Deviation and OOS Investigations: The Procedure That Survives a Health Canada Inspection

Every manufacturer gets unexpected results. A tablet assay comes back low. A batch yield is short. A step is done out of sequence. What separates a strong quality system from a weak one is not whether these events happen, it is what happens next. Inspectors know this, which is why they open the deviation and OOS files early and read them closely.

This guide explains how to investigate a deviation or an OOS result in a way that satisfies Health Canada, demonstrates control, and protects patients. It is written for quality assurance and quality control managers, Quality Assurance Persons, and the production leaders who own the floor where deviations begin. It is grounded in the Food and Drug Regulations and Health Canada's Good Manufacturing Practices Guide (GUI-0001).

Deviation, OOS and OOT: what they are

What is it? A deviation is any departure from an approved instruction, procedure, specification or standard. An out-of-specification (OOS) result is a test result that falls outside an approved acceptance criterion. An out-of-trend (OOT) result is within specification but inconsistent with the expected pattern. Why it matters? Each needs a documented investigation, and mixing them up leads to the wrong depth of response. What to do? Define all three in a written procedure so the floor and the laboratory classify events the same way every time.

Term	Definition	Typical trigger
Deviation	A departure from an approved instruction, procedure, specification or batch record	A step done out of sequence, a parameter outside range, equipment downtime
Out-of-specification (OOS)	A test result outside an approved acceptance criterion	Assay, impurity, dissolution or microbial result that fails the limit
Out-of-trend (OOT)	A result within specification but inconsistent with the expected pattern	A stability point drifting toward a limit, a shift in a control chart
Incident	An unplanned event that may or may not affect product quality	A spill, a power loss, a sample handling error

These definitions are not academic. GUI-0001, interpreting C.02.011, expects you to avoid any deviation from instructions or procedures, and when one occurs, to record and investigate it. A borderline conformance is treated the same way. Our guide on how to write SOPs that pass a Health Canada inspection covers how to word these definitions so there is no ambiguity on the floor.

Why the investigation is the finding inspectors cite first

What is it? The documented review that establishes what happened, why, whether product is affected, and what will prevent recurrence. Why it matters? A failing result is an event. A failing investigation is a systemic weakness, and that is what regulators cite. How it affects compliance? Weak investigations signal that your quality system cannot reliably detect and correct problems, which puts batch release decisions in doubt.

In the United States, the single most cited manufacturing regulation is 21 CFR 211.192, which requires a thorough investigation of any unexplained discrepancy or failure of a batch to meet specifications. Our breakdown of how to get 21 CFR 211.192 right shows the pattern FDA cites again and again. Canada is no different in substance. Health Canada expects the same rigour under GUI-0001, and a shallow investigation is a frequent observation in Canadian inspections.

The Canadian rules behind a defensible investigation

What is it? The specific Food and Drug Regulations provisions and GUI-0001 interpretations that your investigation procedure must satisfy. Why it matters? Citing the right rule in your SOP shows inspectors your system is built on the regulation, not on habit. What to do? Map each element of your procedure to the provision it satisfies.

Several provisions work together:

C.02.011 requires that deviations from instructions or procedures be recorded and investigated by qualified personnel, with a written report covering the deviation, the investigation, the impact and the disposition rationale, and that quality control approve the report.
C.02.014 requires the person in charge of quality control to approve each lot before sale, considering production conditions and in-process results, and to evaluate deviations and borderline conformances according to a written procedure.
C.02.009 and C.02.010 govern testing against specifications and the conditions under which re-testing is addressed, which is the heart of an OOS laboratory phase.
Section 4 of GUI-0001 sets the quality management system expectation to apply an appropriate level of root cause analysis to deviations, suspected product defects and other problems.

Health Canada does not publish a separate OOS guidance, so inspectors expect your procedure to reflect the internationally recognized model. The reference text most laboratories follow is the United States FDA guidance Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production, finalized in 2006 and updated in 2022. Building your SOP around its two-phase structure is a defensible choice that Canadian inspectors recognize.

