OOS Investigation Workflow: A Step-by-Step Guide for Pharma QC

2026-05-31

How to run a compliant OOS (out-of-specification) investigation in pharma QC: Phase I lab check, Phase II investigation, retest rules, CAPA and audit trail.

When a quality control result comes back out of specification, the clock starts and the stakes are high. Handle the investigation well and you protect the patient, the batch, and your audit record. Handle it badly — undocumented retests, a "lab error" conclusion with no evidence, a timeline nobody can reconstruct — and you have a data-integrity finding waiting to happen.

This is a step-by-step OOS (out-of-specification) investigation workflow built the way regulators expect it: a disciplined two-phase process, a defensible root cause, and an audit trail that survives an FDA or MHRA inspection.

What counts as OOS — and how it differs from OOT

An OOS (out-of-specification) result is any test result that falls outside the established acceptance criteria in the registered specification or pharmacopoeia.

An OOT (out-of-trend) result is within specification but inconsistent with the historical pattern — a creeping assay value, a stability data point drifting toward the limit. OOT isn't a failure, but it's an early warning, and a good quality system trends for it rather than waiting for a hard OOS.

Treating these the same is a common mistake. OOS triggers a formal investigation; OOT triggers review and trending. Both need to be captured, but they follow different paths.

The two-phase investigation

The FDA's guidance on investigating OOS results (and the MHRA's equivalent expectations) define the backbone every pharma QC lab should follow:

Phase I — Laboratory investigation

Phase I asks one question: is this result valid, or is there an assignable laboratory cause?

Critically, you may not presume laboratory error. The analyst and supervisor review the method, the instrument, the standards, the sample prep, and the raw data before the original sample is discarded. The investigation must:

• Be initiated promptly (most firms set a 1–3 day target for Phase I).
• Document a clear hypothesis for any suspected lab cause — not "probably a dilution error" but a specific, testable assignable cause.
• Justify any retest before it happens, with a defined retest plan and who authorised it. Testing into compliance — retesting until you get a passing result — is exactly what inspectors look for.

If Phase I finds a genuine, documented assignable cause, the result can be invalidated and the investigation closed at this stage. If it does not, the result stands and you escalate.

Phase II — Full-scale investigation

Phase II widens the lens to the manufacturing process. Now the questions are about the batch itself:

• Is the original result confirmed?
• What is the impact on the batch, and on other batches made with the same materials, equipment, or conditions?
• Is there a manufacturing root cause — a process deviation, a raw material issue, an equipment problem?

Phase II is where the OOS connects to the rest of your quality system. A confirmed OOS almost always spawns a deviation and, if a systemic cause is found, a CAPA.

Decision and disposition

The investigation closes with a documented conclusion and a batch disposition:

• Invalidated result (assignable cause found) — the original result is set aside with full justification, and the reportable result is based on valid data.
• Confirmed OOS — the result is real. The batch is rejected or dispositioned per procedure, impact on related batches is assessed, and the failure feeds CAPA and trending.

Either way, the decision is made by quality, signed off at the right level, and recorded with the evidence behind it.

Why spreadsheets and paper fail OOS investigations

OOS is one of the hardest processes to run on paper or email, because the things inspectors scrutinise are exactly the things ad-hoc tools don't capture:

• Timelines. When was the OOS detected? When did Phase I start and close? A paper form doesn't timestamp itself.
• Sequence and authorisation. Was the retest authorised before it ran, or justified after the fact? A spreadsheet can be back-dated; a controlled workflow can't.
• Sign-offs. Who reviewed Phase I? Who approved the disposition? Initials in a margin aren't an audit trail.
• Linkage. A confirmed OOS should be tied to its deviation, its CAPA, and the batch record. In a spreadsheet, those live in four different files.

How to run a compliant OOS workflow in Flobri

Flobri models the OOS investigation as a controlled, stage-based workflow — the same structure used by pharma manufacturers running quality on the platform:

• Status fields and stages move each OOS from initiated → Phase I → Phase II → disposition → closed, so the state of every investigation is unambiguous and visible.
• Stage approvals mean a retest or a final disposition can't proceed without the right person signing off — and every transition is captured with who, what, and when.
• A built-in audit trail records the full timeline automatically. There's nothing to back-date, because the system stamped it.
• Linked records connect each OOS to its deviation, CAPA, batch, and instrument, so the whole story sits in one place.
• OOT trending surfaces results drifting toward the limit before they become a hard OOS.

The result is an OOS process that closes faster and stands up to inspection — because the discipline is built into the workflow instead of relying on people to remember it.

Frequently asked questions

How long should an OOS investigation take?

Most firms target Phase I within 1–3 days and the full investigation within 30 days, though the right limit is whatever your procedure commits to — and then you must meet it. A workflow that tracks elapsed time per stage makes overdue investigations visible before they become a finding.

Can you retest an OOS sample?

Only with a documented, pre-authorised retest plan tied to a specific assignable-cause hypothesis. Retesting to "get a better number" without that justification is testing into compliance and is a serious data-integrity violation.

What's the difference between OOS and OOT?

OOS is outside specification (a failure that triggers a formal investigation). OOT is within specification but outside the expected trend (an early warning that triggers review and trending).

Does every OOS need a CAPA?

Not automatically. A confirmed OOS with a systemic root cause needs CAPA; an invalidated result with a one-off assignable lab cause may not. The investigation conclusion drives the decision.

Flobri lets pharma manufacturers run OOS, deviation, change control, CAPA, calibration, and batch release as connected, audit-ready workflows — no coding, built around how your quality team already works. See how Flobri handles pharma quality workflows.