Deviation Classification: What a Buyer Is Entitled to Know

A deviation reaches a customer in one of two ways: because the supplier decided it was serious enough to mention, or because something downstream made it impossible to hide. The grading system is the mechanism that decides which, and it operates before the customer ever hears anything.

That is why the classification criteria are worth understanding even though they are internal documents. They determine what you are told.

What the grades are for

A deviation is any departure from an approved instruction: a parameter outside its range, a step performed in the wrong order, a document completed late, a sample taken from the wrong location. The grade answers one question, which is how much the departure could have affected the product.

Grade	Basis	Typical consequence
Minor	No plausible effect on the product or on a recorded result	Documented and closed locally
Major	Possible effect on quality, or on the reliability of a record	Formal investigation, batch on hold pending conclusion
Critical	Plausible risk to the patient, or a breach that invalidates the batch	Immediate containment, customer notification, regulatory assessment

Two things about this table are frequently misunderstood. The grade is about effect on the product, not about effect on the schedule, and it is assigned on the basis of what could have happened rather than what is believed to have happened. A deviation that turns out to be harmless is still a major deviation if the potential effect was major.

Why the grading is invisible to buyers

Because the classification decision is made internally, before notification. A supplier with a generous definition of minor will notify less. A supplier with a strict definition will notify more. Both will describe their system as compliant, and both may be right, in the sense that the criteria are theirs to write.

This is exactly why the quality agreement exists. It converts a discretionary internal decision into a contractual one by naming categories that must be notified regardless of internal grade: any deviation affecting a released batch, any deviation in a validated step, any repeat of a deviation previously investigated, any deviation that changes a documented result.

Without those categories, the customer is relying on the supplier's judgement about what the customer needs to know. That is a large thing to delegate.

The three phrases that carry the most weight

"No impact on product quality." "Within the validated range." "Complies with specification." Each of these can be a conclusion or a placeholder, and the difference is whether an assessment sits behind it.

An assessment names what was examined, what was found, and why the finding supports the conclusion. For a temperature excursion during drying, that means the drying curve, the residual moisture results, and the stability data for the affected interval. For a late documentation entry, it means the original record, the reason for the delay, and evidence that the entry reflects what actually happened.

The phrase without the assessment is not a lie. It is a conclusion that nobody can check, which is worse than an admission that the assessment is pending.

Deviations and the other two systems

Three quality systems are routinely confused. A deviation is a departure from an instruction. An out-of-specification result is a test result outside its limit, with its own phased investigation. A change is a deliberate modification, approved before it happens.

The confusion matters commercially because the three have different notification duties. A change is notified in advance. An out-of-specification result usually terminates the batch. A deviation may be invisible unless the agreement says otherwise, which is precisely the gap worth closing.

What a trend tells you

One minor deviation is noise. Twelve minor deviations in the same step across a year is a process that is not in control, described in a vocabulary that never crosses the notification threshold. The count matters more than any individual entry, and it is the number a buyer almost never sees.

That is the argument for asking about the deviation summary rather than the deviation report: how many were raised in the last twelve months, how many were major, how many remain open, and what the top three causes were. Those four numbers describe a site better than any single investigation.

What to write into the quality agreement

Notification categories, a timeline for initial notice, a definition of what the initial notice must contain, and the requirement that any assessment concluding no impact states the basis. Four clauses, one page, and they convert a discretionary system into an auditable one.

The timeline matters because of what the customer has to do with the information. A deviation affecting a released batch may require the customer to assess their own stock, and that assessment has its own clock. Notice that arrives after the customer's decision has been made is a record rather than a warning.

Where this leaves a supply-chain partner

We notify against the categories in the quality agreement rather than against internal convenience, and where a deviation is graded minor we say what the grading rests on. That produces more notifications than a lenient reading would, and fewer surprises than a silent one.

The complaint and CAPA process is the downstream test of the same discipline. A supplier whose deviations are closed with an effectiveness check will handle a complaint the same way. One whose deviations are closed by a sentence will close your complaint the same way too.

