SOPs, deviations, CAPA

Why it matters

In a regulated lab, work is done the same way every time because it follows a written, approved procedure. When something does not go to plan, the lab does not quietly fix it and move on. It records what happened, works out why, judges the impact on results and products, and changes something so it does not happen again. This loop (SOP, deviation, investigation, CAPA) is the heart of quality systems under GMP, GLP, ISO/IEC 17025 and clinical accreditation. Technicians are usually the ones who spot and first document a deviation, so you need to know how to write one well.

Standard operating procedures (SOPs)

An SOP is a controlled document describing exactly how to do a task. A typical SOP has:

1. Title, document number and version, for example SOP-QC-017 v4.
2. Purpose and scope: what it covers and what it does not.
3. Responsibilities: who does what (analyst, reviewer, supervisor).
4. Definitions and safety notes.
5. Materials and equipment.
6. Procedure: numbered, unambiguous steps, with acceptance criteria.
7. Records: which forms or LIMS entries to complete.
8. References and revision history.

Document control keeps SOPs trustworthy: only the current approved version is in use, old versions are withdrawn, changes go through review and approval, and staff are trained and signed off on the new version before they use it. Using a printed copy of an old version is itself a deviation.

Deviations

A deviation is any departure from an approved procedure, specification or expected condition.

• Planned deviation: approved in advance for a specific, justified reason (for example, using an alternative qualified instrument while the usual one is serviced).
• Unplanned deviation: something that happened: a missed step, an equipment failure, an environmental excursion, a mislabelled sample.

Labs also have specific procedures for out-of-specification (OOS) results: a test result outside the product's specification. FDA's OOS guidance describes a phased investigation: first check for an obvious laboratory error, then a full investigation if none is found. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/investigating-out-specification-oos-test-results-pharmaceutical-production-level-2-revision (Checked on 2026-10-23.)

What a good deviation report contains

• What happened, factually: what, where, when, who found it. No blame, no speculation.
• Immediate actions (containment): what was done to stop the impact, such as quarantining reagents or holding results.
• Impact assessment: which samples, batches, results or patients could be affected.
• Investigation and root cause.
• CAPA and its owner and due date.
• Approval by quality assurance.

Finding the root cause

The first explanation ("human error") is rarely the root cause. Two simple tools help:

• 5 Whys: keep asking why until you reach something the organisation can change.
• Fishbone (Ishikawa) diagram: list possible causes under headings such as Methods, Machines, Materials, People, Measurement and Environment.

Worked example, 5 Whys. A reagent fridge reached 12 °C overnight (limit 2 to 8 °C).

1. Why? The compressor stopped.
2. Why? The fridge was unplugged.
3. Why? A cleaner unplugged it to use the socket.
4. Why? The plug looks like any other and is in a shared socket.
5. Why? The lab never labelled critical-equipment sockets or used locking plugs.

Root cause: critical equipment is on unprotected, unlabelled shared sockets. And a second question: why did nobody know until morning? The fridge had no alarm connected to anyone on call.

CAPA

CAPA stands for corrective and preventive action.

• Correction: fixes the immediate problem (plug the fridge back in; quarantine and assess the reagents).
• Corrective action: removes the cause so it does not recur (locking plug, labelled dedicated socket, alarm to an on-call phone).
• Preventive action: stops a similar problem elsewhere before it happens (survey every critical fridge, freezer and incubator in the building for the same risk).
• Effectiveness check: after a set time, verify the action worked (for example, no further excursions and alarm tests passing over three months).

Each action has an owner and a due date, and QA tracks it to closure.

Common mistakes

• Writing "analyst error, retrained" as the root cause without asking why the error was possible.
• Fixing the problem but not raising a deviation.
• Leaving out the impact assessment.
• Closing a CAPA without checking it worked.
• Editing an SOP copy by hand instead of going through change control.

Quick recap

• SOPs are controlled documents; only the current, approved, trained version is used.
• A deviation records what happened, containment, impact, root cause and CAPA.
• Use 5 Whys or a fishbone to get past "human error".
• CAPA = correction, corrective action, preventive action, and an effectiveness check.

Try it

Open the Do tab to write a deviation report and a CAPA plan for a realistic scenario, on paper.