_1762866128417-DS2_OO1j.png)
What is a deviation?
A deviation occurs when a process, product or material does not meet the defined requirements – a skipped inspection step, a temperature outside tolerance, a gauge without valid calibration. Not every deviation leads to a defective product, but every one must be detected, assessed and documented.
ISO 9001 clause 8.7 requires nonconforming outputs to be identified and controlled to prevent their unintended use or delivery. In pharmaceutical and medical device manufacturing (EU GMP, ISO 13485 clause 8.3), documented deviation investigations are mandatory.
The flow in docxpert
- 1
Record
Title, description, category (process, product, equipment, material, environmental, other), severity and detection time. Each deviation gets a sequential number automatically.
- 2
Immediate action
What was done right away to limit the impact – quarantine, sorting, readjustment?
- 3
Assess impact
Are products, batches, customers or other processes affected? The assessment is documented on the deviation.
- 4
Cause and CAPA
The cause is recorded. For serious or recurring deviations, you link a CAPA with root cause analysis and effectiveness check.
- 5
Review and close
The deviation moves through “under review” to “closed”. All status changes are logged with person and time.
Rating severity correctly
| Severity | Description | Example | Typical response |
|---|---|---|---|
| Critical | Risk to safety, health or product efficacy | Wrong material batch in a safety-relevant component | Immediate quarantine, CAPA, inform customers and authorities if needed |
| Major | Significant impact on quality or conformity | Hardening furnace temperature out of tolerance | Investigation, assessment of affected batches, usually CAPA |
| Minor | Low impact, no hazard | Inspection step skipped, follow-up inspection passed | Correction, cause clarification, CAPA if it recurs |
| Cosmetic | Purely visual or formal deviation | Label with smudged print | Correction and documentation |
Features at a glance
Standards reference
| Standard / regulation | Requirement | Implementation |
|---|---|---|
| ISO 9001:2015, 8.7 | Identify and control nonconforming outputs; retain documented information | Record with description, action, decision and responsible person |
| ISO 13485:2016, 8.3 | Control of nonconforming product, evaluation and investigation | Impact assessment, link to product and process |
| EU GMP Part I, chapter 1 | Document and investigate deviations, initiate CAPA | Deviation with investigation and CAPA link |
| IATF 16949:2016, 8.7.1 | Control of nonconforming product including customer notification | Documented decision and export for customers |
| ISO 14001 / 45001, 10.2 | Handle nonconformities and incidents | Environmental category and CAPA link |
Learning from deviations
Handling individual deviations is mandatory – spotting patterns is where the real value lies. If deviations of one category cluster on one machine or in one process, that signals a systemic cause. The filtered overview shows such clusters quickly and is an important input to the management review.
- Number of deviations by category and severity over time
- Lead time to closure
- Share of deviations that led to a CAPA
- Recurring deviations after a closed CAPA – a sign of ineffective actions
Example: temperature deviation in the hardening furnace
The night shift notices that hardening furnace 2 was above tolerance for 40 minutes. The shift lead records a deviation in the equipment category with severity major and quarantines the affected batch as an immediate action. In the morning, quality assurance assesses the impact: hardness tests on samples are fine, and the batch is released and shipped.
Because it is the third temperature deviation in two months, quality assurance links a CAPA. The root cause analysis finds a faulty temperature sensor, and a maintenance interval is introduced. The deviation history shows every step with time and person – traceable for customers and auditors.
Frequently asked questions
Can a deviation be assigned to several CAPAs?
A deviation points to one CAPA; a CAPA, however, can bundle several deviations, for example when the same cause occurred more than once.
How do deviations relate to complaints?
A customer complaint can lead to one or more internal deviations. Record the complaint as the source in the CAPA and link the related deviations.
What is the difference between a deviation and a CAPA?
The deviation documents the individual case and the immediate response. The CAPA removes the cause so the case does not recur. Not every deviation needs a CAPA.
Who can record deviations?
Authorised employees, typically everyone working in production, the lab or quality assurance. The assignee handles the deviation.
Can I export deviations?
Yes. Single deviations and filtered lists can be exported as PDF.
How is the history protected against tampering?
Each event of a deviation is cryptographically chained to the previous one. The chain can be verified; later changes stand out.
Is deviation management suitable for GMP?
It covers the core elements: recording, assessment, investigation, CAPA link and audit trail. Suitability for your GMP use is assessed as part of your validation.
What should a deviation investigation contain before a CAPA decision?
Start by describing the expected condition, the observed deviation and when it was detected. Record affected products, batches, processes or records only as far as they have actually been identified, and label open checks clearly. Keep containment and immediate correction separate from later action on the cause. The investigation should capture evidence, people consulted, data reviewed and the rationale for the chosen severity. Assess recurrence, potential impact and escalation against your defined criteria. A CAPA is appropriate when the cause is systemic or the risk warrants it; a reasoned decision not to open one should also be recorded. This makes the decision reviewable and prevents the investigation from ending with a bare description of the error.