Deviations, incidents or investigations – whatever you call them – require an efficient and effective system for review and approval. The ease of the review and approval steps, and your ability to feedback weaknesses in the report, will come down to the foundational systems you have in place for consistency. Fundamentally, deviations need to meet the requirements of U.S. FDA 21 CFR 211.100 and EU GMP 5.15, 1.8 (vii) and 1.4 (xiv). First, we should ensure absolute clarity on the process which is likely to be in line with the following diagram:

We need to be very clear on responsibilities. Operations should investigate and QA should be independent oversight. QA should not investigate or write deviations. Looking at the deviation system we are looking at a very logical flow, from identifying the problem through to the initial assessment. This is a key step where we need to ensure that there is a consistent approach, done at the place that the deviation occurred and collecting a defined set of information. Create a structured form to ensure consistency in approach. Always think:

Who? Operator, verifier, QA, engineering, others

Product, product code

  • Batch Number
  • Sequence of events leading up to the deviation
  • How was the event detected?
  • What actions were taken in response to the event
Where? Facility, room, equipment
When? Date, time, duration of the event
Prevent further use of adversely
affected material for now
Consider the boundary of the event – is it limited to this occasion?
Can you prove that?
Consider potential need for
external communication


  • Regulators – potential for recall or batch-specific variation
Collect process background Specification ranges, setpoints or other relevant process information that could be useful to describe what went wrong

As soon as possible you will get your corrections in place. This just brings you back to where you were before the event occurred; for example, if you had a spillage you would clear up and dispense new materials. Then we have a need for a formal notification. This ensures people outside of the department are made aware of the issue. At this stage, a documented risk assessment needs to take place. The department responsible should do the assessment and make a proposal but in the event of disagreement, the final decision should be with QA. This just stops disagreements from escalating.

With this initial risk assessment, you’re looking at what is possible in terms of the potential for patient impact and you very quickly need to work out whether this is a significant issue which requires a team to investigate. There may be a need to notify your regulator if the event meets the EU GMP Annex 16 Unexpected Deviation criteria. There may be a need to consider the potential for a recall.

Then the investigation itself happens. Your investigators need certain capabilities and a certain skill set to enable them to do that investigation. They should be curious, want to do the role and want to understand the minutiae. For them, it’s not a punishment to undertake the investigation.

Once all the data and facts associated with the event are available, conduct a root cause analysis exercise to work out why it happened, looking to identify the process and system gaps that have enabled this to occur.

Your corrective action will prevent re-occurrence of the specific incident. During the subsequent monitoring period, check that the actions have helped. There may also be appropriate preventive actions to prevent this event from happening in other departments or sites.


To support this overall process we need a framework in place. There are the obvious elements:


The high-level policy


The procedures addressing how to use the computer system


The procedures that cover the investigation, the tools to be used and the report requirements

In addition, we need access to expert knowledge of products, processes, procedures and practices.

Once all the work is done it is critical to clearly communicate this in the report, which needs to:

Tell the full story
Give assurance that all product affected by the deviation is safe and effective for release and distribution
Demonstrate an understanding of the issue to ensure prevention of a recurrence

The report should flow logically, recording your investigation with enough details to show what has been considered, use as few words as possible and be supplemented with pictures, diagrams and schematics. Use bullet points and the “right” language in line with technical writing skills:

  1. Use good grammar
  2. Write concisely
  3. Use the active voice (for example, “Close the door.” versus “The door should be closed.”)
  4. Use positive statements such as “Leave the valve open” rather than “Do not close the valve”.
  5. Avoid big words and long sentences (ideally no longer than 15-20 words)
  6. Punctuate correctly

To reach the right degree of consistency, the writers, reviewers and approvers should develop a standards document, the core of which is considered in the following tables:

Who Personnel that:
> found the event
> are involved in the event – for trending, not disciplinary
> are consulted
> are informed
Formally record the interviews
What Check for consistency throughout report focus on:
> Lot number
> Lot identification (Item number) –
> Equipment and equipment number
Confirm an adequate description of the issue and the actual deviation (what happened and
what was supposed to have happened), for example:
> Product ABCD failed in-process moisture testing with a result of 22 (specified limit
15 to 20).
> Procedure xyz was not followed. The requirement is X but instead, B was completed.
Consider potential for impact to stability
Boundary Documented evidence identifying all product, lots, materials, equipment or systems
potentially affected
> Limit to this batch / occasion – justification?
> Consider all possibilities initially and explain rationale for limitations.
Where Document the “scene” visit:
> Room identification
> Equipment
> GMP / non-GMP areas
“event” process
> Confirm the risk prioritisation number has led to the appropriate classification (critical,
major, other or repeat other) and that requirements have been met
> Perform any additional testing / trials for verification subject to protocols
> Document root cause analysis
> Logically categorise root cause
> Consideration of recall / field alerts
> Customer notification (signed version required / available?)
Conclusion > Final conclusion – what happened and why (root cause, most likely root cause)
• Must state impact to batch as a consequence of this event
• Could there be any other batches/materials/equipment affected?
• If “no impact,” ensure justification
> How was the issue corrected and how will recurrence be prevented?
> Conclusion should “flow” from the investigation and the root cause analysis
Correction At discovery:
Clear training issues must be addressed prior to launching any further batches
Immediate / short-term (pre-approval)
Long-term (post-approval)
Does the action stem from the root cause analysis?
Is it clear what must be done to deliver the action? Is it feasible?
If no actions are required, provide justification
Approach for effectiveness check clearly defined
document pack
Are all the necessary documents included, identified, scanned and legible?
> Interview notes
> Records of investigation
Are all related documents (CAPA, EC) at the proper stages?
Style Requires logical flow
Prefer (not rejectable):
> Fewer words; use bullet points
> More pictures, diagrams, schematics
> The “right” language, i.e. in line with technical writing rules
> The right level of detail
> Completeness
• Show your working – not just the answer

Download the white paper here

About The Author

Rachel Susan Carmichael | Executive Director, Pharmaceutical Services

Rachel Susan Carmichael has over 20 years’ experience of pharmaceutical manufacture, control and quality management including nearly 11 years as a GMDP Inspector for the UK Competent Authority, the MHRA. This includes serving as the lead inspector representative within the MHRA for the transition from the Medicines Act to the Human Medicines Regulation, SI 2012 1916.

Ms. Carmichael is eligible to act as a Qualified Person under the provisions of EU Directives and is a member of the Royal Society of Biology. She has wide-ranging experience of inspecting against European Good Distribution Practice and Good Manufacturing Practice requirements in the UK, China, India and the U.S. to meet the associated quality standards for medicines (non-sterile and aseptic production, including radio pharmaceuticals) and the blood industry.


About NSF

NSF International provides a comprehensive range of support services for the pharmaceutical industry covering consulting and regulatory guidance, training and auditing on a global basis.
We combine experienced industry professionals with former regulatory agency staff (FDA, MHRA, etc) to deliver a unique team that will help you achieve and maintain compliant, future-proof pharmaceutical quality systems.