Author: Robert Holley,
Principal Consultant, Hamilton Quality
Regulatory and Technical Review
Timothy Cassity
Former RABQSA Certified Lead QMS Auditor, TÜV Rheinland North America
Industry and Technical Review
William Diljak
Quality Systems Consultant serving Pharmaceutical and Medical Device Industries
Scott Schmidt
Quality Assurance Director, Retired
Introduction
Both pharmaceutical and medical device manufacturers encounter quality events that require investigation. Whether the issue is a manufacturing deviation, laboratory error, product nonconformity, customer complaint, or an audit observation, the response often determines whether the event becomes a one-time occurrence or the beginning of a recurring problem. While regulatory expectations differ between the pharmaceutical and medical device industries, the fundamental principles of thorough investigation and effective corrective action are consistent in the cGMP regulated industries.
About the Regulations Related to the Deviations and CAPA
Both the pharmaceutical and medical device industries are regulated by health authorities around the world and follow applicable regulations, standards, and guidance, including ISO standards and ICH guidance where appropriate. Both industries are required to have processes for identifying, investigating, and addressing quality issues. While pharmaceutical manufacturers are regulated by national competent authorities throughout the world, and medical device manufacturers are assessed by notified bodies in many jurisdictions, this paper discusses the workflow of deviations and CAPAs. The regulatory and guidance framework within the United States (U.S.) and European Union (EU) is used to support the compliance reasons manufacturers serving those markets use that workflow.
Applicable regulations, for the U.S. and EU, and standards are summarized in the table below, and discussed in more detail following.
Table 1: Regulations Applicable to Deviations and CAPA in cGMP Environments
| Product Type | US Regulations | EU GMP Requirements | Standards / Guidance |
|---|---|---|---|
| Pharmaceutical, Biologics (inc. vaccines and gene therapies) | 21 CFR Parts 210 & 211 |
Good Pharmacovigilance Practices (GVP) Module VI | ICH Q10 |
EudraLex Volume 4 |
|||
| Medical Devices | 21 CFR Part 820 (QMSR) |
EU MDR 2017/745 | ISO 13485 |
For pharmaceutical manufacturers, 21 CFR Part 211.192 establishes that manufacturers must thoroughly investigate the failure of a batch or any of its components to meet specifications, and requires a written record of the investigation including conclusions and follow-up. ICH Q10, Pharmaceutical Quality System, provides guidance as well, and recommends that pharmaceutical companies have a CAPA (corrective and preventive action) system to ensure appropriate actions are taken following investigation of audit and inspections findings, complaints, deviations, non-conformances, product rejections, recalls and negative trends. The ICH guidance further recommends classification by risk level and that the investigation and CAPA be commensurate with the risk. Mature pharmaceutical quality systems follow these regulations and recommendations by adhering to and maintaining procedures, work instructions and guidance level documents aligned with ICH Q10 standard.
The concepts described in ICH Q10 are also consistent with the expectations established in EudraLex Volume 4 regarding pharmaceutical quality systems, investigation, quality risk management, CAPA, and continual improvement. The EudraLex similarly requires that quality events be investigated, with requirements related to investigations of quality events and documentation of investigations referenced in Chapters 1, 4, 5, 6 and 8 of the regulations. Additionally, portions of the EudraLex - Volume 4 have been revised in light of the principles established in the ICH Q10 standard.
Similarly, medical device companies in the US follow 21 CFR Part 820, Medical Device Quality Management System Regulation which now references ISO 13485 for many elements of medical device good manufacturing practices, including CAPA. The ISO 13485 standard requires that medical device manufacturers investigate nonconformities, implement correction, containment, CAPA (corrective and preventive actions) and test the effectiveness of actions taken.
Figure 1: The Issue or the Symptom?
This writing is the first in a technical series meant to help companies in the cGMP regulated industries improve their quality system elements related to deviation and CAPA systems.
