Deviation investigation: from event description to root cause

A deviation investigation should convert an unexpected event into a scientifically supported decision: what happened, what may be affected, why it happened and what must change to prevent a recurrence.

Weak investigations often begin with a conclusion and work backwards. They describe the event vaguely, identify “human error,” prescribe retraining and close the record when the action is completed. The paperwork moves, but the risk remains.

A strong investigation is timely, objective, risk-based and evidence-led. It protects the product first, preserves evidence, tests plausible explanations and reaches only those conclusions that the available facts can support.

What is a GMP deviation?

A deviation is an unplanned departure from an approved instruction, established standard, expected condition or validated state. It may involve a process, material, test, facility, utility, equipment, computerized system, document or personnel practice.

The event may be discovered while it is occurring or retrospectively during record review, trending, an audit, a complaint or another investigation. The name applied by the company—deviation, nonconformance, incident or exception—is less important than having a controlled system that evaluates the event and its consequences.

Under 21 CFR 211.192, unexplained discrepancies and failures of a batch or its components to meet specifications require a thorough investigation, whether or not the batch has already been distributed. EU GMP Chapter 1 likewise expects significant deviations to be recorded, investigated to determine root cause and followed by appropriate CAPA.

1. Protect first—investigate second

The first response is not to complete the form. It is to control the situation without destroying information needed to understand it. Immediate actions should be proportionate to the potential risk and taken through the approved escalation process.

Depending on the event, immediate actions may include:

• Stopping or safely pausing the affected operation
• Placing materials, batches or equipment on hold
• Segregating potentially affected units and controlling labels or documents
• Preserving samples, test preparations, audit trails, alarms, photographs and electronic data
• Recording the actual equipment settings and environmental conditions
• Informing Quality and other responsible functions
• Assessing whether distributed product, another batch or another product may be affected
• Introducing a justified temporary control until the risk is understood

Replacing a damaged gasket, correcting an entry or retraining an operator may be necessary, but these actions do not explain why the event occurred. Emergency action and root-cause analysis are related stages, not substitutes for one another.

2. Write an event description that contains facts

A useful investigation begins with a neutral description of the known event. It should not assign blame, hide uncertainty or include an untested cause.

The initial description should establish:

• What: the observed condition and the expected requirement
• Where: the room, process step, equipment, system or document
• When: the date, time and stage of the operation
• Who: the roles involved in the activity and discovery
• Which: product, material, batch, sample, record or data set involved
• How detected: observation, alarm, in-process result, review, complaint or trend
• Immediate condition: the status of the operation and product when discovered

The second description provides a defined problem and investigation boundary. It does not assume that the operator or any equipment component caused the failure.

3. Perform and update the impact assessment

The initial assessment determines how urgently the event must be escalated and what should be contained. It is provisional: the scope and risk should be updated as new evidence appears.

Consider:

• The potential effect on identity, strength, quality, purity, safety and efficacy
• Whether critical process parameters or quality attributes may have been affected
• The time window and quantity produced under the suspect condition
• The reliability of detection and any downstream controls
• Other batches, products, equipment, methods, rooms or sites using the same system
• Previously released or distributed product
• Data-integrity, validation and regulatory-filing implications
• Whether notification, recall or field action may need evaluation

Risk classification should follow the approved procedure. The severity of an event should not be reduced merely because a later control happened to detect it. Detection is part of the control system and must itself be evaluated.

4. Use a defined investigation structure

The depth and formality should match the risk, complexity and uncertainty of the event. A minor, well-understood event may require a short investigation. A potentially critical, recurring or poorly understood event requires a cross-functional plan and deeper review.

A practical investigation plan identifies:

1. The problem statement and investigation objective
2. The investigator, Quality oversight and required subject-matter experts
3. The initial product-impact and patient-risk assessment
4. The process boundaries, time window and potentially affected scope
5. The records, samples, electronic data and physical evidence to preserve and review
6. The possible causes or hypotheses to test
7. The actions, owners and target dates
8. The required approvals and escalation points

The investigation owner should be competent and sufficiently objective. The people closest to the process provide essential knowledge, but Quality retains the authority to challenge scope, evidence and conclusions.

