What is deviation management? Deviations, non-conformances and CAPA explained

Updated October 9th 2026
Deviation management is the structured process for identifying, documenting, investigating and correcting deviations, and preventing them from happening again. A deviation is a departure from an approved procedure, instruction, requirement or standard. The aim is to understand why it happened and to remove the cause.

In this article we explain what a deviation is, how it relates to a non-conformance, what the process looks like step by step, how CAPA (corrective and preventive action) fits in and how deviation management relates to risk management.

What is a deviation?

A deviation occurs when something does not turn out as intended according to a procedure, a requirement or an expectation. It can be anything from a broken workflow or incorrect documentation to a quality issue in production or a failure to meet a standard such as ISO 9001 or HACCP.

Deviations are usually categorized by type and severity. Common types include:

• Product deviations – a product or service does not meet the specified requirements.
• Procedural deviations – a procedure or instruction was not followed.
• Safety deviations – an event caused or could have caused harm.
• Environmental deviations – emissions, spills or breaches of environmental requirements.
• Supplier deviations – a supplier delivered the wrong item or delivered late.
• Audit findings – shortcomings identified in an internal or external audit.

Near misses, events that could have caused harm but did not, should also be reported. They often provide the most valuable information because they reveal risks before something serious happens.

Deviation, non-conformance or incident?

Different industries use different words for closely related events:

In GMP environments, a deviation often refers to how the work was done, while a non-conformance refers to the result. Many organizations use the terms interchangeably. Whatever the name, they are handled through the same kind of process: report, investigate, correct and follow up.

Examples of deviations in different industries

In healthcare: A patient receives the wrong dose of medication because the prescription list was not updated in the medical record system. The error is discovered by a nurse during the next medication round. Type: patient safety incident.

In transport: A driver loads cargo without proper load securing according to current procedures. At the end of the journey, it is discovered that the cargo has shifted. Type: safety and procedural deviation.

In the food industry: During a routine internal check, it is discovered that the temperature in a cold-storage room has been above the critical limit for several hours. Type: HACCP deviation.

How deviation management works step by step

1. Detect and report. Whoever notices the deviation reports it as soon as possible, describing what happened, where and when.
2. Immediate action. If needed, an immediate action is taken to limit the consequences, for example stopping a production line or quarantining a batch.
3. Assess severity. The deviation is classified so that serious events are prioritized and, where required, reported to the authorities.
4. Investigate the root cause. The owner finds out why the deviation occurred, not just what happened.
5. Decide on corrective actions. Actions that remove the root cause, with an owner and a deadline.
6. Verify effectiveness. After some time, check that the action has actually worked.
7. Close and give feedback. The deviation is closed and the reporter is told what happened.

What is CAPA?

CAPA stands for corrective and preventive action. It is the part of deviation management that deals with fixing causes rather than symptoms:

• A correction fixes the error itself, for example scrapping a faulty batch.
• A corrective action removes the cause so that the error does not recur, for example clarifying an instruction.
• A preventive action removes the cause of a potential problem before it occurs, for example applying the same fix to similar processes elsewhere.

ISO 9001 clause 10.2 requires the organization to handle nonconformities, evaluate the need for corrective action, review its effectiveness and retain documented information about it. In the current version of ISO 9001, preventive action is handled through risk-based thinking rather than as a separate requirement. CAPA remains a central term in ISO 13485 and in regulated life science.

Root cause analysis – finding the real cause

The most common mistake is stopping at the obvious cause, such as "the employee made a mistake". The real cause often lies in an unclear procedure, insufficient training or a system that makes it easy to get things wrong. Two common methods are:

• 5 Whys. Ask "why?" repeatedly until you reach a cause that can be acted on.
• Fishbone diagram (Ishikawa). Possible causes are sorted into categories such as people, method, machine, material, environment and measurement.

Why is deviation management important?

Every deviation shows where a process falls short, where a procedure does not work in practice or where a risk is not sufficiently controlled. Without a working process, the same mistakes are likely to recur, leading to costs, quality problems and, in the worst case, harm to people, the environment or the brand. A well-designed deviation management process helps organizations to:

Deviation management and risk management

Deviation management deals with events that have already happened. Risk management is forward-looking and is about identifying and reducing the likelihood of events before they occur.

The two are closely connected. A deviation often reveals a risk that was not adequately managed, and every deviation provides input for the next risk assessment. Read more about what risk management is.

Common mistakes

• A blame culture. If deviations are used to find someone to blame, people stop reporting. Focus on the process, not the person.
• Reporting that is too complicated. Every extra field reduces the number of reports. Make reporting easy and add detail during the investigation.
• Actions without follow-up. If an action is never followed up, you do not know whether it worked.
• No trend analysis. Individual deviations may seem small, but patterns over time show where the big risks are.

Summary

Deviation management is the process of capturing, investigating and correcting what did not go according to plan, whether it is called a deviation, a non-conformance or an incident. CAPA makes sure the cause is removed. A working process moves from report to root cause analysis, corrective action and verification of effectiveness, and it is a requirement in most ISO management system standards.

Next step: See how Centuri works as deviation management software →