SOP Title: Handling of Deviations

OBJECTIVE

To define the procedure for handling deviations that may occur during dispensing, manufacturing, testing, or storage. This also includes issues related to equipment or facility maintenance and engineering.

SCOPE

This procedure applies to reporting, investigating, reviewing, and following up on deviations involving materials, testing procedures, products, equipment/facility maintenance, or processes. It includes all departments, product categories (Product/General), and any market or customer complaints.

RESPONSIBILITY

Originating / Initiating Department

• Report any observed deviation to the Head of Department (HOD) and Quality Assurance (QA) and initiate the deviation report.
• The deviation owner must carry out an investigation and impact assessment with help from QA and other involved departments. They must also request an extension for the investigation if needed.
• Implement corrective and preventive actions (CAPA), verify their effectiveness, and ensure issued deviation forms and logbooks are reconciled properly.

Quality Assurance

• Issue deviation log pads to departments and verify previous pad pages before giving new ones.
• Record deviation details in the Deviation Logbook (Annexure) and review the information provided by the originating department.
• Assign a deviation number and return the completed form to the user department.
• Classify the deviation as Minor, Major, or Critical, both initially and finally.
• Work with the initiating department and other teams to perform the investigation, risk analysis, and impact assessment.
• Review and approve the investigation and CAPA.
• Make a final decision on the release or rejection of affected batches.
• Arrange training for departments if the investigation reveals a need for it.
• Approve any investigation extensions and prepare trend analysis reports of deviations.

Other Departments (QC, Microbiology, Production, Engineering, Warehouse, HR, EHS/Safety, IT, R&D, etc.)

• Review the deviation and assess how it might impact their operations or the product.
• Participate in the investigation with the initiating department and review the proposed CAPA as needed.

DEFINITIONS

Deviation
A deviation means any unexpected change or departure from approved procedures, instructions, standards, policies, or current status within the company.

Critical Deviation
A critical deviation poses a serious risk to patient safety. It may affect product quality and can lead to the release of harmful products. Examples include data falsification, fraud, or a major system failure that could harm patients. These deviations affect critical processes or equipment and may involve life-threatening situations.

Major Deviation
A major deviation is serious but does not pose an immediate risk to the patient. It may affect the product’s quality, safety, or regulatory compliance, but it is not life-threatening. These may involve unplanned events that could potentially cause non-compliance or specification issues.

Minor Deviation
A minor deviation is a small issue that does not fall under critical or major. It shows a departure from Good Manufacturing Practices (GMP) but does not affect product quality, safety, or labeling. These can involve equipment, materials, environment, or documentation.

PROCEDURE

Deviation Procedure

The following are examples (but not limited to) of situations that may require logging a deviation:

• Standard testing procedures
• Cleaning/process/analytical methods
• Batch manufacturing or packaging instructions
• Equipment or instrument breakdown
• VMP and CSVMP plans
• Calibration or preventive maintenance schedules
• Unexpected yield changes

Other situations that can trigger a deviation:

• Market or customer complaints
• Internal or external audit findings
• Document or facility review reports
• Stability or environmental monitoring reports
• Issues found during material handling, production, or testing

If a market complaint, OOS (Out of Specification), OOC (Out of Calibration), or OOT (Out of Trend) investigation finds the cause to be a procedural deviation, a separate deviation form is not needed. Instead, the deviation details will be included in the investigation report using the investigation tools defined in this SOP.

Reporting a Deviation

• Anyone who notices a deviation must inform their supervisor, HOD, or QA
• A deviation form (Annexure) should be filled out within 24 hours of identifying the issue or by the next working day at the latest.
• If not submitted on time, a justification must be included in the investigation report.

Deviation Form Handling

• QA issues deviation form to departments.
• Each pad contains 25 forms numbered from 01 to 025.
• Before issuing a new pad, QA will verify that all forms from the old pad were used properly and reconciled (Annexure).
• The initiator completes the deviation form and sends it to QA for a deviation number.

Deviation Number Format

Format: PADYYXZZZ

• PA = Site code
• D = Deviation
• YY = Year
• X = Deviation Type (P for product, G for general)
• ZZZ = 3-digit running serial number

Separate Logbooks

• Maintain two logbooks: one for Product deviations and one for General deviations.
• This helps in trend analysis and tracking different types of deviations clearly.

QA Responsibilities

• QA assigns the deviation number and gives the form back to the initiating department.
• The originator completes a risk assessment and submits it with the form.
• QA evaluates the form and assigns cross-functional teams for investigation.
• If the reported issue is not a valid deviation, QA will cancel it with justification.
• All assigned investigation team members must sign the deviation form.