5. Build the investigation from evidence

Start broad enough to avoid locking onto the first plausible answer, then narrow the investigation as facts eliminate or support hypotheses. Review original records wherever possible.

Process and chronology

Reconstruct the sequence before, during and after the event. Include start and stop times, process transitions, alarms, adjustments, samples, interventions, shift changes and material movements. A timeline often exposes relationships hidden in separate records.

People and actual practice

Interview personnel promptly and separately where appropriate. Use open questions: “Show me what happened next” is more useful than “Did you follow the SOP?” Compare the account with records and system data. Interviews are evidence inputs, not proof by themselves.

Equipment, utilities and computerized systems

Review status, settings, alarms, audit trails, maintenance, calibration, breakdown history, access rights and recent changes. Preserve transient information before restarting, cleaning or repairing equipment where safe and practicable.

Materials and environment

Examine material identity, supplier and lot history, sampling, storage, dispensing, status, hold time and environmental or utility conditions. Consider variation within approved specifications when process robustness may be limited.

Documents, data and prior history

Compare the approved procedure with actual practice and process knowledge. Review validation, development, change control, similar deviations, complaints, OOS/OOT results, maintenance history, CAPA effectiveness and product-quality trends. A “first occurrence” can only be claimed after a meaningful search.

6. Distinguish direct, contributing and root causes

Investigations become clearer when they separate different levels of causation.

More than one causal pathway may exist. The purpose is not to force every event into one “root cause” box, but to identify the causes that must be controlled to prevent recurrence and assess wider impact.

A defensible cause statement should:

• Be supported by objective evidence
• Explain the mechanism connecting the cause to the event
• Be consistent with the timing and observed facts
• Account for evidence that does not support the hypothesis
• Identify assumptions and remaining uncertainty
• Lead to actions that can reasonably prevent or detect recurrence

If evidence cannot establish a definitive root cause, document the most probable cause only when the balance of evidence supports it. Record alternative hypotheses, justify why they were rejected or remain unresolved, and use risk-reducing actions appropriate to the uncertainty. “Root cause not identified” is more honest than an unsupported conclusion.

7. Select the root-cause tool to fit the problem

A completed diagram does not prove a cause. Tools organise thinking; evidence tests the output.

FMEA is valuable for prospective risk assessment and prioritising failure modes. It can support investigation scoping and CAPA risk review, but an FMEA score does not demonstrate what caused a past event.

8. Treat “human error” as the start of inquiry

A person’s action may be the direct cause, but “operator error” alone rarely explains why the system failed. Ask what made the action possible, likely or difficult to detect.

• Was the instruction clear, current and usable at the point of work?
• Was the task designed around realistic workload and human capability?
• Were controls dependent on memory, repeated transcription or confusing labels?
• Was competence demonstrated, not merely attendance recorded?
• Were supervision, staffing and shift handover adequate?
• Did equipment or software design invite selection of the wrong option?
• Why did the verification or detection control not prevent or identify the action earlier?
• Have similar events occurred with other trained employees?

Retraining is appropriate when a defined knowledge or skill gap is supported by evidence. It is weak CAPA when the task, procedure, equipment or organisation remains unchanged and the same conditions will confront the next trained employee.

A worked pharmaceutical example

The event

During tablet compression, 12 of 20 units in a scheduled in-process sample fell below the approved individual-weight limit. The previous 30-minute sample complied. Compression was stopped and tablets made since the last acceptable sample were segregated.

The initial hypothesis

The operator had adjusted machine speed shortly before the failure, so “incorrect operator adjustment” appeared plausible. The batch record, however, permitted the adjustment and the entered setting was within the validated range.

