We had a client, a frozen seafood importer, who used our Los Angeles food warehouse in the fall of 2024. One Saturday at 2 a.m. the refrigeration unit's high-pressure alarm went off. The night shift followed SOP, switched to the backup unit, and by 4 a.m. temperatures were back below -18°C. Textbook emergency response, right?
Three months later, an FDA inspector showed up for a routine visit, pointed at that night's temperature log, and said: "The temperature drifted between -18 and -9 degrees for over four hours. I need a CAPA report on this temperature deviation."
The client's QA manager, a solid and honest guy, pulled an all-nighter and turned in three pages. A week later it came back with one line of comment: root cause not substantiated, please rewrite.
He called me that night, voice completely hoarse: "Susan, we saved the temperature, the product is fine — why won't this report pass?" I told him: buddy, the inspector never cared whether you saved the temperature. He cares whether your report contains the things he's looking for.
After years in 3PL sales, I've sat through more than twenty audits with clients, and the CAPA report for a food warehouse temperature deviation is the single most returned document I know. So today I'm spilling what I know, to save you the all-night rewrites.
Another Client, Same Deviation, Passed on the First Try
Early 2025, a dairy distributor in Dallas rented ambient space from us. Their SOP capped warehouse relative humidity at 65%. That spring brought heavy rain, the dehumidifiers were down for maintenance, and humidity hovered between 72% and 78% for four straight days. By the time anyone noticed, out of 1,200 cases of milk powder, a sample of 80 turned up 23 cases with mold spots on the outer cartons.
Objectively worse than the LA incident — product was genuinely affected. But this client's QA manager submitted a 12-page CAPA report, the inspector asked three questions, and it passed on the spot.
What was the difference? The LA report described "what we did." The Dallas report answered "what the inspector wants to see." Corrective action cleans up what already happened; preventive action makes sure it never happens again. The inspector needs exactly two things confirmed: can this product still be sold, and will this happen again? Every paragraph must serve those two questions.
The Five-Part CAPA: The Only Structure an Inspector Wants
Every CAPA report I've seen pass on the first try looks the same — five parts. Don't invent a structure; just fill in the blanks.
Part 1: Deviation description — nail down the facts. When, which warehouse, which specification was breached, by how much, for how long, how it was discovered, and which products (lot numbers, pallet IDs) were in the room. Facts only, zero judgment — "temperature out of range for six hours" is a fact; "no impact on product" is a judgment, and that belongs in Part 2.
Part 2: Impact assessment — can this product be sold or not? List every affected lot, pallet, and quantity, and back your conclusion with real evidence: retain sample test reports, the complete temperature-time curve, written confirmation from the manufacturer or supplier. The LA report died right here — the QA manager wrote "assessed, no impact on product" with nothing behind it. The inspector's comment was polite: "Please provide the basis of assessment." Translation: you say it's fine, so it's fine?
Part 3: Root cause — dig down to the system level. This is where most reports get killed. Here's the counterintuitive truth: "human error" as a root cause is the same as writing nothing. The moment an inspector sees those words, the pen comes out — "someone was careless" explains everything and nothing, because next time, with a different someone, it happens again. Keep asking "why" until you hit the system layer: Why didn't the night shift switch to backup sooner? Because the alarm text only went to the day-shift supervisor's phone. Why only to him? Because the alarm contact list hadn't been updated in two years. Why? Because no SOP assigned anyone to maintain it. The root cause isn't "human negligence" — it's "no maintained process for the alarm contact list." The first relies on conscientiousness; the second relies on a system. Inspectors only accept the second.
Part 4: Corrective and preventive actions — write them separately. Corrective actions are what's done: quarantined lots, tested retain samples, repaired the unit, recalibrated loggers. Preventive actions stop recurrence: alarm contact list updated with an owner, quarterly review added to the SOP, monthly test-runs of the backup unit. And here's an insider truth from the 3PL side: "retrain the staff" is the cheapest placebo in the business. Nearly every rejected report lists "enhanced training" as preventive action number one. Inspectors have a catchphrase I've heard at least five times: "Will training stop the compressor from breaking next time?" Training can be a side dish, never the main course — the main course must change a process, a piece of equipment, or a system. Anything that costs nothing and changes nothing gets spotted instantly.
Part 5: Effectiveness verification — prove it actually worked. What are the acceptance criteria, who verifies, and by when — in writing. Review alarm logs at 30 days, spot-check the contact list at 60, run a full drill at 90, with names and dates. Never write "ongoing monitoring" or "long-term tracking" — verification without a deadline is no verification at all.
Five Things Inspectors Love to Flag in a CAPA
That's the skeleton; now the flesh. The objections I hear under audit are always some version of these five:
- The timeline doesn't match. Your report says "alarm discovered at 2 a.m." but the logger's raw data says 2:10. Ten minutes off gets circled — raw data is fixed, your words are flexible, and the flexible must match the fixed, exactly.
- The root cause stops at a person. "Night shift negligence" — the inspector is already reaching for the rejection stamp. Blaming a person is writing nothing.
- The impact assessment has no evidence. "Assessed, no impact" — zero attachments, zero data. Why did Dallas pass? They attached the retain sample lab report, the 72-hour humidity curve, and the supplier's written confirmation. Three items, no haggling.
- The only preventive action is training. One line: "enhance training for relevant personnel." The inspector will ask: what happens next time the equipment fails? No answer, rewrite.
- The verification plan has no closure. "Ongoing observation," "incorporated into daily management" — translation: "once this report is filed, we're done here." What the inspector wants: who, when, against what standard, verifying what. All four, no exceptions.
Three Insider Truths Only the 3PL Side Knows
Finally, intel from the vendor's side of the table — earned the hard way, sitting next to clients under audit:
Insider truth one: inspectors read your report backwards. Attachments first — raw temperature curves, alarm logs, lab reports. Then the timeline check. Your narrative comes last. If the attachments don't add up, the prose is wasted — so organize attachments before writing a single paragraph.
Insider truth two: your 3PL contract must spell out deviation notification timing. Our template has a clause born from a painful audit: "Upon discovering a temperature or humidity deviation, the 3PL shall notify the client's QA within two hours." Back then the inspector asked our client, "When did your 3PL tell you?" The client couldn't answer, and we nearly earned an observation alongside them. Don't dismiss fine print at signing — under audit, it's a lifeline.
Insider truth three: the inspector's favorite question for a 3PL. "How do you prove this product is fine?" Never "we assessed it" — it's three things: the raw temperature curve, the retain sample test report, the disposition record. Miss one, rewrite. Gather those three first and your report is halfway to passing.
One more note: every temperature spec and humidity limit should follow the regulation text and the client's SOP — never copy numbers from the neighbor's SOP. Storage conditions are set by the manufacturer; your SOP mirrors them. Under audit, that chain of evidence has to link up, ring by ring.
Next time you write a CAPA, ask yourself three questions:
One: swap out the name of the person involved — does your root cause still hold? Yes means you've reached the system layer; no means you're just blaming someone.
Two: delete "enhance training" from your preventive actions — what remains? Nothing? Then you don't have a plan. Go back and think.
Three: three months from now, what proves this is truly fixed? Can't answer? Your verification plan is empty talk — fill it in now.
Answer those three cleanly and the report passes on the first try. If you can't, don't panic — a rewrite beats an observation on your record every time.
By Susan, 3PL Sales Director
