QMS-035 Pharmaceutical Deviation Report System

Document Owner

Quality Assurance Manager

Affected Parties

All GMP site colleagues

Purpose

To define the procedures to be followed and the responsibility for raising and documenting Deviation Report (DR) where material/product or process do not comply with organization/regulatory requirements.

NOTE: The aim is to segregate product linked with a Quality concern, determine the root cause, assign Corrective Action responsibilities, and whenever possible, actions that lead to prevention.

Scope

This procedure applies to all personnel who carry out operations with the potential to impact upon product quality, Quality System requirements, safety or the environment.

This procedure relates to any material purchased by a gmp site or supplied to a gmp site for use in the contract manufacture for a customer. This procedure relates to any product (or intermediate) produced by any company, distributed under own name, or any product produced under contract for a customer.

Definition

Related Documents

EHS Statement

EHS Hazard reporting is initiated by using the DR System, assessed by Management and administered by the EHS Team.

Procedure

1. General – Deviation Report

1.1.     A deviation is a departure from standard procedures or specifications resulting in non-conforming material &/or processes, or where there have been unusual or unexplained events which have the potential to impact on product quality, system integrity or personal safety.  For compliance to GMP and the sake of continuous improvement, these deviations are recorded in the form of Deviation Report (DR).

1.2.     There are a number of DR examples, but not limited to, the following:

Production Deviation (DR1) – usually raised during the manufacture of a Batch Production.

EHS Deviation (DR2) – Raised due to a “EHS Hazard”. See SOP EHS-010. in conjunction with this SOP

Quality Improvement Deviation (DR3) – may be raised if a potential weakness has been identified, and the implementation will require project approval.

Audit Deviation (DR4) – Raised to flag non-conformance identified during internal, external, supplier or corporate audits. See SOP QMS-080 in conjunction with this SOP.

Customer Service Deviation (DR5) – Raised to track implementation measures related to customer complaints.

Technical Deviation (DR6) – DR can be raised for validation discrepancies, MI (Manufacturing Instruction) sheet changes etc.

House-Keeping Deviation (DR7) – raised as a result of a housekeeping audit. See SOP QMS-105 in conjunction with this SOP

Material Complaint (DR8) – raised to document any issues with regards to non-conforming, superseded or obsolete raw materials/components, packaging, or imported finished goods. See SOP QMS-055 in conjunction with this SOP

System Routing Deviation (DR9) – raised to track changes made to BOM (Bill of materials) as a result of an Artwork change.

2.  Responsibilities

2.1.         All colleagues

2.1.1.     A hard copy Deviation Report Form (Form-450) should be raised when there is:

A deviation from methods or controls specified in manufacturing documents, material control documents, standard operating procedure for products and confirmed out of specification results.

The occurrence of an event and observation suggesting the existence of a real or potential quality related problems. Frequent events are identified and listed in section 1.2. of the form.

2.1.2.     When a trend of deviations noticed that requires further investigation.

2.1.3.     All batch production deviations (planned or unintended) covering all manufacturing facilities, equipment, operations, distribution, procedures, systems and record keeping are covered by this procedure.

2.1.4.     In parallel with the issue of a DR, deviations in a manufacturing process must be documented directly on the batch documents at the time of occurrence through a batch comment.

2.1.5.     DRs are required to document deviations regardless of final batch disposition. If a batch is rejected a DR is still required.

2.1.6.     All electronic and hard copy reports, tables and other documents generated in the course of DR investigation should be linked with the report.

2.2.         Management Responsibilities

2.2.1.     The department manager or delegate should initiate the DR, perform an initial investigation, write a short description of the fact with a title in the table on the form and notify the Quality Assurance department within one business day to identify the investigation.

2.2.2.     QA has to evaluate the deviation and assess the potential impact to the product quality, validation and regulatory requirement. All DRs to be approved by QA Manager or delegate. QA manger to justify wither the deviation is a Critical, Serious or Standard. For a deviation of either critical or serious nature QA delegate has to arrange a Cross Functional Investigation as described in SOP QMS-120.

2.2.3.     For a standard type deviation a Cross functional Investigation (CFI) is not necessary. Management Response tasks are to be completed before the final disposition of a batch. Final batch disposition is the responsibility of Quality Assurance Department.

