Deviation / Nonconformance (NC) – Containment, Investigation & CAPA

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • GMP/GDP/ISO • Pharma, Food, Devices, Cosmetics • QMS, eBMR/MES/LIMS, Data Integrity, Supplier Quality

A Deviation (process not followed as planned) or Nonconformance (NC) (requirements not met) is a formal signal that something in your quality system has drifted or failed. Whether it’s a missed SOP step, an OOS analytical result, a label misprint caught by Label Verification, or damage detected at Goods Receipt, the response must be disciplined: contain the risk, find the cause, fix the system, and prove it stayed fixed. This page outlines practical governance, roles, data requirements, and system design so your NC process protects patients/consumers and your business—with traceable evidence across MES, LIMS, QMS, and WMS.

“Treat every NC like an x‑ray: it shows the crack in your system. Contain it; then fix the bone, not just the bruise.”

1) Definitions—Deviation vs. Nonconformance

Deviation typically means “didn’t execute as planned” (missed parameter, skipped verification, unapproved substitute). Nonconformance means “didn’t meet a requirement” (spec failure, defective component, label mismatch). In practice they travel together and route to the same QMS workflow with risk‑based triage. Examples: OOS result (see OOS), SPC rule break (SPC & Control Limits), supplier defect at receipt (NCMR), or label error (Label Verification).

2) When to Open an NC—Triggers & Thresholds

• Spec/drawing/label requirement failure (QC test, Barcode Validation, Serialization).
• Process executed off‑plan (step skipped, parameter outside alert/action limits).
• Supplier material/document defect at Component Release or Goods Receipt.
• Data‑integrity concern (back‑dated entry, missing Audit Trail, shared credentials).
• Environmental/utility excursion (see EM, Temperature Mapping).

Use a simple severity schema: Critical (patient/consumer safety or regulatory exposure), Major (could affect quality/compliance), Minor (limited impact). Severity drives containment speed, RCA depth, and approver level.

3) Standard NC Workflow—Signal to Closure

4) Roles & Responsibilities—No Orphans

Assign an NC owner (process/area lead), an independent QA reviewer, and functional contributors (lab, engineering, warehouse). Define who can place Hold/Release, who evaluates impact, and who approves closure. Enforce UAM segregation—no self‑approvals. Tie competencies to a maintained Training Matrix.

5) Evidence & Record Integrity

• Immutable records with full Audit Trails (who/what/when/why, before/after).
• Device provenance: instrument IDs and Calibration Status at time of measurement.
• Links to executed data: eBMR, DHR, LIMS, WMS.
• Retention/archival per clocks; prove retrievability (Record Retention & Archival).
• Electronic signatures aligned to 21 CFR Part 11/Annex 11.

6) Risk Assessment—Focus Where Harm is Real

Use QRM to rank the NC by severity, occurrence, and detectability. Assess patient/consumer risk, regulatory exposure, and business impact (CoPQ, service levels like OTIF). Link to the risk register; ensure CAPA targets the dominant drivers.

7) Root Cause Analysis—Tools & Traps

Select tools that fit the data: 5‑Whys, Fishbone, Fault Tree, or statistical exploration (capability, Cp/Cpk, X‑bar/R). Validate measurement first (MSA) to avoid chasing noise. Traps: blaming “operator error” without evidence; ignoring configuration drift (Document Control shows a new recipe; line used the old one); under‑estimating environment (EM, minimum weight); method not fit‑for‑purpose (TMV).

8) CAPA—Design, Verification, Effectiveness

Corrections (containment, rework) fix the immediate issue; Corrective actions remove the cause; Preventive actions reduce the risk of similar issues elsewhere. For each action define owner, due date, and measurable outcome. Where changes affect validated state, run Change Control with impact assessment (CSV, IQ/OQ/PQ). Verify completion; check effectiveness via trends (CPV, APR/PQR).

9) Supplier & Incoming Quality—NCR, NCMR, SCAR, MRB

Capture supplier issues as NCR/NCMR. Trend by supplier, lot, and attribute; escalate through SCAR with expectations/timelines. Convene MRB to decide rework, use‑as‑is, or scrap based on risk and specs (Quality Agreement applies). Link to Supplier Qualification and periodic audits.

10) Electronic Systems—Join the Dots

NC processes fail when data is siloed. Integrate via ISA‑95: ERP↔MES↔LIMS↔QMS↔WMS↔label/Serialization. Validate interfaces/volumes; maintain Audit Trails and UAM per Annex 11/Part 11. Keep Quarantine and Hold/Release statuses authoritative in WMS to prevent shipping suspect goods.

11) Special Cases—OOS/OOT, Labels, Serialization, Net Content

• OOS/OOT: Follow analytical OOS workflow; verify system suitability, standards, and TMV; distinguish lab error vs. process failure.
• Labels & UDI/GTIN: Errors trigger NC; verify symbology/content via Label Verification, GTIN, GS1‑128.
• Net Content: Under‑fills drive NC and TNE risk assessment; review SPC guardbanding.
• Environmental/Utilities: Excursions (EM, temp, humidity) feed NC; check Hold Time and product risk.

12) Metrics That Matter

• NC rate by million units/batches; % Critical/Major/Minor.
• Time to containment; median time to closure by severity.
• Repeat NC rate within 6–12 months (CAPA effectiveness).
• Supplier PPM and % SCARs closed on time.
• Audit‑trail review coverage; stale access removals (UAM).
• Archive restore‑test pass rate for NC records (Archival readiness).
• Linkage to APR/PQR and CPV signals.

13) Common Pitfalls—How to Avoid Them

• Late/missing NCs: If it crossed a requirement, log it. Unlogged events destroy trends.
• Weak RCA: “Operator error” without evidence of design/SOP/training gaps isn’t a cause.
• Paper detours: Side spreadsheets lack context and Audit Trails.
• Over‑broad holds: Use genealogy to target precisely.
• Task‑only CAPA: Define outcomes and verify effectiveness.

14) How This Fits with V5 by SG Systems Global

Integration. The V5 platform links NCs to executed data: eBMR/DHR steps, LIMS results, WMS movements, and Label Verification.

Hard‑gating. Execution blocks on open Critical NCs or missing signatures, enforcing QA disposition before shipment.

Data Integrity. Immutable Audit Trails, role‑based access, and verified device inputs (Calibration Status) satisfy Annex 11/Part 11.

Analytics. Dashboards trend NCs by line/SKU/supplier, correlate with SPC and CPV, and quantify CoPQ. Embedded workflows drive CAPA to closure with Change Control where needed.

Related Reading
• Core Processes: CAPA | Root Cause Analysis | Change Control | Quality Assurance
• Records & Integrity: Data Integrity | Audit Trail | Record Retention & Archival
• Execution & Release: eBMR | Quality Control | Release Status
• Supplier & Materials: NCMR | SCAR | MRB
• Methods & Monitoring: TMV | MSA | CPV
• Compliance Foundations: EU Annex 11 | 21 CFR Part 11 | QMS