SOP on Handling of Incidents and Deviations (Example)

In short: This is an illustrative SOP for raising, assessing, approving and closing deviations in a pharmaceutical plant. It is for QA, production and QC staff. Time limits and numbering are site choices shown as examples; adapt everything to your own quality system and applicable regulations.

See also: CAPA process: step-by-step instructions | SOP for risk management

Note: This is an example template, not a regulatory requirement. Timelines (such as 7 days and 30 working days), the numbering format and approval levels below are examples only. Define yours in your own approved SOP.

1. Objective

To describe how deviations and incidents are raised, investigated, classified, approved, closed and trended.

2. Scope

Applies to deviations from approved instructions and standards in manufacturing, packaging, quality control, engineering and warehouse operations at the site.

3. Responsibility

• Initiator: raises the deviation promptly, describes it factually and carries out assigned actions.
• Department manager: reviews the deviation, the preliminary investigation and proposed actions.
• Other affected departments: give impact comments.
• Quality Assurance: allots the number, coordinates the review, classifies, approves or rejects, tracks closure and trends.
• Plant head: comments on actions to avoid recurrence.
• Customer or contract giver: consulted where agreements or the product require it.

4. Procedure

4.1 Definitions

• Deviation: a departure from an approved instruction or established standard.
• Incident: an unplanned event or error. If it departs from a written procedure, it is handled as an unplanned deviation.
• Planned deviation: a temporary, pre-approved departure that is known in advance.
• Unplanned deviation: a departure discovered after it has occurred.

4.2 When to raise a deviation

Raise a deviation when a departure is observed from documents such as SOPs, batch manufacturing records (BMR), batch packing records (BPR), standard test procedures (STP) or specifications. A deviation is also raised when the approved procedure cannot be followed or an error has occurred.

Departures from pharmacopoeial or registered (marketing authorisation) specifications cannot be justified through a deviation. Extra steps that go beyond the compendial requirement are not deviations.

4.3 Deviation form contents

The initiator records the deviation and the stage of operation in the prescribed form and sends it to the department manager. The form should include:

• Deviation number, date and initiating department (number allotted by QA)
• Type: planned or unplanned
• Description of the deviation
• Material, product or procedure, code and batch number, if any
• Preliminary investigation and root cause
• Justification (for planned deviations)
• Immediate correction and corrective action
• Preventive action to avoid recurrence
• Impact analysis, including other products, batches and systems
• Comments of affected departments and plant head
• Comments of customer or contract giver, if required
• Classification, QA recommendation and final decision
• Compliance with recommendations and closure

4.4 Numbering (example)

An example format is type letter, year and serial number: P for planned and U for unplanned, then two digits of the year and a three-digit serial that restarts each year. The first planned deviation of 2018 would be P-18-001 and the first unplanned one U-18-001.

4.5 Investigation and impact assessment

1. The concerned department carries out a preliminary investigation where needed and identifies the root cause.
2. The department manager reviews the proposed corrective and preventive actions.
3. Impact analysis is done and documented by the impacted departments, endorsed by their managers and reviewed by QA. R&D is consulted where relevant.
4. Where input is needed from outside the plant, QA sends the deviation by scan, hard copy or another approved route and files the signed reply with the deviation.
5. Where required, QA sends the deviation to the customer or contract giver for comments.

For significant deviations, link the investigation to the CAPA process.

4.6 Classification

Classification should follow a documented, risk-based approach consistent with ICH Q9(R1): consider the severity of the possible harm to the patient and product quality, how likely it is to recur and how easily it would be detected, and record the reasoning. Reduce subjectivity by using defined criteria. See the SOP for risk management.