2.2.4.     A Standard type deviation which does not lead to a CFI should be completed within 5 working days of initiation.

2.2.5.     If a deviation leads to a CFI, corrective and preventive actions should be determined and follow up tasks should be assigned to area representatives. Follow up tasks should be completed within 30 business days of the observation of deviation. If a deviation with CFI can not be completed within 30 business days, an interim report should be generated detailing the reason for the delay and the progress so far. The interim report should be attached with the DR after QA review. After successful completion of the Follow up tasks DR should be completed and attached with the Batch Report (MI sheet) /Audit report/ Product complaint report /EHS investigation report as appropriate.

2.2.6.     A CFI team should be initiated by QA if:

The observation is of critical or Serious in nature. (See definition above)

The cause of the deviation can not be determined by the department manager of the area where deviation occurred.

There is a probable cause based on the available evidence, but the cause is not confirmed. This is at the discretion of the QA manager.

A deviation demonstrates repeated trends, or there are repeated complaints.

3. What is Deviation

A deviation is a departure from standard procedures or specifications resulting in non-conforming material &/or processes or where there have been unusual or unexplained events which have the potential to impact on product quality, system integrity or personal safety.  For compliance to GMP and the sake of continuous improvement, these deviations are recorded in the form of Deviation Report.

4. When to Report Deviation

A Deviation Report (Form-450) should be raised when there is a deviation from methods or controls specified in manufacturing documents, material control documents, standard operating procedure for products and confirmed out of specification results and from the occurrence of an event and observation suggesting the existence of a real or potential quality related problems.

A deviation should be reported if a trend is noticed that requires further investigation.

All batch production deviations (planned or unintended) covering all manufacturing facilities, equipment, operations, distribution, procedures, systems and record keeping must be reported and investigated for corrective and preventative action.

DRs are required to document deviations regardless of final batch disposition. If a batch is rejected a DR is still required.

Form: 450 An example of “Deviation Report Form”

5.  How to Manage Reported Deviation

The department manager or delegate should initiate the deviation report by using the form-5, perform an initial investigation, write a short description of the fact with a title in the table on the form and notify the Quality Assurance department within one business day to identify the investigation.

QA has to evaluate the deviation and assess the potential impact to the product quality, validation and regulatory requirement. All DRs to be approved by QA Manager or delegate. QA manger to justify wither the deviation is a Critical, Serious or Standard. For a deviation of either critical or serious nature QA delegate has to arrange a Cross Functional Investigation described in later topic.

For a standard type deviation a Cross functional Investigation (CFI) is not necessary. Management Response tasks are to be completed before the final disposition of a batch. Final batch disposition is the responsibility of Quality Assurance Department.

A Standard type deviation which does not lead to a CFI should be completed within 5 working days of initiation.

If a critical or serious deviation leads to a CFI, corrective and preventive actions should be determined and follow up tasks should be assigned to area representatives. Follow up tasks should be completed within 30 business days of the observation of deviation. If a deviation with CFI can not be completed within 30 business days, an interim report should be generated detailing the reason for the delay and the progress so far. The interim report should be attached with the DR after QA review. After successful completion of the Follow up tasks DR should be completed and attached with the Batch Report (MI sheet) /Audit report/ Product complaint report /Safety investigation report as appropriate.

6.  Numbering System of a Deviation Report

Upon receipt of the DR, QA representative should assign a unique DR number which can be in the format of DRX -YYYY where, X represents the deviation category as described in section “Major Areas Where Deviation Might Occur’. YYYY represents the DR number sequentially assigned for the unique category. i.e. DR1-0010 Batch related deviation number 10 for the year.

7. How Does QA Assess the Level of Risk from a Deviation

QA delegate has to conduct a primary Investigation on the deviation reported and evaluate the following information

Scope of the deviation – batch affected (both in-process and previously released)

a. Trends relating to (but limited to) similar products, materials, equipment and testing processes, product complaints, previous deviations, annual product reviews, and /or returned goods etc. where appropriate.

b. A review of similar causes.

c. Potential quality impact

d. Regulatory commitment impact

e. Other batches potentially affected

f. Market actions (i.e. recall etc.)

