Deviation Management

Deviation Management provides a centralized system for documenting, tracking, and resolving any departure from approved procedures, specifications, or standards. The module enforces SLA-based deadlines, supports AI-powered classification, and integrates directly with CAPA to drive corrective and preventive actions.

Report a new deviation

1. On the left sidebar, select Deviations.
2. Select Report deviation.
3. Fill in the deviation form: title, description, severity, linked SOP, and detection date.
4. Submit the form.

Report a deviation from a template

1. On the left sidebar, select Deviations.
2. Select Report deviation.
3. In the Form template section at the top of the form, your workspace’s default deviation template is already selected. Choose a different template, or clear the selection to report on the basic form.
4. Complete the form and submit. Fields the template shares with the basic form appear once, not twice.

Filter the deviation register

The register uses a filter panel rather than a row of separate controls, and every filter you apply appears as a chip above the table so you can always see what is being excluded.

1. On the left sidebar, select Deviations.

2. Select Filters. The panel opens with five filters:

   Filter	Values
   Status	Open, Under Review, Pending Approval, Approved, Rejected
   Severity	The severities configured for your workspace
   Overdue	Overdue only – deviations past their due date that are not yet closed
   Source	QMS or Validation – see below
   Reported	A date range, matched against the date the deviation was reported

3. Choose a value. The table updates immediately – there is no Apply step.

4. To remove one filter, select the x on its chip. To remove all of them, select Clear all.

Filters combine, and they are carried in the page address – so a link to a filtered register opens the same filtered register for a colleague.

Source: QMS vs. Validation

A deviation raised directly in this register has Source: QMS. A deviation raised from a failed test during a validation package run has Source: Validation and carries a small “Validation” badge next to its number in the table. Both go through the exact same approval workflow and electronic-signature requirements – there is no separate lifecycle for a validation-sourced deviation. A validation-sourced row that predates this unification shows its original identifier as a legacy reference, unchanged.

Note

Overdue is now one filter among four rather than a separate view. Previously, switching to the overdue list silently discarded the status and date filters you had selected, while leaving them looking selected. As a filter it combines with the others: “high-severity, under review, and overdue” is a single question you can now ask.

Paging through the register

The table shows 25 deviations per page. When your filters match more than that, use the pagination controls below the table to move between pages; the count above the table always reflects the total number of matching deviations, not just the ones on the current page. Columns are not sortable – the register always lists the newest deviations first.

Save a filtered view

If you find yourself setting the same search text and filters every time you open the register, save them as a named view instead of rebuilding them.

1. On the left sidebar, select Deviations.
2. Set the search text and filters you want to save (for example, Status: Open and Overdue only).
3. Select Views in the toolbar, then select Save current view….
4. Enter a name (for example, “My open criticals”) and select Save.

To reapply a saved view, select Views and choose it from the list – the search text and every filter it was saved with are restored together. To remove one you no longer need, select the trash icon next to it in the list.

Note

Saved views are personal: only you see the views you save, on any device you sign in from. There is currently no way to share a view with the rest of your team.

Saved views work the same way on every register – documents, change control, audits, equipment, training, CAPA, suppliers, and complaints – not only Deviations.

Read the SLA status summary

1. On the left sidebar, select Deviations.
2. Above the table, review the Deviation SLA Status panel.

It shows three counts across every deviation that is still open or under review:

Count	Meaning
Overdue	Past its due date
Due in 24h	Due within the next 24 hours
On track	Due more than 24 hours from now

Select the Overdue count to apply the Overdue only filter to the table beneath it, and select it again to clear it. Due in 24h and On track are counts only – they are not selectable.

Tip

The summary answers “how much is late” before you have to ask it. The Overdue filter answers “show me which ones.” Use the summary in daily stand-ups and management reviews to see whether there is anything to chase at all.

Note

A deviation with no due date is not counted in any of the three. Set a due date when reporting so the deviation is tracked against the SLA.

View a deviation’s details

1. On the left sidebar, select Deviations.
2. Select the deviation’s row in the table. The whole row is the link – there is no separate View button.

