The true Effort behind a GMP Deviation

Chapter 1, 1.8 (vii) of the EU-GMP Guidelines defines that "any significant deviations are fully recorded, investigated with the objective of determining the root cause and appropriate corrective and preventive action implemented."
This requirement makes clear that a deviation is rarely an isolated event without any consequences. Rather, it marks the beginning of a structured and potentially resource-intensive process. The individual steps are described throughout the EU-GMP Guidelines. Let us therefore follow this regulatory pathway step by step.

1. A Deviation occurs

The first essential requirement is proper documentation and formal approval of the deviation.
"If a deviation occurs, it should be approved in writing by a competent person" (Chapter 5, 5.15). The most appropriate place for such documentation is usually the batch processing record. Chapter 4, 4.20(h) states that such a record should contain "notes on special problems including details, with signed authorisation for any deviation from the Manufacturing Formula and Processing Instructions".
This step underlines a fundamental GMP principle: deviations must never remain informal. Transparency and traceability are the foundation of compliant deviation management.

2. Appropriate and structured Investigation

Once documented, the deviation must be investigated.
"An appropriate level of root cause analysis should be applied during the investigation of deviations" (Chapter 1, 1.4 (xiv)).
According ICH Q10 3.2.2, the approach should also be structured: "A structured approach to the investigation process should be used with the objective of determining the root cause. The level of effort, formality, and documentation of the investigation should be commensurate with the level of risk". The corrective actions and preventive should result "from the investigation".
This means that investigations are not a purely administrative exercise. They must be risk-based, proportionate, and methodologically sound.

No root cause found?
"Where the true root cause(s) of the issue cannot be determined, consideration should be given to identifying the most likely root cause(s)".
Even when the exact root cause cannot be definitively proven, a scientifically justified and risk-based conclusion is still required.

Human Error as cause?
"Where human error is suspected or identified as the cause, this should be justified having taken care to ensure that process, procedural or systembased errors or problems have not been overlooked".
This sentence is particularly important: human error should not be used as a superficial explanation. Systemic weaknesses must always be excluded before attributing a deviation to an individual.

3. Define Actions

Based on the investigation results, appropriate actions must be defined.
"Appropriate corrective actions and/or preventative actions (CAPAs) should be identified and taken in response to investigations" (Chapter 1, 1.4 (xiv)).
Corrective actions address the identified root cause, while preventive actions aim to avoid recurrence or similar issues elsewhere. At this stage, the workload often increases significantly, as process adjustments, training, documentation updates, or technical modifications may be required.

4. Assessment of Impact

Annex 16 states that "a Qualified Person (QP) may consider confirming compliance or certifying a batch where an unexpected deviation concerning the manufacturing process and/or the analytical control methods from details contained within the MA and/or GMP has occurred".
In such cases, not only should the deviation be "thoroughly investigated and the root cause corrected", but also the "impact of the deviation should be assessed in accordance with a quality risk management process". This includes the impact on "quality, safety or efficacy of the batch(es) concerned".
This highlights the role of risk assessment - particularly for the QP - when determining batch disposition.

5. Effectiveness Check

"The effectiveness of [the] actions should be monitored and assessed, in line with Quality Risk Management principles" (Chapter 1, 1.4 (xiv)).
Deviation management does not end with CAPA implementation. A structured effectiveness check is essential to confirm that the measures taken actually resolved the problem and prevented recurrence.

6. Product Quality Review (PQR)

The deviation process also feeds into periodic quality oversight.
The PQR should also include a "review of all significant deviations or non-conformances, their related investigations, and the effectiveness of resultant corrective and preventive actions taken" (Chapter 1, 1.10 (iv)).
This ensures that deviations are not evaluated in isolation, but rather analysed for trends, recurring patterns, and opportunities for continuous improvement.

7. Process Improvement

As shown above, deviation management can require considerable effort and resources. Therefore, prevention remains the most efficient strategy. Chapter 5 emphasises that "any deviation from instructions or procedures should be avoided as far as possible".
Reducing deviations means strengthening systems, improving process understanding, and embedding quality into daily operations.

How Can This Be Achieved?

Root Cause Analysis

Investigations must be conducted with sufficient depth and methodological rigor to identify the true root cause. Only then can appropriate and sustainable corrective and preventive actions be defined.
In this context, ICH Q10 3.2.2 states that "CAPA methodology should result in product and process improvements and enhanced product and process understanding".
Thus, deviation management should not only solve problems but also increase organisational knowledge.

Quality Culture

Quality Culture is essential for ensuring robust processes and high-quality products. It is a key driver of continuous improvement.
All employees must understand the relevance of GMP compliance and their individual responsibility. Knowledge, experience, and quality values must be actively transferred and reinforced throughout the organisation. A strong Quality Culture reduces the likelihood of deviations and strengthens proactive risk management.

ECA can support you here by offering targeted training programmes on Deviation Management and CAPA, Root Cause Analysis, and Quality Oversight.