The Lifecycle of a Deviation (Pharmaceutical) or CAPA (Medical Device)
Pharmaceutical deviations and medical device nonconformances that lead to CAPAs progress through a series of logical steps designed to understand the problem, protect patients, and, where possible, restore the quality of affected product. As deviations or medical device CAPAs progress, they go through further steps intended to determine the cause of the problem, prevent its recurrence, prevent it from also occurring in other processes or systems and verify that actions taken truly solved the issues identified through the investigation.
While terminology sometimes differs between pharmaceutical and medical device quality systems, the fundamental lifecycle is largely consistent. This paper examines the quality event lifecycle as illustrated in Figure 2, below.
Figure 2: The Lifecycle of a Quality Event
Issue Occurrence / Reporting
Quality events do not begin when a firm’s Quality Assurance department opens an investigation record. They begin when the organization first becomes aware of information that may indicate a product or quality issue. This is also held as true from a regulatory perspective. As of the time of this writing, 21 CFR Part 314.81 requires that pharmaceutical companies submit field alert reports (FARs) for events meeting FAR criteria within 3 working days of receipt by the applicant. The medical device industry has its own similar requirements, as 21CFR Part 803 has a 5 working day requirement for filing Medical Device Reports in cases where remedial action is needed to prevent unreasonable risk. Regulators often define the date of awareness as the date the first employee becomes aware, without regard to the employee’s level or area of responsibility. European regulations follow the same fundamental principle. EudraLex Volume 4, Chapter 8 requires firms to establish systems that ensure quality defects and complaints are promptly identified. The regulatory clock starts when the organization becomes aware.
Quality events are rarely first identified by a firm’s senior management. They are most often discovered by manufacturing operators, laboratory analysts, technicians, maintenance personnel or other employees performing day-to-day operations. Customer complaints often enter a firm’s quality system through established intake processes, but detection also extends to employees hearing about potential adverse events or product quality issues outside of work and formal intake channels.
Because some types of quality events do carry risk to patients and thus have regulatory reporting obligations with defined reporting timelines, organizations must address this concern by establishing processes that require all employees to promptly communicate potential quality issues through the appropriate quality channels. Creating a culture where employees across all levels are encouraged and required to report potential quality events within a company allows for early recognition and timely escalation of quality events through a firm’s quality system.
Companies with mature quality systems implement policies, procedures and work instruction level documents, and employee training, to ensure events are reported within one working day and triaged appropriately for risk and potential containment actions.
Issue Description, Bounding and Event Triage, including Initial Risk Assessment
When events are reported within a company’s QMS, steps must be taken to triage the event for risk and severity to determine if it meets reporting requirements and the level of investigation required. In the medical device industry this usually determines if an event can be investigated as a nonconformance or if it must be treated as a CAPA. In the pharmaceutical and related industries, events are commonly investigated as deviations with severity indicating the level of investigation required (eg: minor, major or critical), based on the result of the initial triage. To ensure a successful first triage of the event, it is critical that the event can be described in enough detail to fully understand the event, its detection and what QMS elements the event deviates from. In short, at the time of an event triage, the minimum information that should be presented should answer:
What was found?
Where was it found (process step and location)?
When it was found and, if known, when did it occur?
Who found it (title and function)?
How was it found?
Why is it a quality event?
This allows the triage process to consider if the event was detected before, at or after controls meant to initially detect it, and whether existing process controls up to that point functioned as intended. This information is useful in determining if additional product could be affected, which is necessary for bounding the event.
Companies with mature processes and quality management systems commonly have implemented failure mode and effect analysis (FMEA) as part of their risk management process to identify the controls intended to detect quality events at each stage, and defined processes for determining initial event risk and severity based on event stage of the detection and potential impact of the event to product and process.
Bounding is the process of determining scope of the event, and it is critical that it be done early in the process. Incomplete or late bounding can fail to detect product that should quarantined to prevent it from leaving the company’s control. The result of the bounding can often affect the initial risk determination at event triage. and must consider
Product both still in and no longer under the company’s control
Materials both in stock and previously used
Processes involved
Equipment involved
Personnel Involved
As quality events are triaged companies must consider whether the events are reportable. A summary of considerations is provided in the table below.
