Nonconformance vs Deviation in GMP and ISO Quality Systems

Nonconformance vs Deviation is the source-dependent comparison between failure to meet a requirement and departure from approved instructions or procedures. These are working usages for this comparison, not a single universal definition governing every GMP and ISO quality system. Read each term against the source and the site’s controlled terminology.

Start with two classification questions:

• Was an applicable requirement unmet?
• Was there a departure from the approved instruction?

The answers are not mutually exclusive. A procedural requirement can itself be unmet, so one event can fit both descriptions. Product specification failure is only one possible type of nonconformity; the comparison also accommodates procedural requirements. Classify the observed facts against the relevant requirement rather than forcing the event into one label.

Keep four interpretive layers separate: binding provisions within their applicable jurisdiction and product scope; official guidance; proposed operating conventions; and generic software support. A suggested classification method is not a regulatory requirement, and a software record label does not establish which rule applies. The discussions of 21 CFR 211 and QMSR versus ISO 13485 provide context for those different frameworks.

For food, supplements and chemicals, use this comparison as an operational framework, but check the applicable product and jurisdiction rules before adopting a pharmaceutical or device regulatory citation.

Start with the applicable reference, not the event-form title. The source map below separates US regulations from guidance and identifies the scope question to check before using a reference to classify an event.

For drug-product production and process-control procedures, 21 CFR 211.100(a) requires written procedures, including changes, to be drafted, reviewed and approved by the appropriate organizational units, and reviewed and approved by the quality control unit. This gives the comparison a concrete procedural reference: identify the instruction and version involved rather than relying only on the label “deviation.”

The US drug rule names the term directly. 21 CFR 211.100(b) says written production and process control procedures "shall be followed in the execution of the various production and process control functions and shall be documented at the time of performance. Any deviation from the written procedures shall be recorded and justified." Here a deviation is defined by reference to a written procedure. Laboratory controls use the word more widely: under §211.160(a), "Any deviation from the written specifications, standards, sampling plans, test procedures, or other laboratory control mechanisms shall be recorded and justified." Use the deviation glossary for the broader event topic and the Part 211 overview for regulatory context.

ICH Q7, the GMP guide for active pharmaceutical ingredients, is broader still. Its glossary defines a deviation as "Departure from an approved instruction or established standard." Under that usage, failing an established standard can itself be called a deviation even where no written instruction was departed from—which is exactly the territory that device and ISO-based systems tend to call a nonconformity. The practical consequence is that the same event can be a deviation in an API site's vocabulary and an NCR in a device site's vocabulary, and neither label is wrong within its own source.

A narrow example shows why wording must stay attached to its source. 21 CFR 211.86 requires approved components, drug product containers and closures to be rotated so the oldest approved stock is used first. It permits deviation from that requirement when temporary and appropriate.

As a scope-control convention, keep that permission confined to the stock-rotation provision; do not treat it as general permission for a planned departure elsewhere. Likewise, use each guidance document within its applicable context rather than treating its terminology as a replacement for the governing regulation.

In an ISO 9001 or ISO 13485 context, start by identifying the applicable standard edition and the actual requirement being assessed. Attribute formal terminology to that standard and edition. The operational convention below is recommended site practice, not an ISO quotation or a substitute for the applicable text.

A site glossary can map “nonconformance” and “nonconformity” to the same operational category, provided the mapping is explicit. Keep the condition separate from its documentation: an NCR is the report or record used to manage a finding, not another physical failure. See nonconformance reporting for the record-focused terminology.

For example, assume an approved procedure requires assembly to the current drawing revision, but an operator used a superseded revision. Record the procedure step, applicable drawing revision and observed revision—not merely “nonconformance.” Those references explain the procedural finding; they do not, by themselves, establish that the assembled item fails its dimensional requirements. This is an illustrative requirement reference, not an ISO-mandated record template.

