In short: deviations, corrective and preventive actions (CAPA) and change control are three linked flows. On paper or in separate spreadsheets the link gets lost: a deviation closed without a CAPA, a CAPA without an effectiveness check, a change approved without knowing which batches it affects. In a digital system, each one starts from the event and stays linked to the batch.
Why separate registers no longer hold up
In many plants, deviations are in a register, CAPAs in a spreadsheet, change requests in binders, and the link between them is known by the quality manager. It works until the first inspection that asks for “all deviations that affected batch X and what was done afterwards”. Then the search begins.
The problem is not missing information but scattered information. The more time passes, the harder it is to show that a problem was understood, corrected and did not happen again.
The deviation: from report to closure
- Reporting: whoever notices the departure reports it on the spot, from a computer or a phone, with what happened, where and on which batch.
- Initial assessment: quality classifies the deviation by risk (minor, major, critical) and decides whether affected batches are blocked.
- Investigation: the root cause is sought, not a culprit. The usual methods are the five whys and the cause-and-effect diagram.
- Impact: which batches, products and customers are affected. This is where the link to the batch makes the difference.
- Actions: the immediate correction and, where needed, a CAPA.
- Closure: approved by quality assurance, with the evidence attached.
Some deviations can be proposed automatically from data: an unusual stock adjustment, a loss above the threshold at batch reconciliation, a failed calibration.
CAPA: corrective and preventive
A corrective action removes the cause of a problem that has occurred, so it does not recur. A preventive action removes the cause of a possible problem before it happens. Both share the same elements: an owner, a deadline and, most often forgotten, an effectiveness check.
The effectiveness check means coming back after a while and showing that the problem did not recur: the same deviation did not reappear, the result stabilised, training was done and understood. A CAPA closed without a check is a promise, not an action.
Change control
Any change of process, equipment, supplier, specification or computerised system goes the same way: the request, the impact assessment (on quality, validation, documents and batches in progress), quality assurance approval, implementation and post-implementation review.
Many CAPAs become change requests, and many changes start from deviations. That is why it helps for the three to live in the same place.
The link to the batch and to release
For whoever releases the batch, the question is simple: are there open deviations, OOS investigations or unfinished changes affecting this batch? If the answer comes from searching through registers, release is delayed or, worse, done without the full information. In a digital system the batch shows by itself what affects it, and release can be blocked until they are closed.
OOS and OOT
A laboratory result outside specification (OOS, out of specification) opens an investigation in two phases: first the laboratory is checked, to rule out an analytical error, then the manufacturing process. Trends still within limits but unusual compared to history (OOT, out of trend) are signals to watch before they become nonconformities. Both link naturally to deviations and CAPA.
What to check in a digital quality system
- a deviation can be reported from a phone on the shop floor, not only from the office;
- every deviation, CAPA and change is linked to the batches, equipment and documents it affects;
- overdue items are visible without searching for them;
- the effectiveness check is a mandatory, dated step, not a tick box;
- every decision has an electronic signature and an audit trail;
- you see everything affecting a batch, on the spot, before release.
Useful indicators
- the number of open deviations and their age;
- deviations repeated on the same cause;
- CAPAs past their deadline;
- how many CAPAs prove effective at the check;
- the average time from reporting a deviation to closing it.
Frequently asked questions
What is the difference between a deviation and a nonconformity?
In practice the terms overlap. A deviation is a departure from an approved procedure or parameter; a nonconformity is usually a product or material that does not meet its specification. Both are investigated and can lead to a CAPA.
Does every deviation need a CAPA?
No. Minor deviations with a clear cause are often solved by a correction. A CAPA is needed when the cause can recur or when the risk requires it.
Who approves closing a deviation?
Quality assurance. The investigation owner proposes closure, and QA checks that the cause, impact and actions are documented.
Does this apply to cosmetics or supplements too?
Yes. The principles are the same under ISO 22716 or HACCP-based systems: departures are recorded, investigated and corrected, with evidence.
In DataFlows Pharma, deviations, CAPA, change control, OOS and OOT live in the same application as the batch record and the laboratory, linked to the batches they affect. See also the requirements of production software for the pharmaceutical industry.
