Deviation Management & CAPA

● ACTIVE v4.2.1 Updated: 2026-04-12

Document ID AZ-QMS-008-DEV

Approver VP of Quality Assurance

Next Review 2027-04-12

Classification Internal - Controlled

Purpose & Scope

This procedure establishes a standardized framework for identifying, documenting, investigating, and resolving deviations across all Aevum Zenth operations. It ensures consistent application of Corrective and Preventive Action (CAPA) methodologies to mitigate risk, maintain compliance, and drive continuous improvement.

ℹ️ Applicability

This protocol applies to all subsidiaries, manufacturing sites, clinical operations, software development lifecycles, and third-party vendors under Aevum Zenth contractual oversight.

Definitions

Term	Definition	Classification
Deviation	Any departure from approved procedures, specifications, or regulatory requirements.	Minor / Major / Critical
CAPA	Systematic process to identify root causes and implement corrective/preventive measures.	Corrective / Preventive
OOS	Out-of-Specification result requiring immediate investigation and disposition.	Quality Event
RCA	Root Cause Analysis using methodologies like 5-Whys, Fishbone, or FMEA.	Investigation Tool

Deviation Management Workflow

All deviations must be logged within 24 hours of detection. The workflow follows a strict escalation and documentation path:

STEP 01

Detection & Logging

Submit via QMS portal. Auto-generates unique ticket ID.

STEP 02

Triage & Classification

QA assesses impact: Minor, Major, or Critical.

STEP 03

Investigation & RCA

Cross-functional team conducts root cause analysis.

STEP 04

CAPA Implementation

Deploy corrective actions & preventive controls.

STEP 05

Verification & Closure

Audit effectiveness. Close ticket with sign-off.

⚠️ Critical Deviations

Deviations classified as Critical require immediate escalation to the Site Quality Lead and VP of Quality within 4 hours. Production/operations must be halted if patient safety, product integrity, or regulatory compliance is at risk.

CAPA Framework

The CAPA system operates on a risk-based approach aligned with ICH Q9 and ISO 14971. Actions are categorized by type and implementation timeline:

Corrective Actions (CA)

Address the immediate cause of a specific nonconformance. Examples include equipment recalibration, operator retraining, or batch disposition review.

Preventive Actions (PA)

Eliminate potential causes of nonconformities before occurrence. Examples include process optimization, system architecture updates, or supplier qualification revisions.

📊 Effectiveness Checks

All CAPAs require a 90-day effectiveness review. Metrics include recurrence rates, process capability indices (Cp/Cpk), and audit findings. Failed effectiveness checks trigger a secondary investigation.

Roles & Responsibilities

Role	Responsibility
Deviation Initiator	Report events, provide initial evidence, participate in RCA.
Quality Assurance (QA)	Triage, oversight, CAPA validation, regulatory alignment.
Subject Matter Expert (SME)	Technical investigation, root cause determination, solution design.
Site/Division Lead	Resource allocation, risk acceptance/rejection, operational impact assessment.
Compliance & Audit	Periodic review, regulatory submission support, trend analysis.

Documentation & Templates

Standardized forms ensure consistency and audit readiness. All templates are hosted in the Aevum Zenth Document Management System (DMS).

AZ-DEV-001: Deviation Report Form

Captures event details, initial impact assessment, affected batches/systems, and immediate containment actions. Required fields auto-validate against master data.

AZ-DEV-002: Root Cause Analysis Worksheet

Structured template supporting 5-Whys, Fishbone/Ishikawa, and FMEA methodologies. Includes evidence logging and cross-functional sign-off blocks.

AZ-DEV-003: CAPA Implementation Plan

Defines corrective/preventive actions, owners, deadlines, resource requirements, and success metrics. Integrated with project tracking tools.

AZ-DEV-004: Effectiveness Verification Report

Post-implementation audit checklist comparing baseline vs. current performance data. Requires quantitative evidence for closure.

Regulatory Alignment

This procedure maintains strict adherence to global quality management standards and industry-specific regulations:

ISO 9001:2015 (Clause 10.2)
ISO 13485:2016 (Medical Devices)
21 CFR Part 211 (cGMP for Pharmaceuticals)
21 CFR Part 820 (QSR for Medical Devices)
EU MDR 2017/745 & EU IVDR 2017/746
ICH Q9: Quality Risk Management
SOX & ISO 27001 (for IT/Software deviations)

🚫 Compliance Violation

Falsification, omission, or unauthorized modification of deviation records constitutes a critical compliance breach and may result in disciplinary action up to termination, plus regulatory reporting obligations.

Support & Escalation

For technical assistance, template access, or escalation pathways:

Channel	Use Case	Response Time
QMS Portal Support	Account access, form errors, workflow routing	< 4 hours
Quality Assurance Helpdesk	Classification disputes, CAPA guidance	< 8 hours
Regulatory Compliance Office	Audit prep, regulatory submissions, MDR/FDA queries	< 24 hours
Executive Escalation	Critical safety events, multi-division impact	Immediate

Need to report a deviation?

Open Deviation Ticket →