Video in production
The full written lesson is below. The recorded version is being produced and will appear here.
The case you will follow
Throughout this course you will follow one event from first observation to closed record. It is 14:20 on a Tuesday. A packaging operator on Line 3 notices that the batch number printed on the last two cartons is 4471 while the batch record says 4417. The line has been running for twenty minutes. Keep this in mind. Every module adds the next step.
1.1Why the regulation refuses to define it for you
EU GMP never gives a tidy definition of a deviation. Chapter 1 requires a quality system in which 'deviations, suspected product defects and other problems' are recorded, investigated and learned from. Annex 16 requires the QP to consider every deviation affecting a batch before certification. Neither tells you what a discrepancy is.
That is deliberate. The regulator expects each site to decide what matters for its products and to justify the decision. An inspector will not ask you to recite a definition. They will pull your deviation log and ask why a specific event is in it, or, more often, why it is not.
So the definition you need is one you can defend in that conversation. The one this course uses: a deviation is any departure from an approved instruction, specification, validated condition or expected state that could affect product quality, patient safety or the integrity of GMP data. Every word in it does work. 'Approved instruction' means there is a document to point at. 'Could affect' means a credible mechanism, not proven harm.
If you cannot name the document, parameter or expected condition that was departed from, you do not yet know whether you have a deviation. Find that first. It takes two minutes and it is the first thing an inspector will ask.
What the inspector asks
- "Show me your definition of a deviation and where it is approved."
- "Who decides whether an event meets it, and how is that decision recorded?"
1.2The three-question test
On the floor, at 14:20, nobody is going to open the quality manual. You need a test that fits in your head. Three questions, in order.
One, the instruction question: was there an approved instruction or expected condition, and was it followed? For the carton event: the batch record says 4417, the carton says 4471. The instruction was not followed. Yes.
Two, the impact question: could this plausibly affect quality, safety or data? A mislabelled carton means a patient or pharmacist could receive product whose identity cannot be traced. Yes, and it is not close.
Three, the knowledge question: did the system just reveal something it should remember? Two cartons out of hundreds carried the wrong number, which means the print verification either was not performed or did not catch it. That is a control weakness whether or not the cartons are caught today. Yes.
Three yeses is unambiguous. But the test earns its keep on the events that score one or two. A door propped open in a Grade D corridor for two minutes with no product exposed: instruction yes, impact weak, knowledge yes. Record it. The impact will drive the classification, which is Module 3. The knowledge question is why it goes in the system at all.
The rule of thumb: two yeses, record it. One yes and it is the instruction question, record it and let the classification decide the effort. Zero yeses, it is not a deviation, but write down why you concluded that if anyone asked.
The knowledge question is the one most sites skip. It is also the one that separates a deviation log that inspectors trust from one they treat as decoration.
What the inspector asks
- "Talk me through how an operator decides whether to raise a deviation."
- "Your log shows eleven deviations last year for a site this size. What does not get recorded?"
1.3Five grey areas that turn into findings
Planned departures. If you know in advance that you will not follow the procedure, that is not a deviation, it is a change. 'Planned deviation' is a phrase inspectors read as 'we bypassed change control', and it is cited regularly under Chapter 1, 1.4(xiii). Route it through change control with the impact assessed before, not after.
Laboratory results. An out-of-specification result is not, by itself, a deviation. It triggers a laboratory investigation under Chapter 6. It becomes a deviation when that investigation finds a departure from procedure, or when the result is confirmed and a batch is affected. The mistake in both directions is common: raising a deviation for every OOS and clogging the system, or never raising one and losing the link to batch disposition.
Repeat minors. Ten identical minor deviations are not ten minor problems. They are one systemic problem with ten data points. The tenth report should say so, and if your trending does not surface it, Module 4 will show you what an inspector does instead.
Late discovery. A deviation found during batch record review three weeks after the event is still a deviation. The delay in detecting it is a second one, about the review process. Sites that record only the first get a finding for the second.
Near misses. Nothing was affected, this time. If the reason nothing was affected is luck rather than a control, the knowledge question says record it. If the reason is that a control worked as designed, it is not a deviation, but it may be worth a note in the trend review that the control was tested.
Inspectors read a deviation log for what is not in it. A site with very few deviations and no near misses is not a clean site. It is a site that does not record.
What the inspector asks
- "How do you handle an intentional departure from a procedure?"
- "Show me a deviation raised from a near miss."
1.4Who raises it, and when
The person who observes the departure raises it. Not their supervisor, not QA, not 'the area owner'. The observer records what they saw, at the time, in the approved system, before the shift ends. Everything that follows in the course depends on that first record being contemporaneous and attributable. If it is written up the next morning by someone else from memory, the investigation starts on sand.
Back to Line 3. It is 14:21. The operator has answered the three questions in her head and has three yeses. What she does in the next ten minutes, before a single form is filled in, is Module 2: immediate actions and containment. What she writes, and how it is classified, is Module 3. By Module 6 you will have a complete, closed record for batch 4417 that an inspector can read without you in the room.
What the inspector asks
- "Who raised this deviation, and when, relative to the event?"
- "What did the person who observed it do in the first hour?"
What to take away
- A deviation is a departure from an approved instruction or expected condition that could affect quality, safety or data integrity. Name the document first.
- Three questions: instruction, impact, knowledge. Two yeses, record it.
- Planned departures are changes. 'Planned deviation' is a finding in waiting.
- An OOS is a laboratory investigation first and a deviation only if it finds a departure or a confirmed batch impact.
- Late discovery is two deviations: the event and the delay.
- The observer records it, contemporaneously, in the approved system, before the shift ends.
Check your understanding
Three questions on this module. The full course has one of these after every module.
1An operator notices the Grade D corridor door propped open for around two minutes. No product was exposed. Under the three-question test, what should happen?
2A department wants to skip a cleaning step for one campaign because of a scheduling clash and proposes to document it as a planned deviation approved by QA. Is this acceptable?
3During batch record review, fifteen days after manufacture, a reviewer finds an in-process check that was never recorded. What should the record contain?
The rest of the course
- What counts as a deviation and what does notFree
- Immediate actions and containment
- Classification: minor, major, critical
- Investigation tools: 5 Whys, Ishikawa, timeline analysis
- Impact assessment and batch disposition
- Writing the report and closing the loop