The guidance in ICH Q10, Section 5 makes a related boundary explicit: for ICH Q10, requirement language appearing in its ISO-derived definitions does not necessarily indicate a regulatory requirement. Avoid treating that vocabulary alone as a legal obligation.

For US device manufacturers, the event label is not a substitute for identifying the controlling requirement. Under 21 CFR 820.1(b), the device QMSR supplements regulations in other parts of the chapter except where explicitly stated otherwise. Read the FDA QMSR as part of the applicable regulatory framework, not as a standalone vocabulary for classifying every quality event.

A concrete use of “nonconforming product” appears in the device-specific definition of rework in 21 CFR 820.3(b): the action brings that product into fulfillment of the specified medical device file (MDF) requirements before distribution. This definition connects the product condition to specified requirements and the intended result of the action. Do not extend it to pharmaceutical reprocessing or assume that every industry uses “rework” identically.

Device labeling and packaging provide another concrete reference point. In addition to its reference to ISO 13485 Clause 7.5.1, 21 CFR 820.45 requires documented, maintained procedures detailing activities to ensure labeling and packaging integrity, inspection, storage and operations. That explicit regulatory text matters when comparing QMSR and ISO 13485.

As a practical assessment method, connect a device finding to the applicable procedure, product specification and current regulatory reference. For a labeling discrepancy, record what the procedure directed, what the specification called for and what was observed. Then apply the site's event classification. Calling the record a deviation or an NCR should not replace that requirement-by-requirement assessment.

Use a recommended site convention, not a purported regulatory taxonomy: separate the requirement involved from the evidence of failure. Document the field meanings in the site procedure so different teams classify equivalent observations consistently.

• requirement_type: identify the requirement category, such as an approved instruction or product specification, and link its exact reference.
• procedure_departure: record confirmed, not established or pending against the applicable instruction.
• product_specification_failure: independently record confirmed, not established or pending against the applicable specification.
• classification_state: record whether the proposed event classification is confirmed, not established or pending; retain the basis for that assessment.

Define pending as awaiting assessment or evidence, and not established as a conclusion from the evidence assessed—not a substitute for missing information. This avoids forcing an early yes/no decision.

Keep existing deviation and NCR form names where useful, but map both to the same underlying event identifier and requirement references. Assign classification ownership to a named process role, such as the Quality Event Coordinator, rather than letting the form title determine ownership. Record local labels separately from the shared fields.

Route prospective changes through a separate authorization decision path from observations of what already happened. For an executed activity, compare the applicable instruction revision, its effective status at execution and the execution evidence. The words “planned deviation” alone do not establish whether the activity followed an applicable authorized instruction.

Use the two evidence columns independently. These rows are illustrative operating conventions, not definitions substituted for a regulation or standard. “Not established” marks an evidence gap; it does not mean that no departure or failure occurred.

An acceptable result for one measured attribute does not establish fulfillment of every procedural or product requirement. Even a passing critical quality attribute result supports only the attribute and requirement actually assessed.

For each classification, retain the requirement reference and supporting observation using attributable recording. Update the assessment when evidence changes rather than forcing the conclusion to match the first form opened.

Use the following recommended workflow to move from an observation to a justified material decision. It is an operational convention, not a universal mandated sequence; revisit earlier steps when new evidence changes the assessment.

1. Capture the observation: record what happened, when and where, the applicable instruction or requirement, and the original record references.
2. Apply immediate control: identify potentially affected material and document restrictions, using an electronic hold tag or another controlled method where appropriate.
3. Classify provisionally: select the initial event category without treating that label as a cause or a final product-impact conclusion.
4. Collect evidence: preserve relevant records, measurements and accounts. Separate observed facts from hypotheses; label untested explanations explicitly.
5. Assess affected scope: use material genealogy and equipment-use history to examine connections beyond the initially identified lots.
6. Evaluate causes: test hypotheses against evidence and record supported conclusions, unresolved questions and limitations.
7. Document the material decision: identify the material covered, the supporting assessment, any conditions and the authorized approver.

