Deviation and Incident Investigation Procedure (GMP) SOP

Standard operating procedure for detecting, classifying, investigating, documenting, and closing GMP deviations and incidents, including root cause analysis and CAPA implementation.

Steps

• Detect and report the deviation or incident
  The operator records the deviation or incident immediately after detection. The operator includes the date and time, affected product or process, equipment involved, observed condition, and any immediate impact on quality, safety, or compliance.
• Make the area safe and contain the event
  The operator stops the affected activity if continuing could worsen the deviation. The operator segregates suspect material, labels affected equipment or product status, and prevents unintended use until QA review is complete.
• Notify the responsible roles
  The operator notifies the line supervisor and Quality Assurance without delay. The operator escalates immediately if the event may affect released product, validated state, data integrity, patient safety, or regulatory compliance.
• Classify the deviation or incident
  The QA reviewer evaluates the event against site criteria for severity, product impact, recurrence, and compliance risk. The QA reviewer assigns the investigation category and determines whether the event is minor, major, or critical based on defined thresholds.
• Escalate critical events for immediate review
  The QA manager or designee reviews the event, confirms containment actions, and determines whether batch disposition, product quarantine, or additional notifications are required. The reviewer documents the escalation decision and assigns investigation ownership.
• Collect facts and evidence
  The investigator gathers objective evidence, including batch documentation, equipment status, calibration or maintenance records, environmental data, operator statements, and photographs where appropriate. The investigator records only factual observations and avoids conclusions at this stage.
• Perform root cause analysis
  The investigator analyzes the event using an approved method such as 5 Whys, fishbone analysis, or fault tree analysis. The investigator distinguishes the immediate cause, contributing factors, and systemic cause, and documents the evidence supporting the conclusion.
• Define corrective and preventive actions
  The investigator and QA define corrective actions to address the immediate issue and preventive actions to reduce recurrence. The team assigns owners, due dates, effectiveness checks, and acceptance criteria for each action.
• Implement and track CAPA actions
  The responsible owners complete assigned actions and upload objective evidence into the CAPA system. The QA reviewer monitors overdue items, escalates missed due dates, and confirms that implementation matches the approved plan.
• Verify effectiveness and close the investigation
  The QA reviewer confirms that the root cause, actions, and evidence are complete and that the effectiveness check shows the issue has been controlled. The reviewer closes the deviation or incident record only when all required approvals and documented information are in place.