Deviation Investigation Format and Content: A Guide for Inspection Success

The primary purpose of a deviation investigation report in a GMP environment is to clearly and concisely demonstrate that the root cause of the deviation has been identified; corrective actions have been taken; and that safety, integrity, strength (potency), purity, and quality (SISPQ) of the product has been ensured.

The investigation report should house the details of the investigation in a manner that provides appropriate level of background and ensures the level of investigation is thorough and commensurate with level of risk. To achieve these objectives, an investigation report is recommended to contain the following sections:

1. Executive Summary
1.1 Deviation event
1.2 Root cause
1.3 Product impact
1.4 CAPAs

2. Process or equipment overview
3. Deviation event description
4. History review
5. Root cause investigation
6. Product impact assessment
7. Corrective actions.

Executive summary

The executive summary is the most visible section of the deviation investigation report. A well-written executive summary is one that satisfies the reader (e.g., regulatory agency inspector) by presenting a complete and concise synopsis of the deviation investigation. To achieve this, the executive summary should contain the following subsections:

• Deviation event: Two to four introductory sentences describing the deviation. Although the deviation event itself will likely be already know to the reader, the event should be restated such that the investigation report and the executive summary may serve as stand-alone documents during the inspection.

• Root cause: Subsection begins with “The most probable root cause of deviation # is ….” followed by the concluding statement taken directly from Root Cause Investigation section (described below). It must be made clear to the reader that a formal investigation tool was used to arrive at the most probable root cause.

• Product impact: This subsection clearly and concisely repeats the product impact concluding statement taken directly from Product Impact Assessment section (described in the following). If no product impact has been confirmed, then this section should state at that onset “There is no expected product impact resulting from this deviation as confirmed by … (e.g., quality attribute testing, in-process controls, quality risk assessment, etc.)” 

• Corrective actions: This subsection begins with “The following CAPAs [corrective actions and preventive actions] have been implemented to address the root cause of this deviation,” followed by a bulleted list of the CAPAs and/or change controls. Regulatory agencies will expect corrective actions be taken in response to deviations, so a strong emphasis should be made by the manufacturer to demonstrate that a proactive approach has been undertaken to correct the deviation root cause.

Background (process and/or equipment overview)

If the reader proceeds pass the executive summary and into the main body of the investigation--and because the reader may only have a high-level understanding of the event--a process or equipment overview is necessary for complete background information of the deviation event.

While it is important to give an adequate level of detail, emphasis should be placed on clarity. Deviation investigations likely deal with a series of complex events that are site-specific such as manufacturing equipment malfunctions, production process aberrations, or assay techniques. To clearly visualize complex processes, the use of flowcharts, process flow diagrams, or parts and assembly drawings is highly recommended in this section (see example in Figure 1).

The process or equipment overview section should reference all pertaining documents, including internal documents (standard operating procedures [SOPs], batch records, engineering test plans, validation master plans, etc.) and external references (peer-reviewed journals, vendor reports or manuals, certificates of analysis [CoAs], etc.). It is up the regulatory agencies to request these documents if deemed appropriate.

Deviation event description

Once a sufficient process or equipment overview has been provided, the next step is a detailed description of the nonconformance that caused the deviation event. Depending on the complexity of the event, the use of tables, timelines, or flow charts may be warranted. Emphasis is placed on clarity of the sequence of events leading up the deviation.

The goal of the deviation event description section is to not only to describe the deviation event in detail, but to outline the immediate actions that were taken. A justification for initial classification of the deviation event (e.g., minor, major, critical) should be provided with reference to documentation for classification justification (e.g., deviation management SOP).

History review

The history review section is intended to provide the reader with an overarching historical context of the deviation event. This section typically includes a query of the quality management system with specific words and phrases pertaining to the current deviation event with the goal of identifying similar and/or related events.

If the deviation event is a first-time exclusive event, then it should be stated that a query was performed with no previous instances identified. Conversely, if the investigation encompasses several events, it may be necessary to depict the historical context in an outline, timeline, or Gantt chart. Emphasis should be placed on clarity for a first-time viewer.

Depending on the size of the organization, it may also be necessary to perform a global assessment of the deviation event to confirm to the reader that corrective actions will be implemented throughout the organization and the supply chain.

