A deviation is any departure from an approved procedure, specification, or established standard during a GxP activity. They happen in every manufacturing facility because operations involve humans, equipment, and materials that don’t always behave as planned.

The measure of a quality system is not whether deviations occur. It’s whether they’re captured, understood, and resolved in a way that protects product quality and prevents recurrence. A facility with no deviations in its records isn’t operating deviation-free. It’s not reporting them, which is worse.

What Triggers a Deviation

Deviations get opened when:

  • A step in a batch manufacturing record wasn’t performed as written
  • A process parameter went outside its specified range during manufacturing
  • A raw material was stored at the wrong temperature
  • Equipment went out of calibration and was used in production before the issue was caught
  • A step was performed in the wrong order
  • The wrong document version was used
  • A sample was handled incorrectly before testing
  • Environmental monitoring results exceeded alert or action limits
  • A system or utility failed during a production run

The triggering event must be documented at the time it’s discovered or as close to it as possible. Deviations written hours or days after the fact raise data integrity concerns. The initial report doesn’t need to be complete, but the time of discovery must be recorded.

Planned vs. Unplanned Deviations

Unplanned deviations are what most people picture: something went wrong unexpectedly. Equipment malfunctioned, an operator made an error, a reagent was added in the wrong sequence.

Planned deviations are intentional departures from a procedure that are approved in advance. If a process step needs to be modified for a specific batch due to known circumstances, a planned deviation (sometimes called a temporary change or exception) can be used. Planned deviations require QA approval before the batch is manufactured, document the specific modification and its rationale, and typically expire after a defined number of batches or time period.

Planned deviations are not a workaround for inadequate procedures. If the same planned deviation is being requested repeatedly, that’s a signal the procedure needs to be updated through change control.

Classification: Critical, Major, Minor

Classification determines the urgency and depth of investigation required. Definitions vary by facility, but the typical framework:

Critical Deviation: The departure could directly affect patient safety, product efficacy, or data integrity in a way that cannot be remediated. A sterile product manufactured after a major HVAC failure, a batch manufactured with an unapproved substituted API, contamination of a filled product, these are critical. Critical deviations typically require immediate QA escalation, may require batch rejection, and always require a full root cause investigation.

Major Deviation: The departure represents a significant GMP violation that may affect product quality or the integrity of GMP records, but the risk can potentially be assessed and may be manageable. A process parameter exceeded its limit but remained within a broader acceptable range. A form was used without a signature but the activity was otherwise performed correctly. Major deviations require full investigation and may require batch rejection depending on impact assessment.

Minor Deviation: The departure is a low-risk procedural error with no likely impact on product quality, safety, or the integrity of critical records. A date was entered in the wrong format. A reference to a previous batch was used on a form. Administrative errors without quality impact. Minor deviations still get documented and investigated, but the investigation can be brief and the action may simply be retraining.

The danger in classification is under-classifying to avoid the workload of a full investigation. An inspector who reviews deviation records and finds critical process deviations classified as minor, with no meaningful investigation, will escalate that finding significantly.

The Investigation Process

A deviation investigation has to answer several specific questions. The quality of the investigation depends on actually answering them, not just completing a form.

What happened? Describe the deviation factually and specifically. Not “environmental monitoring exceedance” but “viable airborne count at sample point EM-04 in filling room Zone B returned 12 CFU on 2026-06-01 against an action limit of 5 CFU.”

What was the actual vs. expected? State the specification or requirement that was not met. The numerical limits, the procedural step, the required condition. This makes the scope of the deviation clear.

Was product or process affected? The impact assessment determines the fate of the batch. It addresses: Was the product at risk? Was the deviation isolated to one point in the process or potentially broader? Is the product suitable for release? This section is where manufacturing and QA often disagree, and QA’s conclusion is the one that controls.

What was the root cause? Root cause is not the same as the immediate cause. The immediate cause of a filling room EM exceedance might be “personnel traffic exceeded the defined threshold during filling.” The root cause might be “gowning documentation didn’t capture headcount, so the traffic limit wasn’t being enforced.” Root cause investigation methods include 5-Why analysis, fishbone (Ishikawa) diagrams, or structured failure analysis. The method matters less than the rigor.