A step-by-step OOS investigation

What is it? A two-phase procedure: a laboratory investigation to rule out analytical error, then, if none is found, a full-scale investigation into production. Why it matters? The structure stops you from either ignoring a real failure or discarding a valid result. What to do? Follow the phases in order and document each decision as you go.

Phase I: laboratory investigation

The first step is to determine whether the OOS result was caused by a laboratory error, before any retesting. The analyst and supervisor review the method, the calculation, the instrument, the standards, the sample preparation and the system suitability. Key rules:

Do not invalidate the original result without a documented, scientifically justified assignable cause.
Do not average a passing and a failing result to produce a conforming number, unless the method itself defines averaging.
Do not apply an outlier test to discard an inconvenient chemical result unless the procedure and statistics justify it.
Define retest and resample criteria in advance, including who authorizes them and how many are permitted.

Phase II: full-scale investigation

If no laboratory error is confirmed, the result stands and the investigation widens into production. This phase reviews the batch record, the process parameters, the equipment, the materials, the environment and any related batches. It asks whether the OOS reflects a real quality problem, whether other batches are affected, and what the root cause is. The output is a disposition decision and a corrective and preventive action plan.

Element	Phase I: laboratory investigation	Phase II: full-scale investigation
Trigger	An OOS result is confirmed	Phase I finds no assignable laboratory error
Question	Was the result caused by analytical error?	Does the result reflect a real quality problem?
Scope	Method, calculation, instrument, standards, sample prep	Batch record, process, equipment, materials, related batches
Owner	Analyst and laboratory supervisor	Quality assurance with production and quality control
Output	Original result invalidated only with justified cause, or confirmed	Root cause, product impact, disposition and CAPA

Root cause, CAPA and closing the investigation

What is it? The analysis that identifies why the deviation or OOS happened, and the corrective and preventive actions that stop it recurring. Why it matters? An investigation that names a symptom instead of a cause produces a CAPA that fails, and the problem returns. How it affects compliance? Repeat deviations with the same root cause are a strong signal to an inspector that your CAPA system does not work.

Use a structured root cause method, such as the five whys or a fishbone analysis, at a depth proportionate to the risk. Avoid the common trap of stopping at human error, which is rarely a true root cause. Ask why the error was possible: Was the procedure unclear? Was training inadequate? Was the system designed so the mistake was easy to make? Our guide on why CAPA keeps failing explains how shallow root cause work undermines the whole investigation. When the fix requires a process or document change, route it through GMP change control so the correction is controlled, not ad hoc.

Close the investigation only when the root cause is identified, the product impact is assessed and justified, the disposition is approved by quality control, and the CAPA is defined with owners and due dates. Track trends across investigations: a cluster pointing at one line, one supplier or one procedure is exactly the pattern your annual product quality review should surface.

Records, timelines and data integrity

What is it? The documentation and data controls that make an investigation credible. Why it matters? An investigation is only as trustworthy as the records behind it. What to do? Keep contemporaneous, attributable and complete records of every step, result and decision.

Data integrity failures and investigation failures travel together. Original laboratory data, including aborted or suspect runs, must be retained and explained, not deleted. The investigation record should show who did what and when, the rationale for each decision, and the evidence behind the conclusion. A batch released on a tested-into-compliance result, with the original failing data missing, is both an investigation failure and a data integrity failure. When an OOS traces to an analytical method problem, see our note on analytical method validation for how a validated method prevents false failures in the first place, and our guide on batch release testing and certificate of analysis reliance for the release decision that depends on it.

Deviation and OOS investigation checklist

Use this checklist to gauge whether your investigation procedure would satisfy a Health Canada inspector. It mirrors the free worksheet at the end of this article.

