Deviation and Incident Investigation Procedure (GMP)

Standard operating procedure for detecting, classifying, investigating, and closing GMP deviations and incidents, including root cause analysis, CAPA assignment, effectiveness checks, and documented review.

Steps

• The operator identifies and logs the deviation or incident
  Document the deviation in the controlled deviation/incident report within 2 hours of discovery, including: date/time, exact location, product or batch affected, equipment or process involved, factual description of what happened, and the immediate containment action taken. Verification: the supervisor reviews the log entry for completeness and assigns a unique record number.
• The operator contains the immediate risk
  Stop the affected activity immediately, segregate impacted material or equipment, and apply hold tags or status labels before the end of the shift. If the event creates an unsafe condition, escalate to the supervisor and follow site emergency or permit-to-work controls. Verification: affected material, equipment, or process status is placed on hold and the immediate risk is controlled.
• The supervisor classifies the event
  Review the event against approved SOPs and specifications, then classify it within 4 hours as deviation, incident, non-conformance, or escalation-required event. Record the classification rationale and severity based on product quality, data integrity, and validated state impact. Verification: the classification is documented and routed to the correct investigator or escalation path.
• The investigator performs a formal impact assessment
  Assess the potential impact within 1 business day on product, process, equipment, personnel, data integrity, and any released or potentially released material. Document the affected lots, scope of exposure, and whether additional containment, testing, or notification is required. Verification: the impact assessment is complete, time-stamped, and reviewed for affected scope and compliance impact.
• The investigator gathers facts and evidence
  Collect objective evidence within 2 business days, including relevant logs, records, screenshots, photos if available, and witness statements when needed. Organize the evidence in time order and confirm it is sufficient to reconstruct the event without relying on assumptions. Verification: the evidence package is complete, traceable, and linked to the event record.
• The investigator determines the root cause
  Use an approved root cause analysis method within 3 business days to identify the root cause or most probable cause, supported by objective evidence. Distinguish root cause from contributing factors and document why alternative causes were rejected. Verification: the conclusion is evidence-based and reviewed by the quality owner or designee.
• The investigator defines corrective and preventive actions
  Define CAPA actions within 2 business days of root cause confirmation, ensuring each action is specific, assigned to one owner, dated, and linked to the root cause and impact assessment. Include measurable completion criteria and a due date for each action. Verification: the CAPA plan addresses the root cause and is approved before implementation.
• The quality owner reviews and approves the investigation package
  Review the full investigation package within 2 business days of submission, confirming that the event description, impact assessment, evidence, root cause, and CAPA plan are complete and internally consistent. Approve, reject for rework, or escalate with a documented disposition. Verification: the review decision is recorded with comments and approval status.
• The owner implements and tracks CAPA actions
  Implement assigned CAPA actions by their due dates and update the CAPA log with completion evidence, status, and any blockers within 1 business day of each change. Escalate overdue actions to the quality owner. Verification: all actions are tracked to completion with evidence attached.
• The quality team verifies CAPA effectiveness and closes the record
  Perform the effectiveness check at the defined review point and confirm the acceptance criteria are met before closure. Attach the effectiveness evidence, final comments, and retention references to the record. Verification: the record is closed only after effectiveness is confirmed and all required documentation is complete.