What corrective action was taken? Corrective action is what was done to address the current situation. For the EM exceedance: re-sampling, additional cleaning, cleaning verification. Corrective action is immediate.

What preventive action was needed? Preventive action is what prevents recurrence. If root cause was that the headcount wasn’t being tracked, the CAPA might be to add a headcount log to the gowning SOP and include headcount in the environmental monitoring trend review. If the deviation requires a significant process or system change to prevent recurrence, it should be elevated to a formal CAPA.

When is the deviation closed? A deviation cannot be closed until: the impact assessment is complete, the affected batch disposition has been decided, corrective actions are complete, and any required CAPA is opened. QA closes the deviation.

Impact Assessment and Batch Disposition

This is the most consequential output of a deviation. The question is whether the product made during or following the deviation meets its specifications and can be released.

For some deviations, the answer is straightforward: a typographical error on a batch record with no bearing on the manufacturing execution doesn’t affect product quality. The batch is released with the deviation documented and closed.

For others, additional testing may be needed. If a process parameter went out of range, the impact assessment might identify specific quality attributes that could be affected and require additional testing to verify the product still meets specification. The testing is designed to address the specific risk, not to test everything.

For critical deviations, or deviations where additional testing can’t adequately address the risk, rejection is the right outcome. Product that may be compromised must not enter distribution, regardless of the commercial pressure.

Common Investigation Failures

Root cause that isn’t a root cause. “Human error” is an immediate cause, not a root cause. The question is: what allowed or enabled the human error? Inadequate training, unclear procedures, excessive workload, poor workspace design, missing safeguards. If your investigation ends at “operator error,” you haven’t found the root cause.

CAPA that doesn’t address the root cause. A retraining CAPA in response to a deviation caused by an ambiguous SOP doesn’t fix anything. The procedure is still ambiguous. The next person to use it will make the same mistake.

Investigations completed too slowly. FDA expects deviation investigations to be completed within 30 days for most deviations (aligned with OOS investigation timelines in 21 CFR 211.192). Investigations that drag on for months without documented justification are findings.

Copy-paste investigations. When similar deviations in a facility have nearly identical investigation text, it’s often a sign that investigations aren’t being done substantively. Each deviation occurred under specific circumstances; each investigation should reflect those circumstances.

Batch released without completing investigation. Sometimes there’s commercial pressure to release product before the investigation is done. The investigation can be open at release only if QA has made a documented, risk-based determination that the investigation to date is sufficient to support release. “We need to ship” is not a documented, risk-based determination.

Individual deviations are events. The pattern of deviations across a facility over time is information about the health of the manufacturing process and quality system.

Trending typically looks at:

  • Deviation rate by area, process, system, or product
  • Deviation rate by category (procedure deviation, equipment failure, documentation error, etc.)
  • Recurrence of deviations with the same or similar root cause
  • Time-to-closure by deviation classification
  • Deviations associated with specific shifts, personnel, or equipment

Trending is a management review input. A manufacturing area with a rising deviation rate, or a persistent recurrence of the same root cause, is a signal that the CAPAs opened against earlier deviations haven’t been effective. That’s an effectiveness check failure, which generates another CAPA.

Regulatory Expectations

21 CFR 211.192 requires investigation of any unexplained discrepancy or the failure of a batch to meet its specifications. The regulation doesn’t use the word “deviation” but the requirement is clear.

EMA’s GMP Part I Chapter 8 addresses complaints and recalls but references investigations broadly. The MHRA and EMA have been explicit in guidance that deviation management is a core quality system element and that failure to investigate adequately is a significant GMP deficiency.

Inspectors will review a sample of deviation records, typically recent ones and any related to the product being inspected. They’ll assess whether: the investigation was timely, the root cause was genuinely investigated, the corrective actions addressed the root cause, and the batch disposition decision was defensible.

A well-run deviation system is evidence of a quality culture that takes problems seriously. A deviation system full of superficial investigations and generic root causes tells inspectors the opposite.