The evidence

• The weight trend began to oscillate before the speed adjustment.
• Feeder-current data showed intermittent changes during the same period.
• Inspection found a worn locking component in the feeder-paddle drive.
• The component could loosen under vibration and create inconsistent die filling.
• The preventive-maintenance instruction inspected wear visually but did not include the locking integrity check recommended in updated vendor information.
• Two presses used the same component and maintenance instruction.

The causal conclusion

The direct cause was intermittent feeder-paddle drive movement caused by the worn locking component. The systemic cause was an inadequate preventive-maintenance control that had not incorporated the defined locking-integrity check. A contributing cause was that the process alarm did not detect the short fluctuations before the scheduled in-process sample.

The response

The batch impact assessment used production timing, segregated quantity, weight records and additional justified sampling. The same component was inspected on comparable presses; maintenance instructions and spare-part controls were updated; alarm and IPC detection capability were reviewed; and effectiveness was defined as acceptable inspection results and stable compression performance across a justified number of subsequent batches.

The investigation did not ignore the operator’s action. It tested it and found that it did not explain the mechanism or evidence.

9. Link CAPA directly to the established causes

Every significant cause should have a corresponding action, and every action should have an owner, due date, risk-based priority and verification method. Avoid one action list that is disconnected from the causal analysis.

• Correction: restore or control the immediate condition
• Corrective action: remove or control the verified direct and root causes
• Systemic action: examine other products, equipment, procedures, departments or sites exposed to the same weakness
• Change control: assess and approve changes that may affect the validated state or regulatory commitments
• Effectiveness check: define what evidence, period and acceptance criteria will show that recurrence risk is controlled

“CAPA completed” means the planned task was performed. “CAPA effective” means evidence shows that the intended control is working. Closure should also confirm that the batch-disposition decision, regulatory assessment, related records and residual risks have been addressed.

For practical criteria, review periods, evidence and closure decisions, continue with the CAPA effectiveness-check guide.

Common investigation mistakes

• Delaying the investigation until physical or electronic evidence is lost
• Writing a vague event statement that does not define expected versus actual
• Starting root-cause analysis before containing potentially affected product
• Assuming the first plausible explanation is the cause
• Interviewing personnel with leading or blame-focused questions
• Reviewing only the batch record and not the raw or electronic data
• Failing to reconstruct a detailed timeline
• Rejecting a batch but not investigating the cause and wider scope
• Using retesting, repeated sampling or averaging to make an unwanted result disappear
• Calling “human error,” “procedure not followed” or “equipment malfunction” a root cause without explaining why
• Listing possibilities in a fishbone diagram without testing them
• Searching prior deviations too narrowly to detect recurrence
• Forcing a definitive root cause where evidence supports only a probable cause
• Selecting retraining as the default CAPA
• Closing the record when actions are completed rather than when effectiveness is demonstrated

The practical investigation sequence

1. Recognise, report and document the event promptly.
2. Stop, contain and preserve evidence according to risk.
3. Describe expected versus actual conditions without assuming a cause.
4. Perform the initial impact, scope and risk assessment.
5. Appoint the investigator and define a proportionate investigation plan.
6. Build the chronology and collect original, traceable evidence.
7. Generate plausible hypotheses using an appropriate tool.
8. Test each material hypothesis and document supporting and contrary evidence.
9. State direct, contributing and root or systemic causes at the level supported by evidence.
10. Complete product-impact, recurrence and wider-scope assessments.
11. Link corrections and CAPAs to the established causes.
12. Approve the conclusion, decide disposition and define effectiveness criteria.
13. Trend the event and feed learning into risk management and management review.

The best investigation may reveal that the original hypothesis was wrong, the scope is wider than expected or uncertainty remains. That is not failure. Failure is allowing an unsupported conclusion to create false confidence.

Educational notice: This article provides general educational information. Manufacturers should follow their approved procedures and apply product and process knowledge, quality-risk management, marketing-authorisation commitments and the requirements of their applicable regulatory authorities.