What is a deviation in GMP, and does every deviation need to be investigated?

1What a deviation is.

ICH Q7 defines a deviation as a “departure from an approved instruction or established standard”.¹ Its questions and answers of June 2015 add that a deviation “may or may not have an impact on the quality of the material”, which is what separates it from a non-conformance: the status of material that has failed to meet its specifications or established standards.² FDA’s 2006 quality systems guidance groups both under “discrepancy”: a result outside the expected range or an unfulfilled requirement, which “may be called non-conformity, defect, deviation, out-of-specification, out-of-limit, out-of-trend”.³

Deviations can arise anywhere in GMP work. The regulations and guidance name, among others, departures from production procedures, from laboratory specifications and test procedures, from time limits in the master production instructions, from approved calibration standards on critical instruments and from the expected yield.⁴⁵¹⁶

2What every deviation needs.

The baseline is the same in each framework: the deviation is written down and explained.

Sources for the table: the US regulations,⁴⁵⁷ ICH Q7¹ and EU GMP Chapters 1 and 5.⁸⁶

So only EU GMP, for deviations in quality control sampling and testing, asks for every deviation to be investigated. Elsewhere investigation is reserved for critical, significant or unexplained events, and no framework lets a deviation go unrecorded.⁸ ICH Q7 does not define a critical deviation, but it defines “critical” as describing a process step, condition, test requirement or other parameter “that must be controlled within predetermined criteria to ensure that the API meets its specification”.¹

3What an investigation must cover.

Where an investigation is required, 21 CFR 211.192 sets its reach. It must be thorough “whether or not the batch has already been distributed”, extend “to other batches of the same drug product and other drug products that may have been associated with the specific failure or discrepancy”, and end in a written record that includes “the conclusions and followup”.⁷ ICH Q7 asks for written procedures for investigating critical deviations, extending to other batches that may be associated.¹ For out-of-specification results, FDA’s guidance of May 2022 says the investigation should be “thorough, timely, unbiased, well-documented, and scientifically sound”.⁹

EU GMP says “an appropriate level of root cause analysis” should be applied, and that the level can be set using quality risk management. Where the true root cause cannot be found, the most likely cause should be identified and addressed. Human error should only be concluded once “process, procedural or system-based errors or problems have not been overlooked”, and appropriate CAPAs follow from the investigation.⁸

4How deviations are classified.

The texts above use the classes “critical” (ICH Q7) and “significant” (EU GMP) to mark the deviations that must be investigated, but none of them defines a scheme of minor, major and critical deviations.¹⁸ Where a company uses such classes, it defines them in its own procedures, and EU GMP says the level of root cause analysis can be set using quality risk management.⁸

Inspectors grade the deviation system itself. PIC/S PI 040-1, its guidance on classifying GMP deficiencies in force since 1 January 2019, lists “Deviations from instructions not approved” and “Inadequate deviation system” among examples rated major, in the absence of risk-reducing factors.¹⁰

5Deviations and batch release.

Deviations are part of the release decision. In the US the quality control unit reviews and approves production and control records before a batch is released or distributed.⁷ ICH Q7 asks for “all deviation, investigation, and OOS reports” to be reviewed as part of batch record review before release.¹

In the EU, Annex 16 allows a Qualified Person to certify a batch after an unexpected deviation from the marketing authorisation or GMP, provided registered specifications are met, the deviation is “thoroughly investigated and the root cause corrected”, and a quality risk assessment concludes its impact on quality, safety or efficacy is negligible. The assessment should consider adding affected batches to the stability programme, and for biological products that a process deviation “can have an unexpected impact on safety and efficacy”.¹¹

6Some deviations must also be reported.

Most deviations stay inside the company’s quality system, but some go to the regulator. In the US, the holder of a biological product licence who had control of the product must report a deviation from CGMP, regulations, standards or specifications, or an unexpected event, that “may affect the safety, purity, or potency” of a distributed product. The report goes on Form FDA 3486 “as soon as possible” and no later than 45 calendar days after the manufacturer acquires information reasonably suggesting a reportable event has occurred. Blood establishments report under 21 CFR 606.171 instead.¹²

For a drug approved under a new drug application, the applicant must send a field alert report within three working days of receiving information about, among other things, bacteriological contamination of a distributed product or a distributed batch that fails the specification in its application (21 CFR 314.81(b)(1)).¹³

7How it runs in Seal.

In Seal, a deviation opens linked to the batch, sample and procedure version behind the event, so the investigator starts from the execution record rather than values retyped into a form. Containment, competing explanations, the impact assessment and the disposition are separate records, each with its own evidence and authority, and the affected population is traced through recorded links to the batches, samples, data and inventory the event could reach. An investigation that needs longer is extended on the record, keeping the original date, the reason and the approval.

Neil, Seal’s AI agent, can draft a deviation investigation with a timeline, sources and open questions; the investigator determines root cause and QA approves the investigation and any CAPA.