Biopharmaceutical Quality: Managing Good Manufacturing Practice Deviations

STOCK.ADOBE.COM

Effectively managing deviations is fundamental to ensuring product quality, regulatory compliance, and patient safety. Intricate processes are involved in deviation management, from the initiation phase, where incidents are swiftly evaluated, to the comprehensive investigation of root causes. Through a systematic examination of impact assessment, deviation investigations, and implementation of corrective and preventive actions (CAPAs), I seek to provide a thorough understanding of the critical components that contribute to a robust deviation-management system. Here I focus on the pragmatic methodologies, challenges, and strategic considerations that characterize efficient deviation management within the biopharmaceutical industry, emphasizing the importance of timely actions and continual improvements to establish robust quality systems.

Incident Discovery and Immediate Actions

Traditionally, incident discovery begins when a deviation initiator opens a deviation report. That person collaborates with a quality assurance (QA) team typically within one business day of a triggering event (1). In the initial phase of incident discovery, an area manager must confirm whether containment or other immediate actions are needed to mitigate impact. If so, the manager should implement those actions to minimize impact and delegate a team to assess and segregate all potentially affected products, either physically or through an electronic inventory-management system (IMS). The QA team and responsible personnel must be notified immediately if any affected batches of product have left the site. A deviation owner is usually responsible for evaluating a deviation’s impact across processes and areas and should initiate contact with relevant personnel accordingly. Rapid responses are fundamental to addressing and containing problems caused by deviations.

Initiating a Deviation Report

To initiate a deviation report, an electronic record must be created within a quality management system (QMS). Recorded information should encompass several key elements, including the nature of a deviation, the location where it was detected, an account of immediate actions taken, and a list of individuals who were informed (2). The description should be written clearly and include required details, such as relevant procedure and equipment numbers, product names and lot numbers, and the name of the person who identified the event. Details provided in the report’s title and description can provide keywords to be searched by electronic quality systems to identify recurring events. The description also should incorporate relevant records and photographs of discovered defects, ensuring that information is documented thoroughly to enable initial risk evaluation.

Impact Assessment: Once a deviation report has been initiated, a deviation owner typically conducts an initial impact assessment and risk evaluation (3). This process involves gathering information from a number of sources, including subject-matter experts (SMEs) and the QA team (2). An initial classification often is assigned, categorizing a deviation as minor, major, or critical (4).

An initial impact assessment should consider potential regulatory implications of a deviation. The assessment should note whether a deviation from specified process details could affect regulatory submissions as well as potential effects on product stability and process validation. All implicated batches must be assessed, especially if they already have been released and are no longer under the manufacturing site’s control. To assess the potential quality impact of a deviation, deviation owners often use a decision tree.

Deviations are typically classified as major or critical when they necessitate notification of a health authority or cause the need for reprocessing or rework (4). Additionally, a pattern of similar incidents or recurrences often is categorized as major and can indicate that CAPAs and recurrence checks have not been effective. Critical deviations typically necessitate escalation to a qualified or responsible personnel. Such individuals often must agree on an investigation plan. They play a pivotal role in guaranteeing that pharmaceutical products adhere to regulatory requirements, particularly those associated with good manufacturing practices (GMPs)

and QA.

Deviation Investigations and Root-Cause Analysis

Once an investigation record is initiated, the scope of an investigation might require a cross-functional team, depending on the nature of the deviation. A deviation owner usually oversees an investigation’s progress, initiates CAPAs, and documents pertinent activities. To commence an investigation, the owner and investigation team collaborate to gather information, collect relevant data, and interview colleagues. Investigations seek to identify a given incident’s root cause (5).

In cases of recurring events or complex issues, more extensive investigations may be warranted. To determine the root cause of a deviation, teams often rely on a systematic approach. Such a method includes interviewing employee, reviewing training records, assessing the impact on other batches, examining the calibration status of equipment, reviewing relevant documents, and evaluating the implementation status of other CAPAs. Commonly used investigative tools for root-cause analysis include the five-why technique, Ishikawa diagrams, failure mode and effect analysis (FMEA), and control charts (5). Investigators choose tools based on event complexity and the number of potential root causes. When human error is identified as a root cause, investigators need to determine whether that error is attributable to underlying process, procedural, or systemic issues.

Historical Reviews

Investigators undertake historical reviews to determine whether the same deviations and root causes have occurred previously and whether existing CAPAs have been effective (6). A deviation owner usually conducts a historical review to check for repeat events or recurrences. To undertake a historical review, the owner searches keywords related to an incident to identify previous occurrences (6). It is therefore important that detailed information is included when a deviation report is initiated. Doing so ensures that recurrences are identified as such. Some QMSs include keywords that also may be used during a search.

