Deviation Management in GMP: From Finding to Justified Decision

A deviation begins with a specific defined requirement

Deviation management connects an identified deviation with its investigation, the assessment of its consequences, and the decisions derived from them. The starting point is a verifiable requirement: for example, an approved work instruction, a permitted process range, or an acceptance criterion. The report describes what was actually observed and how it differs from the requirement. Any assumption about the cause is recorded alongside it as a hypothesis, not as part of the factual description.

In the fictitious example, starting material RM-427 arrives in four containers. During the inspection under SOP-WE-12 V3, a damaged seal is found on container 3. At this point, it is simply an observation at goods receipt. An investigation must determine whether the quality of the material has been affected. EU GMP Chapter 5, section 5.4 calls for damage to containers and any other problem that might affect quality to be investigated, recorded, and reported to Quality Control. ^[1]

The term “planned deviation” needs a clear operational definition. If a different approach is foreseeable, the question of a controlled change must be addressed before execution. Annex 15, sections 11.2–11.7 cover the evaluation, approval, and review of planned changes. A pre-approved form alone does not create a general exemption from applicable requirements. ^[2]

An OOS result is defined more narrowly: according to the FDA guidance, it is a test result that falls outside established specifications or acceptance criteria, including corresponding in-process laboratory tests. Without such a test result, a damaged seal is not an OOS. A complaint, in turn, is one possible source of quality information; EU GMP Chapter 8 distinguishes the complaint from the potential quality defect, which still has to be assessed. ^{[3] [4]}

The report captures the observation and the immediate action

At goods receipt, the first priority is an unambiguous record. For RM-427, the person performing the work records: material batch, affected container, time, observed condition, associated inspection step, and applicable SOP version. A photo can supplement the finding. The wording “seal damaged” is kept separate from the assumption “transport damage” as long as it is unclear when the damage occurred.

The immediate action prevents further use of the material until the investigation is complete. In the example, RM-427 remains in quarantine; container 3 is clearly identified and secured against inadvertent use. The report is sent to the responsible Quality Control function. EU GMP Chapter 5, section 5.5 provides for incoming materials to be held in quarantine until release. ^[1]

The operational procedure specifies who takes over a case, what information must be provided later, and when to escalate. These rules must suit the activity and the risk. ICH Q10 section 2.1 addresses responsibilities and the timely communication of quality issues up to the appropriate level of management. ^[5]

In the digital record, the observation, immediate containment, and the next investigative step can be managed as distinct work steps. At a handover, this makes it clear whether the material has merely been contained or whether a quality decision has already been made. An open question is assigned a responsible person and a due date; its answer is then linked to the case.

Classification follows the risk question

For RM-427, the first risk question is: Could the damaged closure have affected the identity, purity, or other relevant quality of the starting material? To answer it, the team gathers information on the condition and function of the seal, additional packaging layers, material properties, transport conditions, and possible exposure. The investigation is tailored to the specific material and its intended use.

ICH Q9(R1) links the assessment of quality risks to scientific knowledge and the protection of the patient. It considers potential harms, their probability, and their severity; depending on the method, detectability may also be included. Effort, formality, and documentation should be commensurate with the risk. Knowledge gaps and uncertainty must be reflected in the assessment. ^[6]

An organization may use its own classifications with defined criteria. The names of these classes do not replace the justification. For the damaged seal, for example, the record should state which protective function is affected, what information is still missing, and why the chosen depth of investigation is appropriate. New information can trigger a reassessment and a change to the actions.

Classification determines which experts are involved, in what order, and along which decision path; it does not replace the documented assessment of the finding.

The investigation tests hypotheses against reliable evidence

For RM-427, a timeline is established: delivery, acceptance, container inspection, detection, securing, and notification. Delivery notes, transport information, photos, and existing records are checked against one another. The question is where the damage could have occurred and which observations support or refute each explanation.

A cause overview can organize hypotheses by material, packaging, handling, equipment, and procedure. A chain of “why” questions probes one suspected cause in depth; a cause-and-effect diagram keeps several explanations open. Both are tools for the investigation. A template that has been filled in plausibly is no substitute for evidence supporting the cause selected.

EU GMP Chapter 1, section 1.4(xiv) requires an appropriate root cause analysis. Where human error is assumed, possible errors in the process, procedure, or system must be carefully considered. Where the actual cause cannot be determined, the most likely causes should be considered and addressed. ^[7]

In the operational twin, process events link action, person, time, and affected object. For RM-427, this makes it possible to link the documented inspection with the follow-up inspection. The events document the recorded sequence; the technical investigation determines how much this information reveals about the damage.

Process discovery can reveal the sequence that was actually documented. A comparison using conformance checking then helps identify differences from the intended sequence. However, the order of entries in the event log does not in itself prove a causal relationship.

If a laboratory test also yields an OOS result, the investigation defined for that case follows. The FDA guidance distinguishes the initial laboratory assessment from a full-scale investigation when no assignable laboratory cause is found. Retests require a scientific justification; a passing result must not simply override the original result. ^[3]

Impact assessment extends beyond the individual container

The investigation must clarify which material quantities and subsequent batches could be affected. For RM-427, the team checks whether only container 3 is affected, whether other containers show similar features, or whether material has already been dispensed and processed further. Any conclusion that the impact is limited requires a documented justification.

