Quality & Compliance / Pharmaceutical Manufacturing

Deviations, OOS Investigations & CAPA: Closing the Loop When Something Goes Wrong

Every topic in this series eventually produces a deviation, an out-of-specification result, or a failed acceptance criterion. What happens next is governed by the single most frequently cited regulation in FDA drug warning letters.

⏱ 11 min read 📋 21 CFR 211.192 / FDA OOS Guidance 🔍 Investigations & CAPA

In this guide

1. Why this is where the series converges
2. The regulatory foundations
3. The investigation & CAPA lifecycle
4. Root cause analysis tools
5. Investigation path indicator
6. Investigation program self-check
7. Where investigations fail inspection
8. Specimen quality forms
9. References

01Why this is where the series converges

A deviation in cleaning validation, an OOS result in analytical testing, a failed media fill unit, a capability signal in an annual review — every topic covered so far in this series eventually produces something that has to be investigated. This post covers what happens in that moment.

The stakes are well documented: 21 CFR 211.192 — the regulation requiring thorough investigation of any unexplained discrepancy or batch failure — was the second most commonly cited CGMP regulation in FDA drug warning letters from FY2017 to FY2021, appearing 523 times.¹ It isn't an obscure corner of the regulations; it's one of the places inspectors look hardest, precisely because a weak investigation can mask a real, recurring quality problem.

The regulation itself is direct: any unexplained discrepancy or the failure of a batch or its components to meet specifications must be thoroughly investigated, whether or not the batch has already been distributed, and the investigation must extend to other batches and products that may share the same cause.^3,4

CAPA

Recommended reading

CAPA in the Pharmaceutical and Biotech Industries — José Rodriguez-Perez

A nine-step closed-loop CAPA process built specifically around 21 CFR 211's investigation requirements, with a direct focus on why treating symptoms (retraining, procedure tweaks) without root cause analysis lets problems recur.

Find it on Amazon →

02The regulatory foundations

Framework	Issuing body	Core contribution
21 CFR 211.192 — Production Record Review	U.S. FDA	Legal requirement to thoroughly investigate any unexplained discrepancy or batch failure1,3,4
Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production	U.S. FDA (CDER, October 2006; revised May 2022)	Defines the two-phase laboratory investigation framework, and clarifies outlier/averaging practices in the 2022 revision2,5,6
United States v. Barr Laboratories, Inc. (1993)	U.S. District Court, D.N.J.	Federal case that established the analytical framework FDA later formalized, rejecting "testing into compliance"6
ICH Q10 — Pharmaceutical Quality System	International Council for Harmonisation	Frames CAPA as a core quality system process, with rigor scaled to risk per ICH Q9

FDA's 2006 OOS guidance was itself shaped by the 1993 Barr Laboratories decision, which distinguished retesting from resampling and rejected the practice of testing repeatedly until a passing result appeared — a decision often credited with defining how the industry handles OOS results even before formal agency guidance existed.⁶ The May 2022 Level 2 revision updated terminology (quality control unit → quality unit) and clarified outlier and averaging practices without changing the core two-phase framework.⁵

03The investigation & CAPA lifecycle

An OOS result or deviation moves through a defined sequence, from initial lab review through to confirming the fix actually worked. Click each stage to expand it.

Every OOS result triggers an initial laboratory-level review before anything else happens: was there an assignable, documented error — a calculation mistake, an instrument malfunction, a sample preparation error? This phase alone, if it identifies a genuine, confirmed lab error, can justify invalidating the result.

• Analyst and supervisor responsibilities defined and followed
• Retesting, where justified, follows a predefined, documented rationale — never repeated testing until a passing result appears

When Phase I doesn't identify an assignable laboratory cause, the investigation expands beyond the lab into the manufacturing process, raw materials, and other batches or products that may share the same root cause.^2,3

• Cross-functional review — manufacturing, QA, and QC together
• Scope extends to other batches/products per the regulation's own text³

Once a root cause is identified, corrective actions (fixing the immediate problem) and preventive actions (stopping recurrence) are implemented and, echoing the effectiveness check covered in the change control post, verified to have actually worked.

• Level of rigor scaled to risk, per ICH Q9
• Effectiveness confirmed with data, not assumed from implementation alone

RCA

Recommended reading

Root Cause Analysis in Pharma — Henvora Solutions

A practical guide covering exactly the terrain of this post — deviations, nonconformities, investigations, root cause analysis and CAPA — with templates for GMP-regulated environments.

Find it on Amazon →

04Root cause analysis tools

Phase II and CAPA both depend on genuinely identifying a root cause rather than the first plausible explanation. Switch tabs to compare common root cause analysis tools.

5 Whys. Repeatedly asking "why" about each answer, typically five times, to move past the first symptom and toward an underlying systemic cause. Simple and fast, but can stop too early without a disciplined facilitator.

Fishbone (Ishikawa) diagram. Organizes potential causes into categories — people, process, equipment, materials, environment, measurement — to structure brainstorming and avoid tunnel vision on the first suspected cause.

Is / Is Not analysis. Compares where, when, and under what conditions the problem occurs versus where it doesn't, narrowing the field of plausible causes by contrast rather than brainstorming alone.

