How to write a deviation report: format, fields and a worked example
The fields a GMP deviation report needs, the writing rules that make it stand up at inspection, and a complete worked example from a fictional packaging line.
You have a deviation open, the investigation is mostly done, and now someone has to write it up so that QA can approve it, a Qualified Person can rely on it, and an inspector reading it in two years can follow the logic without phoning anyone. That write-up is the deviation report. This article gives you the format and the fields that a GMP deviation report needs, the writing habits that make it hold up, and a complete worked example from a fictional packaging line that you can use as a model for your own template.
What a deviation report has to prove
A deviation report has one job: to show, with evidence, that the event was understood and that the product and the system were protected. The EU GMP Guide asks for exactly that. Chapter 1, paragraph 1.8(vii) requires significant deviations to be fully recorded and investigated with the objective of determining the root cause, with corrective and preventive action implemented. Chapter 4, paragraph 4.29 lists investigations into deviations among the activities that need written procedures and records of the actions taken and conclusions reached. Batch processing and packaging records (paragraphs 4.20 and 4.21) must note special problems, with signed authorisation for any deviation from the instructions.
So the reader should be able to answer five questions from the report alone. What happened, compared with what should have happened? What was done immediately? Why did it happen? What does it mean for the product? What will stop it happening again? If any answer depends on knowledge that is in someone's head, the report is not finished.
The deviation report format: the fields
Most companies use the same core fields whether the report lives on paper, in a spreadsheet or in an eQMS. The order below follows the order in which information becomes available, which makes the report easier to fill in as the work progresses.
| Field | What to write |
|---|---|
| Deviation number and title | A unique ID and a short factual title: product, event, area |
| Type | Planned or unplanned |
| Dates and times | When it occurred, when it was discovered, when it was reported |
| Reported by | Name and role of the person who found it |
| Area, process step, equipment | Where it happened, with equipment IDs |
| Products and batches | Product name, strength, batch numbers, quantities |
| Requirement | The SOP, batch record step, specification or limit, with document number and revision |
| Description | What was observed, in factual terms |
| Immediate actions | Containment: holds, segregation, line stops, checks of other batches |
| Initial classification | Minor, major or critical, with the reason |
| Scope and impact assessment | Other batches, products, sites or records that could be affected, and the evidence for each conclusion |
| Investigation | Method used, evidence reviewed, people interviewed, causes considered and ruled out |
| Root cause | The cause or most likely cause, stated plainly |
| Final classification | Confirmed or changed, with the reason |
| Disposition | Release, rework, reject or concession, and who decided |
| CAPA | Reference to the CAPA record, or a justification for none |
| Approvals | Investigator, area owner, QA, with dates and signatures |
Two fields deserve more care than they usually get. The requirement field forces the writer to name the exact rule that was broken, which removes most vague descriptions at a stroke. The scope and impact field is where inspectors look first, because a report that concludes "no impact" without showing which other batches were checked is a report that has not looked.
How to write each section so it holds up
Description: facts, numbers and the source
Write what was seen, measured or found, with quantities and times, and say where the information came from. "During line clearance on 3 March at 14:10, the packaging operator found 40 patient information leaflets of revision 06 in the leaflet magazine; the batch packaging record specifies revision 07" is a description. "Wrong leaflets were found on the line" is a headline.
The MHRA's GxP data integrity guidance sets out the ALCOA+ principles: records should be attributable, legible, contemporaneous, original and accurate, as well as complete, consistent, enduring and available. A deviation report is a GMP record like any other, so the same applies. Write the initial description on the day, by the person who found it, and keep later additions clearly dated and attributed.
Immediate actions: what and when
List each containment action with the time and the person. The reader is checking that the product was protected within hours, so the timeline matters as much as the action.
Investigation and root cause: show the reasoning
State the method (five whys, fishbone, timeline reconstruction), the evidence reviewed and the causes you ruled out, with the reason for ruling each out. EU GMP Chapter 1, paragraph 1.4(xiv) expects that where human error is suspected, it is justified only after checking that process, procedural or system-based problems have not been overlooked. A report that says "operator error" without explaining why the error was possible will usually come back from QA, and if it does not, it may come back from an inspector.
