Deviation management software: six vendors read against the deviation record

Part 11 never says which records to keep. For a deviation the predicate rule is Part 211, and it asks for four things: a record made at the time, a justification, an investigation that “shall extend to other batches of the same drug product and other drug products” that may be associated, and “A written record of the investigation” that includes “the conclusions and followup” § 211.192. The quality control unit holds the authority to see that errors “have been fully investigated” § 211.22(a), and each year the product review takes in the investigations made under § 211.192 § 211.180(e)(2).

A failed lab result runs through the same section. FDA's OOS guidance (Revision 1, May 2022) reads § 211.192 as requiring an investigation “whenever an OOS test result is obtained”: a Phase I laboratory investigation first, then a full-scale investigation when no laboratory error is found. ICH Q10 then treats deviations as one input to the CAPA system § 3.2.2 and to the monitoring of process performance and product quality § 3.2.1.

Outside drug CGMP the words change, not the record. A GLP lab's deviations from SOPs are “authorized by the study director and … documented in the raw data” § 58.81. Device makers work under the QMSR, which incorporates ISO 13485 by reference, and often file the same events as nonconformances (our QMSR guide covers the switch). In the EU, a failure of the computerised system itself is also an incident under Annex 11 § 13.

Pick a worked example. Each stage shows what the record holds, the signature it carries where there is one, the rule behind it and the Part 11 control that applies. The process example starts where most deviations do, on the batch record; the electronic batch record comparison reads the systems that raise them.

FDA does not intend to enforce the Part 11 version of the audit trail, its 2003 guidance says, but the signature sections still apply in full, as does every predicate rule, and the same guidance names exactly the case a deviation is: audit trails are “particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.” An investigation is edited for days. Two controls carry the weight.

The audit trail on the investigation

Part 11 asks for a “secure, computer-generated, time-stamped” trail of every entry that creates, modifies or deletes the record, and “Record changes shall not obscure previously recorded information” § 11.10(e). On a deviation, the edits an inspector looks for are a grade lowered after QA review, a root cause rewritten after approval, an other-batches field cleared, a CAPA link removed and a due date moved. Annex 11 adds that the reason for each change is documented and the trail “regularly reviewed” Annex 11 § 9.

The trail is also part of what QA approves. FDA's 2018 data integrity Q&A says production and control records, “which includes audit trails, must be reviewed and approved by the quality unit” under § 211.192. The audit trail review checklist builds that review for one system, and what an audit trail must capture covers the fields.

Signatures with meaning on QA approval

A deviation usually carries more than one signature: QA's review of the grade, the approval of the investigation, the closure. Each must show the printed name, the date and time, and “the meaning (such as review, approval, responsibility, or authorship)” § 11.50(a), on screen and on every printout § 11.50(b). The meaning is what tells the reader which decision was signed. The signature is linked so it cannot be moved to another record § 11.70, needs two components such as an ID and a password § 11.200(a), and only the roles you authorise can sign § 11.10(g). Test one approval block with the signature manifestation check.

The rows run in the order a deviation meets them: the trail on the investigation first, then the QA signature, then access, copies and validation. The open-system row (§ 11.30) depends on how your system is hosted and reached, not on the deviation workflow, so it sits on the eQMS comparison.

TrackWise Digital's statuses come from the vendor's Part 11 and Annex 11 assessment. We read it on 2026-10-22; the document itself is dated March 2019, so ask for the assessment that matches the release you would buy.

Search a vendor's site for “deviation” and you may miss the module. Qualio files deviations under events, and other suites name quality events. What matters more is what sits in the same system, because the links a deviation needs (to the CAPA, the change control, the lab investigation) are easiest to keep when both ends live in one place.

Lab investigations are named beside deviations in the description of Veeva QMS. If your OOS work lives in a LIMS instead, the link between the OOS record and the deviation crosses systems, and both ends need their own trail; the LIMS comparison reads that side.

On the pages we read, the audit trail is described by Veeva QMS, TrackWise Digital, MasterControl Quality Excellence, Scilife and Qualio, and what a signature shows is described by Veeva QMS, TrackWise Digital and MasterControl Quality Excellence. The notes in the table are the vendors' own details; a cell without a note is a claim or a description with nothing more to add.

TrackWise Digital takes best overall because deviations, quality events and CAPA run in one system and its assessment describes the trail down to old and new values, with the date caveat above. Qualio suits a small lab: events sit beside CAPA and change control, and the validation pack covers what a small team cannot write itself. Veeva QMS fits a company whose deviations happen at more than one site or at a contract manufacturer, with lab investigations in the same application. These match our CAPA verdict for TrackWise Digital and Qualio; the third use case differs because a deviation, unlike a CAPA, often starts at someone else's site.

The rows that make deviation software different are not in our register: we read no vendor's pages on them, so they carry no status. Run them in every demo, copy them into your user requirement specification, and test them again in validation.

When the investigation ends in an action, the CAPA form template lays out the record that follows. Changes to equipment or procedures go through change control.

Each card shows the six rows a deviation leans on. Some quality vendors' pages could not be read on the read date, so they are not in this lineup; a missing vendor is not a verdict on it.

1. 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§§ 211.22, 211.100, 211.180, 211.192), eCFRread 2026-10-22
2. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
3. Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production (guidance, Revision 1, May 2022), FDAread 2026-10-22
4. Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
5. Data Integrity and Compliance With Drug CGMP: Questions and Answers (2018), FDAread 2026-10-22
6. Q10 Pharmaceutical Quality System (guidance, April 2009), FDAread 2026-10-22
7. 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies (§ 58.81), eCFRread 2026-10-22
8. Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (2024), Federal Registerread 2026-10-22
9. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22
10. EudraLex Volume 4, Chapter 4: Documentation (2011), European Commissionread 2026-10-22