Which statement best describes when a deviation approval process is used in CBM T6?

• A. For changes with no impact on requirements.
• B. For standard changes that do not require risk assessment.
• C. For exceptions to requirements when there is documented risk mitigation.
• D. For supplier changes only.

Answer: (C)

Deviation approvals are used when a proposed change cannot meet a stated requirement, and there is documented risk mitigation that justifies accepting the deviation. The process provides formal review, approval, and tracking of the exception, with explicit risk controls to show the residual risk is managed.

If a change has no impact on requirements, or if it’s a standard change that does not require risk assessment, there’s no need for a deviation because the normal change process applies. The deviation path isn’t limited to supplier changes; it can apply to any change that would violate a requirement but is offset by documented risk mitigation.