Deviation Investigation

Investigation Process

• The investigation team creates a plan to analyze the deviation and identify the root cause.
• They may refer to similar past deviations and relevant documents.
• If needed, the team can conduct experiments or analysis with a pre-approved protocol.

Investigation Report Should Include:

• Objective: Reason for investigation, risk/impact assessment, and CAPA plan.
• Background: Summary of event and history of similar deviations or past CAPAs.
• Root Cause Analysis: List and analyze possible causes using scientific tools or methods such as:
  • Brainstorming
  • Fishbone diagram
  • 5-Why analysis
  • Pareto chart
  • Control charts
  • FMEA, FMECA, or FTA
• Risk Assessment: Identify and propose risk mitigation steps
• Impact Assessment: Mention affected products, lots, processes, or systems.
• CAPA: List immediate actions and long-term preventive measures. Indicate if they apply to other departments or areas.
• Summary: Brief conclusion on root cause and actions, with proper documentation.
• Annexures: List all related documents and references.

Final Steps

• The investigation team finalizes the root cause, risk, impact, and CAPA.
• CAPAs are handled and tracked as per SOP
• If a deviation is found after batch dispatch, the site QA must:
  • Notify customers
  • Check the potential impact on other batches

Closing Deviations

After the investigation, the initial classification (Minor/Major/Critical) can be updated based on the final risk assessment. This must be noted by the QA Head or designee in the remarks section.
The deviation report must be signed by the deviation owner and approved by the Site QA Head  or their designee.
If similar deviations have occurred in the past (within at least one year), they should be reviewed to check the effectiveness of previously implemented CAPAs. These should be documented in Annexure.

If a deviation is reclassified as Critical, QA must inform the customer within 5 working days through appropriate communication channels.

Once the investigation is complete, the deviation owner submits the investigation report and completed risk assessment form to QA for final review and approval.
All deviations should be closed within 30 working days from the date of logging.

If more time is needed to close a deviation:

• The initiating department can request an extension using Annexure.
• A maximum of two extensions is allowed, and each must not exceed 30 working days.
  • First extension: Approved by QA Head / Site QA Head / Designee.
  • Second extension: Approved by Site Head and QA Head.
• If still not closed after two extensions, a risk and impact assessment must be performed by the initiating department. The deviation can then be closed based on this assessment and additional CAPA, if required.

All supporting documents—like investigation reports, assessments, and communications—must be attached to the deviation form and clearly cross-referenced.

The quality head and department heads must review deviations and CAPAs during regular management reviews, as per SOP

Deviation Trending

Deviation trends must be analysed twice a year, and reports should be prepared by:

• End of July
• End of January

Trending is carried out by QA and results are shared with management during reviews.

Trending reports (using Annexure) may be adjusted as needed and must include repeated or similar deviations.
Trends should consider deviation types and areas, such as:

• Departments, products/materials, yield
• Equipment, procedures, data integrity
• Utilities/engineering
• Deviation classifications (Minor, Major, Critical)

Trend Analysis Document Number Format:
QA/DEV/MMM/YY/ZZ

• QA = Quality Assurance
• DEV = Deviation
• MMM = First three letters of the month
• YY = Last two digits of the year
• ZZ = Revision number for that year

Investigation Tools

Start by identifying the most likely cause of the deviation. If the cause is unclear, use tools listed in Section 5.2.2, including those below.

6M Ishikawa (Fishbone) Diagram
Used to explore causes from six areas:

• Machine
• Manpower
• Method
• Measurement
• Material
• Mother Nature (Environment)

Why-Why Analysis

• Ask “Why did this happen?” for each problem.
• Keep asking “Why?” for each answer.
• Repeat until the root cause is identified.

Reinvestigation of Deviation

If a deviation report is found to be incomplete or deficient during an internal or external audit, an addendum must be prepared in consultation with the QA Head or Site Quality Head.

If a deviation needs to be reopened, the reason must be documented in the deviation form (Annexure).
QA must issue a Deviation Reopen Request Form, which should be attached to the original deviation report.

To reopen a deviation, the same deviation number will be used. The user department, QA, and cross-functional team will continue the investigation using the original record.

REFERENCES

• 21 CFR 211.100
• ICH Q7, Q9 Guidelines
• EU GMP Guidelines
• USFDA Guidelines
• PIC/S Guidelines – Sterility Testing, GMP Deficiencies (PI 040-1)

ABBREVIATIONS