Keep trustworthy lab records, query LIMS data, run QC with Westgard rules, build calibration curves, estimate uncertainty, and work within SOPs, CAPA and accreditation.

Lab Data & Quality

Write a factual description of what happened: what, where, when, who found it and how. Avoid blame and guesses.

List the immediate (containment) actions you would take for the fridge, the kits, the calibrators and the 24-sample run.

Write an impact assessment: which materials, results and customers or patients could be affected, and what information you need to decide (for example, the kit manufacturer's stability data).

Draw a fishbone diagram with at least one possible cause under each of Methods, Machines, Materials, People, Measurement and Environment.

Use 5 Whys on the most likely cause and write the root cause in one sentence.

Write a correction, at least one corrective action and at least one preventive action, each with an owner (a role, not a name) and a due date.

Write an effectiveness check: what you will measure, for how long, and what counts as success.

Read your report as if you were an auditor: could someone who was not there understand what happened and why your actions fix it?

## Why it matters

In a regulated lab, work is done the same way every time because it follows a written, approved procedure. When something does not go to plan, the lab does not quietly fix it and move on. It records what happened, works out why, judges the impact on results and products, and changes something so it does not happen again. This loop (SOP, deviation, investigation, CAPA) is the heart of quality systems under GMP, GLP, ISO/IEC 17025 and clinical accreditation. Technicians are usually the ones who spot and first document a deviation, so you need to know how to write one well.

## Standard operating procedures (SOPs)

An **SOP** is a controlled document describing exactly how to do a task. A typical SOP has:

1. **Title, document number and version**, for example SOP-QC-017 v4.
2. **Purpose and scope:** what it covers and what it does not.
3. **Responsibilities:** who does what (analyst, reviewer, supervisor).
4. **Definitions and safety notes.**
5. **Materials and equipment.**
6. **Procedure:** numbered, unambiguous steps, with acceptance criteria.
7. **Records:** which forms or LIMS entries to complete.
8. **References** and **revision history.**

**Document control** keeps SOPs trustworthy: only the current approved version is in use, old versions are withdrawn, changes go through review and approval, and staff are **trained and signed off** on the new version before they use it. Using a printed copy of an old version is itself a deviation.

## Deviations

A **deviation** is any departure from an approved procedure, specification or expected condition.

- **Planned deviation:** approved in advance for a specific, justified reason (for example, using an alternative qualified instrument while the usual one is serviced).
- **Unplanned deviation:** something that happened: a missed step, an equipment failure, an environmental excursion, a mislabelled sample.

Labs also have specific procedures for **out-of-specification (OOS)** results: a test result outside the product's specification. FDA's OOS guidance describes a phased investigation: first check for an obvious laboratory error, then a full investigation if none is found. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/investigating-out-specification-oos-test-results-pharmaceutical-production-level-2-revision (Checked on 2026-10-23.)

### What a good deviation report contains

- **What happened**, factually: what, where, when, who found it. No blame, no speculation.
- **Immediate actions** (containment): what was done to stop the impact, such as quarantining reagents or holding results.
- **Impact assessment:** which samples, batches, results or patients could be affected.
- **Investigation and root cause.**
- **CAPA** and its owner and due date.
- **Approval** by quality assurance.

## Finding the root cause

The first explanation ("human error") is rarely the root cause. Two simple tools help:

- **5 Whys:** keep asking why until you reach something the organisation can change.
- **Fishbone (Ishikawa) diagram:** list possible causes under headings such as Methods, Machines, Materials, People, Measurement and Environment.

**Worked example, 5 Whys.** A reagent fridge reached 12 °C overnight (limit 2 to 8 °C).

1. Why? The compressor stopped.
2. Why? The fridge was unplugged.
3. Why? A cleaner unplugged it to use the socket.
4. Why? The plug looks like any other and is in a shared socket.
5. Why? The lab never labelled critical-equipment sockets or used locking plugs.

Root cause: critical equipment is on unprotected, unlabelled shared sockets. And a second question: why did nobody know until morning? The fridge had no alarm connected to anyone on call.

## CAPA

**CAPA** stands for **corrective and preventive action**.

- **Correction:** fixes the immediate problem (plug the fridge back in; quarantine and assess the reagents).
- **Corrective action:** removes the cause so it does not recur (locking plug, labelled dedicated socket, alarm to an on-call phone).
- **Preventive action:** stops a similar problem elsewhere before it happens (survey every critical fridge, freezer and incubator in the building for the same risk).
- **Effectiveness check:** after a set time, verify the action worked (for example, no further excursions and alarm tests passing over three months).

Each action has an **owner** and a **due date**, and QA tracks it to closure.

## Common mistakes

- Writing "analyst error, retrained" as the root cause without asking why the error was possible.
- Fixing the problem but not raising a deviation.
- Leaving out the impact assessment.
- Closing a CAPA without checking it worked.
- Editing an SOP copy by hand instead of going through change control.

## Quick recap

- SOPs are controlled documents; only the current, approved, trained version is used.
- A deviation records what happened, containment, impact, root cause and CAPA.
- Use 5 Whys or a fishbone to get past "human error".
- CAPA = correction, corrective action, preventive action, and an effectiveness check.

