1What root cause analysis is.
Root cause analysis is the part of an investigation that asks why a problem happened, so that the action taken removes its cause and not only its effect. FDA’s quality systems guidance notes that quality system models treat CAPA as three separate concepts: remedial correction of an identified problem, “root cause analysis with corrective action to help understand the cause of the deviation and potentially prevent recurrence of a similar problem”, and preventive action to avert recurrence of a similar potential problem.¹ ICH Q10 uses the ISO 9000 definitions: corrective action eliminates the cause of a detected nonconformity to prevent recurrence, and preventive action eliminates the cause of a potential one to prevent occurrence.²
2Where GMP requires it.
In the US, the drug CGMP regulations require that any unexplained discrepancy, including a yield outside the limits in the master record, or any failure of a batch or component to meet its specifications “shall be thoroughly investigated, whether or not the batch has already been distributed”. The investigation extends to other batches of the same product and to other products that may be associated with the failure, and its written record includes “the conclusions and followup”.³ The quality control unit has the authority to review production records to assure that errors, where they occurred, have been fully investigated.⁴
In the EU, Chapter 1 of the GMP guide asks for significant deviations to be “fully recorded, investigated with the objective of determining the root cause”, with appropriate corrective and preventive action implemented. It asks for “an appropriate level of root cause analysis” for deviations, suspected product defects and other problems, a level that “can be determined using Quality Risk Management principles”.⁵ Chapter 8 repeats it for the investigation of quality defects, including those reported in complaints.⁶ ICH Q10, reproduced in Part III of the EU guide, asks for “a structured approach to the investigation process” aimed at the root cause, with the effort, formality and documentation commensurate with the level of risk.²⁵
3How to perform one, step by step.
No regulation prescribes a single method. The steps below follow what EU GMP Chapter 8 asks a quality defect procedure to address, and the corrective action process FDA’s guidance describes.
| Step | What it involves | Basis |
|---|---|---|
| 1. Describe the problem | What was found and how far it extends | EU GMP 8.9 (i) and (ii)⁶; ICH Q9(R1) 4.2⁷ |
| 2. Assess the risk and contain it | Set the depth of the investigation by risk, and take risk-reducing action without waiting for full information | EU GMP 8.10 and 8.14⁶; ICH Q10 3.2.2² |
| 3. Gather the evidence | Batch production, certification and distribution records, reference and retention samples, and earlier reports of similar problems | EU GMP 8.9 (ii) and 8.12⁶ |
| 4. Find and test possible causes | Use a structured tool, stay objective and drill down rather than jump to a conclusion | ICH Q9(R1) Annex I⁷; FDA CDRH training⁸ |
| 5. Conclude on the cause | The root cause, or where it can’t be determined, the most likely root cause | EU GMP 1.4 (xiv)⁵ and 8.16⁶ |
| 6. Check what else is affected | Other batches of the same product, and other products, that may be associated | 21 CFR 211.192³; EU GMP 8.11⁶ |
| 7. Act and verify | Choose the action, take it within a defined timeframe and evaluate its effectiveness | FDA 2006 guidance¹; EU GMP 8.18⁶ |
| 8. Record and trend | Write up the conclusions and follow-up, and trend the records for recurring problems | 21 CFR 211.192³; EU GMP 8.19⁶ |
EU GMP also asks companies to consider an inter-disciplinary team for complaint and quality defect investigations, including trained quality management staff.⁶
4Choosing a tool.
ICH Q9(R1) says no one tool or set of tools fits every situation, and that less formal methods can also be acceptable.⁷ These are the tools in it that help an investigation look for a cause.
| Tool | How it works | Where ICH and WHO place it |
|---|---|---|
| Cause and effect diagram (fishbone, Ishikawa) | Organises data on the problem and helps the team reach a decision | A basic facilitation method in ICH Q9(R1)⁷; WHO lists it for less complex deviations and complaints⁹ |
| Fault tree analysis | Assumes the failure, then traces causal chains, combining causes with AND and OR at each level | ICH Q9(R1) names it for investigating complaints or deviations “to fully understand their root cause”⁷ |
| Flowcharts, check sheets and process maps | Lay out the process and collect observations | Basic facilitation methods in ICH Q9(R1)⁷ |
| Control charts, Pareto charts, histograms | Assess data and the significance of a data set | Supporting statistical tools in ICH Q9(R1)⁷ |
Fault tree analysis also helps check the fix: ICH Q9(R1) says it helps ensure that intended improvements “will fully resolve the issue and not lead to other issues”.⁷ WHO describes it as a method “used to identify all root causes of an assumed failure or problem”.⁹ FMEA works the other way, from potential failure modes to their likely effects, and ICH Q9(R1) says it can be used to prioritise risks and monitor the effectiveness of risk controls, the subject of FMEA and the RPN.⁷
5When the answer is human error, or no cause is found.
EU GMP accepts human error as a cause only when it is justified. Where it is suspected or identified, the investigation should take care that “process, procedural or system-based errors or problems have not been overlooked, if present”.⁵⁶ ICH Q9(R1) speaks of root cause analysis that can address “the root cause(s) and other causal factors (e.g., human-related)”.⁷ An FDA training on CAPA for device makers, recorded under the former Quality System Regulation, tells investigators not to jump to conclusions; the presenter says that, as an auditor, seeing training used again and again as the corrective action made him question how much investigation had been done.⁸ There is more in is human error an acceptable root cause.
