Case File #04 — Deviation Risk Assessment

Inspection Trigger

Investigator reviewed Deviation Report DR-2023-0441 for Vancomycin Hydrochloride for Injection 500 mg, Lot 2023-2208, including the deviation investigation report and CAPA closure documentation.

Decision Failure

The firm could not produce documentation of the risk assessment supporting the root cause determination, evidence ruling out systemic and equipment-based causes, or the risk basis for retraining as adequate corrective action.

Regulatory Exposure

21 CFR 211.192 requires investigation of unexplained discrepancies in production. Absent documentation identifying who authorized the risk assessment and on what evidentiary basis systemic and equipment causes were eliminated, the closure determination cannot be verified during inspection.

Decision Defense Record

A deviation closure authorization documenting systematic cause elimination, corrective action risk rationale, and the named decision owner would have made this closure inspection-defensible.

The inspector pulled the deviation log. It was documented. Then they asked: "Who authorized the risk disposition, and what was the rationale for that classification?"

That question ends careers. Not because the deviation was mishandled — but because the authorization logic was never captured as a formal record.

This case file gives you that record.

Section 01

What the Investigator Asked

483 Observation

During inspection of Deviation Report DR-2023-0441 for Vancomycin Hydrochloride for Injection 500 mg, Lot 2023-2208, the investigator noted the investigation concluded with an assignable cause of operator technique variation during aseptic fill on Line 3 and was closed with a retraining CAPA. The investigator requested documentation of who authorized the risk assessment supporting that determination, what evidence was reviewed to rule out systemic and equipment-based causes, and what risk basis supported retraining as adequate corrective action for an aseptic fill deviation. No authorization record responsive to any of these questions was produced.

Inspector's Question

"Who authorized the risk assessment supporting the operator technique determination, what evidence was reviewed to eliminate systemic and equipment-based causes, and what risk basis supports retraining as adequate corrective action for an aseptic fill deviation?"

For aseptic manufacturing deviations, the investigator's concern is specifically whether systemic and equipment-based causes were formally evaluated and eliminated — because an undetected systemic cause represents an ongoing patient safety risk.

FDA investigators treat an unexamined systemic cause in aseptic operations as an ongoing contamination risk — making the authorization record not merely a documentation requirement but a patient safety obligation.

Section 02

Evidence Present vs. Authorization Missing

What Existed	What Was Missing
✓ Deviation report DR-2023-0441 opened within required timeframe	→ Authorization of the risk assessment for the assignable cause determination
✓ Assignable cause stated: operator technique variation	→ Documented evidence eliminating systemic causes across Line 3 operations
✓ CAPA issued for targeted operator retraining — completed 6 October 2023	→ Documented evidence eliminating equipment-based causes
✓ QA signature on deviation closure page	→ Risk assessment for adequacy of retraining as corrective action
✓ Lot 2023-2208 released with notation of closed deviation	→ Named individual responsible for the closure authorization

A QA signature on a deviation closure page confirms the document was reviewed for completeness. It does not authorize the closure decision. Authorization identifies the accountable decision owner, the evidence reviewed to eliminate alternative causes, and the risk rationale for the corrective action selected.

Section 03The Operational Cost — Following the 483 observation, none of 11 deviation closures over 24 months contained a standalone risk authorization record. Two lots placed on quality hold. CAPA escalation with 90-day effectiveness commitment provided to FDA.

Section 04DDR Reconstruction — The complete Decision Defense Record for this deviation closure: decision statement, regulatory context, enumerated evidence with EM data and equipment qualification status, risk evaluation, named decision owner, and timestamped authorization.

Section 05Authorization Model — The six required elements for aseptic deviation closure authorization, including the precise standard for systematic cause elimination and the risk rationale structure that satisfies FDA's contamination control expectations.

Section 06Preventive Control — Mandatory risk authorization checklist embedded in the deviation management system, with electronic enforcement of authorization gates before closure status is available and QA management sign-off required for all aseptic fill closures.

⚠️

No authorization record exists for this deviation closure.

Authorization gap confirmed · Inspection exposure active

The complete DDR reconstruction, authorization model, and preventive controls are in the full case file.

Get the authorization framework sent to your inbox

Produce the authorization record → $149

🔒 Secure checkout · Stripe · Instant delivery

Deviation Risk Assessment — The inspector is going to ask who assessed this deviation. I don't have a clean answer.

What the Investigator Asked

Evidence Present vs. Authorization Missing

The decision was made. The exposure appears only when inspection forces reconstruction.