OOS is handled at three levels.
1) at first instance, finding out, if that, is an laboratory error.
1.1) procedural it triggers an 'incident', and trigger analytical-review/investigation,(here you must have a detailed checklist/guidance for handle 4M(man material, machine, method...), handling kinds of test-parameters,processes etc.,)
1.2) if an laboratory-error is verified(Root cause), look into level/extent of impact, on other analysis...(due to that cause on other batches, results etc.,)
1.3) then re confirm the results through ""multiple/duplicate"" testing (either samples-analysts-equipments, depending kind of error noted)
1.4) also ensure that appropriate CAPA is tracked & trended
1.5) if an laboratory error is ruled out, then it must trigger next process-reviews/investigations, involving respective functions (usually, technology manufacturing, led-by-QA etc.,)
this phase can be either seen as 2) OR 1.5.1) people have different approaches,
2) it triggers process-review/investigations (detailed checklist/guidance to handle various process controls - equipment, operations, area etc.,)
2.1) broadly again , two scenarios, assignable cause, or non-assignable cause;
2.2) if its assignable cause, its first, assessed for level&extent of impact,
2.3) based on kind of situation (found a process error, sampling error, etc.,) it leads to multiple/dupliate sampling-testing ....(similar as 1.2-1.3...)
this is most toughest(freqient) situation which is as good as third section of OOS...
2.4) if its unassignable cause, and initiate full scale investigation, which includes, extensive sampling or experimentation ""or hypothesis testing"";
the point is you have to ''conclude"" upon with reasonable data about the RCA & impact on other batches/products etc.,
apart from above process steps, one ought to describe the responsibilities, communications, documentation requirements in procedure.
this is the trickiest part., the depth and success of investigation depends on the sincerer & seriousness of the team/management handling the problem. so get management involved, which works most of the times; but be sure to let the know the impact&risk,,, that is the key for involving/influencing management.
hope that helps.
loads of references are available...just in case if you have not already seen them...
http://www.iagim.org/pdf/sop10.pdf
http://www.gmp-verlag.de/media/files/Dateien/OOS_Form-UD6.pdf
http://www.pharmchem.tu-bs.de/forschung/waetzig/dokumente/courtesy_translation.pdf
http://pharmtech.findpharma.com/pharmtech/data/articlestandard//pharmtech/032002/6989/article.pdf
...
and still best source is 483s and warning letters...
viz.,
http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm170912.htm