Root cause investigation

The root cause investigation section is intended to demonstrate to the reader that a systemic and logical approach was undertaken to arrive at the most probable root cause as stated in the executive summary. Numerous formal root-cause-analysis tools may be used, depending on the scope and complexity of the deviation. Examples of common root-cause analysis tools that are applicable to pharmaceutical manufacturing include fishbone diagrams, 5-why analysis, fault tree analysis, and failure modes and effect analysis (FMEA).

Under ideal circumstances, the pharmaceutical manufacturer should have SOPs dedicated to root-cause analysis. These SOPs should be referenced and executed as part of the deviation investigation write-up. At minimum, it is recommended to categorize all potential root causes or other factors into what is commonly referred to as the 5Ms: manpower, method, machine, materials, mother nature (environment).
Once categorized into the 5Ms, the potential root causes may be further subdivided based on likelihood as one of the following categories: ruled out, unlikely (non-ideality), contributing factor, and most probable root cause. Figure 2 depicts an example of the type of output that may be generated using this form of cause-effect analysis. As with all sections, emphasis should be placed on clarity such that the reader may easily relate the most probable root cause to the deviation event and the resulting corrective actions.

Product impact assessment

The primary purpose of the product impact assessment section is to determine the extent (if any) that the deviation event affected the pharmaceutical product SISPQ, for lot(s) tagged with the deviation event. A secondary purpose of this section is to determine the risk to process or equipment, which might affect future lots. Ideally, this section should demonstrate to the regulatory agency that SISPQ of the product has been ensured.

SISPQ impact may be assessed by the following:

• Impact to critical quality attributes (CQAs) and critical process parameters (CPPs)

• Severity, occurrence, detection (SOD) assessment of any additional physical, biological, or chemical risks.

The CQAs and CPPs must be within an appropriate limit, range, or distribution to ensure the desired product quality. If the deviation resulted in a CQA out-of-specification (OOS), as determined in the root cause section, then there’s sufficient evidence of product impact to merit lot rejection. Conversely, if there is no demonstrated impact to the CQA and CPP, a further assessment of any additional risk may be performed using a SOD assessment.

The SOD assessment may be applied to any potential physical, biological, or chemical risks identified as part of the root cause investigation. SOD assessment is a method used to quantify potential risks to product quality by ranking the severity (S), occurrence (O), and detection (D) as low (1), medium (2), or high (3) (see Table I).

Table I: A severity, occurrence, detection (SOD) impact assessment is a qualitative risk analysis performed by ranking the severity, occurrence, and detection as high, medium, or low.

Severity (S)  

Occurrence (O)

Detection (D)

Low (1)

Not noticeable/cosmetic

Highly unlikely

Almost certain to detect failure

Medium (2)

Noncritical aspect of product or process impaired

Occasionally

Fair chance of detecting failure

High (3)

Patient safety or regulatory compliance endangered

Repeated/almost certain

Highly unlikely to nearly certain not to detect failure

The output of a SOD assessment is termed a risk priority number (RPN), and is defined as a multiplier of severity, occurrence, and detection (S × O × D). An RPN of 9 or less typically indicates negligible patient risk and may be used to demonstrate to the reader that there is no product impact as result of this deviation event. The product impact assessment should conclude with a clear and concise list all potential risks associated with the deviation event and the corresponding RPNs, if an SOD assessment was performed.

Corrective actions

The purpose of the corrective actions section is to provide a list of CAPAs and change controls in response to the root cause and all of the contributing factors (if any) that were identified in the root cause section. It should be clearly emphasized to the reader that a proactive approach has been taken to rectify the deviation event and prevent reoccurrence.

Depending on the scope of the deviation event, it may be appropriate to subdivide the corrective actions based on priority (e.g., immediate corrective actions, long-term corrective actions, etc.). All corrective actions should include the following sections:

• Proposed due date

• Brief background

• Actions

• Deliverables

• Effectiveness check (if required).

After all of the corrective actions have been listed, the deviation investigation should conclude with a clear statement that the problem has been corrected and that the deviation is not expected to reoccur.

Conclusion

To achieve regulatory inspection success in a GMP environment, a well-written deviation investigation requires balance between conciseness, completeness, and adequate level of detail. Emphasis must be placed to clearly communicate to the reader (the inspector) that a deviation root cause has been identified, that the corrective actions have been undertaken, and that the quality of pharmaceutical product has been ensured.

Article Details

Pharmaceutical Technology
Vol. 41, No. 7
Pages: 108–110

Citation

When referring to this article, please cite it as P. Drapala, “Deviation Investigation Format and Content: A Guide for Inspection Success,” Pharmaceutical Technology 41 (7) 2017.