The detail page is organized into sections along a tab bar (which scrolls sideways when it overflows on narrow screens):

• Details – Deviation metadata including title, description, severity, status, reported-by user, linked document/SOP, and detection and reporting dates.
• Root cause – The root cause analysis panel, including AI-generated 5 Whys and Fishbone analyses.
• Corrective actions – The actions recorded against the deviation.
• Attachments – Files uploaded to the deviation (evidence photos, scanned records), each downloadable.
• Linked records – The linked CAPA (or the Create CAPA action when none is linked yet).
• Comments – A collaborative thread for discussion, investigation findings, and resolution coordination.
• History – The full audit trail with creation, status changes, approvals, and rejections displayed chronologically.

Update a deviation’s status

1. On the deviation detail page, select Update Status.
2. In the modal, select the new status: Open, Under Review, Pending Approval, Approved, or Rejected.
3. Optionally enter a resolution description.
4. Select Update.

Caution

When approving a deviation, the system may require you to verify your identity by clicking Get Verification Code and entering the 6-digit code sent to your email. This is a regulatory compliance requirement under 21 CFR Part 11.

Segregation of duties

The person who reported a deviation can never approve it, whatever their role – approval must evidence an independent review. This identity-based rule is enforced on the approve action and on bulk status updates alike.

Discard a deviation raised in error

An administrator can discard a single deviation from its own page, for example one that was reported twice.

1. Open the deviation.
2. Select the More actions menu (⋯) in the record header, then Discard. When the deviation cannot be discarded, the entry is greyed out and says why.
3. Enter a reason for discarding (required) and select Discard deviation.

Only open deviations that have not entered review, carry no active electronic signature, and that no other record cites (a CAPA raised against it, a complaint linked to it, a SCAR naming it, or a training assignment raised from it) can be discarded. Discarding is not a permanent delete: the deviation stays in the system with its history, comments, attachments and audit trail, marked Discarded with your name, the time and your reason, and a “discard” entry is written to its audit trail. It drops out of the register and out of every dashboard and analytics total; filter by the status discarded to find it again.

A discarded deviation is read-only. Its status, comments, actions, attachments, linked documents and root cause analysis can no longer be changed, and no signature can be requested or recorded against it. Any such change is refused with the message “This deviation has been discarded and is read-only.” A discarded deviation also cannot be linked to a new CAPA, complaint, SCAR, training assignment or validation test execution.

Signature requests still waiting on the deviation when it is discarded are cancelled at the same time, so they leave the recipients’ task lists; the request page shows Cancelled — the record was discarded.

The Discard entry appears only for administrators.

Bulk-update or discard several deviations at once

1. On the left sidebar, select Deviations.
2. Select the checkbox on each row you want to act on, or the header checkbox to select every row currently loaded.
3. A bulk actions panel appears above the table showing how many rows are selected.
4. Select Update Status to enter a new status for every selected deviation, or Discard Selected to take deviations raised in error out of the register. Discarding asks for a reason and is not a permanent delete: each deviation stays in the system with its history and audit trail, marked Discarded with your name, the time and your reason. Only open deviations that have not entered review, and that no other record cites (a CAPA, complaint, SCAR or training assignment), can be discarded; any other deviation is left unchanged and listed with the reason. Filter the register by the status discarded to find discarded deviations. See Bulk operations for the rules for every record type.
5. The panel reports how many records were changed and lists any per-row refusals with their reasons, then clears the selection.

Note

Bulk operations are only available to tenant Admins – the underlying /api/bulk/* endpoints are Admin-gated, so QA_Team, User, and Auditor roles never see the selection checkboxes.

Create a CAPA from a deviation

1. On the deviation detail page, select Create CAPA.
2. The system creates a new CAPA record linked to the deviation.
3. On the left sidebar, select CAPA to define corrective and preventive actions on the new record.

Note

The Create CAPA button is only visible when no CAPA is already linked and you have the capa.create permission.

Upload and download attachments

Files can be attached to a deviation when reporting it, or added afterward from the detail page’s Attachments tab.

1. On the deviation detail page, select the Attachments tab.
2. If you can upload to this record, a drop zone appears above the file list – select it to choose a file, or drag one onto it. Accepted formats are PDF, Word (.doc/.docx), plain text, and Excel (.xls/.xlsx).
3. To download an existing file, select it in the list.

Each entry shows who uploaded the file and when. There is no separate preview – selecting a file downloads it with its original filename.

