Questions that arrive through the contact form, answered here so the next person does not have to ask. Each answer cites the clause. Ask your own at the bottom.
How long do we have to close a deviation?
No regulation sets a number of days. EU GMP Chapter 1 and Chapter 8 require investigations to be thorough and timely, and most sites set a 30-day target with a documented extension process. The number matters less than the behaviour around it: closing on day 30 with the investigation unfinished is a finding; extending to day 45 with a rationale and QA approval is not.
What inspectors check is whether the target drives premature closure. Sample your on-time closures and read the investigation section. If it is thin, the target is doing damage.
EU GMP 5.15 says deviations from instructions should be avoided as far as possible and, if they occur, approved in writing with QA involvement. That is the only regulatory basis for the concept, and it describes a one-off, controlled departure, not a mechanism for making changes.
The trouble starts when a planned deviation is repeated, extended or used for a process change. That is change control by another name without change control's risk assessment and validation review. If you keep the concept, give it a hard end date, a single permitted extension, and a rule that any repeat becomes a change request.
If the batch passed release testing, can we conclude no impact?
Not on its own. Release tests are designed to confirm specification, not to detect every failure mode a deviation could introduce. A temperature excursion may affect a degradant that is not on the release panel; a mix-up may affect units the sample did not include.
A defensible impact assessment names the quality attribute the event could affect, explains the mechanism, and then cites the evidence that the attribute was not affected. Release results are part of that evidence. They are not the conclusion.
Who should investigate: the person who raised it, or QA?
The area that owns the process usually leads the investigation because they understand it; QA reviews, challenges and approves. What matters is independence at the review step and competence at the investigation step. An investigator who caused the event should not be the sole investigator, and QA should not simply countersign.
For major and critical deviations, a cross-functional team (production, QA, engineering, QC as needed) is the norm and is what inspectors expect to see named in the record.
EU GMP 1.4(xiv), 2.5; ICH Q10 3.2.2
What is the difference between a deviation and an OOS?
An OOS is a laboratory result outside specification and is investigated first under the laboratory investigation procedure (phase 1) to rule out an assignable laboratory cause. If none is found, the investigation moves into the manufacturing process (phase 2), and at that point it is handled as a deviation or feeds one.
The two systems must link. An OOS confirmed as a manufacturing cause without a corresponding deviation record is a gap inspectors find quickly.
EU GMP 6.35, 6.36; PIC/S PE 009 Ch. 6
How many deviations per month is too many?
There is no benchmark, and a low count is as suspicious as a high one. A site with very few deviations is either running exceptionally well or not reporting. Inspectors look at the mix: what proportion is minor, whether the same failure modes recur, whether classification is credible, and whether the trend is discussed at management review.
The number to worry about is repeats: the same failure mode more than twice in a year with the same CAPA each time.
Occasionally, after a documented analysis has ruled out procedure clarity, equipment design, workload, environment and training method as contributing factors. The record must show that analysis. As the first and only line of the root cause section, with retraining as the CAPA, it is one of the most cited findings in published inspection data.
We are a medical device company. Does this apply to us?
The vocabulary differs (nonconformance under ISO 13485 8.3, CAPA under 8.5.2 and 8.5.3, and the quality management system obligations in MDR Article 10) but the discipline is the same: define the requirement, record the departure, contain, investigate to a cause that can be changed, assess impact across everything in scope, act, and check the action worked. The course is written around EU GMP and calls out the device equivalents where the expectations differ.
ISO 13485 8.3, 8.5.2, 8.5.3; MDR 2017/745 Art. 10(9)
Have a question that is not here?
Ask it. A person answers within two working days, and if it is a good question it gets added to this page.
