Welcome to a new edition of Business Case — where we take a fictional but realistic scenario, run the numbers, and show you what the cost of inaction really looks like.
In a regulated manufacturing environment, deviations are unavoidable: a temperature excursion, an out-of-specification result, a step performed out of sequence, a piece of equipment that drifts. Handling them is not optional — every deviation has to be recorded, investigated, risk-assessed, and closed with a documented corrective and preventive action. That is exactly why deviation management deserves a business case. It is treated as pure compliance overhead, a cost of doing business that nobody expects to be efficient. And precisely because no one expects it to be efficient, it quietly becomes one of the slowest and most expensive processes in the plant.
The timing argument is straightforward. Regulatory expectations around data integrity and timely CAPA closure have tightened, inspectors increasingly ask to see cycle-time metrics, and the same open deviation that sits in a queue for two months is also the thing holding a finished batch back from release. Slow deviation management is not just an audit risk; it is working capital frozen on a pallet. Today's business case is about that gap — what a slow, manual deviation and CAPA process really costs, and the three levers that close it.
Meet Rheintal Pharma GmbH: a fictional but familiar mid-sized manufacturer based in Biberach, founded in 1988, producing solid-dose generics and a growing line of sterile injectables for European and export markets. Rheintal employs 1,200 people and generates 380 million euros in annual revenue, with an operating profit of around 45 million euros. Its two sites release roughly 3,200 GMP batches a year, and in the course of making them the quality system records about 2,400 deviations annually — the normal background rate for an operation of this complexity.
The quality assurance team is competent and conscientious. And yet, when someone finally pulled the numbers together, the picture was uncomfortable. A deviation takes on average 62 calendar days from being raised to being formally closed; mature quality organisations close comparable deviations in around 20. At any given moment, 34 percent of open deviations are past their target closure date, against a best-practice level below 10 percent. The fully loaded effort spent per deviation — across QA coordination, production input, and quality control — sits near 14 hours, where a well-structured process runs closer to 6. And roughly 40 percent of deviations are, on inspection, repeats: the same root cause producing the same finding on the same line, because the last corrective action never actually addressed it. The best organisations keep that recurrence below 15 percent.
None of these figures appears in a monthly report. The QA department is not failing; it is fully occupied keeping a manual process alive, one investigation email at a time. The moment that prompted the question came when a six-figure sterile batch sat in quarantine for three extra weeks waiting on a single open deviation to be closed. The head of quality asked what this series always starts with: what is this actually costing us, and what would it take to stop it?
When a small team traced how deviations really move through Rheintal, three structural problems came into focus. They are the standard failure modes of deviation management in companies that have a validated quality system but never designed the process behind it.
The first problem is that there is no single, structured intake, and no triage at the door. Deviations are raised on paper forms on the shop floor, in emails to QA, and in a legacy quality module that half the supervisors avoid. It takes days before many deviations are even formally logged, and by then the memory of what happened has faded. Worse, every deviation enters the same undifferentiated queue: a minor label misprint and a genuine sterility concern receive the same heavyweight investigation template, so trivial cases consume the same effort as critical ones and the critical ones wait behind them.
The second problem is that investigation and CAPA run on email and tribal knowledge. There is no standard path with defined steps, owners, and due dates; an investigation advances when a QA specialist finds time to chase the production supervisor, who finds time to answer. Approvals travel as forwarded documents and leave no trail beyond the mail thread. This is where the 62-day cycle time lives — not because anyone works slowly, but because the deviation spends most of its life waiting for the next person to pick it up. It is the same idle-time pattern that turns any exception into a bottleneck, which we examined more generally in our quick tips on handling exceptions without breaking flow.
The third problem is that nobody sees the process, only the individual cases. Quality knows how many deviations are open and which batches are blocked. Nobody knows which lines and root causes generate the recurring findings, which investigation steps consume the most time, or which corrective actions failed and let a deviation come back. Every case is handled as a one-off, and the documented CAPA often lives only in a report that no one reads again — the gap between the written quality system and the operational reality we described in our edition on processes that exist only on paper. So the same deviation recurs next quarter, and the audit trail has to be reconstructed by hand every time an inspector asks.
These three problems compound into a cost surface that is large for a process everyone files under compliance. Start with handling effort: across 2,400 deviations, the gap between Rheintal's 14 hours and the 6-hour benchmark is 8 excess hours each; at a fully loaded technical rate of around 65 euros an hour, and applied conservatively to only the roughly 60 percent of volume realistically addressable in a first phase, that is about 0.75 million euros a year in avoidable effort and rework. Add delayed batch release: open deviations routinely hold finished product in quarantine, and the tied-up working capital, occasional expedited shipping, and missed delivery slots conservatively cost another 0.35 million euros a year. Add the repeat deviations: cutting recurrence from 40 percent toward 15 percent would eliminate several hundred duplicate investigations annually, along with the associated scrap and reprocessing, worth a conservative 0.4 million euros. On top sits the hardest number to bound — the compliance exposure of chronically overdue CAPAs, from audit findings and remediation projects to the tail risk of a warning letter that could halt a product line entirely; even valued cautiously, call it 0.15 million euros a year. In total, the invisible cost of Rheintal's deviation process is on the order of 1.6 million euros a year — money spent, and risk carried, on a process whose entire job is to prove the company is in control.
The path forward is not a new quality system and not more QA headcount. It is three integrated levers that turn deviation management from a chain of emails into a structured, risk-proportionate process. Each lever maps onto one of the three problems above.
