This is a ready-to-use register for a test incident that fails once and will not reproduce on demand. Replace every <<FILL: ...>> placeholder with your own specifics, attach it to the test incident or deviation it supports, and route the periodic pattern assessment through your normal QA oversight. Verify each cited regulation against the current source before you rely on it. See Managing test failures during validation for the full disposition logic this register supports.
Why this log exists
“Could not reproduce, no further action” closes an incident on paper and leaves the actual question open: was this a transient blip, or the first sighting of a defect that only shows itself occasionally? You cannot answer that question from one attempt. You answer it by recording every attempt, across every occasion the symptom shows up, in fields structured enough to compare against each other. One unreproduced failure is weak signal. Three unreproduced failures on the same function, each logged with its own conditions, might be the same intermittent defect wearing three different dates, and the only way to see that is if someone counted.
Keep one register entry per test incident that involves a reproduction attempt. If the same symptom recurs on a different incident number, link the two incidents in Part 2 rather than starting the pattern assessment over.
Part 1: Occurrence and reproduction-attempt log (one row per attempt)
| Field | Format | Required | Notes |
|---|---|---|---|
| Occurrence ID | Text | Yes | Sequential per linked incident |
| Linked test incident / deviation number | Text | Yes | The controlling record this attempt supports |
| Date and time of attempt | Date-time | Yes | For time-window and shift correlation |
| Test case, step, or function exercised | Text | Yes | |
| Build, version, instance, environment | Text | Yes | Must match exactly; a different build is not the same attempt |
| Observed symptom | Free text, factual | Yes | Describe what happened, not an interpretation of why |
| Reproduced on this attempt? | Yes / No | Yes | |
| Test data set used | Text or ID | Yes | Same data set across attempts isolates data-dependence |
| Concurrent activity (jobs, other sessions, load, maintenance window) | Free text | Yes, even if “none observed” | What you checked for, not just what you noticed |
| Evidence reference | Log extract ID, screenshot ID | Yes | |
| Investigator | Name or ID | Yes |
Occurrence table
| Occurrence ID | Date/time | Incident # | Test case/step | Build/environment | Symptom | Reproduced? | Data set | Concurrent activity | Evidence ref | Investigator |
|---|---|---|---|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Part 2: Cross-occurrence pattern assessment
Complete this section when a new occurrence is logged, and at least once before any disposition is finalized. The question here is not “did it reproduce this time,” it is “does this look like the same thing happening more than once.”
| Field | Entry |
|---|---|
| Assessment date | <<FILL>> |
| Occurrences assessed (list IDs) | <<FILL>> |
| Incidents linked by this pattern, if more than one | <<FILL: incident numbers, or "single incident, multiple attempts">> |
| Common factor(s) found across occurrences | <<FILL: same build, same time window, same user, same instrument, same upstream job, or "none identified">> |
| Reproduction rate | <<FILL: e.g. 1 of 14 attempts, or 3 of 3 occurrences across 2 incidents>> |
| Similar symptom reported elsewhere (other test cases, other systems, production help desk) | <<FILL: yes with reference, or checked and none found>> |
| Updated classification | Unexplained one-off, still unresolved / Confirmed intermittent defect / Confirmed transient environmental cause / Confirmed test-artifact or execution error |
| Basis for the updated classification | <<FILL>> |
| Assessor | <<FILL>> |
A classification of “confirmed intermittent defect” moves the item out of this register’s open-ended monitoring and into the normal deviation and corrective action path for a known defect with a low but real reproduction rate. This register is for the period before that is known, not a substitute for it once it is.
Part 3: Disposition and monitoring trigger
| Field | Entry |
|---|---|
| Root cause status | Identified / Not identified despite the investigation in Parts 1 and 2 |
| GxP relevance of the affected function | <<FILL>> |
| Risk-based justification for the disposition | <<FILL: state the reasoning, not just the conclusion>> |
| Monitoring defined (what is watched, and how) | <<FILL>> |
| Reopening trigger (the specific condition that reopens the investigation) | <<FILL: e.g. any recurrence within 90 days, any recurrence on a different instance, a related complaint or deviation elsewhere>> |
| Review cadence while monitored | <<FILL>> |
| Disposition | Closed, accepted with monitoring / Closed, root cause identified and corrected / Open, carried to validation summary report pending watch period |
| QA approval (name, date) | <<FILL>> |
Acceptance criteria
- Every reproduction attempt is logged as its own row, with the conditions of that specific attempt, not summarized after the fact as “tried several times, could not reproduce.”
- A cross-occurrence pattern assessment exists before any disposition closes the item, even when the assessment concludes no pattern was found.
- A disposition resting on an unidentified root cause states the investigation performed, the risk-based justification, and a specific reopening trigger, not just “monitor going forward.”
- If the pattern assessment reclassifies the item as a confirmed intermittent defect, it is routed into the standard deviation and corrective action process and this register stops being the controlling record.
Retention
Retain this register with the linked test incident or deviation record, per the records retention schedule, for not less than <<FILL: retention period>>.
References
21 CFR 211.192 (investigation of unexplained discrepancies). EU GMP Annex 15, Qualification and Validation (2015) (documentation of deviations from the validation protocol with justification). EU GMP Annex 11, Computerised Systems (2011) (reporting and assessment of deviations arising during validation). ALCOA+ data integrity principles as described in the FDA 2018 data integrity guidance, MHRA GxP Data Integrity Guidance and Definitions, and PIC/S PI 041. ICH Q9, Quality Risk Management, for the proportionality of the monitoring and reopening decision.
