Skip to content
← All articles

OOS and OOL investigations in the micro lab

13 min read · 4 November 2026

Audit checklist on a clipboard with a magnifier and an observation stampINSPECTION CHECKLISTEM trendsMedia fillOOS logAudit trailTrainingREVIEWED

Microbiology results are different from chemistry results. Organisms grow, die and clump; samples cannot be split into identical aliquots; a plate cannot be re-injected like an HPLC vial; and a sterility test can never be "retested into compliance". The USFDA guidance on OOS results was written mainly with chemistry in mind, so microbiologists have to apply its principles with care.

This article explains how to run a microbiology investigation that finds the real cause, protects patients and stands up to inspection.

Words that matter

  • OOS (out of specification): a product or material result outside its specification, such as a failed MLT, a positive sterility test or an endotoxin result above the limit.
  • OOL or excursion (out of limit): an EM or utility result above an alert or action level.
  • OOT (out of trend): a result inside limits but outside the expected pattern, such as a water point that has been 0–2 CFU for a year suddenly showing 40 CFU against a limit of 100.
  • Invalid result: a result that cannot be used because a laboratory error has been clearly shown.

Each type needs a response proportionate to its risk. An OOS on a released product is serious; an alert-level excursion in Grade D needs a check, not a three-week investigation.

Why micro is different

  • Variability is high. Repeat counts of the same sample can easily differ by 30% or more. A small difference between a result and a limit is not evidence of error.
  • Samples are not homogeneous. Contamination is often patchy. A retest that passes does not prove the first result was wrong.
  • Results take days. By the time you see growth, the sampling conditions are gone. Records made at the time are the only evidence.
  • Raw data is destroyed. Plates are autoclaved after reading. Photographs and second-person verification become essential.

Phase I: laboratory investigation

Start immediately, before discarding anything. Keep the plates, tubes, media, diluents and the sample if any remains. Then check:

  • Sample handling: transport time, storage temperature, container integrity, labelling.
  • Media: lot, expiry, growth promotion status, sterility check, preparation records, pH.
  • Diluents and neutralisers: preparation, sterilisation and storage.
  • Equipment: incubator temperature records, LAF or isolator status, HEPA certification, balances, pipettes, autoclave cycle records.
  • Analyst: training records, aseptic technique qualification, workload on the day.
  • Controls: negative controls and positive controls for the session.
  • Environment: EM and personnel monitoring of the testing area during the test.
  • Calculations and data entry: dilution factors, transcription, rounding.

Interview the analyst early, while memory is fresh. Ask open questions: "Walk me through what you did", not "Did you forget to sanitise your gloves?"

A result can only be invalidated if a clear, documented laboratory error is found. "Possible analyst error" without evidence is not enough. The evidence must show that the error could have caused the result, not just that an error happened.

Identification during Phase I

Identify the organism as soon as possible. Its identity often tells you more than any checklist. A Ralstonia in an MLT sample from a tablet line points towards purified water. A Staphylococcus epidermidis in a sterility test points towards human contamination, but it could be from the lab analyst or from a filling operator. Identification starts the comparison; it does not end it.

Phase II: full investigation

If no lab error is proven, the result stands, and the investigation moves to manufacturing:

  • Identify the organism to species level and compare with EM, water and personnel isolates from both the lab and production
  • Review batch records, interventions, environmental data, utilities and equipment cleaning records for the period
  • Review raw materials, especially natural-origin materials and water used in the batch
  • Assess every related batch and product made in the same area, on the same equipment or with the same materials
  • Use structured tools and test each hypothesis with data

Root cause tools

  • 5 Whys: keep asking "why" until you reach something that can be fixed. Simple, but easy to stop too early.
  • Fishbone (Ishikawa): list possible causes under people, methods, materials, machines, measurement and environment. Good for making sure nothing is missed.
  • Fault tree: work backwards from the event through the conditions needed to cause it. Useful for complex events.
  • Timeline: put every relevant event in time order. Many investigations become clear once the sequence is visible.

Whatever tool you use, every hypothesis must end with "confirmed", "ruled out" or "cannot be ruled out", with evidence.

Retesting and resampling

  • Retesting means testing the original sample again. It is only justified if the original test was invalidated, and the retest plan must be approved before it starts.
  • Resampling means taking a new sample from the batch. It may be justified if the original sample was compromised, for example by a damaged container, but it is a QA decision, documented in advance.
  • Both results count. A passing retest does not erase an OOS result unless the original was invalidated with evidence.

Impact assessment

Every confirmed OOS or significant excursion needs an assessment of what else could be affected:

  • Other batches of the same product made in the same period
  • Other products made in the same area or on the same equipment
  • Batches that used the same raw material lot or water
  • Already released batches, including those in the market

The outcome may be "no impact" for most, but the reasoning must be written down. Missing impact assessments are a common audit finding.

Writing CAPA that holds up

  • Tie each action to a confirmed or most-probable root cause.
  • Prefer engineering and design fixes over retraining alone. Retraining is appropriate only when the cause really was lack of knowledge.
  • Make actions specific: "Install a sporicide step in the material transfer SOP for all cardboard-free items entering Grade C", not "Improve disinfection".
  • Define an effectiveness check with a measurable target and date, such as "no recurrence of the organism at this location in three months of monitoring".
  • Close the CAPA only when the effectiveness check is met, not when the action is merely done.

Writing the report

A good investigation report can be understood by someone who was not involved. Structure it like this:

  1. What happened: the result, the specification, the sample and the date.
  2. Immediate actions: what was quarantined, who was informed.
  3. Phase I findings: each check, with the evidence.
  4. Phase II findings, if applicable.
  5. Root cause, or most probable cause, with the reasoning.
  6. Impact assessment.
  7. CAPA and effectiveness checks.
  8. Conclusion on batch disposition.

Keep opinions out. Each statement should be supported by a record, a photo or data.

Common audit findings

Inspection desk with a laptop showing trends, a binder of SOPs, an inspector badge and coffeeALERTSOPsINSPECTOR
Inspectors read investigations closely; evidence wins.
  • Invalidations based on assumed analyst error
  • Investigations that never compare the isolate with the EM library
  • CAPA limited to "retrained the analyst"
  • No impact assessment on other batches
  • Retesting without a pre-approved plan
  • Investigations closed long after the due date with no interim actions
  • The same root cause appearing in several investigations without anyone noticing

A strong investigation culture is one of the clearest signs of a mature quality system. It shows that the site would rather find a problem than hide it.

Educational content. Always follow your site's approved SOPs, the current pharmacopoeia and applicable regulations.