Table 2: Reporting Requirements for Quality Events
| Industry | Report Type | Regulatory Trigger (Marketed Product) | Timeline (Days) |
|---|---|---|---|
| Pharmaceutical US | FAR | Event causes the drug product or its labeling to be mistaken for, or applied to, another article | 3 |
| Finding of bacteriological contamination | |||
| Significant chemical, physical, or other change or deterioration | |||
| Failure to meet specifications in drug application | |||
| Pharmaceutical US | 15-Day Alert Report |
Adverse drug experience that is both serious and unexpected | 15 |
| Pharmaceutical EU | Serious Valid ICSR | Serious suspected adverse reaction associated with product | 15 |
| Non-Serious Valid ICSR | Non-serious suspected adverse reaction occurring within the EEA | 90 | |
| Quality Defect Notification | Quality defect presenting a potential risk to public health requiring notification of the Competent Authority (Rapid Alert System, where applicable) | Without Undue Delay | |
| Biological Products – US | BPDR | Manufacturing deviation or unexpected / unforeseeable event that may affect the safety, purity, or potency of a distributed licensed biological product | 45 |
| 15-Day Alert Report | Serious and unexpected adverse experience associated with a biological product | 15 | |
| Medical Device US | 5 Day MDR | Event requires remedial action to prevent unreasonable risk of harm | 5 |
| Awareness of need for remedials action from any information, including trend analysis | |||
| FDA request for 5-day MDR | |||
| MDR | Information reasonably suggests device may have caused or contributed to a death or serious injury | 30 | |
| Malfunction that suggests a similar device (from the firm) would be likely to cause or contribute to a death or serious injury if the malfunction were to recur | |||
| Medical Device EU | Serious Incident Report | Serious incident presenting a serious public health threat | 2 |
| Serious Incident Report | Serious incident resulting in death or an unanticipated serious deterioration in health | 10 | |
| Serious Incident Report | Any other reportable serious incident | 15 |
Containment and Correction
Containment and correction are separate processes but are commonly done in the same phase of the deviation / CAPA lifecycle. Containment actions are commonly based on the results of the bounding, and must consider protection of the public from product within the scope of the event. Containment actions must also prevent the scope of the event from growing. The following types of containment actions should be considered:
Product Hold / Quarantine
Material Hold / Quarantine
Stop Process
Taking Equipment or Areas Out of Service
Containment actions involving product that is no longer in a company’s control should be considered concurrently with reporting for events meeting regulatory reporting requirements. Companies with mature quality systems maintain defined processes for initiating and maintaining each type of containment action discussed, and management escalation trigger points.
Corrections are actions taken to correct the immediate nonconformity. Corrections taken are dependent on the exact event that occurred but can involve actions such as:
Rework
Equipment Repair and Recalibration
Formally Approved Interim Process Changes
Documentation Corrections
Equipment or Room Cleaning / Sterilization
In many cases it is not possible for bound product to be corrected in a manner that would allow it to continue to meet cGMP requirements, which is one of the reasons that thorough investigation and effective corrective actions are critical to the deviation and CAPA process.
A discussion of the types of actions in the deviation / CAPA life cycle is necessary. Other than specific investigative actions, actions commonly taken include containment, correction, corrective and preventive actions. Figure 3, below, details the types of actions and their differences.
Figure 3: Deviation / CAPA Action Types
Containment and corrections are meant to be performed early in the process, and are not intended to prevent the problem from occurring again. Corrective and preventive actions are designed to address the root cause of the quality event, which is also typically not known at this phase of the process.
Investigation / Root Cause Analysis
A thorough investigation that identifies true root cause and contributing factors is usually the difference between one quality event in a trend of events and the event that resulted in the problem being solved. It’s also actually a requirement based on a review of the applicable regulations. As stated previously, 21 CFR Part 211.192, requires investigation of batch or component failures to meet specifications. Additionally, the EudraLex Volume 4, Part 1, Chapter 1 specifically requires an appropriate level of root cause analysis during the investigation of non-conformances, suspected product defects and other problems. For the medical device industry ISO 13485, which is also referenced by 21 CFR Part 820 (QSMR) for sections including CAPA requirements, requires that organizations determine the cause of nonconformities as part of the CAPA process. Failure to investigate remains a common citation by FDA Inspectors in the US and Notified Body auditors within the EU.
