The scope question comes first, and sites get it wrong in both directions. Too narrow, and events that should be visible never enter the system, so trending is built on an incomplete picture. Too broad, and the system floods with trivia, investigation quality collapses, and the events that matter are buried. Clear criteria plus risk tiering is the only workable answer.
Every deviation needs an impact assessment on the batch, and on other batches that shared the same equipment, material, personnel or period. The second half is the one that gets skipped. A contamination event assessed only against the batch in front of you leaves the question an inspector will certainly ask — what else was affected — unanswered.
Investigation depth should track risk, but the standard for root cause does not move: 'human error' is a description, not a cause. Where a person made a mistake, the useful questions are why the process permitted it, whether the instruction was ambiguous, whether the layout invited it, and whether workload made it likely.
Investigation cycle time is one of the metrics inspectors read as a proxy for whether the quality system is under control. A queue of open investigations says the site cannot close what it opens, and each unclosed investigation raises the probability of a recurrence that will cost the same effort again.