Confirm the current version of each reference before issue.
Filled specimen
The following shows the register for an example intermittent failure found during OQ of a building management system monitoring a cell therapy manufacturing suite. The company, system, and numbers are illustrative.
Occurrence table
| Occurrence ID | Date/time | Incident # | Test case/step | Build/environment | Symptom | Reproduced? | Data set | Concurrent activity | Evidence ref | Investigator |
|---|---|---|---|---|---|---|---|---|---|---|
| OCC-001 | 03 Sep 2026, 14:22 | TI-0091 | OQ-BMS-018 step 3, differential pressure alarm verification | BMS-QUAL, build 4.2 | Suite differential pressure alarm failed to trigger at the test setpoint; sensor read dropped out for approximately 8 seconds | Yes, failed | TD-BMS-02 | HVAC compressor for the adjoining air handling unit cycled on at 14:21 per the BMS event log | LOG-BMS-0091-A | R. Okafor |
| OCC-002 | 05 Sep 2026, 09:47 | TI-0091 | Re-attempt of OQ-BMS-018 step 3 | BMS-QUAL, build 4.2 | Alarm triggered correctly at setpoint | No, passed | TD-BMS-02 | No compressor cycling logged in the preceding 2 minutes | LOG-BMS-0091-B | R. Okafor |
| OCC-003 | 09 Sep 2026, 14:05 | TI-0091 | Re-attempt of OQ-BMS-018 step 3 | BMS-QUAL, build 4.2 | Same symptom as OCC-001: sensor read dropped out for approximately 6 seconds, alarm delayed | Yes, failed | TD-BMS-02 | Compressor cycled on at 14:04 per the BMS event log | LOG-BMS-0091-C | M. Suarez |
Cross-occurrence pattern assessment
| Field | Entry |
|---|---|
| Assessment date | 09 Sep 2026 |
| Occurrences assessed | OCC-001, OCC-002, OCC-003 |
| Incidents linked | Single incident, TI-0091, three attempts |
| Common factor(s) found | Both failing attempts (OCC-001, OCC-003) coincide with the adjoining air handling unit’s compressor cycling on within 60 seconds prior; the one passing attempt (OCC-002) has no compressor cycling event in the same window |
| Reproduction rate | 2 of 3 attempts, both correlating with the same external event |
| Similar symptom reported elsewhere | Facilities maintenance log checked for the same sensor and adjacent sensors over the prior 90 days: two unexplained short-duration pressure readings noted on the same sensor circuit, dates coincide with scheduled compressor maintenance test runs |
| Updated classification | Confirmed intermittent defect, electrical interference suspected |
| Basis | Two of three controlled attempts reproduced the symptom, both correlating with the same external trigger; the facilities log corroborates a pre-existing unexplained pattern on the same circuit, which rules out a one-time fluke |
Disposition and monitoring trigger
| Field | Entry |
|---|---|
| Root cause status | Identified following pattern correlation: the differential pressure sensor’s signal cable for this suite shares a cable tray run with the compressor’s power feed for a 4-meter section, and the cable shielding at that section was found improperly terminated during a facilities walk-down triggered by this pattern |
| GxP relevance | High. The differential pressure alarm is a critical monitoring point for a cell therapy manufacturing suite classification boundary |
| Risk-based justification | Not closed as monitoring-only; the corroborating facilities log plus the controlled reproduction rate were sufficient to assign root cause and proceed to corrective action rather than accept an unknown cause |
| Monitoring defined | N/A, superseded by corrective action below |
| Reopening trigger | N/A |
| Review cadence | N/A |
| Disposition | Closed, root cause identified and corrected. Cable shielding at the affected section re-terminated per electrical standard <<FILL: reference>> and the cable re-routed outside the shared tray run under change control CC-<<FILL>>. OQ-BMS-018 step 3 re-executed five times under compressor cycling conditions, all passed. TI-0091 closed to DEV-<<FILL>> with the corrective action and re-execution records referenced |
| QA approval | <<FILL: name, date>> |
This is what the register is for: the first occurrence alone looked exactly like a fluke, and closing it there would have been defensible-sounding and wrong. The second attempt passing made it tempting to stop. The third attempt, logged with the same discipline as the first two, is what turned a coincidence into a pattern with a real electrical cause behind it.
Common inspection findings this register prevents
- A test incident closed as “could not reproduce, no further action” with no record of what was actually checked.
- Multiple unreproduced failures on related functions, logged as separate unrelated incidents, with no comparison ever made between them.
- A disposition that calls the root cause “unknown” with no risk-based justification and no condition defined for reopening the investigation.
- An intermittent defect that was in fact reproducible under the right conditions, missed because every reproduction attempt used different, undocumented conditions.
- A pattern visible in a facilities, help desk, or production log that nobody cross-checked against the validation incident.
How to adapt this register
- Decide the trigger for opening a register entry: every test incident where the first reproduction attempt fails to confirm the original result, or only incidents already classified as GxP-relevant. State the choice in your test incident management procedure.
- Set the minimum number of controlled reproduction attempts your procedure requires before a “root cause not identified” disposition is acceptable, scaled to the function’s risk.
- Extend Part 2’s “similar symptom reported elsewhere” check to the specific adjacent logs your environment actually has: a help desk ticketing system, an equipment alarm history, a network monitoring tool.
- If your quality system already has a trending or signal-detection tool that would catch this kind of cross-incident pattern automatically, reference it here rather than running the comparison by hand, and use this register to capture the individual occurrence detail that feeds it.