Investigations should be done methodically, using structured tools. Figure 4, below, gives examples of common root cause analysis tools used.
Figure 4: Root Cause Analysis
Investigations should start with a thorough issue description, that can be distilled into a problem statement used to drive the investigation. The problem statement should explain the problem that was found, without any suspected causes. It is also helpful to give an understanding of when and where in the process the event was noted. As an example, “On 21 July 2026, during the AQL inspection of batch X1423, inspection associate 1 found critical defects of a clear, sinking particles in 4 vials.” A well written problem statement helps keep the investigation focused. A poorly written problem statement can derail an investigation before it begins.
Investigations should at a minimum consider the defined process and applicable procedures, training and actions of those involved in the event, leading up to the occurrence, as well as other process inputs such as equipment and material involved. Complex investigations often start with a detailed process map of events leading up to the event. Root cause analysis tools commonly used in deviations and CAPA investigations include, but are not limited to:
5 Why
6M
Ishikawa (fishbone)
Is / Is Not diagramming
Fault Tree Analysis
Design of Experiments (for testing specific hypotheses)
Sometimes, investigations for particularly complex issues also utilize brainstorming with affinity diagramming as a tool to determine potential causes, and another structured tool to test potential causes. For straightforward problems with a clearly understood causal chain, techniques such as 5 Whys may be sufficient. Regardless of the methodology selected, every investigation should examine the process and procedures, personnel, and where applicable equipment, materials, the environment, and measurement processes and systems involved in the event.
The application of failure investigation and root cause analysis tools is a topic vast enough to require its own technical paper, and as such prior training and qualification are needed to properly apply them.
Despite the complexity of root cause analysis, investigations need to be completed in a timely manner. The regulations do not give timeline requirements for investigations, but do require that companies take action to investigate and address issues. However, regulatory agencies and notified bodies have frequently cited firms for failure to investigate in instances where investigations had significant delays. Organizations are expected to establish and manage timelines appropriate to the significance and risk of the quality event. Investigations should therefore proceed without unnecessary delay while allowing sufficient time to identify root cause and develop effective corrective actions. Many pharmaceutical companies have internal requirements such as initial 30-day requirements and required approval for documented updates if investigations are not approved within the initial timeframe. Additionally, many medical device companies have set 30-day requirements for nonconformance investigations and 45-day requirements for CAPA documentation, including investigation and CAPA plan. As a result, inspectors from regulatory agencies and notified bodies have developed expectations based on industry standards observed.
Final Risk Assessment
Once the root cause is known, a final risk assessment should be performed. This assessment must include suitability of existing bound products. It must also consider whether additional field actions, such as customer notification or product recall, are warranted.
The risk assessment should also evaluate whether the process can be allowed to continue to operate as currently designed while corrective actions are implemented, and whether there could be impact to future products being produced. Additionally, if applicable, a review of the process FMEA or other risk documentation should be done at this point to ensure it is still accurate based on the results of the investigation.
CAPA Planning
Good CAPA plans have actions that prevent the quality event from happening again, strengthen other processes by protecting them from the same type of event, and do not cause additional problems. The best CAPA plans accomplish these objectives while remaining practical to implement within the organization's quality system in a timely manner. The CAPA planning phase is also where the effectiveness check should be planned.
Corrective actions prevent a recurrence of the event within the same process or area. Preventive actions prevent occurrence of the event in other processes or areas. While most quality events do require some level of corrective action, it is not always necessary to design preventive actions. This is usually determined based on whether similar systems or processes exist, and whether the root cause identified is likely to cause issues in other processes or areas. In some cases, CAPA plans may also be developed in response to audit observations or identified risks of potential nonconformities.
Regulations and guidance in both the pharmaceutical and the medical device industries address the need for companies to take corrective and preventive actions for quality events. Refer to table 3, below, for a summary of guidance and regulatory requirements related to corrective and preventive actions.
