Investigation Timelines: Why Thirty Days Is the Wrong Metric

Where the Thirty Days Actually Came From

Start with the primary sources, because the answer changes the conversation.

What the regulation says

21 CFR 211.192, the production record review requirement, is the section that creates the obligation to investigate in US drug GMP. Its operative sentence reads: any unexplained discrepancy or the failure of a batch or any of its components to meet any of its specifications “shall be thoroughly investigated, whether or not the batch has already been distributed.” The section goes on to require that the investigation extend to other batches and other products that may have been associated with the failure, and that a written record be made including the conclusions and follow-up.¹

There is no number of days anywhere in it. The word the regulation uses is thoroughly. The only qualifier on scope is that the investigation must reach other potentially affected batches and products. Nothing in the text ties thoroughness to a calendar.

EU GMP is the same. Chapter 1 of EudraLex Volume 4, the Pharmaceutical Quality System chapter, says at 1.4 (xiv) that “an appropriate level of root cause analysis should be applied during the investigation of deviations, suspected product defects and other problems. This can be determined using Quality Risk Management principles.” It adds that where the true root cause cannot be determined, the firm should identify and address the most likely root cause, and that human error should not be accepted as a cause without first ruling out process, procedural, and system problems.⁸ The chapter contains no reference to days at all.

Chapter 8, which covers complaints, quality defects, and recalls, is even more explicit about how depth should be decided. Section 8.10 says reported quality defects should be “documented and assessed in accordance with Quality Risk Management principles in order to support decisions regarding the degree of investigation and action taken.” Section 8.13 says decisions “should be timely to ensure that patient and animal safety is maintained, in a way that is commensurate with the level of risk that is presented by those issues.” Section 8.14 acknowledges directly that full information is often not available early, and asks that risk-reducing actions still be taken at an appropriate point during the investigation rather than waiting for the conclusion.⁹

Read together, the EU text describes a risk-tiered model with a separate containment clock. It is close to the opposite of a single fixed deadline applied to every event. The MHRA inspectorate’s own guidance on handling unexpected deviations follows the same logic, focusing on whether the deviation was investigated and the root cause determined and corrected, rather than on how long that took.¹⁵

What the FDA guidance says

The FDA guidance most often invoked in support of the thirty days is Investigating Out-of-Specification Test Results for Pharmaceutical Production, whose current version is the Level 2 revision issued in May 2022. The guidance describes a two-phase model: an initial laboratory assessment, then a full-scale investigation when laboratory error is not established.

On timing, the guidance says an investigation “should be thorough, timely, unbiased, well-documented, and scientifically sound” and that a full-scale investigation “should consist of a timely, thorough, and well-documented review.” It says such investigations “should be given the highest priority.” It does not set a deadline. The only day count in the entire document is a reference to a different obligation: the three working days within which a field alert report must be submitted for an approved application, and the guidance notes that unless an out-of-specification result on a distributed batch is found to be invalid within three days, an initial field alert report should be submitted.³

That three-working-day requirement is real and comes from 21 CFR 314.81(b)(1), which requires an applicant to submit field alert information “within 3 working days of receipt by the applicant.”⁵ It is a reporting clock, not an investigation clock, and it is the shortest hard deadline most quality organizations face. It is also the one many sites are least disciplined about, because attention is consumed by a thirty-day target that is not actually written anywhere.

The real origin: a 1993 court opinion

The thirty days is not folklore in the sense of being invented. It has a source. In United States v. Barr Laboratories, Inc., 812 F. Supp. 458 (D.N.J. 1993), Judge Alfred Wolin issued a ruling that shaped US expectations for out-of-specification handling for the next three decades. In the section of the opinion setting out what a failure investigation must contain, the court wrote:

Three things in that passage are worth holding onto.

First, the sentence immediately before the deadline says the elements of a thorough investigation vary with the nature of the problem. The court set a time limit and, in the same breath, said depth is not uniform. Industry kept the first half and dropped the second.

Second, the court said thirty business days. Depending on the calendar and the holidays, that is roughly forty-two to forty-six calendar days. Somewhere in the years after 1993, a large part of the industry converted the figure to thirty calendar days in its standard operating procedures, which is about a third less time than the opinion allowed. Many firms now hold themselves to a self-imposed deadline that is stricter than the only authority that ever stated one.

Third, this was a district court opinion in a specific enforcement action, not a rulemaking. FDA has had more than thirty years and two revisions of the out-of-specification guidance to carry the number forward into guidance, and has not done it. The agency’s current language is “timely” and “highest priority.”