When the true root cause can’t be determined, EU GMP asks for the most likely root cause or causes to be identified and addressed.⁵ An open investigation is no reason to delay protecting patients: a recall may need to start before the root cause and full extent of a quality defect are established.⁶
6What the investigation feeds.
The cause sets the CAPA, and the CAPA has to be shown to work: EU GMP asks for the effectiveness of corrective and preventive actions to be monitored and assessed.⁵ A root cause found in a failure investigation is also one of the events that should send a team back to its existing risk assessments.⁷ The annual product quality review looks again at significant deviations, their investigations and the effectiveness of the resulting CAPA.⁵
7How it runs in Seal.
In Seal a deviation links the batch, sample and procedure version behind the event, and containment, competing explanations, the impact assessment and the disposition are separate records. Each explanation keeps the evidence for and against it, and an investigation can end inconclusive: the record then keeps the tested hypotheses, the missing evidence, the residual risk and the interim controls rather than forcing an unsupported cause. Neil can draft the investigation with a timeline, sources and open questions; the investigator determines the root cause, and QA approves the investigation and any CAPA.
Approved causes create actions tied to the expected outcome. In CAPA, the source deviation, investigation, actions, controlled change and follow-up evidence share one record, and the effectiveness review keeps its baseline, population, exposure and follow-up window, so a quieter period is not mistaken for a successful correction.
References
- 1Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations, FDA, September 2006, sections III.D and IV.D.4. https:/
/ www. fda. gov/ media/ 71023/ download (read 6 November 2026) - 2ICH Q10, Pharmaceutical Quality System, ICH, 4 June 2008, section 3.2.2 and glossary. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026) - 321 CFR 211.192, Production record review, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 192 (read 6 November 2026) - 421 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 22 (read 6 November 2026) - 5EudraLex Volume 4, Part I, Chapter 1, Pharmaceutical Quality System, European Commission, in operation from 31 January 2013, sections 1.2, 1.4, 1.8 and 1.10. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ vol4- chap1_ 2013- 01_ en_ 0. pdf (read 6 November 2026) - 6EudraLex Volume 4, Part I, Chapter 8, Complaints, Quality Defects and Product Recalls, European Commission, 13 August 2014, in operation from 1 March 2015. https:/
/ health. ec. europa. eu/ document/ download/ b1eb2292- cb0d- 4e3f- aea9- e3fe79faf6e3_ en?filename=2014- 08_ gmp_ chap8. pdf (read 6 November 2026) - 7ICH Q9(R1), Quality Risk Management, ICH, adopted 18 January 2023, sections 1, 4.2 and 4.6 and Annex I. https:/
/ database. ich. org/ sites/ default/ files/ ICH_ Q9%28R1%29_ Guideline_ Step4_ 2023_ 0126_ 0. pdf (read 6 November 2026) - 8Corrective and Preventive Actions, CDRH Learn transcript, FDA, content current as of 4 January 2018. https:/
/ www. fda. gov/ training- and- continuing- education/ cdrh- learn/ corrective- and- preventive- actions- transcript (read 6 November 2026) - 9WHO guidelines on quality risk management, WHO Technical Report Series No. 981, Annex 2, WHO, 2013, Table 3. https:/
/ www. who. int/ publications/ m/ item/ trs981- annex2 (read 6 November 2026)
AQuestions and answers
Should I use the 5 Whys, a fishbone diagram or fault tree analysis?
EU GMP and ICH Q10 ask for an appropriate, structured investigation without naming a tool, and ICH Q9(R1) says no one tool fits every situation. The 5 Whys is not among the tools ICH Q9(R1) or WHO list, but Q9(R1) accepts less formal methods where they fit. A fishbone diagram is one of its basic methods for organising data. Fault tree analysis starts from the failure and shows how several causes can combine, and ICH Q9(R1) names it for investigating deviations and complaints.
Does every deviation need a full root cause analysis?
No. EU GMP asks for an appropriate level of root cause analysis, set using quality risk management, and ICH Q10 scales the effort, formality and documentation to the risk. In the US, every unexplained discrepancy or specification failure must be thoroughly investigated, so the question there is how deep the investigation goes, not whether there is one.
What if we can’t find the root cause?
EU GMP asks you to identify the most likely root cause or causes and address those. Record what was tested, what evidence is missing and the residual risk, and keep any interim controls in place. Protecting patients, for example by a recall, does not wait for the investigation to finish.
Is retraining an acceptable corrective action?
Only when the investigation shows that a gap in training caused the problem. EU GMP asks for human error to be justified after checking that process, procedural and system causes have not been overlooked. In an FDA training on CAPA, the presenter said that, when he audited, seeing training used again and again as the corrective action made him question how much investigation had been done.
Who should take part in a root cause investigation?
EU GMP asks companies to consider an inter-disciplinary team, including trained quality staff, and ICH Q9(R1) expects quality risk management teams to include experts from the appropriate areas, such as the quality unit, production operations, engineering and regulatory affairs, alongside people who know the risk management process.