Deviation management process flowchart

What the deviation management process is

A deviation is any departure from an approved procedure, specification or established standard. In a regulated manufacturing environment the deviation itself is rarely what causes trouble. What an auditor or inspector examines is whether it was contained before anything else happened, recorded inside the reporting window, classified consistently against written criteria, investigated to a cause you can actually act on, and closed with a documented decision about the affected batch.

The process fails in predictable places. Deviations get logged two days later, once the shift has ended and the evidence has been cleaned away. Everything is classified as minor, because major triggers a formal investigation nobody has capacity for. The investigation names operator error and stops. And the batch decision gets taken informally before QA has finished the impact assessment. Drawing the flow across lanes makes each of those points visible, because you can see who is holding the record and what has to be true before it moves on.

This template runs from detection to closure across five lanes: Operator, Supervisor, QA, Investigator and Qualified person. It keeps the branches teams argue about as real decisions rather than footnotes, including classification into minor, major or critical, whether product quality is impacted, the batch disposition, and whether a CAPA is required. Critical deviations are escalated to the qualified person as soon as they are classified, not at the point of batch release. Treat it as a starting point for your own SOP, not as a compliance document in itself.

What this flowchart covers

In this template

• Five swimlanes (Operator, Supervisor, QA, Investigator, Qualified person) across six phases: Detection, Recording, Assessment, Investigation, Disposition, and CAPA and closure
• Containment before paperwork: the operator stops work and contains the deviation, then the supervisor quarantines the affected batch and materials before anything is written up
• The deviation record raised in the QMS inside the reporting window, followed by a supervisor step that confirms the facts, the timeline and which batches are affected
• A QA impact assessment on product and batch feeding a three-way "Deviation classification?" decision, where Minor goes straight to the impact conclusion, Major opens a formal investigation, and Critical escalates to the qualified person first
• Investigation in the Investigator lane, gathering evidence and interviewing operators before determining root cause, with a "More evidence" branch from QA's closure decision that sends the record back into evidence gathering
• A "Product quality impacted?" decision feeding a "Batch disposition?" branch with Release, Reject and Rework outcomes, all three converging on a "CAPA required?" gate, QA approval, and closure with the record added to trending

When to use this template

• You are writing or revising a deviation management SOP and need one diagram showing who owns each step, rather than a numbered list of clauses
• Deviations are being logged late or classified inconsistently, and you want the reporting window and the classification criteria visible at the point they apply
• An audit or inspection observation has questioned how batch disposition decisions are made, by whom, and how they are evidenced
• You are training operators and supervisors on what to do in the first hour, before QA and the investigator are involved at all
• You are configuring a QMS workflow and need the as-is process agreed before anyone builds forms, routing rules and due-date logic

How it works

1. Set your reporting window

   Add your own deadline to the "Raise deviation record in the QMS" step, for example within one working day of detection, and state whether the clock starts at detection or at the end of shift. Most late-logging problems come down to that one number never having been written down.

2. Write your classification criteria onto the decision

   Minor, major and critical mean different things in different quality systems. Put your own definitions in the comment on the "Deviation classification?" node, together with who is authorised to classify and who may reclassify once the investigation changes the picture.

3. Rename the lanes to your real roles

   Smaller sites often merge Investigator into QA or Production. If your organisation has no qualified person, rename that lane to whoever holds release authority, such as the quality director or an authorised signatory, rather than deleting the lane and losing the escalation.

4. Decide what escalates and when

   This chart escalates critical deviations at classification. Add any other triggers your SOP carries, for instance anything affecting a released batch, anything touching sterility or data integrity, or a deviation that has already occurred within the last twelve months.

5. Define when a CAPA is mandatory

   A "CAPA required?" decision with no written criteria always drifts towards No. Record on the node what forces a CAPA: major or critical classification, recurrence, a systemic cause in procedure, training or equipment design, or a correction that does not prevent the deviation happening again.

6. Close the trending loop and version the chart

   Name the trending report the closed record feeds, how often it is reviewed and by whom. Then treat the diagram as a controlled document alongside the SOP text: give it a version, record who reviewed and approved it, and re-review it whenever the procedure changes. A diagram that no longer matches the SOP is worse than none, because people follow it.

Frequently asked questions

What is the difference between a deviation, a non-conformance and an OOS result?

A deviation is a departure from an approved procedure, process or specification, so something was done differently. A non-conformance is a product, material or component that fails to meet its requirement, so something came out wrong. An out-of-specification (OOS) result is an analytical result outside its acceptance criteria, and most quality systems handle it under a separate OOS investigation procedure that only feeds into deviation handling once a laboratory error has been ruled out. Operationally all three share the same shape: contain, record, assess impact, investigate the cause, decide on the product, act on the cause.

How are deviations classified as minor, major or critical?

Most quality systems classify on impact to product quality and patient safety. A minor deviation has no impact on product quality, the validated state or regulatory compliance. A major deviation may affect product quality or a validated state, and requires a formal investigation and root cause analysis. A critical deviation puts patient safety, product efficacy or regulatory compliance at risk, and is escalated immediately, which in this chart means routing to the qualified person before the investigation even opens. Exact wording varies between organisations, so write your definitions down. Consistency of classification matters more to an inspector than which of the three labels you chose.

When does a deviation need a CAPA?

Not every deviation does. A one-off event with a clear, contained cause can reasonably be closed with a correction and a documented rationale. A CAPA is normally required when the deviation is major or critical, when it recurs, when the root cause is systemic rather than local, or when the correction taken does not prevent recurrence. The chart makes this an explicit "CAPA required?" decision rather than an assumption in either direction, because a process that raises a CAPA for every deviation produces a backlog nobody closes, and a process that raises none never fixes anything.

Who approves closure, QA or the qualified person?

QA owns closure of the deviation record in almost every quality system. It confirms the investigation is complete, that the root cause is supported by evidence, that the batch disposition is documented and that any CAPA has been raised and assigned. The qualified person's role is narrower and specific to the batch: in the EU and UK, batch certification before release is the QP's legal responsibility under GMP, which is why batch disposition sits in that lane here while closure sits with QA. In this template QA holds the "QA approves closure?" decision and can send the record back for more evidence before the deviation is closed and added to trending.