Deviation management process flowchart
Deviation management process flowchart: detection, containment, classification, impact assessment, investigation, batch disposition, CAPA and closure.
How it works
Set your reporting window
Add your own deadline to the "Raise deviation record in the QMS" step, for example within one working day of detection, and state whether the clock starts at detection or at the end of shift. Most late-logging problems come down to that one number never having been written down.
Write your classification criteria onto the decision
Minor, major and critical mean different things in different quality systems. Put your own definitions in the comment on the "Deviation classification?" node, together with who is authorised to classify and who may reclassify once the investigation changes the picture.
Rename the lanes to your real roles
Smaller sites often merge Investigator into QA or Production. If your organisation has no qualified person, rename that lane to whoever holds release authority, such as the quality director or an authorised signatory, rather than deleting the lane and losing the escalation.
Decide what escalates and when
This chart escalates critical deviations at classification. Add any other triggers your SOP carries, for instance anything affecting a released batch, anything touching sterility or data integrity, or a deviation that has already occurred within the last twelve months.
Define when a CAPA is mandatory
A "CAPA required?" decision with no written criteria always drifts towards No. Record on the node what forces a CAPA: major or critical classification, recurrence, a systemic cause in procedure, training or equipment design, or a correction that does not prevent the deviation happening again.
Close the trending loop and version the chart
Name the trending report the closed record feeds, how often it is reviewed and by whom. Then treat the diagram as a controlled document alongside the SOP text: give it a version, record who reviewed and approved it, and re-review it whenever the procedure changes. A diagram that no longer matches the SOP is worse than none, because people follow it.
Frequently asked questions
What is the difference between a deviation, a non-conformance and an OOS result?
A deviation is a departure from an approved procedure, process or specification, so something was done differently. A non-conformance is a product, material or component that fails to meet its requirement, so something came out wrong. An out-of-specification (OOS) result is an analytical result outside its acceptance criteria, and most quality systems handle it under a separate OOS investigation procedure that only feeds into deviation handling once a laboratory error has been ruled out. Operationally all three share the same shape: contain, record, assess impact, investigate the cause, decide on the product, act on the cause.
How are deviations classified as minor, major or critical?
Most quality systems classify on impact to product quality and patient safety. A minor deviation has no impact on product quality, the validated state or regulatory compliance. A major deviation may affect product quality or a validated state, and requires a formal investigation and root cause analysis. A critical deviation puts patient safety, product efficacy or regulatory compliance at risk, and is escalated immediately, which in this chart means routing to the qualified person before the investigation even opens. Exact wording varies between organisations, so write your definitions down. Consistency of classification matters more to an inspector than which of the three labels you chose.
When does a deviation need a CAPA?
Not every deviation does. A one-off event with a clear, contained cause can reasonably be closed with a correction and a documented rationale. A CAPA is normally required when the deviation is major or critical, when it recurs, when the root cause is systemic rather than local, or when the correction taken does not prevent recurrence. The chart makes this an explicit "CAPA required?" decision rather than an assumption in either direction, because a process that raises a CAPA for every deviation produces a backlog nobody closes, and a process that raises none never fixes anything.
Who approves closure, QA or the qualified person?
QA owns closure of the deviation record in almost every quality system. It confirms the investigation is complete, that the root cause is supported by evidence, that the batch disposition is documented and that any CAPA has been raised and assigned. The qualified person's role is narrower and specific to the batch: in the EU and UK, batch certification before release is the QP's legal responsibility under GMP, which is why batch disposition sits in that lane here while closure sits with QA. In this template QA holds the "QA approves closure?" decision and can send the record back for more evidence before the deviation is closed and added to trending.