SOP, you should at least:
- Define target timelines per CAPA phase (e.g., investigation, root cause, action plan, implementation, effectiveness check).
- Define risk-based categories (e.g., critical, major, minor) with different expectations.
- Specify time-based aging thresholds for reminders and escalations (e.g., 30/60/90 days, adapted to your environment).
- Require a documented justification and revised plan any time a due date is extended.
- Ensure your eQMS, MES, or tracking tools can report CAPA aging and escalation status accurately.
Whatever thresholds you choose, they should be achievable with your current staffing, system integration, and shutdown windows. Overly aggressive “paper” timelines that are routinely violated often look worse during audits than a realistic, risk-justified plan.
Bottom line
CAPAs should not remain open indefinitely, but there is no single mandated maximum age. Use risk-based, phase-specific targets with clear, staged escalation and documented justifications for any delays. In complex, regulated, and brownfield environments, longer timelines can be acceptable if interim risk controls are strong and governance is disciplined.
