Deviation, CAPA and quality risk management

Most quality systems do not fail because deviations occur. They fail because the same deviation occurs repeatedly, the investigations stop at human error, and the CAPAs close without anyone checking whether they worked. We fix the process and, where needed, we clear the backlog.

Human error is almost never a root cause. It is a description of the last event before the problem became visible. If an operator performed a step incorrectly, the useful questions are why the procedure allowed it, why the training did not prevent it, why the equipment made the wrong action possible, and why nothing caught it before the product was affected.

A finding of human error leads to a CAPA of retraining, and retraining almost never works because the person usually knew the correct action already. That is why the deviation recurs, and recurrence is what an inspector notices when reading your log.

We have written about this at length in our article on GMP deviation management, which sets out the eight places deviation systems commonly break down.

Not every deviation deserves a full root cause investigation, and treating them all identically is a reliable way to create a backlog. A triage step that classifies deviations by potential product impact and by whether the cause is already known allows minor events to close quickly and concentrates real effort where it changes something.

The risk in triage is that it becomes a route to downgrade inconvenient events. We build it with defined criteria and a check on the classification, so the categories mean something.

Three tests decide whether a CAPA is real. Does it change the system rather than the person. Is it specific enough that someone else could verify it happened. And is there an effectiveness check with a defined measure and a date, some months after implementation, that would actually detect failure.

The most common weakness we find is an effectiveness check that confirms the action was completed rather than that the problem stopped. Confirming the new procedure was issued is verification. Confirming that the deviation has not recurred in the six months since is effectiveness. Inspectors know the difference.

A backlog is rarely a capacity problem alone. It usually means the process demands more effort per record than the events justify, so records queue. Adding people to an unchanged process buys a few months.

We approach it in two parts. First the process is adjusted so that new events close at a sustainable rate, otherwise the backlog rebuilds behind the clearance work. Then the existing records are triaged by risk and closed in order, grouped where several share one cause. Grouping is usually where the time is recovered, because a backlog of forty records often contains six real problems.

Risk management under ICH Q9 is meant to support decisions. In practice it often becomes an exercise performed after the decision, to document it. The result is a register nobody consults and scores nobody believes.

We keep it useful by matching the tool to the question. A structured FMEA where the process is complex and the failure modes are worth enumerating. A short, documented assessment where the question is narrow. And a risk register that is reviewed on a schedule and actually influences what gets funded.

How many deviations is too many?

There is no target number, and a suspiciously low count worries an inspector more than a high one. It suggests events are not being raised. What matters is whether they are found, investigated proportionately, closed on time, and not recurring.

Do you perform the investigations for us?

We can, and for a backlog that is often the fastest route. For the long term it is better that your own people can do it, so we usually combine some direct investigation with coaching on live cases. Training on real deviations works far better than training on examples.

Which root cause method should we use?

Whichever your people will use properly. The five whys is adequate for straightforward events if it is not stopped early. A fishbone works well for events with several contributing factors. The method matters less than whether anyone challenges the first plausible answer.

Our CAPAs keep getting extended. Is that a problem?

Repeated extension is one of the first things an inspector looks for, because it indicates either unrealistic commitments or a system nobody is driving. A single extension with reasoning is defensible. A pattern is not.

Can you help with a specific serious deviation?

Yes. An independent investigator is particularly valuable where the cause may sit within the department that would otherwise investigate itself.