Understanding deviations
Aseptic units rely on controlled environments and standardised processes to ensure that injectable medicines are prepared consistently and accurately, but even with these controls in place, unexpected events can still occur.
A deviation management process provides a structured approach to capture deviations, understand their causes, and put in place corrective and preventive actions. Deviation management is a core requirement of the pharmaceutical quality system (PQS), supporting learning and continuous improvement.
For more information about quality in aseptic services, including pharmaceutical quality systems, refer to the article series on understanding aseptic services in the NHS (SPS page).
Definition of ‘deviation’
A deviation is anything that happens that was not planned or expected. For example, errors, departure from authorised procedures, equipment failures and out of specification results. This article considers the general principles applicable to any deviation management process.
Key stages of the deviation management process
In NHS aseptic units, a consistent process ensures deviations are assessed proportionately, investigated appropriately, and resolved with documented evidence. The following sections of this article outline how this works in practice, and the different stages involved.
Identify and make safe
As soon as a deviation is identified, an approved person should make an initial impact assessment so that steps can be taken to make safe without delay. This should be documented contemporaneously.
Once the immediate risk has been controlled, the deviation should be assessed thoroughly and records made.
Assess impact
The initial assessment determines whether the deviation could affect product quality, patient safety, compliance with regulations and professional standards, or service delivery.
Make safe
Appropriate actions must be taken promptly to limit the impact of the deviation, for example, taking equipment out of use or quarantining products.
Record
A deviation record should be created as soon as an unexpected event or a departure from an approved process is identified. Clear and timely recording ensures the facts are captured accurately and supports an effective investigation.
A deviation record should include:
• a reference number and date opened
• category and sub‑category
• a clear, factual description of what happened
• supporting evidence
• when and where the issue occurred
• who identified and reported the deviation
• the initial impact assessment
• the appropriate risk rating
• actions taken to make safe
The video on deviation management in aseptic services (SPS page) provides more information about recording deviations.
Management review
After the initial response to the deviation, a documented review by senior aseptic staff ensures deviations are managed consistently, proportionately and in a timely manner. The management review evaluates the significance of the deviation, determines the appropriate level of investigation and identifies whether escalation is required.
Impact assessment
Review the impact assessment to ensure it considers:
• the potential impact on product quality or sterility
• any patient safety implications
• effects on premises, people, or processes
• regulatory or procedural impacts
If required, an updated impact assessment may be completed.
Make safe actions
Review that appropriate actions have been taken to limit the impact of the deviation. If necessary, additional actions may be proposed and implemented at this time.
Risk rating
Confirm or amend the risk rating and priority assigned when the deviation was initially assessed.
Investigation
Decide if the deviation requires:
• a high-priority internal good manufacturing practice (GMP) investigation
• a low-priority internal investigation
• logging and trending only
Escalation
Escalate or externally report the deviation if required by departmental policy. This may include reporting via the:
• Trust incident management process
• Medicines and Healthcare products Regulatory Agency (MHRA) Inspectorate
• MHRA’s Defective Medicines Reporting Centre (DMRC)
• SPS Regional Quality Assurance
Investigation
If an investigation is required, it should be systematic and evidence‑based, and must be led by someone with appropriate skills, knowledge and authority. A team approach is often helpful to ensure the investigation is thorough.
A good investigation identifies what happened and collects all the information needed for root cause analysis.
Investigation activities may include:
• interviewing the staff involved or present
• watching CCTV footage
• reviewing worksheets, batch records, and environmental monitoring data
• inspecting equipment logs, alarms, or calibration records
• examining similar past deviations or trends
• identifying technical, human, environmental, or organisational factors
Findings should be recorded clearly and objectively, with records appended as evidence. It may be useful to compile a timeline of events.
Some specific types of deviations may use specific standard operating procedures (SOPs) and forms, for example, when dealing with microbiological monitoring results.
The videos on out of specification microbial monitoring results (SPS page) provide more information.
Root cause analysis
Root cause analysis (RCA) should identify why the deviation occurred and support the development of effective corrective and preventive actions. RCA should be proportionate to the complexity and risk level of the deviation.
RCA may use structured approaches such as:
• “5 Whys” analysis
• fishbone (Ishikawa) diagrams
The video on investigating deviations in aseptic services (SPS page) provides more information about investigations and root cause analysis.
Corrective and preventive actions
Corrective and preventive actions (CAPA) should address the immediate issue and prevent recurrence. They should be directly linked to identified root causes and contributing factors to strengthen systems or processes.
CAPA actions may include:
• updating or clarifying procedures
• delivering targeted training or competency assessments
• repairing, maintaining, or recalibrating equipment
• modifying workflow or supervision arrangements
• enhancing monitoring or checks
• raising a change control where required
Actions should be SMART (specific, measurable, attainable, relevant, and time based) and assigned to responsible individuals.
The video on CAPA in aseptic services (SPS page) provides more information. For information about change management, refer to the article change management in NHS aseptic units (SPS page).
Effectiveness check
The effectiveness check confirms that the CAPA actions have been implemented, address the root causes, and that the deviation is unlikely to recur. It ensures improvements have been embedded in routine practice.
The effectiveness review may include:
• monitoring repeat deviation trends
• reviewing operator feedback
• auditing compliance with updated procedures
• reviewing environmental or equipment data
• confirming improved performance
• confirming that there have been no unanticipated consequences
The outcome should be recorded before closure.
Close
A deviation report can be closed once approved by the responsible person.
The final deviation record should include, as applicable:
• completed actions with supporting evidence
• investigation details
• outcome of RCA
• a completed CAPA
• evidence that the CAPA has been effective
• updated risk assessment
Closure confirms that the deviation has been fully addressed and that the risk is controlled. Lessons learned should be documented as part of ongoing quality improvement.