8. Risk Matrix – An Effective way to Assess Risk

Following is simple risk matrix which can be used effectively to assess risk of a deviation. The matrix is based on two variables. On the vertical axis the variable is the impact of deviation on the product quality and GMP. The horizontal axis is based on the probability of deviation recurrence and delectability of deviation.

Figure: 1 Risk Matrix

9. Different Levels of Deviation Risk

For the ease of assessing risk any deviation can be classified into one of the three levels 1, 2 & 3 based on the magnitude and seriousness of a deviation.

Level 3: Critical Deviation (shaded by red color)

Deviation from Company Standards and/or current regulatory expectations that provide immediate and significant risk to product quality, patient safety or data integrity, or a combination/repetition of major deficiencies that indicate a critical failure of systems

Level 3: Serious Deviation (shaded by yellow color)

Deviation from Company Standards and/or current regulatory expectations that provide a potentially significant risk to product quality, patient safety or data integrity or could potentially result in significant observations from a regulatory agency or a combination/repetition of “other” deficiencies that indicate a failure of system(s).

Level 2 or 1: Standard Deviation (shaded by green color)

Observations of a less serious or isolated nature that are not deemed Critical or Major, but require correction, or suggestions given on how to improve systems or procedures that may be compliant, but would benefit from improvement (e.g. incorrect data entry).

Rating of “Impact on Product Quality and GMP”

From all the information collected from the Deviation Report form and other evidences QA has to rate the impact of the deviation on product quality and GMP from 0 to 4.

 0 – No impact on the quality

 1 – Low risk for impact on quality

 2 – Risk for impact on quality

 3 – Probable impact on quality

 4 – Risk for customer or production outside regulatory file

Rating of “Probability of Deviation Recurrence and Ease of Detection”

QA has to determine this variable and rate it by assessing two separate parameters.

The first parameter is the “Probability that the deviation will occur again”. Here the rating can be given from 1 to 3.

  0 – This deviation will probably not occur again

 1 – Deviation may occur again (seldom)

 2 – The deviation will probably occur again (from time to time)

 3 – The deviation will probably occur again (often)

The second parameter is the “Probability that the deviation will be detected if it will occur again”. Here the rating can done between 0 to 6.

 0   -The deviation will definitely be detected again

 2 – The deviation will probably be detected again

 4 – The deviation is at risk of not being detected

  6   – The deviation will probably not be detected.

After assigning the weights for both the parameters, total probability could be determined by adding the rate of “Probability that the deviation will occur again” and “Probability that the deviation will be detected if it will occur again”.

9.1.  An Example

For instance after an initial investigation on a deviation if QA would find the “Impact on Product Quality and GMP” scored 2, “Probability that the deviation will occur again’ scored 1 and “Probability that the deviation will be detected if it will occur again” scored 2. Than, the total probability score will be 2+2 = 4.

Plotting this rating for both the variables will assess the risk as level 2 class. This example is depicted in the following figure.

Figure: 1.2 Risk Matrix used as an example to assess deviation risk

9.2.  Next Step after Assessing Risk

After the depth of the deviation is analyzed QA representative has to determine wither a CFI is necessary. If the deviation is of standard type QA rep. has to send the report to the area where the deviation was observed in order to complete the management response tasks. Report should be sent in 1 business day. Area manager and his delegate has to confirm that the deviation is understood and write any urgent corrective action was made to resolve the issue. Area manager can suggest in writing any Preventative action in the follow up tasks section of the report. Deviation should be sent back to QA within two business days for QA approval.

QA Representative has to review the report and justify the corrective actions if any. Check any preventative action is necessary in the follow up task. List all corrective and preventive actions from the follow up tasks referring the DR number into a spread sheet and send the report to QA manager for approval.

QA manager should review the data for potential impact to the product quality, validation and regulatory requirement. If satisfactory approve the deviation report. The approved deviation report has to be placed in the ‘Completed Deviation Report folder’ if there is no corrective or preventative action necessary.

Follow up tasks should be reviewed and completed within 30 business days from the time of generation. If the tasks can not be completed within 30days, an interim report should be generated by the area manager and send to QA for approval. QA manager should justify if more time is necessary and approve or reject time extension up to 90days.

After all the follow up tasks have completed, assignee to confirm, sign and date. Send the report again to QA manger for final review and approval. Place the completed report into ‘Completed Deviation Report folder’ in QA Office. 

