Deviation management: a practical guide to the full lifecycle
A working guide to deviation management for pharma and medical device manufacturers: detect, contain, classify by risk, investigate, decide disposition, link to CAPA and trend.
A filling line stops because the checkweigher rejected a run of vials. A label roll from a new supplier turns out to carry last year's artwork. An operator realises halfway through a shift that the cleaning log for the granulator was never signed. Each of these is a deviation, and each will be judged by an inspector on the same questions: did you notice quickly, did you protect the product, did you find out why, and did you stop it happening again? This guide walks through the deviation management lifecycle in the order the work actually happens, with the regulatory references behind each step and the practical decisions that tend to separate a clean file from an inspection finding.
What counts as a deviation
A deviation is a departure from an approved instruction or an established standard: a batch record step, an SOP, a specification, a validated parameter, an environmental limit. The EU GMP Guide is direct about it. Chapter 5, paragraph 5.15 says any deviation from instructions or procedures should be avoided as far as possible, and that if one occurs it should be approved in writing by a competent person, with Quality Control involved when appropriate. Chapter 1, paragraph 1.8(vii) requires significant deviations to be fully recorded and investigated with the objective of determining the root cause, with corrective and preventive action implemented.
Medical device manufacturers working to ISO 13485:2016 will recognise the same territory under different words. The standard talks about nonconforming product (clause 8.3), analysis of data (8.4) and corrective action (8.5.2). Many device companies cover process deviations and product nonconformities in one procedure, which works if it states which records need a product disposition.
The practical test for "is this a deviation?" is whether something that should have happened by a written rule did not, or something happened that the rule did not allow. Complaints, out-of-specification results and audit findings usually have their own procedures; write down where the boundaries sit, or one event gets logged three times.
Planned vs unplanned deviations
An unplanned deviation is discovered after the fact: the wrong lot of excipient was dispensed, a temperature excursion ran overnight, a step was skipped. It goes straight into the lifecycle below.
A planned deviation is a deliberate, temporary departure that is assessed and approved before it happens. A typical example is running one batch with an alternative, already qualified piece of equipment while the usual one is under repair, or using a revised sampling plan for a defined number of lots. The record should hold the justification, the risk assessment, the scope (which batches, which dates), QA approval before execution, and a check afterwards that the conditions were met.
Two warnings from experience. First, a planned deviation must never be used to get around change control. If the same "temporary" departure is approved three times, it is a permanent change and belongs in the change control system with validation behind it. Second, a planned deviation cannot authorise a breach of the marketing authorisation or a registered specification. If that is what the plan needs, the route is a variation to the authorisation.
Step 1: Detect and record at the time
The quality of every later step depends on the first record. It should be written by the person who found the problem, as close to the event as possible, and it should state facts: what was observed, where, when, which batch, equipment or material, and what the procedure required. Opinions about cause belong later.
Make reporting easy and safe. If operators fear blame, deviations surface at batch record review days later, after the evidence has gone. A short initial entry that anyone on the floor can complete in minutes, with QA notified automatically, helps detection more than any poster about speaking up.
Step 2: Contain the impact
Containment is what you do in the first hours to stop the problem spreading, before you know why it happened. Typical actions include placing the affected batch, materials or devices on hold, stopping the line, segregating stock, checking whether the same lot of component went into other batches, and asking the warehouse whether anything has already shipped.
Record each containment action with who did it and when. An unexplained gap of days between discovery and containment is a finding in its own right. Containment also feeds the scope question every investigation must answer: which other batches, products or sites could be affected?
Step 3: Classify by risk
Classification decides how much investigation effort the deviation gets, how fast it must close, and who approves it. Most companies use three levels.
| Class | Typical meaning | Example |
|---|---|---|
| Minor | No credible impact on product quality, patient safety or data integrity | A logbook entry completed late but with evidence the activity happened on time |
| Major | Potential impact on quality or compliance that needs investigation before disposition | An in-process control missed for one sampling point on a validated process |
| Critical | Likely impact on patient safety or product quality, or a serious GMP breach | Wrong label applied to a sterile product, or sterility assurance compromised |
The definitions matter less than applying them consistently. Write decision criteria into the procedure (product contact, sterility, potency, traceability, data integrity, regulatory filing impact) and make the classifier record why they chose the level. ICH Q9(R1), revised in 2023, adds explicit guidance on managing subjectivity in risk assessments and on matching the formality of the assessment to the level of risk. In practice, that means a minor deviation can be assessed in a paragraph, while a critical one deserves a structured risk assessment with the evidence attached.
Revisit the classification once the investigation has facts. A deviation logged as minor that turns out to affect three batches should be upgraded, with the reason recorded.
