Deviation vs change control in pharma: which one, when, and how they connect

Deviation management and change control sit side by side in every pharmaceutical quality system. They share people, forms and software, and they meet at several points: a planned deviation, a CAPA that alters a process, an equipment modification that nobody approved. Inspectors look hard at those meeting points, because that is where control is most easily lost.

This guide is about the boundary between the two. How to run the investigation and how to assess the risk of a change are covered in our guides 'Deviation management in pharma: the process step by step' and 'Change control risk assessment: how to make it defensible to an inspector'. Here the question is which record to raise, where planned deviations fit, when one record must lead to the other, and what inspectors find when the boundary is managed badly.

The core difference: discovered after, or proposed before

A deviation is an unplanned departure from an approved instruction, specification, process or standard that is discovered after it has happened, or while it is happening. Nobody chose it. The job of the deviation system is to contain it, find out why it happened, assess what it means for product already made, and stop it from recurring.

A change control is a proposal to alter something deliberately: a process, a document, a piece of equipment, a material, a supplier, a computerised system or a facility. It is assessed and approved before it is implemented. EU GMP Chapter 1 expects planned changes to be evaluated prospectively and approved before implementation, with regulatory notification or approval where required, and ICH Q10 makes change management a core element of the pharmaceutical quality system.

Which record to raise: a decision tree

Write the same decision rules into both the deviation SOP and the change control SOP, so they cannot give different answers. A workable set:

1. Has the departure already occurred, or been discovered in progress? Raise a deviation. Never convert it into a change control to make it look planned.
2. Is someone proposing to do something differently from now on, permanently? Raise a change control and assess it before anything changes.
3. Is someone proposing a one-off or strictly time-limited departure, for a defined batch, quantity or period, with a return to the approved state afterwards? This is the narrow space where a planned deviation may fit, if your procedure allows them. Apply the tests in the next section first.
4. Would the proposed departure, however short, affect the validated state, a specification, a registered detail in the marketing authorisation or the configuration of a computerised system? Use change control, temporary if necessary, not a planned deviation.
5. Does a deviation investigation conclude that a process, document, piece of equipment or system must change to prevent recurrence? Keep the deviation open for its own purpose, and raise a linked change control for the CAPA.
6. Has a change been found that was implemented without approval? Raise a deviation for the unauthorised change and a linked retrospective change control to assess it and either regularise or reverse it.

Two rules sit above the tree. First, one event can need both records; choosing one does not exclude the other. Second, when the answer is unclear, QA decides and records the reasoning, rather than leaving the choice to whichever department is under the most time pressure.

Planned deviations: useful, narrow and often overused

A planned deviation is a temporary, pre-approved departure from an approved instruction, after which the process returns to its approved state. Legitimate examples include using a qualified alternative piece of equipment for one campaign while the usual one is repaired, or extra sampling on a batch under investigation. The term is common in company procedures but is not defined in the EU GMP guide, and some companies do not use the mechanism at all.

Many inspectors and quality units treat planned deviations with suspicion, for good reasons. The deviation system is built to investigate what has already happened, not to assess what is about to happen, so a planned deviation often skips the cross-functional impact review a change control would require. It is also easy to repeat: the third planned deviation for the same workaround is, in substance, an unapproved change on a renewable licence. A planned deviation is defensible only when all of the following are true:

• It is genuinely one-off or strictly time-limited, with an end point stated in batches, quantity or a date.
• QA approves it before execution, based on a documented risk assessment proportionate to the departure, as ICH Q9 expects.
• It does not alter the validated state, a specification or any registered detail of the marketing authorisation.
• The approved state is restored at the end, and the record shows it.
• It is not a repeat of an earlier request for the same departure.

When a deviation must trigger a change control

Many deviations end in CAPA, and many CAPAs are changes. Revising a batch record, adding an in-process check, modifying equipment, reconfiguring an alarm or rewriting an SOP all need change control, whatever their origin. ICH Q10 names CAPA as one of the drivers of change, and a corrective action designed in a hurry to close a deviation can introduce a new failure mode as easily as any other change. Where it affects qualified equipment or a validated process, EU GMP Annex 15 expects the effect on the validated state to be assessed before the change is made.