The first lever is a single structured intake with risk-based triage at the door. Every deviation is captured the same day in one place, on a short structured form that forces the essential facts while they are still fresh, and is immediately classified by risk. Minor, well-understood deviations move onto a fast, lightweight track with a proportionate investigation; only genuinely significant or critical events trigger the full investigation depth. This alone removes the days lost to late logging and stops trivial cases from clogging the queue ahead of critical ones. For Rheintal, this lever recovers roughly 0.3 million euros a year, at about 80,000 euros in the first year for configuration and training and around 30,000 euros a year to run.
The second lever is a standardised investigation and CAPA workflow with defined steps, named owners, due dates, and automatic escalation. A deviation follows the same governed path every time: containment, root-cause analysis proportionate to risk, defined corrective and preventive actions, and effectiveness checks — each step with an owner and a deadline, escalating automatically before it goes overdue rather than after. Investigation depth is matched to risk, so minor deviations close in days and major ones still get full rigour. Cycle time falls from 62 days toward 25, and the overdue rate falls toward the benchmark, which in turn frees blocked batches for release. This lever recovers roughly 0.7 million euros a year — the largest single share, combining recovered effort and faster batch release — at about 140,000 euros in year one and 50,000 euros annually.
The third lever is process mining on the deviation and CAPA data, feeding a monthly quality review. Once deviations flow through one workflow, the process becomes visible: which lines and root causes produce the recurring findings, where investigations stall and with whom, how cycle time and overdue rates develop site by site, and — critically — which corrective actions actually prevented recurrence and which did not. This is the domain of process intelligence tooling, the category in which noreja operates, catalogued alongside peers on directories such as topai.tools. The review turns those findings into systemic CAPAs that attack the root causes behind the recurring 40 percent, rather than papering over each instance. It recovers a further 0.4 million euros a year, at about 70,000 euros fully loaded — and it is the lever that keeps the other two honest, because you cannot reduce a recurrence rate you cannot see, and you cannot prove control to an inspector from a mail thread.
Combined, the three levers recover roughly 1.3 of the 1.6 million euros of annual cost in steady state — about four-fifths of the leak — while turning the audit trail from a reconstruction project into a by-product of the workflow. First-year implementation, including training and cleanup of the open-CAPA backlog, comes in at approximately 300,000 euros, with annual run costs around 130,000 euros thereafter. Payback is reached within the first months after rollout. And there is a strategic dividend the numbers understate: a quality system that closes deviations on time and can show it is one that inspectors trust — which is worth far more than any single number the day an audit goes well instead of badly.
Do you know, today, what one deviation costs your organisation to investigate and close — and would your number survive including the repeat investigations and the audit reconstruction?
What share of your open deviations are minor cases receiving a heavyweight investigation they never needed — and what are the critical ones waiting behind them?
How many of last year's deviations were repeats of a root cause a previous CAPA was supposed to have fixed?
How many finished batches sat in quarantine last quarter waiting on an open deviation, and what was the working capital tied up while they waited?
If an inspector asked for your average deviation closure time and your CAPA effectiveness rate tomorrow, could you produce them from data — or would someone have to reconstruct them from emails?
Deviation management is expensive precisely because it is filed under compliance: nobody expects it to be efficient, no report isolates its cost, and the people running it are visibly busy proving the company is in control. But a process that gates every batch release and every audit deserves the same scrutiny as the production line it protects. The fix is neither exotic nor disruptive — one structured intake that triages by risk at the door, a standardised workflow that matches investigation depth to risk and escalates before things go overdue, and process mining that shows quality where the recurring root causes and the lost days actually are. The deviations will keep coming; that is the nature of regulated manufacturing. Whether they cost 1.6 million euros a year and an anxious audit, or a fraction of that and a confident one, is a design choice.
We invite you to look at your own numbers with Rheintal's lens. Take last quarter's deviations and measure three things: the true effort per deviation, the share that were repeats, and the batch-release days lost to open cases. Then decide whether that is a process you want to fund for another year.
More than the compliance line suggests. The visible cost is investigation effort — often double what a structured process needs. The larger costs are usually hidden: finished batches held in quarantine while deviations stay open, repeat deviations from ineffective corrective actions, and the compliance exposure of chronically overdue CAPAs. Across a few thousand deviations a year, the total commonly reaches seven figures.
It means classifying every deviation by risk at the moment it is raised and matching the investigation depth to that risk. Minor, well-understood deviations follow a fast, lightweight track; only significant or critical events trigger a full root-cause investigation. This stops trivial cases from consuming the same effort as critical ones and keeps the critical ones from waiting in an undifferentiated queue.
Because the corrective action addressed the instance, not the root cause — and because nobody can see the pattern across cases. When each deviation is handled as a one-off in email, the fact that the same line and cause produced the same finding three times last year is invisible. Making the data visible is what allows a systemic CAPA to break the recurrence instead of repeating the paperwork.
Process mining reconstructs how deviations actually flow: where investigations stall, which steps and approvers create the bottlenecks, which root causes recur, and whether corrective actions actually prevented recurrence. It turns deviation management from a black box into a measured process, provides the cycle-time and effectiveness metrics inspectors increasingly expect, and shows exactly where the next improvement is worth the most.
Usually not. Most of the cost comes from how the process runs, not from the software of record. A structured intake with triage, a standardised workflow with owners and escalation, and visibility into the data typically deliver the bulk of the improvement on top of the existing quality system — at a fraction of the cost and disruption of a full replacement.