GMP deviation management: a practical process from detection to closure

A GMP deviation is any departure from an approved instruction, procedure, specification or established standard during manufacturing, testing, storage or distribution. Managing it well means working through a fixed sequence. Record the deviation when it is noticed and contain the affected material. Classify the event by risk and assess its impact on every batch that could be affected. Investigate the root cause to a depth that matches the risk, raise corrective and preventive actions where needed, and only then let QA close the record. US and EU GMP set out what has to happen. Your own procedure decides how fast each step happens.

This guide walks through each step with illustrative examples. It also covers the regulatory basis, the timelines companies typically set for themselves, and the investigation weaknesses inspectors cite most often.

What counts as a deviation

A deviation is a difference between what was approved and what actually happened. Typical unplanned deviations include:

• A process parameter outside its validated range, such as a granulation endpoint reached at the wrong time or a sterilisation cycle that dropped below temperature
• A step performed out of sequence, skipped or performed with the wrong equipment
• A yield outside the limits in the master batch record
• An environmental monitoring result above an alert or action limit
• A missed in-process check, an unsigned entry or a gap in a batch record
• Material used after its retest date, or stored outside its labelled conditions

Many organisations also use planned deviations. A planned deviation is a temporary, pre-approved departure from a procedure for a defined batch or period. One example is using a qualified alternative piece of equipment while the usual one is being repaired. Neither EU GMP nor 21 CFR Part 211 defines the term. It is industry practice, and it only works if the departure is assessed and approved by QA before it happens. If the change is meant to be permanent, it is not a deviation at all. It belongs in change control, which is explained in our guide to change control traceability.

Keep the boundaries with neighbouring processes clear in your SOP. Out-of-specification laboratory results, customer complaints and supplier nonconformances often have their own procedures. They can still trigger or link to a deviation record.

The regulatory basis

The core requirements are short, and inspectors expect you to know them.

United States: 21 CFR Part 211

• 21 CFR 211.100(b) requires that any deviation from written production and process control procedures "shall be recorded and justified".
• 21 CFR 211.192 requires a thorough investigation of any unexplained discrepancy, or of a batch that fails to meet its specifications, "whether or not the batch has already been distributed". The investigation must extend to other batches and products that may be associated with the failure. A written record must include conclusions and follow-up.
• 21 CFR 211.22(a) gives the quality control unit the authority to review production records and make sure errors have been fully investigated.

European Union: EudraLex Volume 4

• Chapter 1, section 1.4(xiv) expects "an appropriate level of root cause analysis" for deviations, scaled using quality risk management. Where the true root cause cannot be found, the most likely cause should be identified and addressed. Human error as a conclusion should be justified, and CAPA effectiveness should be monitored and assessed.
• Chapter 1, section 1.8(vii) requires significant deviations to be fully recorded and investigated to find the root cause and implement appropriate CAPA.
• Chapter 1, section 1.10(iv) includes a review of significant deviations, their investigations and CAPA effectiveness in the annual product quality review.
• Chapter 5, section 5.15 says deviations should be avoided as far as possible. When one occurs, it should be approved in writing by a competent person.
• Chapter 8, sections 8.11 and 8.16 to 8.19 apply the same principles to quality defects: check other batches, apply proportionate root cause analysis, justify human error conclusions, monitor CAPA effectiveness and trend the records.
• Annex 16, section 3 allows a Qualified Person to consider certifying a batch with an unexpected deviation from the marketing authorisation or GMP only if registered specifications are met, the impact has been assessed as negligible and the deviation has been thoroughly investigated.

ICH Q10

ICH Q10 section 3.2.2 expects a CAPA system fed by deviations, complaints, audits and other sources. It says the effort and documentation of an investigation should be "commensurate with the level of risk". That principle explains why deviations are classified in the first place.

Step 1: detect and record

The deviation record should be opened as soon as someone notices the problem, by the person who noticed it or their supervisor. Capture facts, not conclusions:

• What happened, and what the procedure or specification required
• Where it happened: line, room, equipment ID
• When it happened and when it was discovered, which are often different
• Which batches, materials or products are involved
• Who was present, and what was done immediately

Write the description so that someone outside the team can understand it a year later. Recording at the time of the event is a data integrity expectation as well as a GMP one. Our article on ALCOA+ data integrity covers what makes a record attributable and contemporaneous.

Step 2: contain the impact

Containment protects product and patients while the investigation runs. Depending on the event, it can mean:

• Placing affected material, intermediates or finished batches on quality hold or in quarantine
• Stopping the process step or the line
• Segregating suspect equipment or tagging it out of use
• Checking whether batches already released or shipped could be affected

Record every containment action and who authorised it. This is a correction, not a fix. It deals with the immediate consequences but does nothing about the cause.

Step 3: classify and assess impact

Classify the deviation

Classification decides how deep the investigation goes, who must be involved and how quickly it must be escalated. Most companies use three levels. The labels and definitions are company-defined, not set by regulation, so your SOP must state the criteria. The examples below are illustrative only.

• Minor: no plausible impact on product quality, patient safety or data integrity. Illustrative example: a balance printout attached to the wrong page of an otherwise complete batch record, with correct data.
• Major: a potential impact on quality that needs a documented assessment, or a failure of a GMP system that could affect other batches. Illustrative example: a compression machine runs for 40 minutes with a hardness check missed, and later tests on retained samples are needed to confirm the batch.
• Critical: a likely impact on patient safety or product quality, or a serious breach of the marketing authorisation. Illustrative example: a sterilisation cycle record shows a temperature excursion below the validated minimum on a load that has already been released.

Write classification criteria that two QA reviewers would apply the same way. Revisit the classification as facts emerge: a deviation logged as minor can turn major once the investigation finds it has happened on three other lines.

