> Deviation management software: record deviations, rate severity, document immediate actions, link them to CAPA and close them with a tamper-evident history. Source: [https://docxpert.io/en/features/deviation-management](https://docxpert.io/en/features/deviation-management) # Deviation Management Software for QMS and GMP ## What is a deviation? A deviation occurs when a process, product or material does not meet the defined requirements – a skipped inspection step, a temperature outside tolerance, a gauge without valid calibration. Not every deviation leads to a defective product, but every one must be detected, assessed and documented. ISO 9001 clause 8.7 requires nonconforming outputs to be identified and controlled to prevent their unintended use or delivery. In pharmaceutical and medical device manufacturing (EU GMP, ISO 13485 clause 8.3), documented deviation investigations are mandatory. ## The flow in docxpert 1. 1 Record Title, description, category (process, product, equipment, material, environmental, other), severity and detection time. Each deviation gets a sequential number automatically. 2. 2 Immediate action What was done right away to limit the impact – quarantine, sorting, readjustment? 3. 3 Assess impact Are products, batches, customers or other processes affected? The assessment is documented on the deviation. 4. 4 Cause and CAPA The cause is recorded. For serious or recurring deviations, you link a [CAPA](https://docxpert.io/en/features/capa-management) with root cause analysis and effectiveness check. 5. 5 Review and close The deviation moves through “under review” to “closed”. All status changes are logged with person and time. ## Rating severity correctly | Severity | Description | Example | Typical response | | --- | --- | --- | --- | | Critical | Risk to safety, health or product efficacy | Wrong material batch in a safety-relevant component | Immediate quarantine, CAPA, inform customers and authorities if needed | | Major | Significant impact on quality or conformity | Hardening furnace temperature out of tolerance | Investigation, assessment of affected batches, usually CAPA | | Minor | Low impact, no hazard | Inspection step skipped, follow-up inspection passed | Correction, cause clarification, CAPA if it recurs | | Cosmetic | Purely visual or formal deviation | Label with smudged print | Correction and documentation | Tip Define criteria and examples for each severity level in a procedure. Consistent rating is what makes analysis meaningful. ## Features at a glance Filters and overviewFilter by status, severity, category, assignee and period – with search across title and description. Linked to CAPADeviations and CAPAs are linked both ways; the CAPA shows all related deviations. Process and document referenceEach deviation can be assigned to a process and the affected document. PDF exportSingle deviations or filtered lists as PDF, for example for customers or batch records. Verifiable historyAll events of a deviation are hash-chained and can be verified for integrity. ResponsibilitiesReporter and assignee are clearly separated; open deviations appear for the assignee. Serious deviations become a CAPA · Screenshot with sample data ## Standards reference | Standard / regulation | Requirement | Implementation | | --- | --- | --- | | ISO 9001:2015, 8.7 | Identify and control nonconforming outputs; retain documented information | Record with description, action, decision and responsible person | | ISO 13485:2016, 8.3 | Control of nonconforming product, evaluation and investigation | Impact assessment, link to product and process | | EU GMP Part I, chapter 1 | Document and investigate deviations, initiate CAPA | Deviation with investigation and CAPA link | | IATF 16949:2016, 8.7.1 | Control of nonconforming product including customer notification | Documented decision and export for customers | | ISO 14001 / 45001, 10.2 | Handle nonconformities and incidents | Environmental category and CAPA link | ## Learning from deviations Handling individual deviations is mandatory – spotting patterns is where the real value lies. If deviations of one category cluster on one machine or in one process, that signals a systemic cause. The filtered overview shows such clusters quickly and is an important input to the [management review](https://docxpert.io/en/guides/management-review). - Number of deviations by category and severity over time - Lead time to closure - Share of deviations that led to a CAPA - Recurring deviations after a closed CAPA – a sign of ineffective actions ## Example: temperature deviation in the hardening furnace The night shift notices that hardening furnace 2 was above tolerance for 40 minutes. The shift lead records a deviation in the equipment category with severity major and quarantines the affected batch as an immediate action. In the morning, quality assurance assesses the impact: hardness tests on samples are fine, and the batch is released and shipped. Because it is the third temperature deviation in two months, quality assurance links a CAPA. The root cause analysis finds a faulty temperature sensor, and a maintenance interval is introduced. The deviation history shows every step with time and person – traceable for customers and auditors. ## Frequently asked questions Can a deviation be assigned to several CAPAs? A deviation points to one CAPA; a CAPA, however, can bundle several deviations, for example when the same cause occurred more than once. How do deviations relate to complaints? A customer complaint can lead to one or more internal deviations. Record the complaint as the source in the CAPA and link the related deviations. What is the difference between a deviation and a CAPA? The deviation documents the individual case and the immediate response. The CAPA removes the cause so the case does not recur. Not every deviation needs a CAPA. Who can record deviations? Authorised employees, typically everyone working in production, the lab or quality assurance. The assignee handles the deviation. Can I export deviations? Yes. Single deviations and filtered lists can be exported as PDF. How is the history protected against tampering? Each event of a deviation is cryptographically chained to the previous one. The chain can be verified; later changes stand out. Is deviation management suitable for GMP? It covers the core elements: recording, assessment, investigation, CAPA link and audit trail. Suitability for your GMP use is assessed as part of your validation. What should a deviation investigation contain before a CAPA decision? Start by describing the expected condition, the observed deviation and when it was detected. Record affected products, batches, processes or records only as far as they have actually been identified, and label open checks clearly. Keep containment and immediate correction separate from later action on the cause. The investigation should capture evidence, people consulted, data reviewed and the rationale for the chosen severity. Assess recurrence, potential impact and escalation against your defined criteria. A CAPA is appropriate when the cause is systemic or the risk warrants it; a reasoned decision not to open one should also be recorded. This makes the decision reviewable and prevents the investigation from ending with a bare description of the error. ## Read next [CAPA managementCorrective and preventive actions in nine phases – with 5 Whys, Ishikawa, deadlines and effectiveness checks.Learn more](https://docxpert.io/en/features/capa-management) [CAPA processFrom report to effectiveness check: the CAPA process in nine steps.Learn more](https://docxpert.io/en/guides/capa-process) [Root cause analysis5 Whys, Ishikawa and more: which method fits when.Learn more](https://docxpert.io/en/guides/root-cause-analysis) [Tamper-evident audit trailHash-chained change log with export – optionally anchored with a blockchain timestamp.Learn more](https://docxpert.io/en/features/blockchain-audit) [ISO 13485Medical device QMS with document control, training records, CAPA and risk links.Learn more](https://docxpert.io/en/standards/iso-13485) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)