Risk, deviations, investigations, and CAPA
How a controlled organisation responds when reality departs from the plan: record the deviation, find the root cause, take corrective and preventive action, and let risk direct the rigour.
What a module is not
A module is a reading step, not training and not a qualification. Completing it evidences that you read it — SPEQ says exactly that on the credential — and the knowledge checks are a self-check, not an assessment.
Being in control means responding to problems in a disciplined, written way.
Deviations are investigated to root cause; CAPA fixes and prevents; ICH Q9 risk sets the rigour.
Symptom-only CAPA, or CAPA never checked for effectiveness, is a recurring serious inspection finding.
Things go wrong; the system is how you respond
No regulated operation is perfect. What separates a controlled organisation from an uncontrolled one is not the absence of problems but a disciplined, documented response to them. When reality departs from the approved procedure, that is a deviation, and it must be recorded, assessed for impact, and investigated — not quietly fixed.
The investigation asks a specific question: what actually caused this, at the root, rather than at the surface? "The operator made a mistake" is rarely a root cause; "the procedure allowed two similar containers to be confused" often is. Getting to the real cause is what makes the fix effective.
From investigation to CAPA — and from risk to rigour
Once the root cause is understood, the organisation takes corrective action (fix this occurrence) and preventive action (stop it recurring) — together, CAPA. A CAPA that only addresses the symptom, or that is never checked for effectiveness, is a common and serious weakness inspectors probe.
Underneath all of this sits risk. Quality Risk Management (the domain of ICH Q9) is how an organisation decides how much rigour a given activity, deviation, or change deserves — concentrating effort where the consequence to the patient is greatest. Risk is the lens that keeps control proportionate instead of either reckless or paralysed.
- 1A controlled organisation is defined by its disciplined response to problems, not their absence.
- 2A deviation is any departure from the approved way of working — it is recorded and investigated, not hidden.
- 3Investigations seek the root cause; "human error" is usually a symptom, not the cause.
- 4CAPA pairs a fix for this occurrence with prevention of recurrence, and its effectiveness is verified.
- 5Quality Risk Management (ICH Q9) directs rigour to where the consequence to the patient is greatest.
What is a deviation?
- A departure from the approved way of working ✓
- A type of product
- A regulatory inspection
Which is usually the real root cause?
- "The operator made a mistake"
- A system that made the mistake easy to make ✓
- Bad luck
What does the "P" in CAPA add beyond correction?
- Preventing recurrence ✓
- Printing the record
- Paying a fine
After a mix-up between two look-alike materials, the CAPA is simply "operator retrained."
Why might an inspector find this CAPA weak?
Retraining treats the symptom (this operator, this time) but not the cause (two materials that are easy to confuse). A stronger CAPA changes the system — distinct labelling, separation, or a verification step — so the mistake becomes hard to make at all, and then checks that the change actually worked.