Assess impact on product and batches

Impact assessment answers one question: which batches and products could be affected, and how? Work outwards from the event:

• The batch in which the deviation occurred
• Other batches made with the same material lot, equipment, room or operator during the same period
• Batches that contain portions of the affected batch, as EU GMP Chapter 8 section 8.11 specifically notes
• Batches already distributed, which 21 CFR 211.192 explicitly brings into scope

For products marketed under a US application, a deviation involving a distributed batch can also trigger a Field Alert Report. Under 21 CFR 314.81(b)(1), this is due within three working days of receiving the information. Make sure your procedure links deviation assessment to any reporting obligations, so the deadline does not depend on someone remembering it.

Record the evidence behind your conclusion, for example retained-sample results, stability data or validation ranges. "No impact" with no supporting data is a common inspection finding.

Step 4: investigate the root cause

The investigation should explain why the deviation happened, not only what happened. Use structured tools in proportion to the risk:

• 5 Whys for simpler events with a single chain of cause and effect
• Fishbone (Ishikawa) diagrams to examine people, methods, machines, materials, measurement and environment
• Timeline reconstruction using batch records, equipment logs, audit trails and interviews
• Comparison with similar past deviations, which often shows the true cause is systemic

Be careful with "human error" as a conclusion. Both EU GMP Chapter 1 and Chapter 8 require it to be justified, and they warn against overlooking process, procedural or system causes. If an operator skipped a step, ask why the system allowed it. Was the instruction ambiguous? Was the form badly designed? Was the step easy to miss under time pressure? A clearly written SOP prevents a surprising number of "human error" deviations.

Where the true cause cannot be proven, EU GMP allows you to name the most likely root cause and address it, as long as you document why you reached that conclusion.

Step 5: decide on CAPA

Not every deviation needs a CAPA. A minor, isolated event with a clear cause may need only a correction and a note. If the investigation finds a cause that could recur, raise corrective action to remove it. If it shows the same weakness could cause problems elsewhere, raise preventive action. ICH Q10 and EU GMP Chapter 1 both expect the effectiveness of those actions to be evaluated. Our guide to CAPA effectiveness checks explains how to set measurable success criteria before the action is implemented.

Keep the deviation, the investigation and the resulting CAPA linked, so an inspector can follow the trail in either direction. A dedicated CAPA workflow makes that link explicit rather than relying on reference numbers typed into free-text fields.

Step 6: QA review and closure

Closure is a QA decision. Before approving it, QA should confirm that the investigation answers the original question and that every potentially affected batch has a documented disposition. Any CAPA should be raised and linked, and reporting obligations met. In the EU, Annex 16 expects the Qualified Person certifying a batch to be aware of deviations that could affect GMP or marketing authorisation compliance. The deviation can close while its CAPA, and the CAPA's effectiveness check, stays open.

Timelines: required versus common practice

Neither 21 CFR Part 211 nor EudraLex Volume 4 sets a fixed number of days for closing a deviation. The regulations ask for thorough investigations and timely, risk-based decisions. EU GMP Chapter 8 section 8.13 asks that decisions on quality defects be "timely". The specific deadlines come from your own SOP.

In practice, many companies set targets such as:

• Initial record and QA notification within one working day of discovery
• Classification and initial impact assessment within a few working days
• Investigation completed and the record closed within about 30 calendar days

The 30-day figure is a common industry convention, not a regulatory requirement. Choose targets your team can actually meet, require documented and approved justification for extensions, and make sure batch disposition is never left waiting on an open deviation without QA's knowledge. Inspectors check whether you follow your own procedure, and overdue deviations without approved extensions are easy to spot.

Trending: finding the problems behind the problems

Individual investigations can each look reasonable while the same weakness keeps appearing. Trend your deviations regularly, at least for management review and the product quality review, which EU GMP Chapter 1 section 1.10 requires. Useful groupings include:

• Process step, equipment and area
• Root cause category, such as documentation, equipment, materials or training
• Product and product family
• Time to closure and number of overdue records

Agree in advance what counts as a signal: for example, the same root cause category three times in a quarter. Then make sure a signal leads to a recorded decision.

What inspectors look for

FDA publishes summaries of the observations cited on system-generated Form FDA 483s. In fiscal year 2025, covering inspections that ended between October 2024 and September 2025, 21 CFR 211.192 was cited 164 times on drug inspections. Only 211.22(d), on quality unit procedures, was cited more often. FDA notes that the data does not include manually prepared 483s, so the real figures may be higher.

Investigation findings tend to repeat the same patterns:

• Investigations that stop at the batch in question and do not consider other batches or products
• "Human error" or "operator retrained" given as the root cause without evidence that system causes were ruled out
• Impact assessments concluding "no impact" without data
• Deviations closed with no CAPA despite recurrence, or CAPAs closed without checking effectiveness
• Deviations reclassified downwards, or cancelled, without a documented rationale
• Investigations that miss their own SOP deadlines without approved extensions
• Repeat deviations that were never trended or escalated

A checklist for every deviation record

• Factual description, including what was required and what happened
• Date and time of the event and of its discovery
• Containment actions, with who authorised them
• Classification, with the rationale and any reclassification explained
• Impact assessment covering all potentially affected batches and products, with supporting data
• Root cause analysis proportionate to the risk, and justification if human error is concluded
• Links to the CAPA, change control or complaint records
• Batch disposition decision and QA approval
• Closure within the SOP timeline, or an approved extension

Running this in an eQMS

The process above works on paper. It just gets harder to track and trend as volumes grow. In QFacts, deviations are recorded as events with a QA impact assessment and severity classification. Events with impact move into an investigation, and the investigation links to CAPAs with owners, due dates and an effectiveness check before closure. If you want to test the workflow against your own deviation procedure, you can start a 7-day free trial.