Step 4: Investigate the root cause
EU GMP Chapter 1, paragraph 1.4(xiv) sets the bar: an appropriate level of root cause analysis should be applied, determined using quality risk management principles. Where the true root cause cannot be found, the most likely causes should be identified and addressed. And where human error is suspected, it should be justified, having made sure that process, procedural or system-based problems have not been overlooked.
That last sentence is the one inspectors use most. "Operator error, operator retrained" closes a file quickly and almost never stops recurrence. Ask why the error was possible. Was the batch record step ambiguous? Were two similar materials stored side by side? Was the operator signed off on the current SOP revision, or the previous one? Was the shift short-staffed?
Choose the tool to fit the problem. Five whys works for a single linear failure. A fishbone diagram helps when several factors could contribute. A timeline reconstruction is often the most useful of all for temperature excursions and mix-ups. Whatever the method, the investigation report should show the evidence for the conclusion, the alternatives that were considered and ruled out, and the scope assessment of other affected batches.
Step 5: Decide disposition
Disposition is the decision about the product: release, rework, reprocess, reject, or for devices, accept under concession. It is a quality decision and should be made by someone with the authority to make it, on the basis of the investigation and risk assessment.
For medicinal products, Annex 16 of the EU GMP Guide, section 3, allows a Qualified Person to consider certifying a batch affected by an unexpected deviation only where registered specifications are met, the deviation has been thoroughly investigated and the root cause corrected, and a quality risk management process has concluded that the impact on quality, safety or efficacy is negligible. The same deviation recurring is, by definition, no longer unexpected.
For medical devices, ISO 13485:2016 clause 8.3.2 allows nonconforming product to be accepted by concession only where a justification is provided, approval is obtained and regulatory requirements are met, with the identity of the person authorising the concession recorded. If nonconforming product is found after delivery, clause 8.3.3 requires action appropriate to the effects, which may lead into vigilance reporting under Article 87 of EU MDR 2017/745 if a serious incident or field safety corrective action is involved.
Step 6: Link to CAPA
Not every deviation needs a CAPA. A one-off minor event with a clear, contained cause can be closed with a correction. A deviation needs a CAPA when the root cause points to a systemic weakness, when it recurs, or when the risk is high enough that relying on the correction alone would be unwise.
The link should be explicit in both records. The deviation states which CAPA addresses its root cause; the CAPA lists every deviation it is meant to prevent. That two-way link is what lets you show, at effectiveness review, that the same problem has not come back. It also satisfies Article 10(9) of the EU MDR, which requires a device manufacturer's quality system to cover the management of corrective and preventive actions and verification of their effectiveness. ISO 13485 clause 8.5.2 asks for the same.
Step 7: Trend deviations across time
A single deviation tells you about an event. A year of deviations tells you about your system. EU GMP Chapter 1, paragraph 1.10(iv) requires the product quality review to include all significant deviations, their investigations and the effectiveness of the resulting CAPAs. ISO 13485 clause 8.4 requires analysis of data, which in practice includes nonconformity trends.
Trend more than the count. Useful cuts are root cause category, process step, product, equipment, area, shift and time to closure. Look for repeat root causes under different deviation numbers, such as three "unrelated" labelling errors on the same packaging line in a quarter. Also watch the share of deviations closed as human error: if it is high, your investigations are probably stopping too early.
Treat a rising backlog of open deviations as a quality signal. Inspectors routinely ask for the list of open deviations with their age, so know yours before they do.
What deviation management software should do
Paper and spreadsheets make the hard parts harder: linking to CAPAs, enforcing approvals and trending across years. When evaluating deviation management software, check that it records the initial report with a timestamp and the reporter's identity; guides classification with your own risk criteria; holds the investigation, evidence and disposition in one record; requires approval through electronic signatures that meet EU GMP Annex 11 expectations; keeps an audit trail that cannot be edited; links deviations to CAPAs in both directions; and lets you filter and trend by root cause, product and area without exporting to a spreadsheet.
In a demonstration, ask to see a reclassification and a deviation linked to an existing CAPA; those paths show the most.
Takeaway
Run deviations as one lifecycle with clear hand-offs: record facts at the time, contain within hours, classify against written criteria, investigate past "human error", decide disposition with the right authority, link systemic causes to CAPA, and trend the whole population at least quarterly. The EU GMP Guide, EudraLex Volume 4, and ISO 13485:2016 set the expectations; your procedure should show, step by step, how you meet them.
If you want that lifecycle in one place, with risk classification, investigation, disposition and CAPA links held in a single record, see how InnoQualis handles deviation management.
