When an inspector wants to understand a site quickly, they do not start with the validation master plan. They ask for the deviation log, the full list, unfiltered, including everything still open, and they read the age profile before they read a single investigation. Thirty deviations open past their target closure date tells them something. Three hundred tells them something else. A log where every entry is closed on time and every root cause is “operator error” tells them the most of all, because it means the system is generating paperwork rather than knowledge.
Deviation management is where a pharmaceutical quality system either works or quietly stops working. Every other element depends on it. Your product quality reviews are only as good as the deviations feeding them. Your CAPA system inherits whatever causal reasoning your investigations produced. Your process validation lifecycle assumes deviations are detected and understood. When deviation handling degrades, nothing announces it. The metrics still look fine, right up until an inspector reads three investigations and finds the same underlying failure described three different ways.
What the regulations actually require
The requirements are less prescriptive than most people expect, and more demanding than most people implement.
EU GMP treats deviation handling as a core element of the pharmaceutical quality system. Chapter 1 states in the GMP principles that any significant deviations are fully recorded, investigated with the objective of determining the root cause, and appropriate corrective and preventive action implemented. The pharmaceutical quality system section is more explicit still: it requires that an appropriate level of root cause analysis be applied during the investigation of deviations, suspected product defects and other problems, that CAPAs be identified and taken in response, and that their effectiveness be monitored. Chapter 1 also requires the Product Quality Review to cover all significant deviations and non-conformances, their investigations, and the effectiveness of the resulting CAPAs.
Chapter 5 adds operational requirements. Deviations from instructions or procedures should be avoided as far as possible, and where one occurs it should be approved in writing by a competent person, with Quality Control involved where appropriate. Any significant deviation from expected yield must be recorded and investigated. Significant or unusual discrepancies in packaging reconciliation must be investigated and satisfactorily accounted for before release.
ICH Q10 frames the same expectation as a system. It requires a CAPA system covering actions arising from complaints, product rejections, non-conformances, recalls, deviations, audits, regulatory inspections and findings, and trends from process performance and product quality monitoring, and calls for a structured approach to investigation aimed at determining root cause. Critically, Q10 applies proportionality: the level of effort, formality and documentation should be commensurate with risk. That principle is your defence against treating a labelling typo the same way you treat a sterility excursion, and your obligation when the reverse applies.
FDA is blunter. 21 CFR 211.100(b) requires that written procedures be followed, and that any deviation from the written procedures shall be recorded and justified. 21 CFR 211.192 requires that any unexplained discrepancy, or failure of a batch or component to meet specification, be thoroughly investigated whether or not the batch has already been distributed. That investigation must extend to other batches of the same drug product and to other drug products that may have been associated with the failure, and a written record of the investigation, including conclusions and follow-up, must be maintained.
Two points are worth pulling out. First, neither EU GMP nor 21 CFR sets a numerical closure deadline. Thirty days is an industry convention, not a legal requirement, but once you write it into your SOP it becomes an inspectable commitment, and breaching your own procedure is a finding in itself. Second, the regulations do not define minor, major and critical. That classification framework is yours to define and defend, which means the definitions, and their consistent application, are fair inspection targets.
Planned deviations
The term is obsolete and using it invites scrutiny. Regulators have progressively withdrawn it, on a simple logical basis: if you knew about it in advance, it was not a deviation. It was a change. Anything foreseen and approved before execution belongs in change control as a temporary or short-term change, with a defined expiry, a risk assessment and a return path to the approved state. Sites still running a “planned deviation” category are usually using it to bypass change control governance, and inspectors know exactly what they are looking at. A high volume of temporary changes is itself a signal that your registered process does not match the process you can actually run.
Where deviation systems fail in practice
Root cause that is not a cause. “Human error” is the dominant failure mode across the industry. It is a description of what happened, not an explanation of why. An operator who performs a step incorrectly is operating inside a system of procedures, training, interface design, workload, shift patterns and supervision, and it is that system that failed. The test is simple: if your corrective action is “retrain the operator” and nothing about the procedure, the equipment or the workload changes, you have not identified a cause. You have identified a person. Proper root cause analysis in a GMP context requires you to keep asking why until you reach something you can change.
Weak initial description. The investigation is largely determined in the first hour. A deviation raised as “issue with filling line” cannot be investigated well three weeks later, because the transient evidence is gone: the ambient conditions, the operator’s account, the equipment state, the batch context. Vague initial descriptions are the leading cause of investigations that stall and then get closed on assumption.
Scope that never expands. 21 CFR 211.192 explicitly requires the investigation to extend to other batches and other products. In practice, most investigations stop at the batch in front of them. If a filter integrity failure is caused by a supplier change, the scope is every batch filtered since that change, not the one that happened to be tested. Under-scoping is one of the most consequential failures, because it is the one that leads to recalls.
Timeline breaches treated as administrative. Overdue deviations get extension requests, and extension requests get approved without anyone asking why. The pattern matters more than any individual case: a persistently overdue backlog means your quality unit is under-resourced or lacks the authority to compel input from production. Both are systemic findings.
No trending, or trending that changes nothing. Individually minor deviations are where the real intelligence sits. Twelve separate minor deviations on the same piece of equipment across a year is a qualification problem that no single investigation would ever surface. Trending must be by cause, equipment, process step, product and shift, not just by count, and the output must be visible at management review with decisions recorded against it. Trending that produces a chart nobody acts on is worse than no trending, because it documents that you knew.
Repeat deviations not recognised as repeats. Recurrence is the single most damaging thing an inspector can demonstrate, because it proves your CAPA system does not work. Most sites cannot detect their own repeats: the same event gets described in different words by different authors, so a keyword search finds nothing. This is a taxonomy problem. Without a controlled cause classification, recurrence is invisible until an inspector spots it by reading.
