By Grant Mordue
It’s always best to prevent the need to investigate a non-compliance, but if you experience a non-compliance, it’s necessary to quickly and effectively perform an investigation. The investigation needs to be described in an investigation report, which also needs to be clearly understandable to anyone reviewing the report, even if the reviewer was not part of the organization at the time and the review takes place years after the event.
Composing a clearly understandable report is often a challenge, especially in a second language and by a person who was close to the investigation at the time, who therefore might not include key information required by external reviewers seeking to understand the situation.
This article provides guidance on how to compose a suitable investigation report. Throughout these steps, focus on keeping it simple; less is more. A complex investigation often becomes a complex (and potentially confusing) report. Therefore, it’s important to follow a simple structure for the content of the report. If the investigation becomes extended and complex, it’s important to restructure the report accordingly to avoid lengthy and potentially confusing content.
1. Record the initial data.
- What happened?
- When did it happen?
- Where did it happen?
- Who was there when it happened?
- Who was contacted when it happened?
- What was directly impacted?
- What immediate action was completed? Who did what, when, and how?
- What was the immediate impact of the action taken?
The initial data can be reported on an unexpected event or a deviation recording template, and this information and data should be used to compose the introductory section of the report.
2. Describe the normal situation vs. the problem.
The person reading the report now knows about the problem (from reading the information described above); however, they know nothing about how this compares to the normal (compliant) situation that experienced the unexpected event. This part of the report must briefly help the reader to understand the unexpected (the problem or non-compliance) when compared to the routine (expected) compliant situation involved.
Briefly describe the routine (compliant) operation, process, equipment, etc. involved.
Directly relate and compare the unexpected event (non-compliance) to the compliant situation to help the reader understand the potential impact of the non-compliance.
Describe the immediate action taken and explain how this impacted the unexpected situation, e.g., quickly restored compliance and allowed routine operations to continue or stopped operations in a safe manner to support the start of the investigation.
The reader should now understand why the initial action taken was the most correct and appropriate, based on their understanding from reading the previous parts of the report, and the impact of the problem or non-compliance on the operational activities involved.
3. Describe the structure of the root cause investigation process applied.
Describe how the investigation was structured and completed to determine the root cause. Take care to ensure that the relevant procedure was followed throughout and that the evidence and data used and recorded demonstrate compliance with this procedure. Remember that during an inspection the content of the report will be compared to the content of the relevant procedure(s), such as, for example, deviation management and investigation, CAPA management, and, potentially, escalation of critical non-compliances to management.
Outline the structure used for the investigation. This could be a fishbone diagram, with the structural titles completed, e.g,. Product, Process, Paperwork/Procedures, People, Premises, Equipment, and/or the “5 Whys,” or another structure chosen from the relevant procedures.
4. Describe the investigation using the structure applied.
The reader should be able to follow the content of the investigation and reach the same conclusion as the author, i.e., at least the most probable root cause(s) based on the evidence and data reviewed during the investigation and presented in the report, or the actual root cause, again based purely on the evidence and data available and presented in the report.
The description must present the evidence obtained to exclude or include potential definitions of the root cause. Take care to avoid conclusions that are not supported by evidence and are instead based on assumption, jumping to conclusions, or gut feel.
This can be potentially the most complex part of the report; therefore the “less is more” principle mentioned above must be applied to include only the key facts and data rather than simply reporting everything that was done, without any focus on what’s important to help the reader to reach the same conclusion as the author (based purely on the evidence, facts, and data reported).
5. State the most probable root cause, or the actual root cause, and present the evidence and data that support this statement.
At this stage, the evidence might support the conclusion that the true root cause has been proved; however, if this is not the case, the most probable root cause should be
recorded. Take care not to stop the investigation too early, based on the first potential or perceived actual root cause identified. The investigation must continue until all potential root cause elements have been evaluated using the required evidence and data.
If the actual root cause has not been proved, the action plan should include the introduction of additional monitoring and controls to obtain additional information and data that could be used to support further investigation and determine the actual root cause if the problem happens again.
If the actual root cause has not been confirmed and proved, consider using and reporting hypotheses. The hypothesis-based investigation determines sequences and events, which, if they were to happen, would cause the problem experienced. The action plan should then include monitoring and data collection to determine or eliminate each hypothesis, leading to the identification of the most likely root cause, which should be prevented during future operational activity.
6. Describe the assessment of the impact on other operational activities based on the outcome of the root cause investigation.
This is an important part of the investigation and the report, as the impact of the non-compliance must be evaluated for the potential to affect other batches, manufacturing activities, equipment and operations, etc.
This requires an understanding of exactly when the problem first occurred. Based on the evidence and data, the date of the first occurrence might be much earlier than when the problem was first identified. The problem might also be much more widespread than simply affecting the specific operation that first experienced the problem.
In the report, clearly state when the problem first occurred and when it last occurred (based on the impact assessment and the supporting evidence required) and list all the operational activities impacted by this date range.
The actions required must also address the outcome of this impact assessment and date range.
7. Describe the CAPAs.
Describe the actions (listed below) that have been completed at the time of writing the report and any actions that still need to be completed.
Corrective Actions – the actions completed immediately, subsequently, and planned to directly correct the non-compliance specifically experienced. The actions must relate to both the direct activity that alerted personnel to the problem and triggered the investigation and the outcome of the wider impact assessment described above.
Preventive Actions – the actions completed immediately, subsequently, and planned to prevent the recurrence of similar non-compliances, e.g., across all the implicated elements associated with the root cause.
Effectiveness Checking – the actions, data collection, and review that are required to check whether the CAPAs were effective in both correcting and preventing the non-compliance. The effectiveness checking might not have been completed at the time the investigation report is issued; however, this checking must have been formally incorporated into the CAPA tracking system to ensure it is completed and that evidence is available to demonstrate that the actions were effective.
8. Avoid “Human Error.”
Avoid a root cause assignment and a categorization of “human error.” The investigation should continue beyond a connection with a human-related cause to evaluate, for example.:
- The effectiveness of the training received
- The clarity of the instructions provided, e.g., record form, procedure, system display, etc.
- The complexity of the operation, based on the design of the facility and the equipment being used
- The working conditions experienced at the time the non-compliance happened, such as overtime or night shift, absence of key personnel (supervisors and managers), the ambient temperature and humidity experienced by the personnel, the operational restrictions experienced (wearing of restrictive protective clothing, poor lighting conditions, time constraints, reduced visibility, etc.), the level of stress experienced by the personnel at the time, etc.
- Where there is a clear human-related connection with the problem, it is important that the same directly impacted personnel are involved during the open investigation of whether the above factors could have influenced or caused the event experienced.
- The CAPA must include the completion of the appropriate actions agreed upon with the personnel involved and the effectiveness checking must include feedback from the personnel to determine whether the actions completed have successfully corrected and prevented the problem.
If you follow the eight steps outlined above, you’ll be able to clearly communicate the non-compliance situation – and hopefully in going through these exercises, you’ll also learn enough to take action to make sure the non-compliance doesn’t recur.
About The Author:
Grant Mordue is the director of Pro-Active GMP Consulting Ltd., a U.K.-based consultancy founded in April 2020 to help companies to successfully implement a proactive level of quality management and cGMP compliance. Mordue has more than 30 years of management experience across the cGMP compliance of manufacturing and supply operations at local (national) and global levels, including the management of regulatory inspections. He has a BSc (Hons) degree in applied chemistry and is a Chartered Chemist and Member of the Royal Society of Chemistry in the U.K. You can connect with him on LinkedIn.