So what is the thirty days, exactly?

It is an internal commitment. A firm wrote it into an SOP, an inspector read the SOP and asked why records were open past it, and the firm learned that missing its own stated timeline is a finding. That is true, and it is the mechanism that has kept the number in place. Failing to follow your own written procedure is a violation of 21 CFR 211.22(d) and of EU GMP Chapter 4 regardless of whether the procedure was a good idea.

The conclusion is not that timeliness does not matter. It matters a great deal, and a stale investigation is a genuine compliance and patient safety problem. The conclusion is narrower and more useful: the thirty days is a commitment the firm chose, which means the firm can choose a better one.

What a Single Deadline Does to an Investigation

A single deadline applied uniformly to a population of events with wildly different complexity produces four predictable behaviors. None of them are the result of bad people. They are the result of a measure that rewards one dimension of performance and is silent on the rest. The general phenomenon is old and well described in the management literature: V. F. Ridgway’s 1956 paper on the dysfunctional consequences of performance measurement observed that a single measure motivates behavior that is detrimental to the goals the measure was meant to serve.¹² Quality systems are an unusually clean demonstration of it.

Behavior one: root cause analysis truncated to fit the calendar

The most common form is a five-why chain that terminates at the first plausible answer rather than the supported one. The MHRA inspectorate has described this directly, noting that investigators often reach conclusions based on previous experience rather than evidence, and that reports appear stating a true root cause could not be identified without the recognized analysis approaches having been applied at all.¹⁰

The FDA’s warning letters describe the same pattern in enforcement language. A July 2026 letter to International Medication Systems Limited states that the firm’s investigation “failed to identify a scientifically-supported root cause, instead attributing these exceedingly high environmental monitoring findings to an unsubstantiated hypothesis,” and, more bluntly, that “many of your investigations were closed without identifying a root cause.”⁶ A November 2025 letter to Catalent Indiana, LLC found that investigations “frequently lacked data supporting the assigned root cause(s), were not adequately expanded to include all potentially affected drug products, were not formally or adequately documented in your deviation system, and/or did not assess the effectiveness of corrective actions taken.”⁷

A May 2026 letter to Medline Inc. makes the same finding in the same words used in the regulation, that the firm failed to thoroughly investigate any unexplained discrepancy or failure of a batch or any of its components to meet its specifications, and that its investigations failed to adequately identify the root cause of contamination issues.¹⁴

Note what these describe. Not late investigations. Fast ones with nothing in them.

Behavior two: extension paperwork that outweighs the investigation

Every thirty-day system needs an escape valve, so every thirty-day system grows an extension process. The initiator writes a justification, the department head reviews it, quality assurance assesses the delay and approves or rejects the request, and the record is updated. On a complex investigation that genuinely needs ninety days, a site may process three extension packages.

Each one takes real time from the same investigator, the same supervisor, and the same quality reviewer who should be working the investigation. The extension is also, from an inspector’s point of view, a document that says the firm missed its own commitment. The firm is generating evidence of failure against a target it invented, and spending investigator hours to do it.

Behavior three: closure on a symptom

When the clock is the binding constraint, the fastest defensible closure is the one that addresses what happened rather than why. A seal failed, so the seal was replaced. An operator missed a step, so the operator was retrained. Both are true statements. Neither is a root cause.

The MHRA’s worked example is instructive: a seal failure causing oil leakage might trace back to the wrong seals being fitted during planned maintenance, to a supplier specification change, or to a maintenance schedule that no longer matches equipment use.¹⁰ Those three answers lead to three completely different corrective actions. Only one of them stops the next failure. Deciding between them takes time that a thirty-day clock does not reliably provide, and the retraining answer is always available and always fast.

EU GMP Chapter 1 and Chapter 8 both address this specifically, requiring that where human error is suspected or identified, it be formally justified with care taken to ensure process, procedural, or system-based problems have not been overlooked.⁸⁹ That justification is exactly the work a deadline squeezes out.

Behavior four: a queue managed by due date instead of by risk

This is the most damaging one and the least visible. When the reported measure is on-time closure, the rational way to manage a queue of thirty open investigations is to work the ones closest to their due dates. A minor documentation deviation opened twenty-six days ago outranks a sterility-relevant environmental excursion opened four days ago, because the first one is about to turn red and the second one is not.

