Deviation Management

According to the EU GMP Chapter 1 Pharmaceutical Quality System Section 1.4:  
A Pharmaceutical Quality System appropriate for the manufacture of medicinal products should ensure that: "(…) (xiv) An appropriate level of root cause analysis should be applied during the investigation of deviations, suspected product defects and other problems. This can be determined using Quality Risk Management principles. In cases where the true root cause(s) of the issue cannot be determined, consideration should be given to identifying the most likely root cause(s) and to addressing those. Where human error is suspected or identified as the cause, this should be justified having taken care to ensure that process, procedural or system-based errors or problems have not been overlooked (…)"  

The need for an adequate investigation is also placed in the USA GMP regulation in the CFR §211.22 Responsibilities of the Quality Control unit, §211.100 Written Procedures; Deviations and §211.192 Production Record Review it is clearly stated that "the failure of a batch or any of its components to meet any of its specifications shall be thoroughly investigated, whether or not the batch has already been distributed (…)". 

It should be emphasized that any deviation must be registered and classified before proceeding to the next manufacturing step to assess the impact of a particular event on the manufacturing/packaging process. It is of utmost importance to underline the deviation as an unplanned event. All planned changes should be introduced by a change control system.  

EU GMP regulation directly requires a Root Cause Analysis (RCA) process is applied in the investigation phase. Root Cause Analysis is a cluster of problem solving methodologies aimed at identifying the root causes of problems or deviations and establishing the causal relationship between the identified root causes and the problem.

By implementing appropriate corrective actions based on root causes, the goal of a RCA is to minimize or completely eliminate the risk of a problem reoccurring.  

The RCA team must always be composed of a leader (who coordinates the whole process) and a group of experts representing all the areas potentially involved in the problem. 

Phases of RCA are well known, and the analysis is carried out following the flow chart: 

However, despite the idea of continuous improvement behind the concept of the RCA, there is a tendency in the pharmaceutical industry to quickly close the deviation investigation with the conclusion of "human error" as a root cause. When one dives deeper into this kind of statement (and Regulatory agencies do!), it can be easily discovered that the investigation was not performed thoroughly enough. In reality, the majority of deviations are not root-caused by a simple, so-called human error. It may be the visual symptom, while the problem lies elsewhere. 

As listed in the FDA's Inspection Observation Data Sets, in 2020 and 2021 the Agency issued more than one dozen observations related to the violation of CFR 211.22(a) in terms of inadequate investigations. Moreover, it is not hard to find FDA Warning Letters (WL) describing blatant violations in the deviation management system. In a WL from March 6, 2019, a manufacturer of OTC drugs failed to investigate the root cause of Out-of-Specification (OOS) in the stability studies. The OOS results reappeared in the subsequent batches during in-process control; in the deviation report, it was noted that "safety, quality, and performance of the product is unaffected," with no further explanation. Clearly, the level of effort incorporated was not sufficient. 

Another example is a WL from September 15, 2020, to a Human Drug Repackage provider, where the Agency's inspectors identified a folder containing 11 batch records labelled "deviations," with no investigation and procedural form.  

To avoid such unwanted audits or regulatory observations, it is essential to perform the investigation with the proper level of scrutiny. Some RCA tools come in handy to make it feasible, including 5 WHY's, Cause & Effect Diagram (Fishbone) and Failure Mode & Effects Analysis (FMEA). It is crucial to delegate these to competent and adequately trained personnel for deviation management. The process and regulatory knowledge are essential.  

Asking questions is always the basis of every RCA in deviation management. The sooner the questions will be asked, including to operators working on the process, the better, as time typically does not work in favor of memories. Remembering an event that occurred less than a month ago is possible, but crucial details might be missing.    

5 WHY's is one of the simplest and fastest tools that can be used for RCA. It does not require any statistical support or particular notions. It can be used for relatively simple problems, or in any case as a first step, even for more complicated problems, which then require greater statistical or technical support. 

Cause & Effect Diagram (Fishbone) is a tool for more complicated situations that helps the investigation team focus on the problem using graphic/visual methods. The process is based on the identification of macro-categories of the issue and drawing them on the fishbone–shaped chart. Then the analysis begins, gradually increasing the degree of detail and information on the issue, adding collected data on the chart until the root cause is clearly named. It provides opportunities to identify possible relationships and stimulates the discussion.

Failure Mode & Effects Analysis (FMEA) is a step-by-step approach to identifying where and how the process might fail and the relative impact of different failures. It usually starts during the earliest conceptual design stages and continues throughout the product/service life cycle. The purpose of the FMEA is to take actions to vanish or reduce failures, focusing on the highest priority ones. This tool also documents current knowledge and actions regarding the risks of failures to use in continuous improvement. During the design stage, it is used to prevent failures. Moving forward, it is used for control (before and during the process operation).

Conclusion 

Deviation investigation will always be in the spotlight of audits and inspections. Moreover, a deep analysis of unplanned events allows the manufacturer improvements, optimization and possibly, savings.