10.   Trending of Deviation

QA has to review all Deviation Reports from time to time and the corrective and preventative actions listed in a full year in the spread Sheet.

If a trend is identified a Cross Functional Investigation (CFI) will be initiated.

11.   When does a CFI is Necessary

A Cross Functional Investigation (CFI) is necessary if:

The observation is of critical or Serious in nature (Level 3 deviation). (See definition above)

The cause of the deviation can not be determined by the QA or Line manager of the area where deviation occurred.

There is a probable cause based on the available evidence but the cause is not confirmed. This is at the discretion of the QA manager.

A deviation demonstrates repeated trends or there are repeated complaints.

QA Management should organize an Investigation Meeting with all relevant parties within 5 working days of the generation of the deviation Report. Management response tasks and Follow up tasks are raised for the appropriate persons. Management response tasks are to be completed by the Area Manager where the deviation occurred and QA management after the investigation will be completed.

A Draft Investigation Report Form (Form-6) is raised at the time of investigation meeting. Meeting minutes are documented in the form and circulated to all present for comment as soon as possible and responded to within 2 working days of receipt

The Investigation Report with meeting minutes, supporting documentation and agreed corrective / preventative actions assigned is targeted for completion within 30 working days from the time deviation Report was raised or for more complex investigations, 10 days after the close-out meeting of an on-going investigation.

In the event an Investigation is on-going and takes longer than 30 working days to complete, minutes of on-going meetings, which include justification for production and additional actions taken should be circulated to management and maintained with the final Investigation report.

Upon completion of all management response tasks and corrective and preventative actions, the investigation report along with the completed deviation are printed and filed in the appropriate folder. If the investigation is related to a batch production, a copy of the report will be attached with the corresponding batches.

12. Numbering System of an Investigation Report

Investigations could be referenced as YY-INV-XXX, where YY are the last 2 digits of the year in which the investigation took place, INV stands for investigation and XXX is the three digit number unique for the report, assigned sequentially up to the end of the year. i.e. 05-INV-001.

Template: An example template of” Investigation Report”

Investigation Number: YY-INV-XXX

Investigation Type:

This should list the type of investigation (eg. Process Failure, Operator Error, etc.).

Executive Summary

(The executive summary should contain a brief description of the event, root cause found during the investigation and a final summary on product disposition)

Events

(Description of event and details to be added here)

Process Line(s), Product Name(s), Product Code(s) and Batch No.(s) to be added here. Initial Scope of the

investigation and any immediate action/segregation/blocking of stock for sale should be listed here.

Batch Chronology

(This table is an example of events that may need to be documented in a batch investigation chronology. Table can be customised (or even omitted) to fit the sequence of events in an investigation)

Suspect Causes and Rationales

Corrective and Preventive actions to be taken

(State corrective and preventive actions, which need to be taken and the reasoning behind decisions made)

Risk Analysis – Potential impact on other processes

(Here is where you outline whether this event could have an impact on any other equipment or processes and your rational as to why you have made this conclusion)

You should also explore whether this is a repeat event or the first time this has occurred.

Product Disposition

– Product made prior to the event

(Here is where you outline the risk assessment and impact to product made prior to the event and rationale as to why it is either acceptable or not)

– Product made during the event

(Here is where you outline the risk assessment and impact to product made during the event and rationale as to why it is either acceptable or not)

– Product made after the event

(Here is where you outline the risk assessment and impact to product made after the event and rationale       as to why it is either acceptable or not)

– Summary

(Here is where you write your conclusion to the investigation, you must summaries the overall root cause found during the investigation, the impact on this batch and any other batches and the overall batch disposition)

– Root Cause

(State the root cause or suspect cause if root cause was not determined)

– Repeat Event

(State if a similar event occurred in the last 12 months and DR reference)

– Batch Disposition

(State final batch disposition and reasoning behind the decision)

– Impact on other batches / processes

(State if other batches/processes are impacted and reasoning behind the decision)

– List of Attachments

(Brief list of attachments to be added here)

13.   What are the Steps Followed in an Investigation

It is the responsibility of the department, where the problem originated, to involve in the investigation in consultation with the Quality Assurance Department to ensure adequacy of the investigation.

