How Ordo finds the deviations nobody wrote up

Most deviations in a study or a batch get written up because someone noticed them at the time. The sample arrived warm, the analyst saw it, a deviation form went in. Those are the easy ones.

The hard ones are the deviations nobody noticed. A sample drawn twenty minutes outside its collection window. A dilution the plan didn't allow, made at the start of the run and carried into every result after it. A quality control sample that read inside its limits on the instrument and outside them after calculation. Nobody filed a deviation for any of them. They only show up if someone compares the data with the plan, line by line.

Why the unwritten ones matter

The rules expect the report to account for a deviation whether or not anyone wrote it up. Under GMP, 21 CFR 211.192 says any unexplained discrepancy has to be thoroughly investigated. Under GLP, 21 CFR 58.185(a) asks the final report to describe the circumstances that may have affected the quality or integrity of the data. The OECD GLP Principles ask the Study Director to describe, explain, acknowledge and date any deviation from the study plan.

In practice that falls on the reviewer, with the protocol on one screen and the data on the other. On a long study that takes hours, and a tired person checks a few rows and moves on. A deviation in the rows they skipped goes into a signed report unmentioned, and the first person to find it is the auditor.

What Ordo does

Ordo checks every record against the protocol's windows and limits, not a sample. It finds the deviations nobody wrote up, like a sample drawn late or a dilution the plan didn't allow, and puts each one in front of the reviewer with its reason.

When Ordo drafts a report, a separate step reads the whole case for deviations, not one section at a time. The section on storage would never see that the receiving log says a sample arrived warm. One read of the whole case connects the two.

Each deviation Ordo infers from the data, rather than from a record that already raised it, becomes a note on the report. The note says what the deviation is and why Ordo thinks so, and cites the passages in your files it rests on, so the reviewer can check the source. The report can't be signed until someone answers the note.

When it isn't sure

Much of what looks like a deviation isn't one. The window was widened by an amendment. The dilution was in a later version of the method. A tool that only reported what it was sure of would quietly drop those cases, and some of them would be real.

So Ordo errs the other way. If Ordo isn't sure something is a deviation, it includes it and says why. Your reviewer decides. Nothing gets quietly left out.

Leaving out a doubtful event hides it from the person who signs. Including it costs them one decision, with the evidence already in front of them.

What it doesn't do

A reviewer who trusts a tool past its limits is worse off than one who never had it, so here they are.

• It finds what its checks cover. Ordo compares the data against the windows and limits in the plan. A deviation that doesn't show in the data, or sits in a part of the study the plan says nothing about, is still the reviewer's to find.
• It doesn't decide. Every inferred deviation is a note for a person to answer. Ordo makes no claim that a value or a finding is right. Your review decides that.
• It doesn't replace your deviation process. The note in the report is not a deviation record in your quality system. If the reviewer agrees it is one, it goes through your own procedure.

Why we built it this way

A reviewer who checks a sample of records is making a fair call with the hours they have. A computer doesn't get tired at row four hundred, so it can do the check they would do with unlimited time.

It can't take the decision from them, and we didn't want it to. The person who signs is accountable under every rule that applies. Ordo's part is to put the deviations the data shows in front of them before they sign.

For the audit trail and signature side of AI in regulated records, see using AI under 21 CFR Part 11.