Run: Deviation and Incident Investigation Procedure (GMP)

Document the deviation in the controlled deviation/incident report within 2 hours of discovery, including: date/time, exact location, product or batch affected, equipment or process involved, factual description of what happened, and the immediate containment action taken. Verification: the supervisor reviews the log entry for completeness and assigns a unique record number.

Stop the affected activity immediately, segregate impacted material or equipment, and apply hold tags or status labels before the end of the shift. If the event creates an unsafe condition, escalate to the supervisor and follow site emergency or permit-to-work controls. Verification: affected material, equipment, or process status is placed on hold and the immediate risk is controlled.

Review the event against approved SOPs and specifications, then classify it within 4 hours as deviation, incident, non-conformance, or escalation-required event. Record the classification rationale and severity based on product quality, data integrity, and validated state impact. Verification: the classification is documented and routed to the correct investigator or escalation path.

Assess the potential impact within 1 business day on product, process, equipment, personnel, data integrity, and any released or potentially released material. Document the affected lots, scope of exposure, and whether additional containment, testing, or notification is required. Verification: the impact assessment is complete, time-stamped, and reviewed for affected scope and compliance impact.

Collect objective evidence within 2 business days, including relevant logs, records, screenshots, photos if available, and witness statements when needed. Organize the evidence in time order and confirm it is sufficient to reconstruct the event without relying on assumptions. Verification: the evidence package is complete, traceable, and linked to the event record.

Use an approved root cause analysis method within 3 business days to identify the root cause or most probable cause, supported by objective evidence. Distinguish root cause from contributing factors and document why alternative causes were rejected. Verification: the conclusion is evidence-based and reviewed by the quality owner or designee.

Define CAPA actions within 2 business days of root cause confirmation, ensuring each action is specific, assigned to one owner, dated, and linked to the root cause and impact assessment. Include measurable completion criteria and a due date for each action. Verification: the CAPA plan addresses the root cause and is approved before implementation.

Review the full investigation package within 2 business days of submission, confirming that the event description, impact assessment, evidence, root cause, and CAPA plan are complete and internally consistent. Approve, reject for rework, or escalate with a documented disposition. Verification: the review decision is recorded with comments and approval status.

Implement assigned CAPA actions by their due dates and update the CAPA log with completion evidence, status, and any blockers within 1 business day of each change. Escalate overdue actions to the quality owner. Verification: all actions are tracked to completion with evidence attached.

Perform the effectiveness check at the defined review point and confirm the acceptance criteria are met before closure. Attach the effectiveness evidence, final comments, and retention references to the record. Verification: the record is closed only after effectiveness is confirmed and all required documentation is complete.