1What the rules require.
The US drug CGMP regulations, EU GMP and ICH set the minimum the investigation and its record must cover.
| Requirement | Source |
|---|---|
| Any deviation from written production and process control procedures “shall be recorded and justified”. | 21 CFR 211.100(b)¹ |
| Any unexplained discrepancy, or a batch or component that fails a specification, “shall be thoroughly investigated, whether or not the batch has already been distributed”. The investigation extends to other batches and other drug products that may be associated. | 21 CFR 211.192² |
| “A written record of the investigation shall be made and shall include the conclusions and followup.” | 21 CFR 211.192² |
| The quality control unit has the authority to review production records to assure that, if errors have occurred, “they have been fully investigated”. | 21 CFR 211.22(a)³ |
| Significant deviations are “fully recorded, investigated with the objective of determining the root cause”, and appropriate corrective and preventive action is implemented. | EU GMP Chapter 1, 1.8(vii)⁴ |
| The level of root cause analysis can be determined using quality risk management principles; where the true cause cannot be found, identifying and addressing the most likely cause is considered; human error is justified; CAPA effectiveness is monitored. | EU GMP Chapter 1, 1.4(xiv)⁴ |
| For APIs, critical deviations are investigated, and the investigation extends to other batches that may be associated. | ICH Q7, 2.16 and 6.53⁵ |
2What goes in the report.
FDA’s OOS guidance lists what the written record of a full-scale investigation’s production review should include: the reason for the investigation, the aspects of the process that may have caused the problem, a documentation review “with the assignment of actual or probable cause”, a review of whether the problem “has occurred previously”, and the corrective actions taken.⁶ EU GMP Chapter 8 lists similar points for quality defect investigations, adding the extent of the defect, a risk assessment, the decision on risk-reducing actions, and the assessment of CAPA effectiveness.⁷ A report with these sections covers both:
| Section | What it records |
|---|---|
| 1. Event | What should have happened (procedure, version, step, limit) and what did, when, where, and who found it. |
| 2. Immediate actions | What was held, segregated or stopped, by whom and when. |
| 3. Scope | Which batches, products, equipment and materials could be affected, and how they were identified. |
| 4. Investigation | Records reviewed, interviews, tests and data, with each hypothesis considered and the evidence for and against it. |
| 5. History | Whether the same or a similar event has happened before, and what was done then. |
| 6. Cause | The root cause, or the most likely cause and why it cannot be confirmed, with contributing causes. |
| 7. Impact | The effect on each affected batch and the disposition, decided by the quality unit. |
| 8. CAPA | Corrections, corrective actions and preventive actions, each with an owner, a due date and how its effectiveness will be checked. |
| 9. Conclusion | The conclusions and follow-up, approved by the quality unit. |
Several sections answer a specific expectation. Segregating nonconforming product stops it being distributed while the work goes on.⁸ For quality defects, EU GMP asks for checks on other batches, and in some cases other products, to be considered, and for previous reports to be reviewed for recurring problems.⁷ Rejecting the batch does not end the work: in FDA’s words, “Batch rejection does not negate the need to perform the investigation.”⁶
3How deep to go.
ICH Q10 says “the level of effort, formality, and documentation of the investigation should be commensurate with the level of risk, in line with ICH Q9.”⁹ EU GMP Chapter 1 says the appropriate level of root cause analysis can be determined using quality risk management principles.⁴ ICH Q7 separates the two cases for APIs: any deviation “should be documented and explained”, and critical deviations “should be investigated”.⁵ FDA’s 2006 guidance notes that “not all discrepancies will result in product defects”, but all should be documented and handled appropriately.⁸
Classify the deviation early, by its possible effect on product quality and patients, and let the class set the depth. A minor deviation can need a short record and a justification. One that could affect a batch needs a full investigation of cause, scope and impact, with the people from each area involved.
4How long it should take.
21 CFR 211.192 and EU GMP Chapter 1 set no number of days. FDA’s OOS guidance says an investigation should be “thorough, timely, unbiased, well-documented, and scientifically sound”.⁶ EU GMP Chapter 8 asks for risk-reducing actions at an appropriate point during an investigation, even before the full facts are known.⁷
Reporting rules run their own clocks, two of them fixed, and the investigation has to feed them:
| Trigger | Deadline | Source |
|---|---|---|
| NDA or ANDA holder: a distributed batch fails its specification, or shows contamination or significant deterioration | Field alert report to FDA within 3 working days of receiving the information | 21 CFR 314.81(b)(1) and 314.98¹⁰¹¹ |
| Licensed biologics manufacturer: a deviation or unexpected event that may affect the safety, purity or potency of a distributed product | Biological product deviation report within 45 calendar days of acquiring the information | 21 CFR 600.14¹² |
| EU manufacturer: a quality defect that may lead to a recall or an abnormal restriction in supply | Report to the marketing authorisation holder or sponsor and the competent authorities “in a timely manner” | EU GMP Chapter 8, 8.15⁷ |
Section 600.14 also says all biological product deviations, reportable or not, should be investigated under Parts 211 and 820.¹² Set an internal target for closing investigations in your procedure. When one needs longer, record the extension with its reason, progress and new date rather than letting it drift.