Table 3: Guidance and Regulatory Expectations for Corrective and Preventive Action
| Industry | Requirement / Guidance | Reference |
|---|---|---|
| Pharmaceutical, US | Have a system for implementing corrective actions and preventive actions resulting from the investigation. | ICH Q10 §3.2.2 |
| Pharmaceutical, EU | Appropriate corrective actions and/or preventative actions (CAPAs) should be identified and taken in response to investigations | EudraLex Vol. 4, Ch. 1 §1.4(xiv) |
| Medical Device | Corrective Action: Take action to eliminate the cause of nonconformities in order to prevent recurrence. | ISO 13485:2016 §8.5.2 |
| Preventive Action: Determine action to eliminate the causes of potential nonconformities in order to prevent their occurrence. | ISO 13485:2016 §8.5.3 |
Corrective actions should be traceable to the root cause identified as well as the original event. Common problems with many corrective and preventive action plans are scope creep, and unclear root cause or problem linkage. Ensuring that actions taken are truly related to the problem found and root cause identified is key to preventing recurrence of the problem. Additionally, process improvement is an important part of the cGMP regulated industries. However, it is also important to ensure the scope of actions being planned does not become so large as to hinder implementation or cause additional problems. A useful check is to trace actions planned back to both the verified root cause and original problem identified. If actions cannot be easily traced to these things, they may be process improvements, but they are likely not good corrective actions for the deviation or CAPA executed. These broader improvements may still provide value, but they are generally better managed outside the individual CAPA plan, through separate continuous improvement initiatives or change management processes.
Preventive actions should also be traceable to the root cause identified, as they are intended to prevent the same type of event in similar processes, areas or systems.
When action plans are documented, they should be specific about the actual action intended. For instance, “Implement a revision to SOP-134 to include the following points…” is much more likely to result in the intended and appropriate action than “evaluate the process for improvements SOP-134 related to…” The former indicates a specific action that is measurable when completed. The latter action requires an action that is more investigative in nature, often leading to a determination of action that is subjective in nature.
Implementation
Implementation of corrective and preventive action plans is usually executed against timelines that are approved in the CAPA plan. The regulations do not set required timelines for this, but do require that actions be implemented in accordance with the risk associated with the original quality event.
Regulatory agencies and notified bodies have frequently cited organizations for failing to implement planned corrective actions within reasonable timeframes, particularly where delays increased risk or reflected ineffective quality system management.
A well designed CAPA plan sets execution timelines that are realistically achievable. Some of the best designed plans also include phases and expected timelines for each phase. Breaking plans into phases with timelines helps ensure that plan execution stays on track. Companies with mature deviation and CAPA planning elements in their quality management systems often require defining CAPA plan phases or milestones, especially for complex CAPA plans.
Implementation of CAPA plans must also be done in accordance with the company’s established quality system. Process and document changes are still required to follow an organization’s defined change processes. Additionally, implementation of corrective action and preventive action plans must be documented with objective evidence proving completion to allow for effectiveness verification of the CAPA plan.
Effectiveness Verification
Figure 5: CAPA Effectiveness Verification
Ensuring the effectiveness of corrective actions ensures that additional actions can be taken, if necessary, before quality problems recur. It is also a regulatory requirement discussed throughout regulations and guidance documents affecting the cGMP regulated industries. A summary of guidance and regulatory requirements related to effectiveness verification is discussed in table 4, below.
Table 4: Guidance and Regulatory Expectations for Effectiveness Verification
| Industry | Requirement / Guidance | Reference |
|---|---|---|
Pharmaceutical, US |
Effectiveness of actions should be evaluated. | ICH Q10 §3.2.2 |
Pharmaceutical, EU |
The effectiveness of actions should be monitored and assessed. | EudraLex Vol. 4, Ch. 1 §1.4(xiv) |
| Medical Device | Document a procedure to define requirements for reviewing the effectiveness of corrective action taken. | ISO 13485:2016 §8.5.2(f) |
| Document a procedure to define requirements for reviewing the effectiveness of preventive action taken. | ISO 13485:2016 §8.5.3(e) |
Good effectiveness verification plans allow sufficient time for a sampling of data after implementation of actions, with the intent of detecting early indicators of problems prior to recurrence. Where the population is too large for a complete sampling of all data, statistical sampling plans should be employed using sound rationale, such as that offered by AQL (acceptable quality limit) sampling.
