How can you write better deviation reports for GMP?

For any kind of deviation reports including GMP deviation reports you need: 1- to undrestand the deviation and non-conformity, 2- to investigate deviation and determine real root cause from several possible root causes, 3- to find solution for correction and corrective action, 4- to make prevention and preventive action 5- to verify effectiveness of CAPA, 6- to evaluate deviation management system with analyzing annualy data and making trend analysis.

The best deviation system I've seen started with the question "which step of which procedure or specification have we deviated from?" Having clarity with respect to this question is vital because: 1) It helps to understand whether you truly have deviated. It's amazing how many deviations get raised just because something "feels off", when no actual standard has been broken. 2) It aligns all writers and reviewers with documented standards. 3) It makes periodic trending really easy, indicating which standards are most commonly breached, which procedures need rewording and which worksheets need user-centered redesign.

Investigate and analyze the underlying causes of the deviation. This may involve reviewing relevant SOPs (Standard Operating Procedures), conducting interviews, or examining equipment, materials, or environmental factors. Identify and document the specific root cause(s) or potential contributing factors.

Understanding the deviation and the need for it will give perspective to ensuring that the root cause analysis gets an actionable cause or reason for the deviation. This will ensure that the appropriate corrective action is employed while also ensuring there is no future recurrence.

The use of deviations should be used sparingly! To many deviations can be an indicator of an unstable QMS. With that said, understand what part of your QMS is being deviated, D&D controls, purchasing, manufacturing etc. If your deviation is related to a design spec, quarantine your product. You can route deviation and NCMR together for signatures. Oh and repeat deviations is a red flag! And it's time to correct your issue in CAPS or change control at a minimum. Be transparent use the tool in your QMS and you can't go wrong.

In my experience any successful deviation investigation lies in the details. While we have a number of tools for carrying out investigation, majority of the personnel tend to quickly jump into the root cause before thoroughly looking into the factors that might have contributed to the incident. This failure in identifying the root cause is the reason for repeated deviation along with not arriving at the right CAPA.

One fatal flaw is that I see so many people not properly assess the true root cause. They stop too soon in the investigation and fail to dig down to the real root cause. It is very difficult to understand the Impact when you stop at human error instead of trying to figure out why it was human error.

Linking the deviation to product(s) and/or process helps to see the picture of the potential impact. Ring-fencing potentially impacted product, and use the investigation to narrow the scope on impact.

I totally agree with it!. While identifying the root cause by the methods mentioned. The 5 Whys methodology is a powerful tool when investigating non-conformities. By systematically probing the causes of the issue, organizations can effectively identify and address the root cause, reducing the likelihood of similar problems in the future. Embracing this approach fosters a culture of improvement, driving overall quality and efficiency in processes, products, and services.

Yes, I agree that the 5 Why, and the fishbone diagram is one of the important tools for root cause analysis. In my opinion, in addition to this GEMBA walk and brainstorming with the cross-functional team including the operators is very important to identify the exact root cause. Even though we use tools like 5Why and Fishbone, until and unless we go to a place where the deviation has occurred, it is difficult to understand the underlying factors which are the contributory cause for the reported deviation. The discussion with the people involved like operators helps us to understand the issue in depth. Identification of the exact root cause is a success Mantra to avoid repeat deviation by taking effective CAPA.

This is where it usually goes wrong. Most deviations are written to the wrong root cause, and therefore are pretty vague. When you are doing your investigations, make sure to dig past the answer you think it might be. If you conclude that it was the operator, ask your self if that person came in with the malicious intent, or is it possible that there was a problem in the system that led the operator to that point. It might be painful to dig and find larger systemic problems, but that is the expectation placed on us in the guidance.

All of the root-causing tools mentioned are completely valid ways of assessing data that has been gathered. However, we've missed the critical step of gathering information in a structured manner. Tools that work well for this include process flow gap analysis e.g. what should happen vs what DID happen. Going into fishbone analysis or 5 WHYS with incomplete information will give distorted root causes. The DMAIC methodology is great for driving the discipline of understanding the problem statement and defining what information you need to gather. THEN you can analyse using the tools mentioned. As already covered by @Anant Rao Kulkarni, a GEMBA walk is also a valuable precursor to gap analysis.

Agree with many of the comments. Having structure to an investigation allows clearer understanding. Also utilising a cross-functional team to ensure all avenues are explored. For larger investigations it can be useful to have an independent facilitator to drive the investigation without bias. And tying into ICH Q9, the level of effort put into an investigation should be commensurate with the risk.

The principle of "golden CAPA" is central here. If we have truly got to root cause, a very small number of actions (ideally one) should address that cause. Where it seems wise to also address some of the contributory causes, we shouldn't confuse the line of sight.

Effective corrective and preventive actions are very important elements to avoid repeat deviations. Most of the time inappropriate CAPA leads to repeat deviation. The reason for inadequate CAPA is either an inaccurate root cause for the reported deviation or just focusing on the correction of the nonconformity rather than focusing on corrective and preventive actions. It is very important to focus on preventive actions to avoid the occurrence of reported deviation in the other product/equipment/process/system. Deviations are an early warning system related to an issue. Adequate investigation and appropriate CAPA not only helps us to avoid repeat deviation but also it helps us to avoid regulatory observations and market complaints etc.

Part of defining the CAPA should be to define how you will assess its effectiveness. If you cant write an effectiveness check, your CAPA is probably not appropriate.

Most companies look at CAPA as one thing, when in fact it should be two separate things. If the program were split into the 2 components Corrective/preventive, it becomes easy to make the Preventive Action a positive function, potentially with a reward component. Imagine how few Corrective actions there would be if the people in the trenches felt empowered to help fix the things they see. Imagine the pride they would feel seeing things not fall apart before they could suggest changes. This would certainly turn around the entire work culture and make it a much happier work environment. Contact me for more information.

A common mistake I've seen (and made) is to tell the story of the investigation (i.e. the facts in the order they were discovered) in the deviation report. This results in a messy, convoluted report running to scores of pages which explain every dead-end and discounted theory in the investigation. It is far more clear and concise to tell the story of the incident (the facts, in the order that they actually happened).

One thing that I commonly see is that many people fail to understand the audience they are writing the deviation to. So many deviations try to follow a template and end up being great and fully understandable to those directly involved, but for an agency auditor to pick it up and read it, they do not get the answers to the burning questions.

I find that when I review deviations, the best deviation reports are succinct, stick to the facts and the writer knows the target audience, which ultimately could be a global regulatory auditor/authority.