Which of the following best describes the CAPA in CTPAT?

• A. A plan for port infrastructure expansion.
• B. A budget allocation for audits.
• C. A daily security checklist.
• D. A formal plan describing root cause, corrective steps, responsible parties, and timelines to remediate identified security deficiencies.

Answer: (D)

CAPA in CTPAT is a formal process for addressing security deficiencies by identifying their root cause, outlining corrective steps to fix the issue, assigning responsibility, and setting timelines to remediate. It also includes preventive actions designed to prevent recurrence of the problem. In practice, when a security gap is found during a validation, audit, or incident, a CAPA documents exactly what caused the deficiency, what will be done to correct it, who will do it, and by when, with follow-up to verify that the fix worked and that similar issues won’t recur. This structured approach ensures improvements are traced, implemented, and confirmed as effective. The other options describe broader plans or routine tasks (like expanding port infrastructure, budgeting for audits, or a daily checklist), which do not capture the disciplined root-cause analysis and action-tracking that define CAPA.