Three gradings, worked through

Case one. A drying step runs for nine hours instead of eight because the operator extended it to reach the moisture target. The moisture result meets specification, the assay is unaffected, and the extended drying is a departure from the batch record. Minor, with a note: the instruction's time range was too narrow for the material's behaviour, which is a documentation finding rather than a product finding.

Case two. A batch is milled with a screen that had been replaced by a spare of a different aperture. Particle size distribution moves outside its historical range but inside the specification. This is major rather than minor, because the specification's particle size window is wide enough to hide a real change in flow behaviour, and the customer's tableting line may notice what the certificate does not.

Case three. A filter fails during transfer and material passes without the intended clarification step. The batch meets specification after re-filtration. Critical, because the specification cannot demonstrate that the filtration's purpose was achieved, and the assessment has to be about what the step was for rather than about what the tests show.

Three cases, one principle: the grade follows from the potential effect, and the potential effect is assessed against the purpose of the step, not against the specification. A specification is a set of tests that somebody chose, and it does not cover every purpose a process step serves.

Writing the notification clause

The clause does not need to be long. It needs four elements: the categories that are always notified, the time within which initial notice is given, the content of that notice, and the statement that any conclusion of no impact names its basis.

The categories are the part worth arguing about, because they decide what the customer sees. A workable set: any deviation affecting a batch already released or shipped; any deviation in a step identified as critical in the process description; any repeat of a deviation investigated in the previous twelve months; and any deviation whose investigation concludes that a documented result is unreliable.

The last category is the one that catches data integrity problems early, and it is the one suppliers most often resist, because it requires admitting that a number might be wrong before anybody has proved it.

The framing documents are open: the ICH Q10 text describes the quality system in which deviations and CAPA sit, the EudraLex volume 4 text sets the European expectations for investigation and notification, and the EDQM publishes the certification conditions that apply where a certificate of suitability covers the material. None of them prescribes a grading scale, which is precisely why the agreement has to.

The question that tests a system is not how many deviations were raised. It is how many were raised for the same reason twice, and whether anybody noticed the second one as a repeat.

What the initial notice should contain

A notification that says "a deviation occurred, investigation ongoing" transfers no information and creates an obligation to ask. The initial notice earns its keep by naming four things, all of which are known within a day of the event.

The batch or batches affected, with the shipment reference if the material has moved. The step where the departure happened, described in process terms rather than in document numbers. The immediate containment, which is what was done to prevent the affected material moving further. And the customer action required, which is usually none, but stating that is itself information.

What the initial notice should not contain is a conclusion. "No impact on product quality" written on day one is a prediction, and predictions in quality systems age badly. The defensible version is "no impact is expected for the following reasons, and the assessment will be confirmed by a named date", which is a sentence a customer can file.

The interim update matters as much as the notice. An investigation that goes quiet for six weeks is read as an investigation that found something unwelcome, whether or not it did. A two-line update at a fixed interval costs nothing and preserves the credibility that the notice created.

Frequently asked questions

What makes a deviation critical?

A plausible risk to the patient, to the product's identity, strength, purity or quality beyond what the specification can detect, or a breach of a regulatory commitment. Critical classification triggers immediate containment and a formal investigation, and it usually involves the customer because the product may already be in their hands.

Is a deviation the same as an out-of-specification result?

No. An out-of-specification result is a specific event in the laboratory with its own investigation phases. A deviation is any departure from an approved procedure, and it can occur in production, storage or documentation without any result being out of specification.

Should a customer be told about every minor deviation?

Not every one, but the quality agreement should define which categories are notified and which are summarised. Silence by default is the wrong setting, because it makes the classification decision invisible to the party carrying the risk.

What does no impact mean?

It should mean that a documented assessment examined the specific effect and found it absent, with evidence. Used without that evidence, the phrase means the deviation was inconvenient to investigate, and inspectors read it that way.

How long should a deviation stay open?

Long enough to find the cause, short enough that the batch is still identifiable. An open deviation older than the batch's remaining shelf life has effectively been closed by time rather than by investigation.

Do deviations matter if the batch was rejected?

Yes, because the cause usually applies to more than one batch. A rejection removes the material and leaves the mechanism in place, which is why the investigation record is worth more than the disposition.