Change Control: Keeping a Validated State Under Control
Every validated process, method and system in this series eventually needs to change. Change control is the discipline that decides whether that change quietly breaks something — or gets caught before it does.
01Why every post in this series leads here
A new raw material supplier in cleaning validation. A patched LIMS in computer system validation. A modified HVAC unit in equipment qualification. A revised assay in method validation. Every prior post in this series eventually points to the same question: does this change require revalidation, and who decided that?
Change control is the formal mechanism that answers that question before the change happens, not after something goes wrong. It exists because a validated state isn't permanent — it's a snapshot that a specific, documented set of conditions produced, and any of those conditions can shift over a product's life.
Done well, change control is quiet infrastructure — most changes move through it smoothly. Done poorly, it's either a bureaucratic bottleneck that gets routed around, or a rubber stamp that lets meaningful changes through without the scrutiny they need. Both failure modes show up regularly in inspection findings.
ICH Quality Guidelines: An Implementation Guide
Covers ICH Q10's change management system in the context of the full pharmaceutical quality system it's designed to sit inside — useful for seeing how change control connects to CAPA, risk management and management review.
Find it on Amazon →02The regulatory foundations
| Framework | Issuing body | Core contribution |
|---|---|---|
| ICH Q10 — Pharmaceutical Quality System | International Council for Harmonisation | Defines change management as one of the core process elements of an effective quality system |
| Changes to an Approved NDA or ANDA | U.S. FDA (CDER, April 2004) | Defines Major, Moderate and Minor reporting categories for postapproval manufacturing changes1,2 |
| 21 CFR 314.70 / Section 506A, FD&C Act | U.S. FDA | Statutory and regulatory basis for reporting postapproval changes to an approved application1 |
| EudraLex Vol. 4, Annex 15 §10 & Chapter 6 | European Commission / EMA | EU GMP change management expectations, tied to validated state maintenance |
FDA's guidance distinguishes internal quality-system change control (deciding what to do and how to validate it) from external regulatory reporting (telling the agency what was done) — the two are related but not identical, and a change can require rigorous internal control without necessarily triggering the most demanding regulatory filing, or vice versa.1,3
03The change control lifecycle
A change control record moves through four stages from request to closure. Click each to expand it.
The change is described, and its potential impact on product quality, validated state, and regulatory filings is assessed — typically using the risk assessment tools covered elsewhere in this series (FMEA, impact assessment against critical quality attributes).
- Affected systems, documents and validated states identified up front
- Regulatory reporting category considered early, not as an afterthought
Relevant functions — QA, the process owner, engineering, regulatory affairs where applicable — review the proposed change and either approve it, reject it, or request more information before it proceeds.
- Cross-functional review appropriate to the change's assessed risk
- Explicit sign-off before implementation begins, not concurrent with it
The change is executed according to the approved plan, which may include requalification, revalidation, updated documentation, training, or a regulatory filing — whatever the impact assessment determined was needed.
- Implementation tasks traced back to the original impact assessment
- Documentation (SOPs, specifications, validation reports) updated in step with the physical or system change
After implementation, the change is confirmed to have achieved its intended effect without introducing new problems, before the change record is formally closed.
- Post-implementation data reviewed against the original objective
- Unexpected consequences captured and, if needed, routed into a new change or deviation
Good Manufacturing Practices for Pharmaceuticals
Places change control within the broader CGMP documentation and quality system it depends on — useful for seeing how a change request connects to deviation, CAPA and batch record systems.
Find it on Amazon →04FDA reporting categories
For a licensed product in the U.S., a postapproval manufacturing change falls into one of three regulatory reporting categories, each with a different filing and timing requirement.1,3,4 Switch tabs to compare them.
Major change. Has a substantial potential to adversely affect product identity, strength, quality, purity or potency. Requires a Prior Approval Supplement (PAS) — FDA approval must be obtained before the product made with the change is distributed.
Moderate change. Has a moderate potential for adverse effect. Reported via a Changes Being Effected supplement — either CBE-30 (implement 30 days after FDA receipt, absent objection) or, for lower-risk moderate changes, CBE-0 (implement upon filing).
Minor change. Has minimal potential to adversely affect product quality. The applicant may proceed with the change immediately and simply document it in the next Annual Report.4
05Change impact classifier
This interactive tool is a simplified illustration of how an impact assessment reasons toward a category — not a substitute for one. Check any risk factors that apply to the proposed change, and see roughly where it tends to land.
Illustrative change classifier interactive
Select every factor that applies to the change being considered.
This is a simplified teaching illustration, not a validated decision tool. Real change classification requires a documented impact assessment against your specific approved application, specifications and quality system — and, for regulated products, consultation with regulatory affairs. Never rely on this tool alone to decide a reporting category.
Quality Risk Management in the FDA-Regulated Industry
The risk-assessment tools (FMEA, impact assessment) that feed a real change control decision, covered in more depth than the illustrative classifier above.
Find it on Amazon →06Change control self-check
Readiness checklist
07Where programs fail inspection
- Changes implemented before approval. A change record opened and closed retroactively, after the physical or system change already happened, defeats the purpose of prior review.
- Impact assessments that don't reach validation or regulatory status. A change control record that updates a document but never asks whether revalidation or a regulatory filing is needed leaves real risk unaddressed.
- No effectiveness check. Closing a change record once implementation is "done," without confirming the change achieved its intended effect, misses exactly the failures a change control system exists to catch.
- Informal changes outside the system. A workaround, a "temporary" fix, or an undocumented supplier substitution that never enters change control is one of the most common gaps inspectors look for.
08Specimen quality forms
A change request/impact assessment form and an implementation & effectiveness-check record — the two documents that typically anchor a change control file end to end.
Form CC-01 — Change Request & Impact Assessment
Specimen only — not a controlled document. Attach supporting risk assessment (e.g., FMEA) as needed.
| Area assessed | Impact identified? | Action required |
|---|---|---|
| Product quality / CQAs | ||
| Validated state (process/cleaning/method/system) | ||
| Specifications / documentation | ||
| Regulatory filing requirement |
Form CC-02 — Implementation & Effectiveness Check Record
Specimen only — completed after implementation, before the change record is closed.
| Task | Completed by | Date | Evidence reference |
|---|---|---|---|
These specimen forms illustrate typical content only. Your quality system's document control procedure — numbering, revision history, approval routing — takes precedence over this format.
09References
- U.S. Food and Drug Administration (CDER). Changes to an Approved NDA or ANDA — Guidance for Industry. April 2004. fda.gov
- Federal Register, Vol. 69, No. 68 (April 8, 2004). Notice of guidance availability. govinfo.gov
- U.S. Food and Drug Administration (CDER). Changes to an Approved NDA or ANDA — Questions and Answers. January 2001. hhs.gov
- U.S. Food and Drug Administration (CDER). Guidance on CMC postapproval changes to be documented in annual reports. fda.gov
- U.S. FDA Center for Veterinary Medicine. Chemistry, Manufacturing, and Controls Changes to an Approved NADA or ANADA. Guidance for Industry #83. hhs.gov
No comments:
Post a Comment