Note

Viewing and downloading attachments requires the deviations.read permission, the same as the rest of the detail page. Uploading requires either being the deviation’s reporter or holding deviations.update – the same rule the Corrective actions panel uses for who can update an assigned action. You can only see and upload attachments on deviations in your own workspace, and only while the deviation is not yet closed.

Link documents to a deviation

A deviation often references controlled documents — the SOP that was departed from, a batch record, or a specification. You can attach those links after the deviation is raised, not only at the moment it is created.

1. On the deviation detail page, find the Linked Documents panel.
2. Select Link document and choose a document from your workspace.
3. The link appears in the panel and is recorded in the deviation’s audit trail.

Each linked document is a live link – selecting its title or number opens that document’s own detail page.

To remove a link, select Unlink next to the document. Unlinking is also audit-trailed — the record of the link having existed is preserved.

Note

Viewing linked documents requires the deviations.read permission; linking and unlinking require deviations.update. Auditors can see the links but cannot change them. You can only link documents belonging to your own workspace.

Export deviation data

1. On the left sidebar, select Deviations.
2. In the filter bar, select Export.
3. Choose the export format and optional status filter.

Severity levels

Level	Description
Low	Minor deviation with negligible impact on product quality or patient safety.
Medium	Moderate deviation requiring investigation but no immediate product risk.
High	Significant deviation with potential impact on product quality.
Critical	Severe deviation requiring immediate attention and escalation.

Permissions

Permission	Description
deviations.read	View deviations and the deviation list.
deviations.approve	Update deviation status, approve, or reject deviations.
deviations.update	Edit any deviation’s supporting details (attachments, linked documents, linked CAPAs, custom form fields) – not only your own.
capa.create	Create a new CAPA from a deviation.

The person who reported a deviation can always edit its supporting details themselves, as a continuation of reporting it. Editing someone else’s deviation needs deviations.update.

A corrective action’s own assignee can update and complete that action even without deviations.update – being assigned the work is what authorizes finishing it. Anyone else needs deviations.update to change an action they were not assigned.

Note

The Overdue only filter is available to anyone who can view the register – it needs only the deviations.read permission. Saving, applying, and deleting views needs only deviations.read too – a view is just a personal shortcut onto records you can already see.

Practical example: managing a pH excursion deviation

This walkthrough shows a deviation moving through its full lifecycle in a pharmaceutical manufacturing context.

Scenario: During in-process testing of Batch #2026-0312, a QC analyst detects that the buffer solution pH is 7.8, outside the validated range of 7.2-7.4.

1. Report the deviation

1. On the left sidebar, select Deviations.
2. Select Report deviation.
3. Enter the following:
   • Title: pH excursion in buffer preparation – Batch #2026-0312
   • Description: During in-process pH testing of phosphate buffer solution for Batch #2026-0312, the measured pH was 7.8, exceeding the validated range of 7.2-7.4. The batch was placed on hold immediately. Affected equipment: Buffer vessel BV-04. The excursion was detected during routine IPC at 10:15 AM.
   • Severity Level: High (the AI suggestion may also recommend High based on the out-of-spec result)
   • Related SOP/Document: SOP-BUF-003 Buffer Preparation Procedure
   • Date Detected: 2026-03-07
4. Select Report deviation.

2. Investigate and update status

1. On the deviation detail page, select Update Status.
2. Change the status to Under Review.
3. Use the Root Cause Analysis panel to run a 5 Whys analysis.
4. Add a comment: “Preliminary investigation indicates NaOH titrant was from a newly opened lot (Lot #T-4421). Requesting COA from vendor.”

3. Create a CAPA

1. After confirming the root cause, select Create CAPA on the deviation detail page.
2. Define corrective actions (for example, retest the NaOH titrant lot, retrain operators on titrant verification).
3. Define preventive actions (for example, add incoming titrant verification step to SOP-BUF-003).

4. Approve and close

1. Once the CAPA actions are completed and the effectiveness review is approved, return to the deviation detail page.
2. Select Update Status and change to Pending Approval.
3. A QA manager reviews the full record and changes the status to Approved, providing an electronic signature.

The deviation now has a complete audit trail from detection through resolution, linked to its CAPA record.