How to Run a Defensible OOS Investigation in a GMP QC Lab, From Phase I to CAPA Effectiveness

Why an OOS result cannot be retested away

A common reflex in QC laboratories is to repeat a failing test and report the passing number, or to write "analyst error" on the record and move on. Neither is acceptable without documented scientific evidence. An out-of-specification (OOS) result falls outside the specification or acceptance criteria set in a drug application, drug master file, official compendium, or by the manufacturer, including in-process laboratory tests. FDA's May 2022 guidance says such a result should not be invalidated by retesting, averaging, or blaming the analyst unless documented evidence supports that conclusion.

Every OOS is a GMP event. 21 CFR 211.192 requires thorough investigation of failures to meet specifications, with written conclusions and follow-up. Rejecting the batch does not end the obligation, because the cause may affect other batches or products.

This guide uses a GMP OOS Protocol as its backbone, built on FDA's two-phase model and the PIC/S Chapter 6 expectations for recording and trending QC results:

• Phase I: a laboratory assessment, including Lab Error Investigation, to confirm or exclude an assignable laboratory cause.
• Phase II: a full-scale investigation across production records, sampling, and related batches when no laboratory cause is found.
• CAPA: corrective and preventive action, with disposition rationale and effectiveness checks for systemic causes.

Every OOS result enters a documented path: laboratory assessment, full investigation, then corrective action.

How to run a Phase I laboratory assessment

The analyst and supervisor lead Phase I, start promptly, and document as they go. Lab error must be proven with evidence, not assumed. In a 2017 warning letter to USV Limited, FDA rejected a retrospective suggestion that analyst error might explain an OOS result, because only a scientifically sound, conclusive investigation can exclude it.

Checks that can confirm or exclude a laboratory cause

• Analytical errors: Compare execution with the approved procedure. Review system suitability, controls, interference, carryover, and recovery. Ask the analyst what was done, then check it against the record.
• Calculation errors: Review worksheets, chromatograms and electronic records for transcription, dilution factors, units, rounding, formulas and processing settings.
• Instrument status: Confirm calibration, qualification, maintenance, sequence integrity and alarms. Where calibration evidence is missing, calibration services can verify the instrument.
• Sample integrity: Check labels, storage, containers, and chain of custody, plus standards and reagents for identity, expiry, and traceability. Pharmaceutical testing services can analyze retained material within their accredited scope.
• Documentation accuracy: Review notebooks, balance records and audit trails for spills, dropped vials, incomplete transfers, or unexplained changes.

Lab error has to be proven from the raw data and records, so analyst and supervisor review them together.

Immediate containment

• Quarantine the batch until the investigation closes.
• Keep original data, preparations, standards, and solutions stable.
• Do not retest before the assessment is complete. FDA's Windlas letter criticized invalidated runs and passing retests without adequate rationale.
• Mark the original result as under investigation so nobody reports or averages a later passing number.

When Phase I ends

Phase I ends when objective evidence identifies a documented laboratory cause that justifies invalidation. If no cause is found, or the evidence is inconclusive, the original result stands, and Phase II begins.

What a full-scale OOS investigation covers

When Phase I finds no proven laboratory cause, the quality unit takes over. FDA's guidance calls for a timely, documented, full-scale investigation involving manufacturing and other relevant functions. QA owns approval and closure. QC supplies laboratory data, manufacturing supplies process knowledge, and neither signs off on its own conclusions.

The investigation runs in four streams:

• Batch record and manufacturing review: Read manufacturing and packaging records, deviations, process capability, related batches, and prior failure history. Rejected batches get the same review, with documented conclusions and follow-up.
• Sampling method and representativeness: Confirm the sample came from the right locations, by the approved procedure, in a suitable container. EU GMP Chapter 6 also expects representative reference samples.
• Environmental and equipment conditions: Check production-area conditions and equipment maintenance and cleaning records at the time of manufacture and sampling.
• Retesting and resampling: Retesting analyses another portion of the original homogeneous sample. Resampling analyses additional units or a newly collected sample under a justified procedure.

The number of retests must be fixed in an approved SOP before testing begins, and testing must not continue until a passing result is obtained. A resample cannot, by itself, prove the original result came from sampling error. Averaging an OOS result with passing results is unacceptable without an established assignable cause, and selecting only passing retests to cancel an unexplained failure is the same problem.

Under EU GMP clause 6.35, a confirmed OOS affecting released batches must be reported to the competent authorities.

Before any retest, record who approved it, the scientific rationale, the predefined number of tests, and the rule for interpreting all results together.

Finding the root cause and proving the CAPA worked

Root cause tools

A fishbone diagram sorts candidate causes under method, machine, materials, people, measurement and environment. The 5 Whys then follows one branch to a cause that can be fixed. Illustrative example: an assay result of 96.8% against a 98.0 to 102.0% specification traces to a reference standard used past its expiry. The expiry was not checked because the balance log did not prompt for it, and the log did not prompt for it because the SOP never required it. The root cause is the SOP gap, not the analyst. Confirm every branch with evidence, such as records or a repeat of the failure, before accepting it.

A fishbone maps the possible causes, then five linked Whys follow one branch to the gap that can actually be fixed.

