Change in Pharmaceutical Manufacture

Change, planned or unplanned, 
is imperative in pharma manufacturing.

1. The concept of change

Within the pharmaceutical industry, the concepts of validation, change, change control, deviation and out of specification (OOS) are often treated as distinct activities which operate with a significant degree of independence.

All these activities are related to change, whether that change is planned or unplanned. While separate terms can usefully serve to focus attention on detail in particular activities when dealing with the consequences of change, treating them as isolated activities can lead to confusion and inconsistency of approach to what are logically very similar and/or closely related processes.

The dictionary definitions of change and deviation below are instructive in challenging any supposition of complete independence:
  • Change – “an act or process through which something becomes different”
  • Deviation – “the action of departing from an established course or accepted standard”
Both definitions describe the move from one state, normally called within the pharmaceutical industry the validated state to a new state - i.e., they are both a change. The difference is that what the pharmaceutical industry normally describes as change is an intended move to a new validated state whereas deviation is an unintended change from the validated state.
My personal conceptual model for the logical relationships between validation, change, change control, deviation and out of specification (OOS) can be summarized as in Diagram 1 below.
Diagram 1 - Types of change and/or deviation

This article explores some of the detail of these relationships, using the terminology typically employed in the pharmaceutical industry.

2. Validated state

The term is normally applied to a process (a test or control is considered to be a process) and it describes the permissible ranges applicable to the inputs, operations, and controls of that process which have been shown to consistently deliver an output (product or data) meeting the customer requirement for product having the required safety, efficacy and quality. Key characteristics are:

  • It defines the baseline against which any change, either intended or unintended is judged.
  • Typically, it is explicitly part of the regulatory commitment underpinning the marketing authorization.

3. Change

The normal use of the word “change” in the pharmaceutical industry describes a planned proactive, controlled move from an existing validated state to a new or alternative validated state. Key characteristics are:
  •  It is planned and all actions are proactive
  •  It is conducted under formal change control (see 4)
  • The validation necessary to establish a new or alternative validated state is performed
  •  Any necessary regulatory authorisations for the new validated state are obtained before product is released to market
  • Any new/updated GMP documentation is implemented and appropriate staff training is provided.

This article is related to the Whitepaper:
Change Control - Quality Improvements in FDA and ISO Environments

To get the full details, please download your free copy.

4. Change control

This term is used to describe the controlled sequence of actions necessary to ensure that change does not negatively impact the safety, efficacy, quality or compliance of any products affected by the change. The control may be proactive as with planned change (see 3) or it may be reactive as a response to mitigate or eliminate the consequences of unplanned change, also known as deviation (see 5). Key features include:
  • There is a formal plan which identifies inputs, actions, outputs and control limits which would define successful achievement of the desired change
  • There is a record of successful completion and review of all the required elements of the plan together with supporting data.
  • Any necessary regulatory approvals for the changed state are obtained before any product made under the change is released to market
  • Any new/updated GMP documentation is implemented and appropriate staff training is provided.

5. Deviation

Deviation is the term is normally applied to an unplanned, and often initially undetected, change from the validated state of a process or control. Out of specification (OOS) is a subclass of deviation (see 6) which focuses specifically on test or control data outside the validated state.

The change caused by a deviation is, by definition, unplanned and the deviation may have taken some time to detect, thus potentially affecting other batches of product that the one in which the deviation was found. Management of a deviation (unplanned change from the validated state) is inevitably more complex than management of a planned change.
The key stages are summarised in the diagram below and are:
  • Immediate investigation of the potential consequences of the deviation for both for the batch in which it was found and for other batches potentially affected by previously undetected occurrences of the deviation.
  •  Management of any immediate consequences by control or mitigation of the issues, with formal change control as appropriate (the CA part of CAPA)
  •  Root cause identification which may trigger additional corrective actions and which informs the preventative actions.
Diagram 2 - Deviation Management Process