Fault Tree Analysis. Covered earlier in the quality risk management post — works backward from the failure event to map the combination of contributing factors, useful for more complex or safety-critical investigations.

05Investigation path indicator

This interactive tool illustrates how the factors present in an OOS event tend to point toward Phase I closure versus a Phase II expanded investigation — not a substitute for following your own SOP and the FDA framework directly. Check the factors that apply.

Illustrative investigation path indicator interactive

Select every factor present in this event.

A specific, documented, assignable lab error has been identified and confirmed

No assignable laboratory cause found after a thorough Phase I review

Result could reflect a genuine manufacturing or raw material issue

Other batches or products may share the same root cause

Similar deviation or OOS has occurred before (recurring pattern)

Isolated, one-time event with no indication of a systemic cause

Select factors above

Check the boxes that describe this event to see an illustrative path.

This is a simplified teaching illustration, not a validated decision tool. Every OOS result and deviation must be evaluated against your own SOP and FDA's OOS guidance directly — never rely on this tool alone to close, escalate, or scope a real investigation.

Q10

Recommended reading

Handbook of Investigation and Effective CAPA Systems

Covers FDA's OOS guidance, 21 CFR Part 211, ICH Q10 and EU GMP side by side, plus a dedicated chapter on root cause identification tools and processes — a strong reference for the section above.

Find it on Amazon →

06Investigation program self-check

Readiness checklist

Phase I laboratory investigation completed before any retesting occurs

Retesting rationale documented in advance, never testing repeatedly until a pass appears

Phase II investigation genuinely extends to other batches/products where warranted

Root cause analysis uses a structured tool, not just the first plausible explanation

CAPA effectiveness verified with data before closure, per the change control effectiveness-check principle

Investigation rigor scaled to risk, per ICH Q9, not uniform regardless of severity

Recurring deviations/OOS trended across the APQR, not treated as isolated each time

0 of 7 complete

07Where investigations fail inspection

• Testing into compliance. Retesting repeatedly until a passing result appears, without a documented, justified basis, is precisely what the 1993 Barr Laboratories decision rejected — and remains one of the most serious findings an inspector can cite.⁶
• Investigations that stop at the first plausible cause. Closing an investigation on a convenient explanation without genuine root cause analysis tends to produce the same deviation again.
• Scope that doesn't extend where the regulation requires. Failing to check whether other batches or products share the same root cause, as 21 CFR 211.192 explicitly requires, leaves related risk unaddressed.^3,4
• CAPA closed without an effectiveness check. An action implemented but never confirmed to have actually worked is a documentation exercise, not a closed loop.

Worth remembering: this post sits at the convergence point of the entire series — a weak investigation here can quietly undermine everything validated elsewhere, which is exactly why 211.192 shows up so often in warning letters even at sites with otherwise solid validation programs.

08Specimen quality forms

An OOS/deviation investigation report and a CAPA plan & effectiveness check record — the two documents that typically anchor an investigation file end to end.

Form DI-01 — OOS / Deviation Investigation Report

Specimen only — not a controlled document. Attach supporting data, retest results and root cause analysis as appendices.

Investigation number

Date initiated / initiated by

Description of discrepancy / OOS result

Phase I outcome (assignable lab error? Y/N)

Phase II required? (Y/N)

Other batches/products assessed for the same cause

Root cause identified

Investigated by / date

Reviewed by (QA) / date

Approved by / date

Form DI-02 — CAPA Plan & Effectiveness Check Record

Specimen only — completed after root cause is identified, closed only once effectiveness is confirmed.

Investigation number (ref. Form DI-01)

CAPA number

Action (corrective / preventive)	Owner	Target date	Status

Effectiveness check result — did the action prevent recurrence?

Verified by / date

Closed by (QA) / date

These specimen forms illustrate typical content only. Your quality system's document control procedure — numbering, revision history, approval routing — takes precedence over this format.

09References

1. The FDA Group. "21 CFR 211.192: An Introduction and Compliance Guide." thefdagroup.com
2. U.S. Food and Drug Administration (CDER). Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production — Guidance for Industry. October 2006. fda.gov
3. eCFR. "§ 211.192 Production Record Review." ecfr.gov
4. Cornell Law School, Legal Information Institute / govinfo.gov. "21 C.F.R. § 211.192 — Production Record Review." syfert.com
5. ProPharma Group. "FDA Revises 2006 Guidance: Investigating Out-of-Specification Test Results for Pharmaceutical Production." May 2022. propharmagroup.com
6. CASRAI. "Out-of-Specification (OOS) Investigation." casrai.org

Disclosure: This article contains Amazon affiliate links. As an Amazon Associate, this site may earn from qualifying purchases at no extra cost to you. Recommendations reflect genuine, independent picks specific to deviation investigation and CAPA practice — they are not a substitute for your organization's own quality and regulatory guidance.

This content is for general professional education and does not constitute regulatory or legal advice. The investigation path indicator is a simplified illustrative aid and must never be relied upon alone to close, escalate, or scope a real OOS or deviation investigation — follow your own SOP and FDA's OOS guidance directly for real decisions.

Page source (HTML)