Every quality professional knows this is backwards. The metric still produces it, every day, in every site that reports on-time closure as its headline number. The regulators have said what the ordering principle should be: EU GMP Chapter 8 asks that the degree of investigation and action be decided using quality risk management principles, and that decisions be commensurate with the level of risk presented.⁹ Risk, not due date.

The evidence that the current approach is not working

FDA publishes its inspection observation counts every fiscal year. Counting the drug program area entries for 21 CFR 211.192, which covers investigations of discrepancies and failures, gives the following series.

Counts taken from FDA’s published inspection observation data files. In every one of these five years, the only more frequently cited drug regulation was 21 CFR 211.22(d), quality unit procedures not in writing or not fully followed, which reached 243 observations in FY2025. FDA issued 713 drug FDA-483s in FY2025.⁴

Some of the year-over-year increase reflects recovering inspection volume after the reduced activity of FY2020 and FY2021, so the series should not be read as a pure quality trend. What is not sensitive to inspection volume is the ranking. Investigations have been the second most cited drug regulation in every one of the last five fiscal years, across an industry that has been reporting on-time closure percentages in the nineties for as long as anyone has been reporting them. Those two facts cannot both describe a healthy system.

The Measure Set That Replaces the Deadline

The replacement is not a different single number. It is six measures that together describe whether investigations are protecting patients, and that are hard to satisfy without doing the work properly.

Why these six and not others

Each one closes a gap that on-time closure leaves open, and each has a defensible regulatory basis rather than being a management preference.

Containment is separated from investigation because the regulations separate them. EU GMP Chapter 8.14 says that comprehensive information may not be available early and that risk-reducing actions should still be taken at an appropriate point during the investigation.⁹ It goes further: recall operations may need to be initiated to protect public health before the root cause and full extent are established. If a regulator expects a recall decision ahead of the root cause, then measuring containment on the same clock as root cause confuses two separate obligations.

Time to confirmed root cause is measured separately from record closure because those are different activities with different constraints. A CAPA that requires an equipment modification during a planned shutdown may legitimately take four months. Holding the whole record open and calling it overdue tells you nothing. Splitting the clock lets you hold the investigation to a tight standard and let the CAPA run to a realistic, risk-based target date, which is what the MHRA guidance asks for.¹⁰

Recurrence is the only measure in the set that is genuinely outcome-based. It is also the reasoning FDA applies in enforcement. A November 2025 letter to Cdymax India Pharma Private Limited, addressing a firm that had recorded approximately 1,500 laboratory incidents involving out-of-specification results and other significant analytical events since 2023, states the chain plainly: “Inadequate investigations can result in unidentified root causes, ineffective CAPAs, and recurring problems that compromise your ability to manufacture safe and effective APIs.” The same letter sets out a rule that a thirty-day clock makes hard to follow: “A possible laboratory error is insufficient to close an investigation at Phase 1. Whenever an investigation lacks conclusive evidence of laboratory error, a thorough investigation of potential manufacturing causes must be performed.”¹¹ Recurrence is how the agency judges whether investigations worked. It is a reasonable thing to measure yourself on first.

The percentage closed without a root cause is deliberately uncomfortable. EU GMP Chapter 1 explicitly permits closing on a most likely cause when the true cause cannot be determined, so a non-zero rate is not a compliance failure.⁸ The failure is not knowing what the rate is. A site that discovers it closes twenty-two percent of investigations with no confirmed cause has found the single most valuable piece of management information in its quality system, and it will not find it in an on-time closure report.

A Rubric for Investigation Depth

Depth is the measure that people assume cannot be quantified, which is why it is usually left out. It can be scored consistently if the rubric is specific, the sample is small, and the reviewers are calibrated. Below is a six-dimension rubric scored 0 to 3, for a maximum of 18.

How to run the scoring so the number means something

The rubric is only as good as its consistency. Four practices make the difference.

Running a Risk-Tiered Timeline Model

Once containment and root cause are on separate clocks, timelines can vary by risk without anything being relaxed. The design has three parts: a tiering rule, tier-specific clocks, and an escalation path that moves records between tiers when new information arrives.

The tiering rule

Tiering must be decided at intake, from defined criteria, by someone other than the person who reported the event. Three tiers are enough. More than three and the boundaries stop being clear.

Tier-specific clocks

Two design points in that table deserve explanation.

The containment clock runs the opposite direction from the root cause clock. Higher risk means faster containment and more time for root cause. That is the correct relationship and it is the one a single deadline destroys, because a uniform target gives a critical event the same time as a documentation error while providing no separate assurance that anything was contained at all.