## Try it

Open the **Do** tab to write a deviation report and a CAPA plan for a realistic scenario, on paper.


Follow controlled SOPs, write a clear deviation report and plan corrective and preventive actions.

SOPs, deviations, CAPA

Deviation Investigation in the Pharmaceutical Industry

Corrective & Preventive Action (CAPA) Explained | Closing the Loop in Total Quality Management

## Why it matters

Clients, patients and regulators cannot check every result a lab produces. Instead they rely on **audits** and **accreditation**: independent checks that the lab's system produces reliable results. A lab that loses accreditation can lose its contracts or its legal right to report patient results. As a technician you will be interviewed by auditors, asked to show records, and expected to explain what you do and why. Knowing the main frameworks helps you understand why your lab's rules exist.

## Audits and inspections

- **Internal audits:** the lab's own quality staff (or trained colleagues) check compliance with its procedures, usually on a schedule.
- **External audits:** by an accreditation body, a client (a **supplier audit**) or a certification body.
- **Regulatory inspections:** by a government agency, such as the US FDA for drug manufacturing.

Auditors review documents and records, watch work being done, and interview staff. A common technique is **tracing**: pick one reported result and follow it back to the sample receipt, the analyst's training record, the instrument's calibration, the reagent lots, the raw data and the review signatures. Gaps become **findings** (also called **nonconformities**), often graded as major or minor. The lab responds with a CAPA plan.

## The main frameworks

| Framework | Applies to | What it is |
|---|---|---|
| **ISO/IEC 17025** | Testing and calibration labs (environmental, food, materials, forensic, calibration) | International standard for competence, impartiality and consistent operation |
| **ISO 15189** | Medical laboratories | International standard for quality and competence in medical labs |
| **CLIA** | US clinical labs testing human specimens | Federal regulations (42 CFR Part 493), administered by CMS |
| **CAP accreditation** | Clinical labs (US and international) | Peer-inspection programme using detailed checklists |
| **GMP (cGMP)** | Manufacturing of drugs, biologics and devices, including QC labs | Regulations such as 21 CFR Parts 210 and 211 (drugs), enforced by FDA |
| **GLP** | Non-clinical safety studies supporting regulatory submissions | Regulations such as 21 CFR Part 58 |

### ISO/IEC 17025

ISO/IEC 17025 sets requirements for impartiality and confidentiality, staff competence, equipment and **metrological traceability**, method validation, **measurement uncertainty**, handling of samples, quality control, reporting and a management system. Accreditation is granted by national accreditation bodies (for example, A2LA and ANAB in the US), which recognise each other's results through the **ILAC** arrangement (https://www.ilac.org/). See ISO's overview: https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html (Checked on 2026-10-23.)

### CLIA and CAP

Every US lab that tests human specimens for health assessment needs a **CLIA certificate**. CLIA sets requirements for personnel, QC, proficiency testing and quality systems based on test complexity: https://www.cms.gov/medicare/quality/clinical-laboratory-improvement-amendments (Checked on 2026-10-23.) **CAP accreditation** is a voluntary programme recognised by CMS as meeting CLIA requirements. CAP inspection teams, made up of practising lab professionals, use checklists and inspect accredited labs on a regular cycle: https://www.cap.org/laboratory-improvement/accreditation (Checked on 2026-10-23.)

### GMP and GLP

GMP covers how medicines and related products are made and tested, so that every batch meets its specifications. QC labs in a GMP plant follow strict rules on data integrity, OOS investigations, equipment qualification and batch release. FDA investigators record significant observations on a **Form 483** at the end of an inspection. FDA's CGMP page: https://www.fda.gov/drugs/pharmaceutical-quality-resources/current-good-manufacturing-practice-cgmp-regulations (Checked on 2026-10-23.) GLP is different: it covers how non-clinical safety studies are planned, performed, recorded and archived (21 CFR Part 58).

## Proficiency testing

In **proficiency testing (PT)**, an external provider sends the lab unknown samples, and the lab's results are compared with other labs or the known value. CLIA requires PT for many clinical tests, and ISO/IEC 17025 accreditation expects participation in PT or interlaboratory comparisons. PT samples must be tested like patient or routine samples, by the staff who normally do the test. Sending PT samples to another lab, or sharing results before the deadline, is a serious violation.

## How to behave in an audit

- Answer the question asked, honestly and factually. "I don't know, but I can find out" or "That is in SOP-QC-017; I'll show you" is fine.
- Show records rather than describing them from memory.
- Never change, backdate or "tidy" records before or during an audit.
- If you notice a problem, say so: a self-identified issue with a CAPA is far better than one an auditor finds.

## Common mistakes

- Thinking audits are only the quality department's business.
- Preparing for audits instead of working to the standard every day.
- Treating PT samples specially.
- Confusing GMP (product manufacturing and testing) with GLP (non-clinical safety studies).

