Deviation management in pharma: the rules, classification and investigation steps

What counts as a deviation under EU GMP and 21 CFR 211

A deviation is any departure from an approved instruction or established standard. That is the definition in the glossary of EU GMP Part II, and it covers a skipped step in a batch record, an equipment alarm, an environmental monitoring excursion or a test run outside its method.

The EU and US rules say the same thing in different words. EU GMP Chapter 1 says "any significant deviations are fully recorded, investigated with the objective of determining the root cause and appropriate corrective and preventive action implemented". In the US, 21 CFR 211.100(b) says any deviation from written production procedures "shall be recorded and justified", and 21 CFR 211.192 requires any unexplained discrepancy to be "thoroughly investigated, whether or not the batch has already been distributed".

Source: EudraLex Volume 4 (European Commission); 21 CFR Part 211 (eCFR).

Our summary of 21 CFR Part 211 covers the rest of the US drug GMP rules.

Planned and unplanned deviations

An unplanned deviation is discovered after it happens. A planned deviation is a departure agreed in advance, for example a one-off use of an alternative piece of equipment. Neither EU GMP Part I nor 21 CFR 211 uses the phrase "planned deviation", so the rules that apply depend on what the departure is.

• Planned departures fall under EU GMP Chapter 5, point 5.15: a deviation "should be approved in writing by a competent person, with the involvement of the Quality Control department when appropriate". Chapter 1 also expects planned changes to be evaluated and approved before they are made. A permanent change belongs in change control, not in a deviation record.
• Unplanned deviations are what EU GMP Annex 16 calls "unexpected deviations". A QP may certify an affected batch only if registered specifications are met, the deviation has been "thoroughly investigated and the root cause corrected", and a risk assessment concludes the impact on quality, safety or efficacy is negligible. For biological medicines, Annex 16 warns that any deviation from the approved process "can have an unexpected impact on safety and efficacy".

US rules allow some specific departures if justified: 21 CFR 211.111 accepts a deviation from production time limits if it "does not compromise the quality of the drug product" and is justified and documented.

How to classify deviations: minor, major and critical

No EU or US regulation gives a single minor, major and critical scale for deviations in finished medicines, so each site defines its own in a deviation management SOP. EU GMP Chapter 1 speaks of "significant" deviations, and says the depth of root cause analysis "can be determined using Quality Risk Management principles". ICH Q9(R1) lists evaluating "the potential quality impact of a suspected quality defect, complaint, trend, deviation" as a use of quality risk management.

The one formal scale in EU GMP is for active substances: Part II says "critical deviations should be investigated" and the quality unit must make sure they are "investigated and resolved". For a benchmark, the HPRA grades the deficiencies it finds on inspection in three categories, shown below.

Source: HPRA, Good Manufacturing Practice (GMP) inspections (human medicines).

Whatever the labels, classify on product and patient risk, record why, and reclassify if the investigation finds more.

Deviation management in pharma: the investigation flow, step by step

A sound deviation management process follows the same path each time, with the depth of each step scaled to risk.

1. Record it at once. 21 CFR 211.100(b) expects production steps to be "documented at the time of performance". Note what happened, when, which batches and equipment.
2. Contain. Hold affected material. Under Annex 16, a batch stays at the site or ships under quarantine until a QP certifies it.
3. Classify. Assign a risk level using quality risk management, and agree who owns the investigation.
4. Investigate and widen the scope. 21 CFR 211.192 says the investigation "shall extend to other batches of the same drug product and other drug products that may have been associated" with the failure.
5. Find the root cause. Where the true cause cannot be found, EU GMP Chapter 1 says to address the most likely cause. A human error conclusion must be justified after checking that "process, procedural or system-based errors" have not been overlooked.
6. Assess product impact and decide on the batch. The QP must know of any deviation that could affect GMP or marketing authorisation compliance before certifying.
7. Raise CAPA, close and trend. Record conclusions and follow-up, as 211.192 requires, and feed the deviation into trend reviews.

Deviation timelines

EU GMP Chapters 1 and 5 and 21 CFR 211.192 do not set a number of days for closing a deviation. The FDA's OOS guidance says an investigation should be "thorough, timely, unbiased, well-documented, and scientifically sound". In practice, each site sets its own target in its SOP and records a justified extension when an investigation runs over. Deviations then come back in the annual product quality review: EU GMP Chapter 1 requires a review of "all significant deviations or non-conformances" and of how well the resulting CAPAs worked, and 21 CFR 211.180(e) requires at least an annual review that includes 211.192 investigations.

How deviation management connects to CAPA

The deviation investigation finds the cause, and CAPA removes it. EU GMP Chapter 1 says appropriate corrective and preventive actions "should be identified and taken in response to investigations", and their effectiveness "should be monitored and assessed". ICH Q10 names deviations as one of the inputs to a company's CAPA system.

A deviation that closes with "operator retrained" and no system fix is a common weak point. Our guide to CAPA vs RCA explains root cause tools and effectiveness checks, and our article on OOS investigations and CAPA covers laboratory deviations. For the wider framework, see the ICH Q10 summary.

What HPRA and FDA inspectors look for in Irish plants

Inspectors test whether deviations are raised, investigated and closed properly, and whether the same problem keeps coming back. The HPRA carried out 108 GMP inspections at sites producing human medicines or active substances in 2025, according to its 2025 annual report. Its inspections review pharmaceutical quality system documents and records, and after each inspection the site must answer every deficiency with a root cause analysis and a CAPA proposal stating what will be done, who is responsible and when. Our guide to HPRA inspections walks through that process.

FDA inspectors cite weak investigations often. In the FDA's FY2025 inspection observations, covering inspections that ended between 1 October 2024 and 30 September 2025, 21 CFR 211.192 was the second most cited drug observation, with 164 citations.

The clearest Irish example is the FDA's warning letter to Genzyme Ireland in Waterford, dated 22 June 2026. The FDA said the firm "cancelled numerous deviations without investigating the root cause or assessing product impact". The firm's own review of 74 cancelled deviations found that 36 needed an investigation. Read our analysis of the Sanofi Waterford warning letter, the Sanofi Ireland company page and our guide to FDA warning letters in Ireland.

• Never cancel or close a deviation before root cause and product impact are assessed.
• Extend each investigation to other batches and products that could be affected.
• Justify every classification and every human error conclusion.
• Trend deviations by area, equipment and cause, and act on repeats.

Deviation management applies at every licensed plant on our Ireland pharma map. Our pillar guide to GMP in Ireland explains the wider rules.