A deviation is any departure from an approved instruction, procedure, specification or established standard. That is the whole definition. Everything else that sites bolt onto it, thresholds, exclusions, categories, is local policy, and local policy is where reporting breaks down.
What the regulations actually say
EU GMP Chapter 1 (1.4 xiv) requires that 'appropriate levels of root cause analysis should be applied during the investigation of deviations, suspected product defects and other problems'. Chapter 5 (5.15) says any deviation from instructions or procedures should be avoided as far as possible and, if one occurs, it should be approved in writing by a competent person with the involvement of QA. Chapter 8 (8.16) extends the same expectation to quality defects: investigations should be conducted at a depth proportionate to the risk, and root cause analysis should be applied to identify the true cause, not just the immediate one.
Notice that none of these give you a list. The regulation defines a deviation by its relationship to the instruction, not by its size. A one-degree temperature excursion and a batch mix-up are both deviations. Classification decides how much effort they get; it does not decide whether they get reported.
Deviation, incident, event, nonconformance
Sites use several words and inspectors are used to all of them. What matters is that your procedure defines each one and that the definitions do not create a category where things go to avoid investigation.
- Deviation: departure from an approved instruction or standard. Investigated, impact-assessed, closed with QA approval.
- Incident or event: some sites use this for occurrences that may or may not be deviations pending a first assessment. Acceptable if the first assessment is documented and time-bound.
- Nonconformance: the ISO 13485 term, used across EU device manufacturers under the MDR, for product or process that does not meet requirements. Same discipline, different vocabulary.
- Planned deviation: a pre-approved, temporary departure from a procedure. Many inspectors dislike the term because it is often used to bypass change control. If you use it, it needs its own approval, its own risk assessment and a hard end date.
Worked examples: is it a deviation?
Why the definition matters for your investigation
Every investigation begins by stating what the requirement was and how the event departed from it. If your SOP has a fuzzy definition, investigators write fuzzy problem statements, and a fuzzy problem statement produces a fuzzy root cause. Module 1 of the course spends its first twenty minutes on getting the problem statement right for exactly this reason.