PhM: What, exactly, is a deviation?
JR: It’s defined as any departure from an approved instruction or established standard. It requires evaluating, investigation, response and control. A few years ago, a big pharma company with a good reputation received a 483 from FDA because it said it could “plan to deviate,” the very concept of which is a deviation.
PhM: Isn’t there a way to document that something isn’t correct as long as it is under control?
JR: If you see a discrepancy in the batch record, and you decide to have a planned deviation to redline the next few products under a controlled plan deviation, how long can you do that? Sometimes pharma deviations stay open for a long time, and FDA inspectors are well aware of the timeline issues that our industry faces.
PhM: Are pharma companies paying close enough attention to deviations?
JR: Often, failures and complaints get more attention, with deviations viewed as “stepchildren,” but deviations, discrepancies and nonconformances are all failures. In each case, one must understand the event, what happened—it could be during task execution, a process step, while carrying out a procedure or running a test. The important thing is to clearly understand what it is. The need is to document the deviation and get an idea of how big its potential impact and how to remediate it, and what to do with the lots that are affected by it.
PhM: Can you share any best practices?
JR: Deviations vary from company to company. The most important thing to do when documenting them, or any failure of a product, process or system, is to identify the problem. It’s like the 12-step program. First you have to admit that you have a problem. You can’t, for example, just say “the machine broke” but you need to specify which machine, equipment number, when, who discovered and who operated it.”
If you don’t have an event, you can’t have a root cause analysis or corrective action.
PhM: Any guidelines for writing up deviations?
JR: First, what’s the deviation from (ie from what spec), where, when, who, how and how many? How many will tell you how big the issue is, and will help establish a risk level).
What remedial actions and corrections will be needed? For example, will there be a need to isolate equipment or product? You may need to gather more data to see if other lots, batches, or field product was affected, and you will then need to analyze data and investigate.
PhM: So how do you take a closed-loop approach?
JR: A closed loop approach means documenting all the way to PA. It depends on the type of failure and level of failure, and the investigation is tied to level of risk involved. For instance, if you replace a defective scale, you can’t close the deviation on a “like for like” basis, but you need to examine how it was damaged, what and who was affected.
With a like for like replacement, we are still missing the “why.” Unless I really know what caused the equipment to fail, I haven’t analyzed the deviation, I don’t know why it happened and it can recur.
I can recall one FDA investigator doing a site check, who was very upset that one batch record had documented where an operator was supposed to record the oven temperature every hour. It was supposed to remain at 50 ˚C, but for five hours, the operator documented 150˚, and the record was reviewed, signed off on and released. Sure, the operator paid no attention to the spec, but the QA/QC person didn’t do his or her job, because they signed off on the record and released it. This isn’t OK, and it happens a lot, which is why documentation is so important. FDA assumes the following signatures: author and QA review and sign deviation explanation as well as the deviation investigation, then author, QA and owner review and sign off on corrective actions.
PhM: When does a deviation become a nonconformance?
JR: Consider a case where weekly nonviable particulate measurements in a filling suite exceeded spec. The measured value at test points exceeded 10,000 particles (measuring 14,000, 16,000 and 15,500 at various times). Some people might consider this a deviation, because the measuring device failed to accurately measure the values. To the FDA inspector, though, this is a failure, and nonconformance because no investigation was run to determine why the analyzer failed.
PhM: How should one approach CAPA?
JR: It’s really a nine-step process:
- Identification of problem
- Evaluation and data gathering
- Analysis investigation
- RCA
- Development of action plan
- Implementation of CA
- Follow-up
- Verification of effectiveness
- Implementation of PAI
One needs to balance the technical content and level of detail, define roles and responsibilities, compile details of the incident, describe methods of data collection, and use tools to gather facts and determine potential root causes.
This is all outlined in Federal regulation, Sec 820.90 for nonconforming product, which requires that procedures be established and maintained to control product that doesn’t conform to spec, and to address identification, documentation, evaluation, segregation and disposition of nonconforming product
There’s a need to determine whether investigation and notification of nonconformance are needed. If rework is required, procedures must be in place to explain what that rework will entail. One must ensure that reworked materials are subject to the same level of inspection as the originals, and one may still need to investigate: why was rework needed, what was the root cause and could it have been prevented.
PhM: What role does training play in all this?
JR: Companies tend to overuse training forms, because training doesn’t mean that you learned or actually paid attention. Training effectiveness must be gaged, in the form of an exam, and there needs to be planning for both short and long term. People signing off doesn’t mean that they “got it,” and if they didn’t the problems will recur. It’s like equipoment being repaired. If you don’t verify that the change was effective, how do you know it won’t happen again?
PhM: How should one handle data collection?
JR: First, ask are collection methods documented? How and to whom will measurement and monitoring activities be assigned? In many cases, people usually default to “operator not following the procedure.” Instead, an investigation must look at the process and the framework, and list evidence—specific information available that demonstrates the problem exists. For instance, a high percentage of equipment service requests may be evidence of a product defect.
The description and documentation should be in the “identification” section and must be evaluated to determine, first, need for action, and then, level of action required. Impact assessment is critical.
Consider the case of a labeler with a worn part that couldn’t stamp the product expiration date. The correction would be rework, reinspection, removing the labels, adding new labels and making the system conformant.
Often “fishbone” cause and effect diagrams can be useful, because they allow team members to specify where ideas fit into diagram. They’re very easy to use, but focus is needed if you are to use them right. You have to gather data properly before even moving to this stage.
Consider a fishbone diagram for this faulty labeler. Say, the manufacturing date was June 2008 for the first complaint. You might ask, “Have we seen complaints for missing serial numbers before and after that date?” This line of question gives the problem a time frame. You can then consider packaging changes during that timeframe, deviations that have occurred, failures, nonconformances, rejects, changes of vendors and changes of facilities. This way you gather the right data before starting the fishbone analysis.