Record why related lots, equipment uses, source materials and time periods are included or excluded. Treat the initial affected-lot list as a starting point, not the final investigation boundary.

For US drug products, 21 CFR 211.192 is the controlling text, whichever label the site uses. All production and control records "shall be reviewed and approved by the quality control unit to determine compliance with all established, approved written procedures before a batch is released or distributed." Any unexplained discrepancy, or "the failure of a batch or any of its components to meet any of its specifications shall be thoroughly investigated, whether or not the batch has already been distributed." The investigation "shall extend to other batches of the same drug product and other drug products that may have been associated with the specific failure or discrepancy", and a written record must include the conclusions and followup. Under §211.198(a), complaint procedures must include a determination of whether a §211.192 investigation is needed.

Keep containment status, material disposition and event closure as separate decisions. Record each decision’s basis and owner rather than allowing one status field to stand for all three. Authorized people approve applicable material-use or release decisions; changing an event status is not itself a release decision.

In this article’s operating convention, a correction addresses the observed condition; cause-focused action addresses why it happened and how to prevent recurrence. Neither replaces the material-disposition decision covered above. Keep the immediate response, causal follow-up and disposition separately identifiable, even when recorded in the same workflow. See corrective and preventive action for the complete CAPA topic.

Use documented escalation criteria that consider significance, recurrence, systemic reach and uncertainty. A repeated low-impact error may warrant broader action because it affects several operations; an isolated event with uncertain consequences may warrant escalation before its cause is settled. Whether to open a separate CAPA record is a site-process decision subject to applicable requirements—not an automatic consequence of calling something a deviation or nonconformance. Record the routing rationale.

Link each event to its causal conclusion, selected action, implementation evidence and effectiveness assessment. One shared action can address several events with a common cause, but preserve each event’s individual impact assessment. Completing an action is evidence of implementation, not by itself evidence that the action worked.

For example, after changing an instruction and its point-of-use control, ask: do subsequent sampled executions follow the intended sequence? For the effectiveness check, define the population as executions using the revised instruction and control across affected lines and shifts. Justify sampling coverage and the observation period using execution frequency, variability and recurrence risk. Record the assessment rationale rather than adopting a universal batch count or completion deadline.

Use five entities as a proposed traceability data model, not a mandated database schema. Keep the event separate from the requirements assessed and the decisions made.

• Requirement: identify each applicable instruction, specification or other requirement and preserve the revision assessed.
• Event: connect the observation to multiple requirement references and affected lots where needed.
• Evidence: link each item to its source record; retain the observation timestamp, original value and unit, source identifier and attachment reference.
• Decision: record the assessment, supporting evidence, affected lots and person responsible.
• Action: link follow-up work to the decisions and events it addresses.

Relationship diagram: Requirement ↔ Event ↔ Evidence → Source record; Event → Decision → Action; Event ↔ Lot; Event ↔ Action. Bidirectional links allow multiple records on either side.

Distinguish an observed value from a derived calculation. For a calculation, retain its inputs, formula and output unit so reviewers can reproduce the result without treating it as a direct measurement.

Several lots can share an investigation yet receive different dispositions; associate each disposition decision with its lot. Several events can also share one corrective action, linked through CAPA.

When evidence changes classification, preserve the earlier assessment and its basis alongside the later decision. Do not overwrite the original rationale.

Case 1: Short mixing time, reported tests within limits

Assumptions: A drug-product mixing instruction specifies 30 minutes, with no permitted timing tolerance. Recorded execution is 28 minutes. Reported product tests are within their stated limits. These are scenario assumptions, not regulatory limits.

Observed evidence and arithmetic: The recorded shortfall is 30 − 28 = 2 minutes. The instruction and execution record establish the timing difference; the test reports establish only the reported results against their respective limits.

