Why deviation investigations take so long: where the days go

Why hours of investigation work can take weeks

An investigation's work hours and its calendar days count different things. The hours cover the tasks people actively perform, while the days run from opening to closure, including time spent waiting. A task pauses whenever the investigator needs something that hasn’t arrived yet, such as a batch record, a laboratory result, or a reviewer's decision.

The 2017 BioPhorum report shows how large the difference between investigation hours and total open time can be. Its survey of 13 member companies reported about 18.1 hours of activity and 29 calendar days to complete minor deviations. The report did not provide the spread of those days between active work, waiting, and time outside working hours.

Determining total waiting time isn’t necessarily straightforward. The calendar days count includes nights and weekends, and several people can be working at once. Specific measurements of waiting show up only in the dates of individual tasks, in the gap between the moment a task could start and the moment it actually started.

What each investigation activity waits for

Each activity in an investigation depends on a different set of records, people, and results. A missing record, an unavailable specialist, or an unfinished test holds up the task that needs it. For out-of-specification laboratory results, the FDA May 2022 guidance describes production-record review, involvement of relevant departments, and appropriate additional testing.

A finding partway through can send the work backwards. A laboratory result brings additional batches into the investigation; a reviewer asks for an equipment log that hasn’t been retrieved. Either one puts a finished task back in progress.

A backlog makes each new investigation wait at the same roadblocks

When new deviations arrive faster than a team closes them, the backlog grows, and every open investigation joins the same queue. The process, engineering, and laboratory specialists are shared across all of them, so the number of cases in front of one specialist compounds how long an answer takes.

Case study: Step-level records expose a delay in agreeing on actions

OQSIE, an operations consultancy, reports a case at an unnamed injectables plant where managers initially thought investigators were simply not productive enough. The plant had a large backlog and widely varying closure times.

OQSIE used records from TrackWise, the plant's quality management system, to compare the duration of each investigation step. The consultancy grouped the records by investigator, product family, and the area that opened the deviation. The time spent agreeing on corrective and preventive actions varied more than time spent on other steps.

OQSIE introduced dashboards to track investigations, alerts for potential delays, and escalation to managers. After six months, the consultancy reported that average closure time fell from 52 to 23 days.

The records exposed a step that ran long in some investigations and not in others, which is something that opening and closure dates alone cannot show. At this plant it was the agreement on actions; at another site the same comparison can land on a different step.

Missing evidence forces teams to repeat work

A review question can reopen work the team considered finished. When a reviewer asks for a batch comparison that hasn’t previously been conducted, the investigation goes back to record retrieval, batch history reconstruction, and analysis. The report returns to review only after the proposed cause has been reassessed against the new evidence.

Assessing an event draws on records from across the operation: executed batch records, test results, material lots and certificates of analysis, equipment and room history, and relevant prior deviations. Matching batch and lot identifiers, timestamps, and document versions is what lets a reviewer see which record supports each finding. A gap in any of them is what sends the work back.

How to reduce waiting and repeated work

Choose an improvement that addresses a delay identified in the records:

• Preserve evidence before it is lost. Retain relevant records and capture event details promptly, then identify missing evidence before assessing possible causes.
• Assign every evidence request. Name the person who will supply the record or result, agree on a delivery date, and record which decision needs the information.
• Check the batch history before review. Verify links between records and gather additional evidence when a finding brings more batches, materials, or equipment into the investigation.
• Prepare the report for review. Link conclusions to source records and state which questions remain unanswered, so the reviewer can assess the reasoning and identify the work still needed.
• Set the investigation effort according to risk. ICH Q10, section 3.2.2, recommends that effort, formality, and documentation reflect the risk involved. Define the required work through approved site procedures while meeting applicable investigation requirements.

How to measure work, waiting, and repeated steps

Select a manageable sample of the site's investigations and group them by risk classification and event type. Include open cases so the sample captures investigations that are still delayed. Record when the team requested and received each necessary record, result, or decision, then record when each task started and finished:

1. Investigation milestones: opening, the first evidence package ready for assessment, the start and end of analysis and review, and closure.
2. Time by activity: work hours, calendar days, and intervals when the next task could not proceed. Record overlapping tasks separately.
3. Missing information: the request date, the reason the information was needed, who supplied it, and when it arrived.
4. Extensions: the original due date, the reason for the extension, the remaining work, and any unresolved decision about product impact.
5. Investigation quality: repeat events, the effectiveness of previous corrective actions, and later findings that exposed an incomplete investigation.

Mark dates or work hours absent from the records as missing, and begin capturing them in new investigations. Assign an action to address the recurring delay, then compare similar cases before and after the change. Check whether closure time improved without an increase in repeat events or incomplete investigations; when an event repeats, compare the findings with the previous conclusions and corrective actions.