Change control vs deviation vs CAPA: how the three GMP records connect

Change control, deviation management and CAPA are three parts of one quality system, and sites get into trouble at the seams between them. The records answer different questions, run in a different order and have different approval logic. Knowing which one a situation calls for, and when one record must open another, removes a large share of the findings inspectors write.

The one-line difference

• Change control: something is going to be different. It is planned, assessed and approved before it is made.
• Deviation: something was different from what the approved instruction or standard says. It has already happened and is investigated after the fact.
• CAPA: corrective and preventive action. What the site will do so that a problem does not recur, or does not occur in the first place.

The timing is the quickest test. If the work has not happened yet, you are in change control. If it has happened and was not authorised, you are in deviation. If you are deciding what to do about a cause, you are in CAPA, and the CAPA often needs a change to be carried out.

How they connect

1. A deviation is investigated and a root cause is found.
2. The investigation leads to a CAPA: revise a procedure, replace a component, change a parameter, qualify a new supplier.
3. Where the action alters a controlled state, it is implemented through a change control record that cites the CAPA, so the impact assessment, approval and verification apply.
4. The change is closed with an effectiveness check, and the CAPA is closed only when that check shows the problem has not returned.

Where it goes wrong

• Change made first, raised later. If the change has already been made, it is a deviation, and the corrective action is the retrospective assessment plus a decision on whether to keep, modify or reverse it.
• The planned deviation that repeats. The same 'planned' departure approved every month is a change that has avoided assessment. Require a risk assessment, a hard end date and a rule that a repeat triggers a change.
• CAPAs that say 'procedure revised' or 'parameter adjusted' with no change control number.
• A change raised to fix a deviation but never linked to it, so the investigation and the implementation cannot be traced to each other.
• CAPA closed when the task is complete rather than when the effect is verified.

The full process for the change side, from raising to effectiveness check, is in the complete guide to GMP change control. Deviation and CAPA are covered in detail in the sister course on deviation management.