Define the problem in detail. Include who, what, when, where and how. Briefly describe why the event is a problem.  This should be a statement of facts.

Identify the probable causes.  These could be raw materials, processing/operations error or problem, equipment or instrument problems, adverse environmental conditions, supporting utilities and/or testing, analytical errors.

Investigate each probable cause.  Prepare a list of questions and records needed for review. Assign and delegate the gathering of information.

Analyze the information and identify the actual or suspect cause(s). Analysis of data must be objective and logical.

Determine the extent of the problem. Is this an isolated occurrence limited to one batch or is this a recurring or potentially system related problem.  Evaluate the effects on other processes, products and batches.

Propose actions and recommendations for the affected batch(s). Evaluate the following aspects of the batch:

a. Quality Aspects such as product safety and integrity, product purity and efficacy, product stability, customer perception and potential complaints.

b. Regulatory Aspects such as deviations from product registration commitments.

c. Compliance Aspects such as violation of cGMPs, or deviations from revalidation / re-qualification requirements.

Develop corrective/preventive actions (CAPA); determine need for new data.

a. Develop corrective actions to support affected batch or batches. Corrective actions relating to batch disposition are documented in the Management Response Tasks of the DR (i.e. confirm rejection of the batch).

b. Develop preventive actions to avoid recurrence.

c. Corrective and preventive actions must be monitored to completion.

d. All other Corrective actions and Preventive actions are documented in the follow up tasks of the DR and monitored until completion.

Trend causes – add all the investigation outcomes including the root cause/s, corrective and preventive actions on a spreadsheet for the current year to facilitate in trending the repetitive issues.

14. Completion Period of a Deviation Report (unplanned deviation)

14.1.      Print a copy of Deviation Report Form (Form-450).  Write a short description of the fact with a title in the table on the form. Notify Quality Assurance within one business day of identifying the deviation. QA should review the DR and either approve the initiation or send back for more information. Follow the following table for prioritising different types of deviation.

 Prioritizing Deviation Report

14.2.      Upon receipt of the DR, QA representative has to assign a DR number which is in the format of DRX -YYYY where, X represents the deviation category as described in section 1.2. YYYY represents the DR number sequentially assigned for the unique category. i.e. DR1-0010 Batch related deviation number 10 for the year.

14.3.      Investigate the deviation and evaluate the following information

Scope of the deviation – batch affected (both in-process and previously released)

a. Trends relating to (but limited to) similar products, materials, equipment and testing processes, product complaints, previous deviations, annual product reviews, and /or returned goods etc where appropriate.

b. A review of similar causes.

c. Potential quality impact

d. Regulatory commitment impact

e. Other batches potentially affected

f. Market actions (i.e. recall etc.)

14.4.      After the depth of the deviation is analyzed QA representative has to determine wither a CFI is necessary. If the deviation is of standard type QA rep. has send the report to the area where the deviation was observed in order to complete the management response tasks. Report should be send in 1 business day. Area manager and his delegate has to confirm that the deviation is understood and write any urgent corrective action was made to resolve the issue. Area manager can suggest in writing any Preventative action in the follow up tasks section of the report. Deviation should be send back to QA within two business days for QA approval.

14.5.      QA Representative has to review the report and justify the corrective actions if any. Check any preventative action is necessary in the follow up task. List all corrective and preventive actions from the follow up tasks referring the DR number into QA metrics sheet and send the report to QA manager for approval.

14.6.      QA manager should review the data for potential impact to the product quality, validation and regulatory requirement. If satisfactory approve the deviation report. The approved deviation report has to be placed in the ‘Completed Deviation Report folder’ if there is no corrective or preventative action necessary. If there are some follow up tasks to complete place the DR in the ‘Incomplete Deviation Report folder’ until all the follow up tasks are completed satisfactorily.

14.7.      Follow up tasks should be reviewed and completed within 30 business days from time of generation. If the tasks can not be completed within 30days, an interim report should be generated by the area manager and send to QA for approval. QA manager should justify if more time is necessary and approve or reject time extension up to 90days.

14.8.      After all the follow up tasks have completed, assignee to confirm, sign and date. Send the report again to QA manger for final review and approval. Place the completed report into ‘Completed Deviation Report folder’ in QA Office.

15.              Appendix – Process Flow of Deviation Report

Summary of Changes