Disposition: the decision and the authority
State the decision on the product and name the person who made it. For medicinal products, a Qualified Person can only consider certifying a batch affected by an unexpected deviation under the conditions in Annex 16, section 3: registered specifications met, the root cause investigated and corrected, and a quality risk management conclusion that the impact is negligible. The MHRA Inspectorate published a clear explanation of how QPs should handle unexpected deviations that is worth reading alongside your disposition section. For medical devices, ISO 13485:2016 clause 8.3.2 requires a justification, approval and the identity of the person authorising any concession.
Deviation report example
The following is a fictional example. The company, product and people are invented, and it is shortened for reading, but every field is filled in the way a reviewer would expect.
Deviation number: DEV-2026-0147
Title: Superseded patient leaflet found in leaflet magazine, Packaging Line 2, Product A 20 mg tablets
Type: Unplanned
Occurred / discovered / reported: Between 09:30 and 14:05 on 3 March / 14:10 on 3 March / 14:25 on 3 March
Reported by: Packaging operator, Line 2
Area and equipment: Secondary packaging, Line 2, cartoner CT-02
Products and batches: Product A 20 mg, batch A20-2611, 4,800 cartons packed at time of discovery
Requirement: Batch packaging record BPR-A20-03, step 4: leaflet revision 07. SOP PK-011 rev 05, line clearance.
Description: During the mid-batch line clearance check, the operator found 40 leaflets of revision 06 in the leaflet magazine of CT-02. Revision 07 adds a new interaction warning and became effective on 17 February under change control CC-2026-031. Leaflet reconciliation showed revision 07 issued from the warehouse; the revision 06 leaflets were not on the issue record.
Immediate actions: 14:12, line stopped by the line leader. 14:20, batch A20-2611 placed on QA hold, all packed cartons quarantined. 14:40, warehouse confirmed no cartons from this batch had been dispatched. 15:30, QA checked the two other batches packed on Line 2 since 17 February; both leaflet reconciliations showed revision 07 only, and retained samples contained revision 07.
Initial classification: Major. A superseded leaflet missing a safety warning could reach patients.
Scope and impact: Limited to batch A20-2611 on the evidence above. A 100% inspection of the 4,800 packed cartons found 212 containing revision 06 leaflets.
Investigation: Timeline reconstruction and five whys; review of the change control record, warehouse movements and the line clearance checklist; interviews with the line leader, two operators and the warehouse supervisor. The revision 06 leaflets came from a part-used box returned to the Line 2 staging rack after an earlier batch in January. Change control CC-2026-031 required withdrawal of revision 06 stock from the warehouse but did not mention part-used stock held on the packaging floor. The line clearance checklist asks operators to confirm "no previous materials" but does not ask them to check the revision code of leaflets already in the magazine. Operator error was considered and ruled out as the root cause: the operator followed the checklist as written.
Root cause: The change control procedure for packaging material revisions does not require withdrawal of superseded material from production areas, and the line clearance checklist does not include a revision check.
Final classification: Major, confirmed.
Disposition: Rework. All 4,800 cartons opened under supervision, every leaflet replaced with revision 07, followed by a second 100% check and reconciliation. Batch released by the QP after review of this report.
CAPA: CAPA-2026-022: revise the change control SOP to require withdrawal of superseded printed materials from all areas, including the packaging floor; add a leaflet revision check to the line clearance checklist; retrain packaging staff on both changes; effectiveness check after three months.
Approvals: Investigator, packaging manager and QA manager, each signed and dated.
Common weaknesses in deviation reports
The same problems turn up again and again. Descriptions that give conclusions instead of observations. Scope sections that say "no other batches affected" without listing what was checked. Root causes that stop at the person. Classifications that never get revisited after the facts come in. CAPAs that retrain the operator while the procedure that allowed the error stays unchanged. Each of these can be caught by a reviewer who reads the report as a stranger would, asking at each section whether the evidence is on the page.
Takeaway
Build your deviation report template around the fields in the table above, write the description on the day with numbers and sources, show which batches you checked, and do not accept a root cause that ends with a person. The worked example is a reasonable benchmark for depth: one page for the facts, evidence for every conclusion, and a clear line from root cause to CAPA. The EU GMP Guide, EudraLex Volume 4, is the reference to cite in your procedure.
If you would rather fill those fields in a structured record with risk classification, investigation, disposition and CAPA links built in, see how InnoQualis handles deviation reports.
