Deviation vs Change Control vs CAPA in Pharma: Explained

A deviation is an unplanned departure from an approved instruction, procedure or specification. Change control is the system for proposing, assessing, approving and implementing planned changes. CAPA, corrective and preventive action, is the system that removes the causes of problems so they do not recur, or never occur.

The three are separate processes that constantly feed each other. Inspectors often trace a single event through all three, so if your teams treat them as unrelated forms, gaps show up quickly.

Definitions in plain terms

• Deviation: something happened that was not supposed to, such as a missed in-process check, an equipment alarm during compression or an environmental excursion. It is recorded, assessed for impact and investigated.
• Planned deviation: a pre-approved, one-off, temporary departure from a procedure, with QA approval before execution. It is not a shortcut around change control for permanent changes.
• Change control: a planned change to a validated process, equipment, material, supplier, method, document or system, assessed for impact before it is made.
• CAPA: actions that correct the cause of an identified problem (corrective) or address a potential problem before it happens (preventive), followed by a check that they worked.

How they link under ICH Q10 and GMP

ICH Q10, the pharmaceutical quality system guideline, names four elements: process performance and product quality monitoring, the CAPA system, the change management system, and management review. Deviations are one of the main inputs into the CAPA system, alongside complaints, audit findings, OOS results and inspection observations.

EU GMP Chapter 1 expects deviations to be investigated with appropriate root cause analysis, appropriate CAPA to be identified and taken, and changes to be managed. In the US, 21 CFR Part 211 requires deviations from written procedures to be recorded and justified, unexplained discrepancies to be investigated, and changes to procedures to be reviewed and approved by the quality unit.

Other authorities, including CDSCO in India and GCC regulators, apply GMP frameworks built on the same principles. Confirm the specific expectations of the regulators that inspect your site.

Deviation vs change control vs CAPA: comparison table

Classifying deviations

Most sites classify deviations by their potential impact on product quality, patient safety, data integrity and GMP compliance. Common categories are:

• Critical: could directly affect patient safety or product quality, such as a sterility assurance failure or a mix-up of products.
• Major: significant impact on quality or GMP compliance that needs full investigation, such as an unvalidated process parameter used during production.
• Minor: limited impact, such as a documentation error corrected without effect on the product.

Classification drives investigation depth and timelines. Many SOPs set a target, commonly 30 days, for closing a deviation investigation, with documented extensions. That is common practice rather than a regulatory rule, so follow your own SOP and justify any delay.

How an event flows through the three systems

1. An event is detected and a deviation is raised immediately, with containment such as quarantining affected material.
2. QA classifies the deviation and assesses impact on the batch and other batches.
3. An investigation identifies the root cause using a structured tool.
4. CAPA actions are defined to correct the cause and prevent recurrence.
5. If a CAPA requires a permanent change to a process, document, supplier or equipment, a change control is raised.
6. The change control is assessed, including validation and regulatory impact, approved and implemented.
7. The CAPA effectiveness check confirms the problem has not recurred.
8. Trends from deviations and CAPA feed management review.

Effectiveness checks

An effectiveness check asks whether the CAPA actually worked, not just whether it was completed. Define the measure at the outset, such as no recurrence across a set number of batches, improved trend data, or audit evidence of the new practice. A CAPA closed on retraining alone, with no check, is a frequent inspection finding.

Worked example: an excipient grade change on a tablet compression line

A generics plant in Ras Al Khaimah compresses an immediate-release tablet. During a routine run, weight variation and capping increase, and the in-process checks show tablets near the hardness limit. The operator stops the press and a deviation is raised. Affected material is quarantined.

The investigation compares lots of microcrystalline cellulose. The supplier's certificate shows a different particle size distribution, and the supplier confirms it changed the grade supplied after a site consolidation. A notification letter had been sent, but it went to purchasing and never reached QA.

• Deviation outcome: the root cause is the unassessed excipient change, with a contributing cause in the notification route. QA assesses the batch and rejects tablets that fail in-process limits.
• CAPA: the supplier quality agreement is revised to require advance change notification to QA, purchasing is trained to route such letters to change control, and incoming checks are extended to include particle size for this material.
• Change control: a formal change control evaluates whether to qualify the new grade or source the original grade elsewhere. It covers trial batches, process validation, stability and a regulatory impact assessment for the markets supplied.
• Effectiveness check: QA reviews the next set of supplier notifications and batches over a defined period to confirm changes now reach change control before material is used.

Common mistakes

• Using planned deviations repeatedly instead of raising a change control.
• Closing deviations as human error without exploring system causes.
• Opening a CAPA for every minor deviation, so the system becomes overloaded.
• Implementing a change before approval, then raising the change control afterwards.
• Closing CAPA without a defined effectiveness check.
• Not linking records, so inspectors cannot trace an event from deviation to change.

Key takeaway: A deviation records what went wrong, CAPA fixes why it went wrong, and change control makes sure the fix, or any other planned change, is assessed before it touches the product.

Frequently Asked Questions

What is the difference between a deviation and a CAPA?

A deviation is the record of an unplanned departure from an approved procedure or specification, including its impact assessment and investigation. A CAPA is the set of actions taken to correct the root cause and prevent recurrence. A deviation often leads to a CAPA, but not every minor deviation needs one, provided your SOP defines when it is required.

What is a planned deviation?

A planned deviation is a temporary, pre-approved departure from a procedure for a specific situation, such as a one-off change to a sampling plan while equipment is repaired. QA must approve it before it is executed. It should not be used for permanent changes, which require change control, and repeated planned deviations for the same issue suggest a change control is overdue.

How long should a deviation investigation take?

There is no single regulatory deadline. Many companies set a target in their SOP, commonly 30 days from initiation, with documented justification for extensions. The timeline should reflect the deviation's classification and risk. Batches affected by an open deviation cannot normally be released until the impact assessment supports it, so delays can affect supply.

Does every change need change control?

Any change that could affect a validated state, product quality, regulatory filings or GMP compliance should go through change control. Your SOP should define the scope, including like-for-like replacements, documents, equipment, suppliers and computerised systems. Some low-risk changes may follow a simplified route, but the decision itself should be documented.

What does ICH Q10 say about CAPA and change management?

ICH Q10 identifies the CAPA system and the change management system as two of the four elements of a pharmaceutical quality system, together with process performance and product quality monitoring and management review. It expects CAPA to come from investigations of deviations, complaints, audits and inspections, and changes to be evaluated using quality risk management.

Next steps

Our Root Cause Analysis & CAPA course builds practical investigation and CAPA skills, and Good Documentation Practices & Data Integrity Essentials covers the records that hold these systems together. For related reading, see the CAPA process from finding to prevention and OOS vs OOT results: how to investigate. You can also speak to a counsellor.