5Write it so a reviewer can follow it.
- Separate facts from interpretation. Give the record and time behind each fact, and label each hypothesis as one.
- Show what was ruled out and why, not only the conclusion.
- Say what is missing. An absent record is a gap in the evidence, not proof that nothing happened.
- Do not stop at “operator error”. EU GMP asks that a finding of human error be justified, having made sure that process, procedural or system-based errors have not been overlooked.⁴
- If the investigation is inconclusive, say so. For an OOS result that is neither confirmed nor explained, FDA says the result “should be given full consideration in the batch or lot disposition decision”.⁶
- Write for a reader who was not there: an inspector, or your successor in two years.
6How it runs in Seal.
Neil, Seal’s AI agent, can draft a deviation investigation. It reads the deviation description and affected records, execution timestamps and equipment events, and the relevant procedures and evidence, then drafts an investigation with a timeline, sources and open questions. Missing evidence stays visible as an open question. The investigator determines root cause, and QA approves the investigation and any CAPA.
In the deviation blueprint, the deviation links the batch, sample and procedure version behind the event, and containment, competing explanations, the impact assessment and the disposition are separate records, each with its own evidence and authority. An investigation that needs longer is extended on the record, keeping the original date, the reason and the new date. One that ends without a root cause keeps the tested hypotheses, the available and missing evidence and the residual risk. Approved causes create linked actions, such as a CAPA, that keep the source deviation.
References
- 121 CFR 211.100, Written procedures; deviations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 100 (read 6 November 2026) - 221 CFR 211.192, Production record review, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 192 (read 6 November 2026) - 321 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 22 (read 6 November 2026) - 4EudraLex Volume 4, Part I, Chapter 1: Pharmaceutical Quality System, European Commission, in operation since 31 January 2013, sections 1.4(xiv) and 1.8(vii). https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ vol4- chap1_ 2013- 01_ en_ 0. pdf (read 6 November 2026) - 5ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, ICH, 10 November 2000, sections 2.16 and 6.53. https:/
/ database. ich. org/ sites/ default/ files/ Q7%20Guideline. pdf (read 6 November 2026) - 6Investigating Out-
of- Specification (OOS) Test Results for Pharmaceutical Production, guidance for industry, Revision 1, FDA, May 2022, sections III, IV and V. https:/ / www. fda. gov/ media/ 158416/ download (read 6 November 2026) - 7EudraLex Volume 4, Part I, Chapter 8: Complaints, Quality Defects and Product Recalls, European Commission, 13 August 2014, in operation since 1 March 2015, sections 8.9 to 8.15. https:/
/ health. ec. europa. eu/ document/ download/ b1eb2292- cb0d- 4e3f- aea9- e3fe79faf6e3_ en?filename=2014- 08_ gmp_ chap8. pdf (read 6 November 2026) - 8Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations, FDA, September 2006, section IV.C.4. https:/
/ www. fda. gov/ media/ 71023/ download (read 6 November 2026) - 9ICH Q10, Pharmaceutical Quality System, ICH, Step 4 version of 4 June 2008, section 3.2.2. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026) - 1021 CFR 314.81, Other postmarketing reports, paragraph (b)(1), eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 314. 81 (read 6 November 2026) - 1121 CFR 314.98, Postmarketing reports, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 314. 98 (read 6 November 2026) - 1221 CFR 600.14, Reporting of biological product deviations by licensed manufacturers, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 600. 14 (read 6 November 2026)
AQuestions and answers
What is the difference between a deviation report and an investigation report?
The deviation report records the event when it is found: what was expected, what happened and what was done straight away. The investigation report records the work that followed: the cause, the scope, the impact on product, the decision and the CAPA. They can be one record with separate sections, as long as the first observation is kept as it was recorded.
Can an investigation close without a root cause?
Yes, if the work was thorough. When the true cause cannot be found, EU GMP asks for the most likely cause to be considered and addressed. Record the hypotheses tested, the evidence that is missing and the residual risk, and let an inconclusive result weigh fully in the batch decision.
Who approves a deviation investigation?
The quality unit. In the US, the quality control unit reviews production records, makes sure errors have been fully investigated, and approves or rejects the batch. In the EU, the assessment of deviations is part of the product assessment before a Qualified Person certifies the batch.
Does the investigation need to cover batches already shipped?
Yes. 21 CFR 211.192 requires the investigation whether or not the batch has been distributed, and it extends to other batches and products that may be associated. For an approved NDA or ANDA, a distributed batch that fails its specification also triggers a field alert report within three working days.
Is “human error” an acceptable root cause?
Only with evidence. EU GMP asks for a finding of human error to be justified after checking that process, procedural and system causes were not overlooked. Ask why the error was possible and why it was not caught, and act on that.
Should every deviation get a full investigation?
No. Scale the effort to the risk. A minor deviation needs to be recorded and justified; one that could affect product quality needs a full investigation of its cause, scope and impact.