How do pharma and medtech manufacturers manage deviations so that they are documented in compliance with GMP and their backlog is cleared in an inspection-ready way?
We build deviation management systems in line with the EU GMP guidelines (EudraLex Volume 4) and ICH Q10: from the SOP and risk triage through structured root cause analysis and OOS handling to trending. The real crux is rarely capturing a deviation, but closing it on time with a defensible root cause analysis. That is exactly where the backlog builds up that turns into a finding during inspections, and exactly where the sequence of triage, investigation and CAPA determines audit readiness.
- Pharma
- Biotech
- MedTech
- IVD
Overview
What does GMP require of deviation management?
System design, OOS investigation and backlog reduction · EU GMP (EudraLex Volume 4), ICH Q10, ICH Q9
Last updated: 2026-06-13
A deviation is any departure from an approved instruction, specification or requirement. The EU GMP Guide (EudraLex Volume 4) requires that such deviations be recorded, assessed, investigated and documented. The points where systems tend to get stuck in practice:
- The pharmaceutical quality system under EU GMP Chapter 1 and ICH Q10 requires a documented procedure that assesses deviations, identifies root causes and derives actions. Without risk-based triage, every case is treated the same way, and critical deviations lose priority.
- The depth of the investigation must match the criticality. ICH Q9 calls for a risk-based approach; a blanket root cause analysis for every case overloads the system, while too shallow an analysis for critical cases generates findings.
- Out-of-specification (OOS) results and out-of-trend (OOT) results require their own multi-stage investigation process with a clear separation between the laboratory phase and the production phase before a result is confirmed or rejected.
- For medical devices and IVDs, ISO 13485:2016 requires the control of nonconforming product and corrective action; here, deviation management is interlinked with the CAPA system and with vigilance under EU 2017/745 (MDR) and EU 2017/746 (IVDR) respectively.
- Open deviations must be closed on time. A growing backlog of overdue deviations is one of the most common inspection findings and an indicator of an overloaded quality system.
Services
How we support you
Deviation System Design & SOP
We design the deviation process and write the SOP in line with EU GMP Chapter 1 and ICH Q10: classification by criticality, risk triage, timelines, escalation paths and responsibilities. The deliverable is an approvable SOP including a classification matrix and a set of forms.
OOS Investigation Process
We define the multi-stage investigation process for OOS and OOT results with separate laboratory and production phases. The deliverable is an OOS SOP with a decision tree that specifies when a result is rejected, confirmed or subject to extended investigation.
Deviation Backlog Clearance
We work through overdue deviations, prioritize them by risk and close cases with a defensible root cause analysis. The deliverable is a prioritized work-down plan and the documented closure of the open deviations with a traceable rationale.
Learn more →Training & Process Embedding
We train the functions involved in root cause analysis, assessment and documentation and embed the process in day-to-day operations. The deliverable is a completed training with training records and an RCA methodology aid for ongoing use.
How we work together
What it comes down to
Robust deviation management stands or falls with the sequence. At the start, triage decides whether a deviation is critical, major or minor, and thereby how deeply it must be investigated and how quickly it must be closed. If this first step is skipped, every case runs through the same process; minor deviations tie up the same investigation capacity as critical ones, and the deadlines for the critical cases slip first. Only after triage does root cause analysis take hold, the depth of which must match the criticality under ICH Q9, and only from a defensible root cause can a CAPA be derived. If the deviation is closed before the cause is established, the CAPA lacks its foundation, and the case recurs.
The typical difficulty is not recording but closing. This is exactly where the backlog of overdue deviations builds up, which turns into a finding in inspections under EU GMP Chapter 1 and is at the same time a symptom: a quality system that generates more deviations than it can process. We therefore act on two fronts: we clear the existing backlog on a risk basis and align the ongoing process so that no new one builds up. Aggregated trending closes the loop: it makes recurring causes visible that remain hidden when cases are viewed individually, and it translates deviation management from reactive mandatory documentation into the continual improvement required by ICH Q10.
Our approach
Our approach
Step
Result
Triage & Initial Assessment
Deviation recorded, classified by criticality and immediate containment actions defined; risk-based prioritization in line with ICH Q9 is in place.
Investigation & RCA
Structured root cause analysis with a documented cause whose depth matches the criticality; OOS/OOT investigation completed where needed.
CAPA Derivation
Corrective and preventive actions derived from the root cause and handed over to the CAPA system, with effectiveness checks planned.
Closure & Trending
Deviation closed on time and transferred into trending; recurring patterns become visible and feed back into the quality system.
Common pitfalls
Where projects commonly fail
The root cause analysis stays at the surface.
Human error is recorded as the root cause without looking for the systemic cause. The same deviation recurs, the CAPA does not take hold, and the audit reveals the pattern of recurring cases.
Risk-based triage is missing.
Every deviation goes through the same elaborate process, critical and trivial cases are treated alike. The system overloads, deadlines slip, and the backlog of overdue deviations grows into a finding under EU GMP Chapter 1.
With an OOS result, the laboratory phase is skipped.
A suspicious result is classified as a production error without a clean laboratory investigation, or vice versa. Without a clear separation of the investigation phases, the later assessment is open to challenge and the rejected result is not defensibly justified.
Deviation and CAPA are conflated.
The deviation is closed before the corrective and preventive actions are defined and their effectiveness is planned. The line between the individual deviation and the CAPA derived from it blurs, and traceability is lost.
Trending does not happen.
Individual deviations are closed but never evaluated in aggregate. Recurring causes remain invisible, the quality system does not learn, and the continual improvement required by ICH Q10 comes to nothing.
FAQ
Frequently asked questions
Sources
- EU GMP Guide (EudraLex Volume 4) - Chapter 1 (Pharmaceutical Quality System)
- ICH Q10 (Pharmaceutical Quality System) and ICH Q9 (Quality Risk Management)
- ISO 13485:2016 - Quality Management Systems for Medical Devices; EU 2017/745 (MDR); EU 2017/746 (IVDR)
- https://theentourage.de/expertise/deviation-management/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- EU GMP Guide (EudraLex Volume 4)
- EU GMP Chapter 1 (Pharmaceutical Quality System)
- ICH Q10 (Pharmaceutical Quality System)
- ICH Q9 (Quality Risk Management)
- ISO 13485:2016 (QMS for Medical Devices)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- 21 CFR Part 211 (cGMP for Finished Pharmaceuticals)
Related topics
CAPA Management →
The corrective and preventive actions derived from deviations, together with effectiveness checks
Complaint Management →
Complaints as a further source of deviations and CAPA in the quality system
Good Manufacturing Practice (GMP) →
The pharmaceutical quality system under EU GMP in which deviation management is embedded
Inspection Readiness →
Preparing for inspections in which open deviations and backlogs are examined
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences