For each deviation that causes or might cause a food safety risk you need to have a procedure for CAPA
1. Who initiates the CAPA
2. Who determines the root cause and the methods used to determine root cause (fish bone, 5 why, etc.)
3. Who determines corrective and preventative actions.
4. Who carries out the corrective and preventative actions or who assigns the tasks.
5. When are corrective and preventive actions due to be completed.
6. Who and how are corrective and preventative actions verified as complete and effective
7. where is this information recorded.
make sure you have a capa procedure(s) that cover "........customer complaints, non-conformances raised at internal or external audits and inspections, non-conforming product and equipment, withdrawals and recalls, as appropriate." Some of these may already be covered in other clauses such as 2.1.3, 2.5.4, etc. i typically address the corrective and preventative action in these programs and then have a generic procedure and log for things like equipment failures, gmp/facility issues that are found outside of inspections - kind of a catch all for everything else.