Inspectors will trace a deviation forward to the change that fixed it, and a change backwards to the deviation that caused it. Good traceability looks like this:

• The deviation record states the root cause and names the CAPA, and the CAPA cites the change control number.
• The change control cites the originating deviation and CAPA, and its impact assessment considers whether the change could itself create a new problem.
• The CAPA is not closed as effective until the change is implemented and the effectiveness check is complete, not when the change control is merely approved.
• Interim controls that apply while the change is pending are recorded in the deviation or CAPA, with an owner and an end date.

As our guide 'Human error in root cause analysis: why it is rarely the real root cause' explains, the strongest corrective actions are usually process, equipment or system changes rather than retraining. More change controls from CAPA is a sign of a healthy system, not a burden.

Unauthorised changes discovered after the fact

Sometimes the change has already happened: an engineer fitted a different model of a part, a supplier altered a component without notice, a spreadsheet template was edited, or a set point was adjusted during troubleshooting and never reset. The event is no longer a proposal: an unapproved departure from the approved state has occurred, which makes it a deviation.

Handle it with linked records:

1. Deviation: record the discovery, contain affected product and equipment, and investigate why the change bypassed the change control system. That failure of the system is a root cause in its own right.
2. Impact: assess every batch made since the change was introduced, using the same impact questions a prospective change control would have asked.
3. Retrospective change control: assess the change as if it were being proposed, then either approve it, with any validation or regulatory actions it needs, or reverse it.
4. CAPA: address how the change escaped control, for example spare parts management, supplier notification terms or system access rights.

Retrospective change control should be rare and visible. If it becomes routine, it shows that changes are implemented first and approved later, one of the most damaging patterns an inspector can find.

The regulatory filing angle

Some changes alter information in the marketing authorisation. In the EU these are handled under the variations framework, which sorts variations into categories (Type IA, Type IB and Type II) by potential impact, each with its own notification or approval route. Every change control should ask whether registered details are affected, and regulatory affairs should answer against the current dossier rather than the site assuming. A product registered in several markets may need a different filing in each.

This has two consequences at the boundary. First, a planned deviation cannot be used to depart from registered details. EU GMP Annex 16 allows the Qualified Person, under defined conditions, to consider certifying a batch affected by an unexpected deviation from registered manufacturing or analytical details, but the word unexpected matters: a deliberate departure from the dossier needs the regulatory route, which starts with change control. Second, a CAPA that changes something registered may need an approved variation before it can be implemented, so the interim controls in the deviation record may stay in place longer than expected. Build that into the CAPA timeline early.

Common inspection findings at the boundary

• Changes made through deviations: a permanent improvement recorded as a deviation or planned deviation, avoiding change control review.
• Repeated planned deviations for the same issue, renewed for months, with no fix.
• CAPA implemented without change control: an SOP, batch record or equipment setting changed directly, with no impact assessment.
• Change control raised after implementation, approved after the change went live, with no deviation for the gap.
• CAPA closed when the change control was approved, before the change was implemented or its effectiveness checked.
• Deviation, CAPA and change control records that do not reference each other, so the history of an issue cannot be reconstructed.
• Planned deviations approved for departures that affected the validated state or registered details.

Boundary checklist

• The deviation and change control procedures contain the same decision rules, in the same words.
• Every deviation whose CAPA changes a process, document, piece of equipment or system has a linked change control, referenced in both directions.
• Planned deviations, if used, are one-off or time-limited, approved by QA before execution, and checked for repetition.
• Nothing that affects the validated state, a specification or a registered detail is handled as a planned deviation.
• Temporary change controls have an expiry date and a documented return to the approved state.
• Unauthorised changes found after the fact have both a deviation and a retrospective change control.
• Regulatory affairs assesses the filing impact of every change against the current dossier.
• CAPA closes only after the linked change is implemented and verified as effective.
• Planned deviations and retrospective change controls are trended in management review.

When the boundary is clear, deviations show what needs to change and change control makes sure the fix is safe. When it is blurred, each system becomes a way around the other. The Change Control, Deviation Management and CAPA courses on this site cover all three in depth.

Frequently asked questions