Classification: Under the convention above, this is a deviation from the instruction and an unmet procedural requirement. It does not demonstrate a product-specification failure.

Unresolved decision and needed evidence: Broader product impact remains open. Review the batch execution history, timing accuracy, mixing-process knowledge and coverage of the reported tests. Passing results alone do not explain the shortened mixing or establish its effect on untested attributes.

Case 2: Oversized device component, cause not established

Assumptions: A device component drawing specifies a nominal diameter of 10.00 mm with a tolerance of ±0.10 mm. Treat the endpoints as inclusive and the observed measurement as valid for this example.

Observed evidence and arithmetic: The acceptable range is 9.90–10.10 mm. The observed diameter is 10.16 mm, exceeding the upper limit by 10.16 − 10.10 = 0.06 mm.

Classification: The demonstrated finding is dimensional nonconformance to the drawing. No procedure departure has been established; the measurement does not identify an operator, equipment or instruction-related cause.

Unresolved decision and needed evidence: Use the device disposition terminology discussed above. Before deciding the component’s disposition or the extent of affected material, examine measurement records, drawing revision, component identity and relevant production history. Neither a cause nor an acceptable disposition follows from the diameter alone.

Case 3: API recovery exceeds process and impurity limits

Assumptions: An approved API recovery instruction sets a maximum temperature of 45 °C. The recovered material’s intended-use impurity limit is 0.20% w/w. Both limits are hypothetical.

Observed evidence and arithmetic: Execution reaches 47 °C and the impurity result is 0.24% w/w. The exceedances are 47 − 45 = 2 °C and 0.24 − 0.20 = 0.04 percentage points.

Classification: Both axes have evidence: an instruction departure and a material-specification failure. ICH Q7, Section 14.40 describes recovery as acceptable when approved procedures exist and recovered materials meet specifications suitable for their intended use. This is API guidance, not a universal recovery permission.

Unresolved decision and needed evidence: The temperature excursion does not itself prove the impurity’s cause. Assess temperature history, sampling and analytical evidence through out-of-specification handling. The stated impurity result fails the intended-use limit; no successful rework or release conclusion is established.

As an implementation practice, optional connections can link manufacturing execution, laboratory results, inventory status and quality-event records. Before designing MES–QMS integration, identify which system owns each source value, material status and approval record. Define where updates originate and how receiving systems acknowledge them; synchronization should not create competing authorities.

Treat these as distinct failure modes, with different recovery checks:

• Duplicate event creation: use stable event identifiers and duplicate detection when messages are retried.
• Delayed result transfer: reconcile expected results against received records; distinguish pending delivery from an absent test result.
• Incorrect lot mapping: check stable lot and sample identifiers before linking evidence; route mismatches to a visible exception queue.
• Stale material status: reconcile the receiving system against the designated status owner, particularly across MES–WMS connections.

During recovery, preserve both the original observation time and the later entry or transfer time. Retain contradictory source values and record the reconciliation decision rather than silently replacing one value with another. A failed transfer should remain visible as a data-transfer exception, not appear to be a completed investigation.

Software design options here are record linkage, routing and visibility. Technical recovery does not substitute for the authorised human decisions described above.

Use a cross-functional review with quality, operations and system owners. Sample several contrasting records—not only a straightforward specification failure. Include an overlapping event, an unresolved classification and an integration exception. Treat the following as practical review tests, not additional regulatory requirements.

• Can reviewers identify the applicable requirement and revision?
• Are procedural-departure and product-failure assessments distinguishable?
• Are pending conclusions visible?
• Can each event be traced to affected lots and supporting evidence?
• Are decision authority and rationale recorded?
• Can action effectiveness be evaluated through a defined effectiveness check?
• Are integration transfer exceptions reconciled?

Finally, can another qualified reviewer reconstruct the requirement, observation, reasoning and authorized decision from the record? Judge usability of the evidence, not terminology purity.