Example site definitions (each site must define and approve its own):

• Critical: a departure that has, or could have, a serious impact on patient safety or on the quality, safety or efficacy of the product, or that seriously compromises data integrity or regulatory compliance. Examples: sterility assurance failure, mix-up or mislabelling that reaches release, falsified or deleted GMP data.
• Major: a departure that has, or could have, a significant impact on product quality, process validity or GMP compliance, but where serious patient harm is not expected, or where the impact can be contained before release. Examples: a critical process parameter outside its validated range with no confirmed product impact, a missed calibration of a critical instrument.
• Minor: a departure with no meaningful impact on product quality, patient safety, data integrity or regulatory compliance, which does not affect the validated state. Examples: a documentation slip corrected under GDP, a non-critical parameter slightly outside its alert limit.

Classify according to risk (severity of harm, probability of occurrence and detectability, as in ICH Q9(R1)), not by the effort needed to fix the problem. Where the classification is unclear, assign the higher category until QA has completed the impact assessment. Recurrence of the same minor deviation can justify raising its category. Examples and thresholds for each category should be defined by the site.

4.7 Approval and batch disposition

QA (Manager QA or designee) approves a deviation only when it is scientifically justified, the actions are satisfactory and the impact on the strength, identity, safety, purity and quality of the product has been assessed.

• If an unplanned deviation is not approved, the batch is not processed further, and QA decides on further processing or rejection.
• Planned deviations must be approved before the activity is carried out.
• Example time limit: if a planned deviation has no final decision within 7 days of number allotment, it is invalidated and a fresh deviation is raised if still needed. This 7-day period is a site choice.

4.8 Closure

• A deviation is closed after all recommendations in the impact analysis are implemented and verified. The initiator or department is responsible for completing them.
• Example target: close within 30 working days of approval. If not met, the initiator submits a justification approved by QA. This 30-day period is a site choice; define it by classification and risk.
• Product-specific deviations are closed before batch release, and a copy is filed with the batch record.
• QA maintains a log of all deviations raised during the year.

4.9 Trending and APQR

• QA reviews deviations for trends at a defined frequency (for example quarterly and annually). The original text trended once at the start of the next year; a more frequent review is usually better.
• Product-specific deviations are listed in the Annual Product Quality Review (APQR).

4.10 Record retention

Retain deviation records at least as long as the related batch records. The original text said “expiry plus 1 year or 5 years, whichever is earlier”, which is not correct against the regulations.

• Under 21 CFR 211.180(a), batch-associated production and control records are kept for at least 1 year after the batch expiry date (3 years after distribution for certain OTC products without expiry dating).
• Under EU GMP Chapter 4, batch documentation is kept for 1 year after batch expiry or at least 5 years after QP certification, whichever is longer. Investigational medicinal products have separate rules.
• Longer periods may apply under other laws, contracts or for specific products.
• Example site rule: keep the deviation with the batch record for the longest period required by the markets supplied.

5. Abbreviations

APQR: Annual Product Quality Review; BMR: Batch Manufacturing Record; BPR: Batch Packing Record; CAPA: Corrective and Preventive Action; QA: Quality Assurance; QP: Qualified Person; SOP: Standard Operating Procedure; STP: Standard Test Procedure.

Frequently asked questions

Is the 7-day and 30-day timeline a regulatory requirement?

No. These are examples of site-defined limits. Regulators expect timely, justified timelines set in your procedure and followed.

How long should deviation records be kept?

At least as long as the related batch records: 1 year after expiry under 21 CFR 211.180(a), and 1 year after expiry or 5 years after QP certification (whichever is longer) under EU GMP Chapter 4. Check any longer requirement for your markets.

How are deviations classified?

Use defined criteria based on risk to patient and product quality (ICH Q9(R1)), not personal judgement. Critical, major and minor are common categories, but each site defines its own.

References

• US FDA: 21 CFR 211.180, General requirements (records retention), as published on eCFR (checked 2026).
• European Commission: EudraLex Volume 4, EU GMP Guidelines, Chapter 4: Documentation, section on batch documentation retention (2011 revision, in force since 30 June 2011; a revised draft went to public consultation in 2025).
• ICH Q9(R1) Quality Risk Management, Step 4, 18 January 2023.