Deviation

A deviation is any departure from an approved instruction, specification, or standard. The essential distinction is between planned and unplanned. A planned deviation is authorised in advance, risk-assessed, and time-bounded — and it should be rare, because a procedure that repeatedly needs planned deviations is a procedure that is wrong. An unplanned deviation is discovered after the fact and is what most systems mean by the word.

Classification drives the response. A minor deviation with no product impact needs documentation and closure; a major or critical one needs a full investigation, a product-impact assessment covering other batches potentially affected, and usually a CAPA. Getting classification right matters more than getting it fast: under-classifying to avoid an investigation is a finding in itself, and one inspectors actively look for by reading the low-classified records.

The maturity signal is not how few deviations a site records — it is whether they are trended. A high count with strong investigation and visible trending is usually a healthier system than a suspiciously low count, because the low count often means problems are being absorbed informally rather than surfaced. Regulators expect pattern recognition across deviations, not just individual closure.

• —Planned (authorised in advance, risk-assessed, time-bound) vs unplanned (discovered after the fact).
• —Classification (minor / major / critical) drives investigation depth and product-impact assessment.
• —Under-classification to avoid investigation is itself a finding — inspectors read the minor records.
• —Product impact must consider other batches, not just the one in front of you.
• —Trending across deviations is the expectation; individual closure alone is not enough.
• —A very low deviation count can signal under-reporting rather than control.

21 CFR 211.100(b) and 211.192 (production record review and investigation of discrepancies); EU GMP Part I Chapters 1 and 5, and Chapter 8 for complaints and recalls; ICH Q10 §3.2.2 (CAPA system); ICH Q9(R1) for proportionate, risk-based response.