For product-related deviations, historical review should include a minimum number of lots within a specified timeframe, typically with two years (7). Usually, if a minimum number of lots is unavailable, that timeframe is extended. Deviations are searched using applicable keywords and reviewed to find any similar events. Recurrences are defined as new deviations that have similar descriptions and root causes as past ones, having occurred in the same process, system, or GMP area. If a minor deviation recurs, the new event might be classified as major and require an extended investigation. When recurrences are identified, it also is important to assess whether CAPAs have been implemented and whether additional CAPAs should be implemented to prevent future recurrences (7).

Recurring deviations are perceived negatively and can indicate that a quality system is not in control (7). But the practical challenges of commercial-scale GMP production often get overlooked, so some recurring events may be unavoidable. In many cases, causes are addressed in a CAPA plan, and implementing them can require change-control measures. Some actions also take time to implement, opening the possibility of recurrences before changes are finalized. QA teams might also identify deviations during batch-record review, and if more than one batch has been produced, that might identify more recurring events. Timely investigations and CAPA implementations are therefore important to ensuring quality system control.

Deviation Report Closure

The QA department usually can close deviation reports after investigations have concluded, root causes have been defined, CAPAs have been established, and (if necessary) once an effectiveness check has been conducted. The head of quality typically must approve closing a deviation report when major and critical deviations occur (8). The same is true for events that deviate from established process specifications, such as significant excursions in critical process parameters (CPPs) included in approved regulatory filings. Deviations reports are usually due 30 days after event discovery (9).

If closing a deviation report is expected to take more than 30 days, then an investigative team can request an extension by providing justification and explaining the due date’s impact on GMP activities. An extension request should include a deviation’s status and why investigative activities are expected to exceed the allotted time. It is important to obtain approval for a requested extension before the original due date; otherwise, the deviation report will be considered overdue.

Extensions are approved or denied based on factors such as their criticality, classification, and duration. Third-party investigations, such as those undertaken by suppliers, are a common cause of extension requests. QA teams usually are authorized to extend a due date for minor deviations up to a specified time frame, such as 60 or 90 days, with longer extensions often requiring approval from the head of quality. Some organizations limit the maximum number of extensions beyond which a deviation would be considered overdue.

Careful management of extension requests helps to prevent prolonged extensions. The time frame for closing a deviation report should account for an investigation’s scope, the complexity of identifying a root cause, and assessments needed to determine effective CAPAs. Generally, due dates should be extended only with evidence of undertaken activities. And if a deviation remains open because of competing business priorities, then no extension should be granted, and the report should be considered overdue.

Cancelling and Reopening Deviations: Cancellation of open deviation records usually is allowed if there are duplicates, but such instances should be documented. It is important to explain why multiple records were generated for the same event or if a raised deviation does not qualify as such (10). Additionally, it is generally permissible to reopen a closed deviation for minor corrections, clarifications, or additions, but modifications or additions must adhere to the original intent of the investigation or root-cause analysis. Unless they are self-evident, rationale behind changes should be documented.

CAPA Management

Once a root cause has been established, identification and implementation of appropriate CAPAs become imperative, followed by systematic tracking and monitoring. Generally, two types of actions are considered: Corrective actions seek to eliminate the cause of a nonconformity and prevent recurrence of an event. Preventive actions address the cause of a similar problem or potential event before it occurs (4). A procedure is used to implement CAPAs that are not linked to specific events or deviations, such as those resulting from external audits or regulatory inspection findings. CAPA actions require careful consideration to ensure that they target the root cause of a problem and are proportionate to the risk involved in correcting or preventing an incident. Additionally, effectiveness checks can help the incident team ascertain whether an implemented CAPA has met its intended objective without unintended consequences. The planning of CAPAs typically involves gathering input from a number of stakeholders. Upon reaching an agreement, a CAPA is initiated to outline actions and establish timelines.

A comprehensive CAPA description is essential. Incorporating sufficient details elucidates how changes will address or eliminate root causes of deviations, enabling organizations to anticipate results. Additionally, careful consideration should be given to potential adverse or negative effects that could stem from CAPAs. The due date for completing a CAPA action should be determined based on factors such as criticality; urgency; the complexity of an event; its impact on products or processes; and the time required to gather information. Timely yet realistic due dates are crucial, and setting them should take into consideration other factors like manufacturing schedules, the risk of deviation recurrence, and the scope of required work. Whenever possible, organizations should implement CAPAs quickly to minimize the potential for recurring events. In some cases, interim measures can help prevent recurrences until CAPAs are implemented fully.

If an extension is needed, requests should be made before the current CAPA due date with ample justification provided. The QA team usually approves a first extension request, but second and third extensions often must be reviewed and approved by the head of quality. CAPAs that are raised because of observations from regulatory authorities usually are not extended.