Retrospective raising. Deviations identified during batch record review, weeks after the event, and documented as though contemporaneous. This stops being a deviation problem and becomes a data integrity problem, and it escalates the severity of the finding considerably.
Closure without effectiveness. A deviation closed on the basis that a CAPA was raised is not closed. CAPA effectiveness has to be verified against defined criteria at a defined point in the future, and that verification has to be capable of failing.
What inspectors actually look for
MHRA’s published deficiency data has consistently shown Chapter 1 as the most cited chapter, by a wide margin, and a dominant source of both critical and major deficiencies. Among critical citations, the root cause analysis requirement and the requirement to investigate significant deviations appear repeatedly. This is not incidental. It reflects a deliberate inspection focus on whether the quality system is generating understanding.
FDA warning letters follow a recognisable pattern. The citation is 21 CFR 211.192, and the language is that the firm failed to thoroughly investigate any unexplained discrepancy or failure of a batch or any of its components to meet any of its specifications. Where the finding is systemic, FDA typically demands a comprehensive, independent assessment of the entire system for investigating deviations, discrepancies, complaints, out of specification results and failures, covering investigation competency, scope determination, root cause evaluation, CAPA effectiveness and quality unit oversight. That remediation demand is expensive, public and slow.
In practice, an inspector will:
- Take the deviation log and select their own sample, weighted towards long open, recently closed and repeat events. Never the ones you offer.
- Read your classification SOP, then check whether a sample of deviations is classified consistently with it.
- Trace one deviation end to end: initial notification, impact assessment, batch disposition decision, root cause, CAPA, effectiveness check.
- Compare a deviation on the shop floor logbook against the QMS record, testing whether everything that should be raised is being raised.
- Ask the Qualified Person how unexpected deviations were assessed prior to certification.
- Look for the same cause appearing in more than one investigation.
What good looks like
A functioning system has a few observable characteristics. Deviations are raised within a defined short window of discovery, by the person who saw it, with enough factual detail to investigate later. Triage happens quickly and separates immediate product impact decisions from the longer investigation. Classification is driven by patient risk and product impact, applied against written criteria, and reviewed for consistency rather than assumed.
Investigation depth is proportionate to classification, and the tools are matched to the problem: a structured technique for anything major or above, and a documented rationale for why that technique was appropriate. Causes are recorded against a controlled taxonomy so that recurrence can be detected automatically. Corrections, corrective actions and preventive actions are distinguished from one another rather than collapsed into a single field. Effectiveness checks have pre-defined acceptance criteria and a real possibility of failing.
Above all, the system produces intelligence that reaches decision makers. Deviation trends, recurrence rates, ageing profiles and CAPA effectiveness rates are reviewed by senior management with documented decisions and resource commitments. If your deviation data has never caused management to change a plan or fund something, it is not being used.
Frequently asked questions
What is a deviation in GMP?
A deviation is any departure from an approved instruction, procedure, specification or established standard. It covers unplanned events during manufacturing, packaging, testing, storage and distribution. The defining characteristic is that it was not foreseen. Anything known and approved in advance is a change, and belongs in change control.
How long do you have to close a GMP deviation?
Neither EU GMP nor 21 CFR sets a numerical deadline. Thirty days is a widespread industry convention rather than a legal requirement. What matters at inspection is that you meet whatever timeline your own procedure commits you to, and that extensions are justified rather than routine. A large or ageing backlog is read as a resourcing or authority problem in the quality unit.
Is “human error” an acceptable root cause?
Not on its own. Human error describes what happened rather than why it happened. Inspectors expect the investigation to continue into the conditions that allowed the error: procedure clarity, training effectiveness, interface or equipment design, workload and supervision. If the only corrective action is retraining, the investigation is generally treated as incomplete.
What is the difference between a deviation and a change?
Timing and intent. A deviation is unplanned and identified after the fact. A change is proposed, assessed and approved before it is made. The term “planned deviation” is obsolete because it describes a change that has bypassed change control governance, which is precisely why it attracts scrutiny.
Does every deviation need a CAPA?
No. The response should be proportionate to risk, which is explicit in ICH Q10. A minor, isolated event with no product impact may need a correction and nothing more. What is not acceptable is a system where significant or recurring events routinely close without corrective action, or where a CAPA is raised and the deviation is closed before its effectiveness has been verified.
Closing
Deviation management is not a documentation exercise. It is the mechanism by which your site notices that something has changed, and decides what to do about it. Sites that treat it as a compliance obligation generate volume and learn nothing. Sites that treat it as a knowledge system detect problems early, and their inspection outcomes reflect that.
The most useful audit you can run is not against your SOP. It is to pull ten closed deviations at random, read the root cause fields, and ask whether a competent stranger could reconstruct why each event occurred. If the answer is no more than half the time, the problem is not your procedure. It is your investigation capability, and that is a training and governance issue rather than a documentation one.
If you want your team working to a consistent standard on this, our Deviation Management in GMP Environments course covers the full lifecycle: classification and risk based triage, investigation technique, scope determination, linkage to CAPA and change control, and trending that stands up under inspection. It is built around the failure modes above rather than around regulatory text, so it is aimed at the people writing and approving investigations day to day.
Not sure where your own system stands? The free GMP self assessment takes about seven minutes and scores your quality system across EU GMP Chapters 1 to 9, including deviations, CAPA and trending.
If the same problems keep returning to your deviation log, the process needs attention rather than the people. Our deviation, CAPA and quality risk management service covers investigations, backlog clearance and CAPAs that hold. Sites with an inspection ahead can start with our inspection readiness support.