The Tier 3 root cause target is longer than thirty days on purpose. This is the part that will attract the most internal resistance and it is the part most worth defending. A sterility-relevant environmental excursion, a suspected cross-contamination event, or an unexplained assay trend cannot be resolved properly in thirty days, and the current system handles that by generating extension paperwork. The tiered model handles it by allowing the time up front and requiring documented interim checkpoints instead. The volume of paperwork goes down and the visibility goes up.

The checkpoint discipline that makes a long clock safe

A longer target is only defensible if it is not a longer silence. Tier 3 investigations get mandatory written checkpoints at fifteen and thirty business days. Each checkpoint records four things: the hypotheses still open, the evidence gathered since the last checkpoint, whether interim controls remain adequate, and whether the tier is still correct. The checkpoint is half a page. It is reviewed by the quality head, not filed.

This produces something the extension process never did. An inspector reading a ninety-day Tier 3 investigation sees a documented trail of active work with named decisions at defined intervals. An inspector reading a ninety-day investigation with three extension requests sees a firm that missed its own deadline three times.

A Worked Scorecard

Below is the monthly scorecard as it would appear for a single manufacturing site. The figures are illustrative and are shown to demonstrate the format and the way the measures interact, not as benchmark data. Every organization has to establish its own baseline before setting targets.

How to read the scorecard as a leader

The scorecard is designed to be read in pairs, and the pairs are where the management judgment happens.

Root cause time against depth score. If time is rising and depth is rising, the system is doing what you asked. If time is rising and depth is flat, you have added delay without adding rigor, and the problem is capacity or capability rather than the metric. If time is falling and depth is falling, the old behavior has returned and something in the incentive structure is still rewarding speed.

Closed without root cause against recurrence. A site with a low unknown rate and a high recurrence rate is assigning causes that are not real. That combination is the most serious signal on the page and it is invisible to any timing measure.

CAPA effectiveness pass rate against depth score dimension six. If effectiveness passes are high but the cause-to-action dimension scores low, the acceptance criteria are too easy. Pull five effectiveness checks and read the criteria.

Explaining the Change to an Inspector

The concern most quality leaders raise about this change is the one that matters: will an inspector conclude the firm loosened its standard? The answer depends almost entirely on how the change is documented, and the position is defensible when three conditions are met.

The three conditions

The tiering criteria are written, objective, and applied by someone independent of the reporter. An inspector’s first question about a tiered system is how a record gets its tier. If the answer is a documented decision rule with named criteria and an independent decision maker, the system is a quality risk management application and it maps directly to EU GMP Chapter 8.10, which asks that quality risk management principles support decisions about the degree of investigation.⁹ If the answer is that the investigator picks, the system is a way to avoid deadlines and it will be read that way.

Containment timelines got shorter, not longer. This is the sentence that carries the whole conversation. The firm has not extended anything that protects patients. It has shortened the clock on quarantine, batch identification, and notification decisions, and applied the freed time to determining why. Have the containment data ready, by tier, with the trend.

The change is under change control with a documented rationale. The rationale should reference the applicable regulatory text and the firm’s own data. A change control that says the site is moving from a uniform commitment to a risk-tiered model, cites 211.192’s thoroughness requirement, cites EU GMP Chapter 1 (1.4 xiv) and Chapter 8.10 on quality risk management determining the level of investigation, and attaches the firm’s own analysis showing investigation depth or recurrence problems under the old model, is a strong document. It shows the firm identified a weakness in its quality system and corrected it, which is what a pharmaceutical quality system is supposed to do.

What to have in the room

• The tiering procedure with the criteria table and the independence requirement.
• The change control record with the rationale and the before-and-after data.
• Twelve months of containment performance by tier.
• The depth rubric, the calibration records, and the panel roster.
• Recurrence data with the adjudication records showing how repeat events were classified.
• Management review minutes showing the six measures being discussed and acted on.

Anticipate the follow-up on your own historical records

An inspector who accepts the new model will still look at records closed under the old one. If the firm’s own depth review found weak investigations in the historical population, expect to be asked what was done about them. Have an answer before the question. The usual answer is a retrospective review of a defined sample of high-risk closed records, with any that fail the depth rubric reopened or addressed through a new investigation. Doing this before an inspection turns a vulnerability into evidence of a working system. Doing it after, under an observation, does not.

Transitioning Without a Spike in Overdue Records

The practical objection to changing the model is that the transition itself creates an inspection risk. Records that were on track under one set of rules become overdue under another, the aging report jumps, and the site looks worse on the day the improvement starts. This is avoidable with sequencing.

