CAPA vs Deviation vs Change Control: Understanding the Difference in GxP

A deviation is something that went wrong, CAPA is about fixing why it went wrong, and change control is about making a planned change safely. Together, CAPA, deviation, and change control form three distinct but connected quality management processes used to identify, investigate, correct, and prevent issues while maintaining control over regulated processes and systems.

In pharmaceutical, biotechnology, medical device, CRO, and other GxP-regulated environments, these terms are often used together because they are closely connected. However, they do not serve the same purpose. A deviation documents a departure from an approved requirement. A CAPA addresses the underlying cause of a recurring or significant problem. Change control manages planned changes to validated processes.

A deviation is an unplanned departure from an approved procedure, specification, process, instruction, or established requirement.

For example, suppose a manufacturing procedure requires a temperature to remain within a specified range, but the temperature temporarily goes outside that range. The event is a deviation because the actual process did not follow the approved requirement. Deviations can occur across manufacturing, laboratory testing, equipment operation, documentation, environmental conditions, computerized systems, or procedural requirements.

The purpose of deviation management is not simply to record that something went wrong. A well-managed deviation process documents what happened, when and where it happened, the potential impact, immediate actions taken, and the investigation performed to determine why it happened.

CAPA stands for Corrective and Preventive Action. It is a structured quality process used to address the root cause of an identified problem and reduce the likelihood of recurrence or occurrence.

A corrective action focuses on addressing the cause of an existing problem. Preventive action focuses on preventing a potential or systemic problem from occurring. In modern quality systems, CAPA is generally approached as a risk-based process rather than simply a formal response to every individual incident.

A CAPA typically involves investigation, root cause analysis, action planning, assignment of responsibilities, implementation, and effectiveness checks. The effectiveness check is particularly important because completing an action does not automatically demonstrate that the problem has been resolved.

Change control is the formal process used to evaluate, approve, implement, and document a planned change to a controlled process, system, document, product, equipment, facility, or other regulated element.

Unlike a deviation, change control normally begins with an intentional decision to modify something. For example, a company may decide to replace laboratory equipment, revise an SOP, modify a validated computerized system, change a manufacturing process, or introduce a new software workflow.