Deviation vs. CAPA: What’s the Difference?

An event and a response are different things

A deviation record tells you that something did not go as expected or as required. CAPA—corrective and preventive action—is how a quality system manages actions aimed at causes and potential problems. The two are connected, but they do different jobs.

If a required check was missed, opening a CAPA does not explain why the check was missed. And closing the deviation does not show that the weakness has been addressed. A useful record connects the event, the evidence, the impact assessment, and the action decision.

Use your organization’s approved definitions. Across life sciences, terms such as deviation, nonconformance, correction, and CAPA can be used differently. The distinctions below are a practical way to think about the work, not a universal regulatory vocabulary.

Separate the work before you select the form

Deviation

The departure or unexpected event being evaluated under the applicable quality system.

Investigation

The work to establish what happened, why, and what may have been affected.

Correction

An action addressing the immediate condition.

Corrective action

An action addressing a cause of an identified problem, with the aim of avoiding recurrence.

Preventive action

An action addressing a potential problem before it occurs.

These working descriptions help distinguish intent. Your procedures determine how actions are classified, approved, tracked, and linked. A correction can be necessary while the investigation is still open; it does not replace the investigation.

A missing verification is a starting point

Hypothetical example

During batch record review, a required second-person verification field is blank. Start by protecting the product and preserving the evidence according to your procedures. Establish whether the verification happened and was not recorded, or did not happen at all. Do not reconstruct a signature as if it were contemporaneous.

Suppose the investigation supports a workflow weakness: the check could be deferred, and the process had no reliable prompt to complete it. Documenting the gap addresses the record of the event. Changing the workflow would address a different issue—the condition that allowed the omission.

A possible action might be to place the verification at the point of use and introduce an appropriate control. That is an option to evaluate, not a ready-made CAPA recommendation. The change still needs assessment for feasibility, risk, approval, and any validation or qualification implications that apply.

Does every deviation need a separate CAPA?

Do not let either “always” or “never” make the decision for you. Whether your system calls for a separate CAPA record depends on its procedures, the applicable requirements, the risk, and the investigation findings. Required actions still need to be identified and controlled even if a separate record is not opened.

Useful questions include: Is the problem recurring? Is there a wider process or system weakness? Could other products or operations be affected? Can actions be managed effectively within the deviation process, or is broader ownership needed? These are practical review prompts, not regulatory thresholds.

Explain the decision with evidence. “Low risk” is a conclusion to support, not a substitute for assessing impact. Likewise, opening a CAPA simply because the record is overdue does not establish a meaningful action.

Completion is not the same as effectiveness

Choose actions that address the supported cause. If the problem is an unclear instruction, another training signature may leave that ambiguity intact. If a knowledge gap is demonstrated, focused training may be appropriate. Match the intervention to the evidence.

Before implementation, define what a successful outcome would look like and how you will check it. In the hypothetical example, you might assess whether the revised verification workflow is usable and whether relevant records demonstrate the check is consistently completed. Select the period, sample, and acceptance criteria based on the situation; there is no universal number in this article.

Consider unintended effects as well. A control that prevents one omission but makes the process difficult to execute may need further work. Keep the event record and action record connected so a reader can follow the reasoning.

What the primary sources say

United States, drug products within scope: 21 CFR 211.192 requires investigation of unexplained discrepancies and specification failures, extension to potentially associated batches or products, and written conclusions and follow-up. A separately named CAPA form is not specified in that section.

Pharmaceutical quality-system guidance: FDA’s ICH Q10, section 3.2.2, describes a CAPA system fed by investigations and other quality information, with investigation formality proportionate to risk. This is guidance, not a universal substitute for applicable law or approved procedures.

EU medicinal-product GMP context: EudraLex Volume 4, Part I, Chapter 1, paragraph 1.4(xiv), addresses appropriate actions following investigations and evaluation of their effectiveness. Confirm the GMP framework for your product; advanced therapy medicinal products have specific EU GMP guidance.

The practical decision questions above are educational recommendations. They do not waive an applicable investigation, action, or documentation obligation.