Deviation management in pharma: the process step by step

Every pharmaceutical site has a deviation procedure. The difference between a site that passes inspection and one that receives a finding is rarely the procedure itself. It is whether each deviation moves through the same clear steps, at the right speed, with a record that a reviewer can follow without asking what happened.

This guide sets out the deviation management process in eight steps, what each step must produce, who owns it, and where sites typically go wrong. It applies to medicinal products under EU GMP and is a sound model for medical devices under ISO 13485 as well.

What counts as a deviation

A deviation is any departure from an approved instruction, specification or established standard: a batch record step done differently, an environmental monitoring excursion, equipment running outside its validated range, a missed in-process check, a material used before release. EU GMP Chapter 1 requires deviations to be recorded and investigated, and Chapter 8 and Annex 16 tie unexplained deviations directly to the decision on whether a batch can be certified.

Two categories cause confusion. A planned deviation is a temporary, pre-approved departure for a defined period or number of batches, assessed before it happens; if the change is meant to be permanent, it belongs in change control instead. An out-of-specification (OOS) result usually follows its own laboratory investigation procedure first, and becomes a deviation if the laboratory phase does not find an assignable laboratory error.

Step 1: Detect and record immediately

The person who discovers the deviation records it the same day, in the deviation system, with the facts only: what was observed, where, when, which batch, material or equipment, and who was involved. Interpretation and cause come later. Most sites set a limit of one working day from detection to initiation, and inspectors check the gap between the event date and the record date.

Step 2: Contain

Before anyone investigates, stop the problem from spreading. Typical actions: place affected batches or materials on hold, quarantine product, stop the equipment, segregate the area, and check whether other batches, lines or sites could be affected by the same cause. Record each containment action with who did it and when. Containment is not the fix; it buys time to find the cause.

Step 3: Classify the risk

Classification decides the depth of the investigation, who must be involved and how fast it must close. Most sites use three levels, assessed using quality risk management principles as described in ICH Q9 (R1):

• Minor: no reasonable potential to affect product quality, patient safety or data integrity. A short, documented assessment is enough.
• Major: could affect product quality or GMP compliance, but not likely to harm a patient. Requires a full investigation and usually CAPA.
• Critical: could affect patient safety or lead to release of a non-compliant product. Requires immediate escalation to QA management and the Qualified Person, a full cross-functional investigation, and assessment of whether regulators must be notified.

Step 4: Investigate the root cause

For major and critical deviations, assemble the people who know the process: production, QA, QC, engineering as needed. Build a timeline of what actually happened, gather the evidence (batch records, logs, audit trails, interviews), and use a structured method such as 5 Whys, an Ishikawa diagram or a fault tree to move from the symptom to the cause. Check the deviation history: if the same thing happened before, the earlier CAPA did not work and that is part of the root cause.

Be particularly careful with 'human error' as a conclusion. EU GMP expects it to be justified, having ruled out process, procedural and system causes. Our guide 'Human error in root cause analysis' explains how to do that.

Step 5: Assess the impact

The impact assessment answers one question with evidence: what does this deviation mean for the product, the patient and the validated state of the process? Cover the affected batch, other batches made with the same material, equipment or people, the stability and validation status, registered details in the marketing authorisation, and any data integrity implications. Every 'no impact' needs a reason and a reference to the data that supports it.

Step 6: Define CAPA

Corrective actions remove the cause of this deviation; preventive actions stop it happening elsewhere or again. ICH Q10 expects CAPA to come out of the investigation and its effectiveness to be evaluated. Each action needs an owner, a due date and, for the main actions, an effectiveness check with a measurable criterion such as 'no recurrence in the next 30 batches'. If an action requires a permanent change to a process, document or system, raise a change control and link the two records.

Step 7: Batch disposition

The Qualified Person cannot certify a batch while a deviation affecting it is open and unexplained. Annex 16 requires that deviations be fully investigated to the extent needed to decide on the batch, and that the QP be satisfied that the deviation does not affect compliance with the marketing authorisation and GMP. In practice this means the investigation and impact assessment for the affected batch must be complete before release, even if longer-term CAPA continues afterwards.

Step 8: Review, approve and close

QA reviews the full record: facts, containment, classification, root cause, impact, CAPA and disposition. Closure means the investigation is complete and approved; it does not require every preventive action to be finished, provided open CAPAs are tracked in the CAPA system. A common internal target is closure within 30 calendar days of initiation, with a documented, approved extension when an investigation genuinely needs longer.

Trending: the step most sites forget

Individual deviations are closed one by one; problems in the quality system only show up in the trend. Review deviations at least monthly by area, process, equipment, root cause category and classification, and feed the results into management review and the product quality review. A rising number of minor deviations on one line is an early warning that no single record will reveal.

Deviation management checklist

• Recorded within one working day of detection, facts only.
• Containment actions recorded with who, what and when.
• Classification justified on potential impact, with QA agreement.
• Root cause found with a structured method and evidence, history checked.
• Impact assessed for the batch, related batches, validation and the marketing authorisation.
• CAPA with owners, dates and measurable effectiveness checks; change control linked where needed.
• Investigation complete before batch certification.
• Closed on time or with an approved extension; included in trending.

A deviation system that follows these eight steps consistently does more than satisfy inspectors. It is the main way a site learns from what goes wrong, and the trend data it produces is some of the most useful information quality management has.

Frequently asked questions