## Quick recap

- Audits are internal, external or regulatory; tracing a result end to end is a core technique.
- ISO/IEC 17025 for testing and calibration labs, ISO 15189 for medical labs.
- In the US, CLIA is the law for clinical labs; CAP accreditation is a recognised way to meet it.
- GMP governs manufacturing and QC; GLP governs non-clinical safety studies.
- Proficiency testing compares your lab with others; treat PT samples like routine work.

## Try it

This lesson is quiz-only. Open the **Do** tab to check your understanding.


Explain ISO/IEC 17025, ISO 15189, CLIA, CAP and GMP audits, and how proficiency testing works.

Audits and accreditation

Discover ISO/IEC 17025 | Standard for Testing and calibration laboratories

CAP Accreditation: 10 Steps on the Path to Laboratory Excellence

## Why it matters

Sooner or later a result looks wrong: one replicate far from the others, a patient value that does not fit their history, a batch result just outside specification. The temptation is to repeat the test, get a "better" number and report that. In regulated and clinical labs this is called **testing into compliance**, and it is one of the most serious data integrity failures there is. Labs need a disciplined way to decide when a result may be rejected, when a repeat is justified, and which result gets reported.

## Rule one: investigate before you reject

A result may be invalidated only for a **documented, assignable cause**: something you can show went wrong. Examples:

- A recorded instrument error or failed system suitability.
- A documented pipetting or dilution mistake noticed at the time.
- A sample problem: clotted, haemolysed, wrong container, short volume.
- A transcription error, proven by the raw data.

"It looks too high" is not an assignable cause. Without one, the original result stands and goes into the investigation.

## Statistical outlier tests

Statistics can tell you that a value is **unusual** compared with the others. It cannot tell you **why**. The **Grubbs test** checks whether the most extreme value in a small, normally distributed data set is an outlier:

```text
G = max |x - mean| / s
```

Compare G with a critical value for your n and confidence level. Commonly quoted two-sided 95 percent critical values:

| n | 3 | 4 | 5 | 6 | 7 | 8 | 10 |
|---|---|---|---|---|---|---|---|
| G critical | 1.155 | 1.481 | 1.715 | 1.887 | 2.020 | 2.126 | 2.290 |

**Worked example.** Six replicate results: 10.1, 10.3, 10.2, 10.0, 10.2, 11.0.

- Mean = 10.30, sample standard deviation s = 0.358.
- The most extreme value is 11.0: |11.0 - 10.30| = 0.70.
- G = 0.70 / 0.358 = 1.96, which is above 1.887.

So 11.0 is a statistical outlier at 95 percent. That is a reason to **investigate**, not by itself a reason to delete it. Limits on outlier tests:

- They assume normal data and usually test one outlier at a time.
- Small n gives them little power.
- FDA's OOS guidance says outlier tests are rarely appropriate for validated chemical assays and cannot by themselves invalidate a result in a GMP OOS investigation (they can have a role in highly variable biological assays). Follow your SOP.

## Repeat testing done right

- **Retest:** re-analyse the same sample (or preparation). **Resample:** take a new sample from the batch. Resampling needs stronger justification in GMP, because it can hide a real batch problem.
- The number of retests, and how results are combined or reported, must be **defined in the SOP before testing**, not decided after you see the numbers.
- Keep **all** results, including the original, in the record.

## Replicate acceptance

Many methods run samples in duplicate or triplicate and set an acceptance limit on agreement, for example "the range of replicates must not exceed 0.5 units" or "the CV must be 5 percent or less". If replicates fail, the SOP says what happens: usually the sample is repeated, and the failure is recorded. This is a predefined rule, so it is not testing into compliance.

## Clinical checks

Clinical labs use extra checks that trigger review or repeats:

- **Delta check:** compares a patient's result with their previous result. A large change may mean a sample mix-up.
- **Critical values:** results that suggest immediate danger are verified and phoned to a clinician.
- **Above the measuring range:** the sample is diluted and rerun, and the dilution factor applied.
- **Interferences:** haemolysis, lipaemia or icterus indices may flag results as unreliable.

## Common mistakes

- Repeating a test until the result passes and reporting only the passing one.
- Deleting a result because a Grubbs test flagged it, with no assignable cause.
- Deciding how many retests to do after seeing the first result.
- Averaging an OOS result with passing retests to "average into compliance".
- Not recording the original result.

## Quick recap

- Reject a result only for a documented, assignable cause.
- Outlier tests (Grubbs: G = max |x - mean| / s) flag unusual values; they do not explain them.
- Retest rules, replicate limits and reporting rules are set in the SOP in advance; keep every result.
- Clinical labs add delta checks, critical values and dilution of over-range samples.

## Try it

Open the **Do** tab. A SQL query groups replicate results by sample; you add the `HAVING` clause that finds samples whose replicates disagree by more than the acceptance limit and need repeat testing.


Decide when a result may be rejected, use the Grubbs test correctly, and apply predefined repeat-testing rules.

Outliers and repeat testing

Chapter 4: Grubbs Test for Outliers | CHM 214 | 031

Work within SOPs, write deviations and CAPA, understand audits and accreditation, and handle outliers and repeat testing.