Batch traceability connects the starting material with withdrawals, partial quantities, and subsequent uses.

Under 21 CFR 211.192, US CGMP requires a thorough investigation of unexplained discrepancies and of failures to meet specifications, including for batches already distributed. The investigation extends to other batches of the same product and of other products that may be affected; conclusions and follow-up must be recorded in writing. 21 CFR 211.100(b) also requires deviations from procedures to be recorded and justified. ^{[8] [9]}

In Germany, § 13(7) and § 14(4) AMWHV require the deviations covered by those provisions to be documented and thoroughly investigated. § 16 governs release for placing on the market by the Qualified Person. A decision on whether a starting material may be used must be distinguished from this release of the medicinal product. ^[10]

Annex 16, section 3 provides a narrowly defined framework for unexpected deviations before QP certification: the registered specifications must be met, and the deviation must be thoroughly investigated and its cause corrected. The impact assessment must conclude that the effect on quality, safety, and efficacy is negligible. This is a case-by-case expert decision. ^[11]

420+ links RM-427 to the inspection and follow-up actions

In 420+, the inspection step for the damaged seal creates a follow-up task “Inspect batch / partial batch.” It inherits the reference to the originating task and thus to RM-427. The observation remains with the recorded step. It is based on work instruction SOP-WE-12, stored as a digital SOP with control steps and evidence fields.

The task preserves SOP-WE-12 V3 as a snapshot. The instruction in force at the time therefore remains visible even if version 4 later becomes active. A reviewer can examine the observation, the applied requirement, and the documented execution together. Roles, second-person review, processing deadlines, and escalation are configurable defaults of the operational workflow.

If an independent second-person review is required, it is managed as a separate step. The approval workflow makes the review and the associated decision traceable. Who decides on the use of the material is defined by the organization; in the example, this is Quality Control.

If an observation is clarified later, the change is clearly marked as a correction. A correction event preserves the original entry. EU GMP Chapter 4, sections 4.8 and 4.9 require contemporaneous records and traceable changes in which the original information remains legible. ^[12]

The audit trail supports review of the change history. PIC/S PI 041-1, sections 7.2–7.5 explain the importance of attributable, contemporaneous, complete, and available data. The investigation also needs to establish what information was available when a decision was made. ^[13]

To continue the fictitious case, assume that the investigation finds the work instruction unclear on how to handle damaged seals. This leads to a CAPA to clarify the inspection step. The change of SOP-WE-12 from V3 to V4 goes through the organization’s change control, including assessment, approval, and required training.

The three records remain distinguishable: the deviation record documents the finding and its consequences, the CAPA tracks the derived action and its effectiveness, and change control governs the new requirement. ICH Q10 sections 3.2.2 and 3.2.3 describe this connection. ^[5]

Closure keeps the decision and open follow-up work apart

Before closure, the reviewer checks whether the observation, scope of investigation, hypotheses tested, impact assessment, and decision are consistent. For RM-427, the record must show what may be done with the material and on what basis the responsible person made that decision. Contradictions and remaining uncertainty are addressed explicitly.

A useful closure note names the documents assessed, the cause or most likely explanation, the affected objects, and the linked actions. If an effectiveness check is performed later, it needs its own owner, due date, and documented link back to the case. The closure criteria are defined in the organization’s quality procedure.

Recurring events must be considered in the overall quality review. EU GMP Chapter 1, section 1.10 includes significant deviations, investigations, and the effectiveness of CAPA in the Product Quality Review. Under 21 CFR 211.180(e), US CGMP requires a quality evaluation at least annually, based on records suitable for that purpose. ^{[7] [14]}

420+ provides the documented process context. The reliability of input data, expert assessment, the qualification of those involved, and the validation required for the intended use remain the organization’s responsibility. Software does not take that responsibility over.

An FDA case shows the gap between report and impact assessment

In its Warning Letter to Sovereign Pharmaceuticals dated October 5, 2022, the FDA criticized, among other things, the firm’s response to stability chamber deviations. In the agency’s assessment, the response lacked sufficient data on the impact on stability samples as well as a retrospective review of comparable events and affected systems. ^[15]

For the internal review of RM-427, this raises a practical question: Is the justification for the chosen scope of investigation sufficient? A case can contain fully completed fields and still leave open whether other materials may be affected. The reviewer should be able to follow the decision from the attached evidence.

Frequently asked questions about deviation management

Does every deviation have to trigger its own CAPA?

The investigation determines the required actions. ICH Q10 links CAPA with structured investigations and handling commensurate with the risk. Whether a separate CAPA is needed is a documented, justified decision; an immediate action and a systemic action addressing the cause serve different purposes.

Is there a general 30-day closure deadline?

EU GMP, ICH Q10, and 21 CFR do not specify a uniform deadline for all deviations. The operational procedure sets risk-appropriate due dates and rules for justified extensions and escalations.

Is RM-427 released once the follow-up task is completed?

The follow-up task documents the inspection. Material release remains a separate quality decision by the responsible Quality Control function. Completion alone does not answer the question of permissible use.

How is a later SOP version taken into account?

The executed task retains its original SOP snapshot. A new version is introduced in a controlled manner; it does not retroactively change the record of the earlier execution.