Corrective versus preventive action

A corrective action fixes the identified failure, for example replacing the expired standard and re-evaluating affected results. A preventive action reduces recurrence risk or finds similar weaknesses elsewhere, for example adding an expiry check to the standard-preparation form for every method in the lab. ICH Q10 also expects investigation depth and actions to match risk.

Documenting the CAPA record

A defensible record names the event and root cause, the risk-based actions, owners and due dates, linked deviations or trends, and the effectiveness criteria. Write those criteria when the CAPA is opened, not at closure.

Verifying effectiveness

Compare the post-CAPA OOS rate with a pre-CAPA baseline. One industry source gives an example of cutting a 2.5% OOS rate to below 0.5% within 12 months, reviewed on trend charts. The same source suggests a 30-day recurrence-free period is often too short for high-risk causes, and that trending over several production cycles or 90 days is better. Add a follow-up audit or record review to confirm the new control is being used.

Training alone is a weak closure basis. Retraining analysts without changing the SOP, form, or system leaves the same gap open, so pair it with a control that can be checked. See also how ISO 17025 supports pharma quality control.

What inspectors look for in an OOS report and where reports fail

Inspectors reviewing an OOS file ask how the result was generated, not just what the number was. FDA warning letters to Accu Bio-Chem Laboratories and Seatex describe the same expectation: a scientifically justified investigation, wide enough to assess manufacturing causes, tied to effective CAPA.

Recurring deficiencies include:

• Testing into compliance. Seatex was cited in 2024 for testing new samples until one passed, without keeping the original OOS data.
• Unjustified invalidation. MHRA treats "analyst error" conclusions without contemporaneous evidence as indefensible. After Episciences' 2022 letter, FDA requested a three-year retrospective review of invalidated OOS results.
• Late or backdated entries. MHRA lists these, along with after-the-fact notebook reconstruction.
• Incomplete scope. Reports that never assess other batches or manufacturing causes appear in FDA's recurring deficiencies, alongside vague root cause and ineffective CAPA.
• Weak QA review. Approval without checking raw data and audit trails lets the rest through.

Inspectors look first for what a report leaves out: the raw data, the wider scope and a proven root cause.

A report should contain the original result with raw data, Phase I findings, written justification for any invalidated data, batch and environmental review, other batches assessed, root cause with proof, CAPA with owners and effectiveness criteria, and dated QA approval.

Writing OOS SOPs and training that prevent repeat failures

An OOS SOP should be specific enough that two analysts reading it reach the same decision. FDA guidance expects it to cover:

• Definitions of OOS, OOT, and invalidated results
• Reporting timelines, Phase I and Phase II
• A decision tree from first result to QCU authority
• Roles for analyst, supervisor, QC, production and QA
• Retest and resample rules, with justification and a ban on testing into compliance
• Escalation criteria for broader manufacturing investigation

Training should be role-specific, periodic and competency-based. Attendance records show who sat in a room. A competency assessment has an analyst work through a case, such as a passing retest after a failed first result, and decide what the SOP permits.

Staff report promptly when they expect a fair hearing. Blame-free reporting covers honest mistakes disclosed early, not concealed or falsified data, which remains a disciplinary and data integrity matter.

Management review under ICH Q10 should include OOS trends: prior OOS and OOT results, invalidated results, and repeated lab errors. See also our post on ISO 17025 in pharma quality control.

Making OOS records reconstructable for inspection

Inspectors reconstruct an OOS result from raw data. Audit trails should show who created, changed, or deleted a record, and chromatography trails should capture reintegration, method changes, and excluded injections. Review them with the record, not afterward, on a documented risk-based frequency. Retain the full analytical history, not only the reportable result.

Readiness checklist: - Audit trails enabled, user accounts controlled, clocks synchronized - Reprocessing and exclusions explained and approved - LIMS links sample, result and investigation - Backups protected, records retrievable - Mock OOS inspection completed

Sources

• Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production — U.S. Food and Drug Administration
• 21 CFR 211.192 Production Record Review — U.S. Government Publishing Office
• USV Limited - 510159 - 03/10/2017 | FDA — FDA
• Calibration Services — Com
• ISO 17025 Certified Accredited Testing Lab In Selangor, Malaysia — KAS (KineAnalytix Services Sdn Bhd)
• Windlas Healthcare Private Limited - 595494 - 03/10/2020 | FDA — FDA
• EudraLex - Volume 4 - EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use - Chapter 6: Quality Control — European Commission
• ICH Q10 Pharmaceutical Quality System Guideline — International Council for Harmonisation (ICH)
• Why Is CAPA So Critical in Pharmaceutical Manufacturing? | Simple But Needed — Simple But Needed
• How Iso 17025 Supports Quality Control For Pharma Companies 32 — Com
• Accu Bio-Chem Laboratories - 619450 - 02/24/2022 | FDA — FDA
• Seatex, LLC - 672951 - 04/01/2024 | FDA — FDA
• Episciences Inc. - 631902 - 08/25/2022 | FDA — FDA
• Glenmark Pharmaceuticals Limited - 582701 - 10/03/2019 | FDA — FDA
• PIC/S Data Integrity Guidance Document — PIC/S
• Data Integrity and Compliance With Drug CGMP: Questions and Answers — U.S. Food and Drug Administration
• Enhancing Compliance With A Laboratory Information Management System 39 — Com