PhM: What, exactly, is a deviation?
JR: It’s defined as any departure from an approved instruction or established standard. It requires evaluating, investigation, response and control. A few years ago, a big pharma company with a good reputation received a 483 from FDA because it said it could “plan to deviate,” the very concept of which is a deviation.
PhM: Isn’t there a way to document that something isn’t correct as long as it is under control?
JR: If you see a discrepancy in the batch record, and you decide to have a planned deviation to redline the next few products under a controlled plan deviation, how long can you do that? Sometimes pharma deviations stay open for a long time, and FDA inspectors are well aware of the timeline issues that our industry faces.
PhM: Are pharma companies paying close enough attention to deviations?
JR: Often, failures and complaints get more attention, with deviations viewed as “stepchildren,” but deviations, discrepancies and nonconformances are all failures. In each case, one must understand the event, what happened—it could be during task execution, a process step, while carrying out a procedure or running a test. The important thing is to clearly understand what it is. The need is to document the deviation and get an idea of how big its potential impact and how to remediate it, and what to do with the lots that are affected by it.
PhM: Can you share any best practices?
JR: Deviations vary from company to company. The most important thing to do when documenting them, or any failure of a product, process or system, is to identify the problem. It’s like the 12-step program. First you have to admit that you have a problem. You can’t, for example, just say “the machine broke” but you need to specify which machine, equipment number, when, who discovered and who operated it.”
If you don’t have an event, you can’t have a root cause analysis or corrective action.
PhM: Any guidelines for writing up deviations?
JR: First, what’s the deviation from (ie from what spec), where, when, who, how and how many? How many will tell you how big the issue is, and will help establish a risk level).
What remedial actions and corrections will be needed? For example, will there be a need to isolate equipment or product? You may need to gather more data to see if other lots, batches, or field product was affected, and you will then need to analyze data and investigate.
PhM: So how do you take a closed-loop approach?
JR: A closed loop approach means documenting all the way to PA. It depends on the type of failure and level of failure, and the investigation is tied to level of risk involved. For instance, if you replace a defective scale, you can’t close the deviation on a “like for like” basis, but you need to examine how it was damaged, what and who was affected.
With a like for like replacement, we are still missing the “why.” Unless I really know what caused the equipment to fail, I haven’t analyzed the deviation, I don’t know why it happened and it can recur.
I can recall one FDA investigator doing a site check, who was very upset that one batch record had documented where an operator was supposed to record the oven temperature every hour. It was supposed to remain at 50 ˚C, but for five hours, the operator documented 150˚, and the record was reviewed, signed off on and released. Sure, the operator paid no attention to the spec, but the QA/QC person didn’t do his or her job, because they signed off on the record and released it. This isn’t OK, and it happens a lot, which is why documentation is so important. FDA assumes the following signatures: author and QA review and sign deviation explanation as well as the deviation investigation, then author, QA and owner review and sign off on corrective actions.
PhM: When does a deviation become a nonconformance?
JR: Consider a case where weekly nonviable particulate measurements in a filling suite exceeded spec. The measured value at test points exceeded 10,000 particles (measuring 14,000, 16,000 and 15,500 at various times). Some people might consider this a deviation, because the measuring device failed to accurately measure the values. To the FDA inspector, though, this is a failure, and nonconformance because no investigation was run to determine why the analyzer failed.
PhM: How should one approach CAPA?
JR: It’s really a nine-step process:
- Identification of problem
- Evaluation and data gathering
- Analysis investigation
- Development of action plan
- Implementation of CA
- Verification of effectiveness
- Implementation of PAI
One needs to balance the technical content and level of detail, define roles and responsibilities, compile details of the incident, describe methods of data collection, and use tools to gather facts and determine potential root causes.