Effectiveness Checks: An effectiveness check is an evaluation tool that investigators use to assess the success of implemented CAPAs in preventing the recurrence of deviations. Each CAPA should undergo a thorough assessment to determine whether an effectiveness check is necessary. For critical deviations, an effectiveness check is often mandatory. For major and minor deviations, decisions are made case by case. Investigators must justify clearly the decision to forego an effectiveness check during an evaluation process. A check can be conducted across multiple batches of manufactured products and within a specified time frame.

It can be advantageous to incorporate interim effectiveness checks. For example, investigators can perform their review after a subsequent batch or activity, especially when time is needed to gather sufficient data. When possible, effectiveness checks should include acceptance criteria, which help to determine the success of implemented actions.

Tracking and Trending: Deviations and corresponding CAPAs usually get evaluated annually, with site metrics reviewed by a quality review committee every few weeks (11). Such committees maintain system control by monitoring the status of open, closed, and overdue deviations. Additionally, the committee identifies trends by assessing the number of deviations per batch within production areas, promoting a proactive approach to quality management. Continuous review of quality metrics is crucial for compliance. It also highlights risks associated with systems, training, equipment, or maintenance that may warrant investigation (12). A quality review measures CAPA effectiveness and often includes an evaluation of deviations caused by human error and lack of data integrity. Additional CAPAs can be implemented to address trends that the review team identifies.

A Quality System Necessity

Effectively managing deviations in the biopharmaceutical industry is crucial to ensuring product quality, regulatory compliance, and patient safety. Focusing on pragmatic methodologies, challenges, and strategic considerations underscores the need for efficient deviation management in the sector. Timely actions and continual improvements are paramount for establishing and maintaining a compliant quality system.

References

1 Damini V, et al. Handling of Pharmaceutical Deviations: A Detailed Case Study. Ind. J. Pharm. Sci. 82(6) 2020: 928–944; https://www.ijpsonline.com/articles/handling-of-pharmaceutical-deviations-a-detailed-case-study-4046.html.

2 Deviation Handling and Quality Risk Management: A Note for Guidance for the Manufacture of Prequalified Vaccines for Supply to United Nations Agencies. World Health Organization: Geneva, Switzerland, 2013; https://dcvmn.org/wp-content/uploads/2016/03/who_guidance_deviation_and_risk_mgt_2013.pdf.

3 Gausepohl C. Implementing a World Class Deviation Management. GMP Compliance Adviser Maas & Peither AG — GMP Publishing: Schopfheim, Germany, 2024; https://www.gmp-publishing.com/media/pdf/ef/25/b0/Reading_Sample-Implementing_a_World_Class_Deviation_Management.pdf.

4 Pharmaceutical Inspection Convention: Guidance on Classification of GMP Deficiencies. Pharmaceutical Inspection Co-Operation Scheme: Geneva, Switzerland, 2019; https://picscheme.org/layout/document.php?id=1609.

5 Traeger S. 7 Powerful Root Cause Analysis Techniques. Reliability: Richmond, VA, 2024; https://reliability.com/resources/articles/7-powerful-root-cause-analysis-techniques.

6 Drapala P. Deviation Investigation Format and Content: A Guide for Inspection Success. Pharm. Technol. 41(7) 2017: 108–110; https://www.pharmtech.com/view/deviation-investigation-format-and-content-guide-inspection-success-0.

7 McGee A. The Challenge of Deviation Management. GMP J. 1 October 2012; https://www.gmp-journal.com/current-articles/details/the-challenge-of-deviation-management.html.

8 Watson T. Handling of Unexpected Deviations. Medicines and Healthcare Products Regulatory Agency: London, UK, 2016; https://mhrainspectorate.blog.gov.uk/2016/06/17/handling-of-unexpected-deviations.

9 Kashyap R. Deviation Management Process. Pharma Qualification 10 July 2019. https://www.pharmaqualification.com/2019/07/Deviation-management-process.html.

10 Deviation Investigation Guidelines in GMP Facilities. GMPSOP: North Ryde, New South Wales, 2017. https://www.gmpsop.com/deviation-investigation-guidelines-in-gmp-facilities.

11 FDA’s Pharma Manufacturing Quality Metrics Research. International Society for Pharmaceutical Engineering: North Bethesda, MD, 2017; https://ispe.org/pharmaceutical-engineering/ispeak/fdas-pharma-manufacturing-quality-metrics-research.

12 Quality Metrics for Drug Manufacturing. US Food and Drug Administration: Rockville, MD, 2023; https://www.fda.gov/drugs/pharmaceutical-quality-resources/quality-metrics-drug-manufacturing.

Corresponding author Anthony Newcombe, PhD, is owner and managing director of Applied Biopharm Consulting, Clonakilty, Cork, Ireland; 353‑87‑3634486; [email protected].