What the aging report should look like afterward

The replacement for on-time closure percentage is an aging distribution with tier bands, showing the count of open investigations by age bracket within each tier, plus every record above a defined age threshold listed individually with its owner and its next checkpoint date. A count of four is a list of four records with names against them. A percentage of ninety-six is a number nobody can act on.

This is also a better inspection artifact. It shows a firm that knows exactly which records are old and why. That is a stronger position than a high percentage with no visibility into the tail.

Human Factors: The Part That Breaks the Change

Everything above is a measurement design, and measurement designs fail for reasons that have nothing to do with measurement. If the people writing investigations are still evaluated on how many they close, the new scorecard will be reported accurately and ignored completely.

What people are actually rewarded for

In most quality organizations, the investigator’s visible performance is closure count and on-time percentage. Those numbers appear in year-end reviews, in team dashboards, and in the informal reputation of who is fast and who is slow. Nothing about that changes when a new scorecard appears at the site level, because site-level measures and individual performance conversations are separate systems that rarely get reconciled.

FDA’s Quality Management Maturity work treats this as a first-order concern rather than a soft one. CDER’s published description of the prototype assessment protocol lists Employee Empowerment and Engagement among the practice areas, with Rewards and Recognition named as an example topic within it, and states that practice areas are assessed against a defined rubric.¹³ A regulator asking what a firm rewards people for is a regulator that understands where investigation quality comes from.

Four changes that have to happen with the metric change

The human error problem is a human factors problem

Human error remains the most commonly assigned root cause in pharmaceutical investigations, and both EU GMP Chapter 1 and Chapter 8 now require that it be formally justified only after process, procedural, and system-based causes have been ruled out.⁸⁹ The MHRA’s position is that human error should be cited as root cause only when all other system and process variables have been eliminated, and that identical problems recurring with different operators indicate a systemic issue rather than an individual one.¹⁰

Under a deadline, human error is the fastest available answer and retraining is the fastest available action. Under a depth rubric that scores alternative causes ruled out with data, it is one of the hardest answers to defend. That is the intended effect. It is also the change that most affects the people on the floor, because it moves the investigation away from asking who made the mistake and toward asking why the process allowed it.

That shift has a practical consequence for reporting culture. Sites that stop closing investigations on operator error see event reporting go up, sometimes sharply, in the first two quarters. That is the system working. More events reported with better causes is a better position than fewer events reported and closed on retraining, and leadership needs to be told this before the reporting numbers move rather than after.

The capability question nobody asks first

One honest caution. Some sites that lengthen their root cause clock find that depth does not improve, because the constraint was never time. It was that the people writing investigations had never been trained in structured cause analysis beyond a one-hour module on the five whys, and had no access to the process and engineering knowledge needed to evaluate alternatives.

Check this before changing the metric. Take ten recent investigations that closed inside the deadline and score them against the depth rubric. If they score poorly on evidence gathered and alternative causes, more time alone will not fix them, and the transition plan needs a training and staffing component alongside the measurement change. The metric change is necessary. On its own it is rarely sufficient.

Conclusion

The thirty-day investigation target is one of the most widely held beliefs in pharmaceutical quality and one of the least examined. It is not in 21 CFR 211.192, not in EU GMP Chapter 1, and not in the FDA’s out-of-specification guidance. It traces to a 1993 district court opinion that said thirty business days, in a passage whose preceding sentence said the elements of a thorough investigation vary with the nature of the problem. Industry kept the deadline and discarded the qualification, then tightened the deadline further by converting business days to calendar days. Three decades later, investigations are the second most cited drug regulation in FDA inspections, and the enforcement language is about investigations closed without root causes rather than investigations closed late.

The replacement is not complicated, but it does require leaders to accept a scorecard with six numbers instead of one, and to accept that two of those numbers will get worse before they get better. Measure containment separately and shorten it. Measure time to a confirmed root cause separately from record closure. Score depth against a written rubric with calibrated reviewers. Track recurrence, CAPA effectiveness at the check point, and the honest percentage of investigations you closed without knowing why. Tier the timelines by risk, document the tiering rule, and put the change under change control with the regulatory basis attached. Then fix what individuals are rewarded for, because the measurement change fails without it.

Sakara Digital works with pharma and biotech organizations rebuilding quality measurement so it reflects what investigations are actually for. If you are considering a change to how your site measures deviation and failure investigations, and you want an independent read on your current depth and recurrence data before you touch a single target, we are happy to have that conversation.

For Further Reading