6. Out of specification (OOS)

OOS is a special subclass of deviation and describes control or test data outside the defined limits of the validated state. Key features are:
  • The logical steps on the OOS management process are essentially the same as those for any other deviation
  • Because of the potential critical impact of OOS on decisions about the safety, efficacy, quality or compliance of a product, there is specific definition of the expectations about the sequence of investigation and interpretation of that investigation in regulatory guidance

7. Root cause analysis

Effective root cause analysis pinpointing the cause of a deviation is critical to resolution of that deviation. Occasionally, a root cause cannot be identified. A far bigger potential problem is, however, incorrect focus on something associated with a deviation and assuming that association is the true root cause. An example would be:
  • There is a deviation whose occurrence is associated with an incorrect batching calculation
  • That incorrect calculation is associated with a particular operator
  •  The association of the operator with the deviation leads to a superficial identification of operator error/incompetence as the root cause.
  • Whilst this is a possibility, it is equally likely that poor and/or confusing documentation of the calculation within the batch instructions, combined with ineffective training are the true root causes.
  • Failure to identify the true root cause will compromise the effectiveness of any CAPA.

8. Corrective action and preventative action (CAPA)

CAPA is, as indicated in Diagram 2, a key component in the GMP expectation for management of a deviation.

The CA or corrective action elements of the CAPA are actions (and the records of these actions) taken to manage the immediate consequences of the detected deviation. These include:
  • Assessing and implementing the actions necessary to restore the process to a state of control, often with additional monitoring until full preventative actions can be implemented.
  • Assessing the likelihood that the deviation may have not been detected in earlier batches. For batches with deviations likely to adversely affect safety, efficacy or quality of products released to market, this typically involves notification of the relevant regulatory authorities and/or batch recalls.
  • Assessing the implications of the deviation for closely related processes/products and initiating action where appropriate (see 8 – multi-process or multi-site CAPA).
A documented root cause investigation is the prelude to successful preventative action – the PA element of CAPA. Establishing a root cause provides the logical basis to define the changes to process and/or controls necessary to prevent future deviations. Where a root cause cannot be determined with certainty, the focus may need to be on controls which would allow prompt detection of a deviation.

The preventative action is the timely, recorded implementation of the changes identified by the root cause analysis.

9. Multi-process or multi-site CAPA

Historically, a common error in dealing with deviations was that action was limited to the batch and/or where the deviation was found and little, if any attention was applied to:
  • Other manufacturing/ testing activities within a site using the same processes affecting other products/controls which could therefore reasonably be expected to be vulnerable to similar effects to those observed in the batch where the deviation was found (multi-process CAPA).
  • Where the company has multiple sites, manufacturing/ testing activities within sites using the same processes affecting other products/controls which could therefore reasonably be expected to be vulnerable to similar effects to those observed in the batch on the original site where the deviation was found.
Logic of GMP would require action to manage potential multi-process or multi-site issues. This logic is increasingly being followed by regulatory authorities who in both public statements and regulatory citations are making it clear that:
  • They regard the GMP requirement for an acceptable deviation investigation to explicitly cover the possibility of multi-process or multi-site issues.
  • The subsequent detection of similar deviations, either at the original site or at other sites managed by the same company would probably attract a more serious citation covering not only the deviation itself, but also the demonstrated management failure to take reasonable and timely action to eliminate the deviation.
©Peter Murray 25/2/2015
Change (noun), Oxford Dictionary of English (3rd ed), Oxford University Press 2010, available at (Accessed 25/4/2015)

Deviation (noun), Oxford Dictionary of English (3rd ed), Oxford University Press 2010, available at

Peter Murray ( is a consultant and former Quality Director at GSK, with 45 years’ experience of management of primary and secondary pharmaceutical manufacture. The experience is primarily in development and consistent routine implementation of effective strategies for quality assurance and GMP compliance management.
Since 1990, this experience involved a high proportion of international work as part of GSK’s corporate quality oversight group, with an emphasis on third party contract manufacturer management, as the quality director attached to a specialist external supply procurement team.

He is registered as an Eligible Qualified Person and is a member of the MC2 British Pharmacopoeia expert advisory committee.