Deviation classification: minor, major and critical, with a risk-based method

Classification decides how much investigation a deviation gets, who approves it and how fast it has to close. Get it wrong in one direction and you drown in critical investigations for trivial events. Get it wrong in the other, the common direction, and a serious event is investigated in an afternoon by the person who caused it.

The three classes, and what they should mean

• Critical: the event has or could have a direct effect on patient safety, product quality or data integrity, or represents a serious breach of GMP. Typical triggers: sterility assurance compromised, wrong product or strength, contamination, falsified data. Requires immediate QA notification, senior management awareness, a full cross-functional investigation, and consideration of regulatory notification.
• Major: the event could affect product quality or the validity of the record but the effect is not immediate or is contained. Typical triggers: out-of-tolerance equipment used in manufacture, missed in-process control, environmental excursion in a graded area. Full investigation, QA approval, defined timeline.
• Minor: no reasonable potential for product impact, no data integrity implication, isolated. Typical triggers: late signature, incorrect form version used, cosmetic documentation error. Short investigation, but still an investigation, and still trended.

A risk-based method that survives challenge

ICH Q9 (R1) wants classification to reflect severity, probability and detectability, with the level of formality proportionate to the risk. In practice a simple two-axis table works and is defensible: severity of the potential effect on the patient or product, and the degree of certainty that the effect did not occur.

1. Ask: what is the worst credible effect on the patient or on product quality if this event went undetected? Not the worst imaginable, the worst credible.
2. Ask: what evidence do we have right now that the effect did not occur? If the answer is 'none yet', classify as if it occurred.
3. Classify on the worst credible effect. Re-classify downward only when the investigation produces evidence, and document the re-classification as a decision with a rationale.

What classification should trigger

Your procedure should tie each class to concrete requirements: who must be notified and when, who leads the investigation, which tools are mandatory, what approvals are needed and the target closure time. If the procedure has classes but no consequences, classification is a label and inspectors treat it as one.

Repeat events change the class

A minor deviation that has happened four times this year is no longer minor, because the fourth occurrence tells you the previous three CAPAs did not work. Build a rule into the procedure: a recurrence within a defined window escalates the class by one level and requires a review of the previous investigations.

Module 3 of the course includes the full decision table with worked examples across production, laboratory, warehouse and documentation deviations.