Written procedures define deviation, OOS, OOT and incident, with clear classification and risk-based depth.
Every event is recorded the day it is found, with a unique number and an assigned investigator.
The OOS procedure follows a Phase I laboratory investigation then a Phase II full-scale investigation.
Original results are never invalidated without a documented, scientifically justified assignable cause.
Retest and resample criteria, including who authorizes them and how many, are defined in advance.
Root cause analysis goes beyond human error to why the error was possible.
Product impact is assessed and justified, and quality control approves the disposition.
A CAPA with owners and due dates is defined, and its effectiveness is verified.
Investigations have a target closure time, with documented approval for any extension.
Trends across investigations are reviewed, and repeat root causes are escalated.
Original data, including aborted and suspect runs, is retained and explained.

Common mistakes that sink an investigation

Testing into compliance. Repeating a test until it passes, then releasing on the passing value, is the error inspectors cite most.
Blaming the laboratory without evidence. Invalidating a result as analyst error without a documented assignable cause is not a Phase I investigation.
Stopping at human error. Human error is a symptom. The root cause is why the error was possible.
Boilerplate CAPA. Retraining the operator, with no change to the procedure or system, rarely prevents recurrence.
Open-ended timelines. Investigations left open for months tell an inspector the system cannot keep up.
No trending. If the same deviation recurs and no one connects the dots, the quality system is not learning.

Frequently asked questions

What is the difference between a deviation and an OOS result?

A deviation is any departure from an approved instruction, procedure or specification, such as a step done out of sequence or a parameter outside its range. An OOS result is specifically a test result that falls outside an approved acceptance criterion. An OOS often triggers a deviation investigation, but not every deviation involves a test result.

Does Health Canada have its own OOS investigation guidance?

Health Canada does not publish a standalone OOS guidance. Its expectations come from the Food and Drug Regulations and GUI-0001, which require deviations to be investigated by qualified personnel with a written report and quality control approval. Inspectors expect your procedure to reflect the internationally recognized two-phase OOS model, which the 2006 FDA guidance describes.

Can I retest an OOS sample?

Retesting is allowed only within a defined procedure that specifies when it is justified, who authorizes it, and how many retests are permitted, all set in advance. Retesting to search for a passing result without a documented assignable cause for the original failure is testing into compliance, which is a serious finding.

How long should a deviation or OOS investigation take?

Open the investigation the day the event is found and set a target closure, commonly 30 days. If more time is genuinely needed, document the reason and obtain approval for the extension. Investigations that drift open for months are a common and avoidable inspection observation.

Why is human error not an acceptable root cause?

Human error is usually a symptom, not a cause. A defensible root cause explains why the error was possible: an unclear procedure, inadequate training, or a system designed so the mistake was easy to make. Fixing the underlying condition is what prevents recurrence, which is the point of a CAPA.

What records must I keep for an OOS investigation?

Keep contemporaneous, attributable and complete records of every step, including the original result and any aborted or suspect runs, the laboratory and full-scale investigation findings, the root cause, the product impact assessment, the quality control disposition, and the CAPA. Deleting original data is both an investigation failure and a data integrity failure.

How MFLRC can help

MF License & Regulatory Consultants helps Canadian and international manufacturers build investigation systems that hold up under inspection. Our work in this area includes:

Deviation and OOS procedure development aligned to GUI-0001 and the two-phase OOS model, with clear definitions and risk-based depth.
Investigation and CAPA training for quality control, quality assurance and production staff.
Root cause facilitation for complex or high-risk investigations.
Gap assessments and mock inspections that pressure-test your open investigations the way an inspector would, using our GMP inspection readiness self-assessment.
Form 483 and inspection response support when an investigation gap has already been cited, as covered in our guide on responding to a Form 483 or Health Canada observation.

Book a deviation and OOS system review

Conclusion

Unexpected results are a normal part of manufacturing. A weak investigation is not. The firms that pass inspections are the ones that treat every deviation and OOS as a chance to prove control: a clear classification, a disciplined two-phase OOS review, a real root cause, a CAPA that works, and records that tell the whole story. Build that procedure now, grounded in GUI-0001 and the recognized OOS model, and your next unexpected result becomes evidence that your quality system works, rather than evidence that it does not.