GMP deviation investigations should be proportionate to the level of risk. There is little value in carrying out a full root cause analysis for every minor issue. Instead, organizations should perform an impact assessment to classify the deviation and determine the appropriate level of investigation.
However, the process around the impact assessment and classification stages needs a coherent, repeatable strategy behind it. In this article we explore the factors to take into consideration.
Why classify GMP deviations?
Establishing a procedure to classify GMP deviation investigations is an important decision. But we cannot create this without understanding the underlying reason for the process.
The purpose of classification is to ensure that the level of effort is proportional to the impact and risk. For each event, the classification protocol tells our organization, regulators, and customers:
- How thoroughly we need to investigate
- Who will investigate
- Who will approve
To set these criteria, we must understand that a deviation investigation aims to give enough information to support effective action. For each event, the classification protocol should consider two questions:
- What do we need to know to take effective action?
- What do we need to document to defend those actions to regulators and customers?
In a GMP deviation investigations, there are two effective actions to take.
1. How should we disposition the batch? Options include release to market, quarantine, rework, or rejection.
2. What CAPA (Corrective and Preventive Actions) do we need to implement? In investigations, CAPA may range from a recall to maintaining the current state.
The classification protocol should also recognize that some events do not require investigations or CAPAs. Simply close these events with a note to the batch record, an NOE, or by following a documented protocol.
Impact Assessment and Scope
The first thing to consider when deciding if we need the root cause is this: “How does it affect patient safety or data integrity?”
For example, a missed inspection that is verified by another source does not present the same SISPQ or ALCOA++ risk as a foreign particle in a sterile injectable, or an unauthorized data change.
21 CFR 211.192 requires a thorough investigation with conclusions and follow-up. However, it does not require a definitive cause. If the SISPQ and ALCOA++ impact is well-understood and minimal, less effort and rigor may be appropriate under FDA risk-based expectations.
To understand the impact on patient safety or data integrity, we must ask: “What is the scope of this event?” To define the scope – or the boundaries – of the event, we need to know and document:
- Which object is affected – equipment, component, product, campaign, batch, or sample – and which similar objects are not?
- What was the noncompliance, and what similar deviations could have occurred but did not?
- Where was the noncompliance observed, and where else was the object inspected and found compliant?
- When was the object inspected and found noncompliant, and when else was the object inspected and found compliant?
It logically follows, that if the event has a broad scope, then we likely need to know the root cause. If the deviation is unclear, how can we decide what to do with the affected batches? How can we choose a CAPA that meets GMP expectations?
Has this happened before?
Another aspect of scope is the question: “How often has this happened before?” This connects to the 21 CFR 211.192 requirement for follow-up. If we can show the event had no SISPQ impact and was isolated, we can simply determine a reasonable apparent cause, and then follow up with track-and-trend monitoring.
However, even when there is no SISPQ impact, a repeat event may raise regulatory questions about process drift, systemic flaws, or CAPA effectiveness. In these cases, we should, at a minimum, revisit previous CAPAs and prior conclusions about cause.
Once we understand how the event affects patient safety or data integrity, and the scope, we can decide how definitively we need to know the root cause.
Deviation Classification: Minor, Major, Critical
GMP best practice classifies each deviation as either minor, major or critical in severity.
Minor Events
For Minor events that are isolated and unlikely to affect product quality or safety, the question is: Do we understand the event well enough to confirm that there was no impact and disposition the batch? The response typically includes documentation, correction, confirmation that there is no broader impact, and possibly routine CAPA.
Example : Minor documentation errors or noncritical procedural gaps
Major Events
For Major events that represent significant failures or systemic weaknesses that may affect product quality, GMP compliance, or patient safety, the question is: Do we understand the event well enough to fix the system and prevent recurrence?
These events need a full investigation, root cause analysis, evidence that the most probable cause has been addressed, corrective and preventive actions (CAPA), and trending.
Examples: Overdue calibration of critical equipment, failure to follow approved procedures, incomplete batch record review
Critical Events
For Critical events involving product impact and patient harm, the question is: “Do we understand the failure mode well enough to prevent patient harm and defend our market-action decision to the FDA?”
These events require urgent containment, rigorous root cause analysis, ruling out alternative causes, immediate corrective action, and may trigger recalls or regulatory action.
Examples: Sterility failure, contamination, use of unapproved materials, data falsification
Classification assigns deviation severity based on the level of risk. In turn, this determines the depth of investigation needed and the standard of evidence required.
Minor issues need a reasonable explanation. Major issues require a preponderance of evidence and preventive action, and Critical issues require highly defensible scientific proof and immediate risk control.
Taking these factors into account, we can define a standard operating procedure (SOP) that meets regulatory requirements. It also ensures the next steps match the impact and risk.
Explore more
Read our recent article on building trust in your in your CAPA investigation with a robust root cause analysis
Find out more about our specialist training Problem Solving & Decision Making for Corrective and Preventive Actions (CAPAs) – an FDA-recognized, step-by-step approach to close out deviations with complete, well-documented investigations.