Companies should design processes defining actions to be taken after a failed effectiveness verification. Commonly, either the original investigation is re-opened to ensure re-investigation and additional action planning or a new quality record is opened to investigate the problem under a new deviation or CAPA.
Closure
Closure of a deviation or CAPA record should follow a company’s defined processes for quality record approval. The U.S. Code of Federal Regulations, EudraLex and ISO 13485 standard all have requirements for review and approval of quality records. In the case of deviations or CAPAs, companies commonly require management review and approval by the department or area the event occurred in and the Quality Assurance unit. Reviews and approvals are commonly required at the following points:
After Investigation and CAPA Planning
After CAPA Implementation
After Effectiveness Verification
Companies with mature deviation and CAPA management processes require approval after initial risk assessment and bounding, or after correction and containment actions have been implemented.
Trending
After closure of deviation and CAPA records, they should also be monitored for trending. Trending is a requirement discussed in regulations and guidance documents for the cGMP regulated industries. Table 5, below, summarizes trending requirements.
Table 5: Guidance and Regulatory Expectations for Trending of Deviations or CAPAs
| Industry | Requirement / Guidance | Reference |
|---|---|---|
Pharmaceutical, US |
A review of complaints, recalls, returned or salvaged drug products, and investigations conducted under § 211.192 for each drug product should be conducted at least annually. | 21 CFR 211.180(e) |
Pharmaceutical, EU |
Regular periodic or rolling quality reviews should be conducted for:
|
EudraLex Vol. 4, Ch. 1 §1.10 |
| Medical Device | Document procedures to analyze data from feedback, conformity to product requirements and audits | ISO 13485:2016 §8.4 |
Companies with mature quality processes meet these requirements by conducting trending in two ways. The first occurs commonly during the investigation process. Searches for similar deviations or nonconformances should be conducted during the investigation process. This allows for detection of trends and repeat events. Additionally, deviations, nonconformances and CAPAs should be reviewed during annual or periodic quality management reviews conducted by organizations.
Conclusion
The lifecycles of pharmaceutical industry deviations and medical device CAPAs have similar requirements. This is evident through regulations and guidance documents for pharmaceutical and medical device industries. Regulatory and notified body citations can happen when companies fail to implement well defined quality processes for deviations or CAPA systems, and when they have poor execution of those systems. Failure to properly investigate and failure to take action are common observations found throughout FDA form 483 observations and Warning Letter items, and notified body audit observations. These observations are often the driving force behind quality system remediations, which can be extremely costly to the companies dealing with them.
Additionally, weak quality system processes related to deviation or CAPA requirements, and poor execution, can cost companies through repeat events and trends involving product rejections or field actions.
While hiring a consulting firm to assist in strengthening quality processes can represent an initial upfront cost, the savings are often realized during regulatory inspections and quality management reviews. An effective deviation or CAPA system is not just a regulatory requirement. It is a systematic process for protecting patients, improving manufacturing processes, reducing recurring quality problems, and ensuring organizational learning. Organizations that consistently execute each stage of the lifecycle, from prompt reporting through effective corrective action and trending, are better positioned to maintain regulatory compliance while continually improving product quality.
References
European Commission, EudraLex – Volume 4: EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use.
European Parliament and Council, Regulation (EU) 2017/745 on Medical Devices (MDR).
International Council for Harmonisation (ICH), ICH Q10: Pharmaceutical Quality System.
International Organization for Standardization (ISO), ISO 13485:2016 – Medical devices — Quality management systems — Requirements for regulatory purposes.
United States Food and Drug Administration,
21 CFR Part 210 – Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General.
21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals.
21 CFR Part 314 – Applications for FDA Approval to Market a New Drug.
21 CFR Part 803 – Medical Device Reporting.
21 CFR Part 820 – Quality Management System Regulation.