Change Control
Nothing in a regulated operation stays still — equipment is replaced, suppliers change, processes are improved, software is updated. Change control is the discipline that lets those changes happen without quietly breaking the qualified, validated state that product quality depends on. Its defining feature is timing: a change is evaluated, risk-assessed, and approved *before* it is implemented, so its effect on the state of control is understood in advance rather than discovered in a failed batch. ICH Q10 names change management as a core element of the pharmaceutical quality system precisely because uncontrolled change is one of the fastest ways a validated process drifts out of control.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 23 LINKSChange control evaluates and approves a change to the validated state before it is made — a QMS and GMP element whose whole point is "before, not after," separating it from a deviation and keeping the state of control intact.
06 · QUALITY MATURITY — CHANGE CONTROL, REACTIVE TO ADAPTIVE
Changes are made and discovered later — "we just swapped the supplier" — surfacing as deviations that should never have occurred.
A change-control SOP and form exist, but impact assessment is a checkbox and changes close on "implemented" without verification.
Changes are risk-assessed and classified before approval, impact assessment is cross-functional, and closure verifies intent achieved without side effects.
Change metrics — open, aging, overdue verifications — feed management review, and established conditions route each change to filing or internal control.
Change control is the mechanism keeping transfer, qualification, and supplier changes inside the validated state, with knowledge driving proportionate rigour.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 4
Derived from the 4 standards SPEQ maps to this subject, across 2 regulatory bodies: FDA, ICH.
RECORDS & OBJECTIVE EVIDENCE
- Change requests risk-assessed and classified before implementation
- Cross-functional impact assessments covering validation, specs, stability, and the dossier
- Regulatory-filing determinations against established conditions (ICH Q12)
- Change-closure records verifying intent achieved without unintended consequences
- Change metrics (open, aging, overdue verification) into management review
COMMON INSPECTION FINDINGS
- Changes implemented without raising change control
- Impact assessment a formality that misses affected systems
- A change requiring a regulatory variation implemented without filing
- Change closed on "implemented" with verification undone
- Unplanned departures recorded as "planned changes" to avoid investigation
Change control vs. deviation — the confusion worth ending
The single most common conflation in quality systems is change control with deviation, and the distinction is simple once stated: a **change is intentional and prospective** — you decide to do something differently and manage it before it happens; a **deviation is unintended and retrospective** — something departed from the approved state and you investigate after the fact. Change control is how you *plan* a departure from the current state on purpose; deviation management is how you *respond* to one you did not plan.
Getting this backwards is a real finding. Implementing a change without raising change control — "we just swapped the filter supplier" — converts a planned change into an unmanaged one, and when it later causes a problem it surfaces as a deviation that should never have occurred. Conversely, dressing up an unplanned departure as a "change" to avoid a deviation investigation hides the failure. The two processes are complements: one governs the changes you choose, the other the departures you did not.
Impact assessment: the work that makes a change safe
The heart of change control is the impact assessment — a structured, cross-functional evaluation of everything a proposed change could touch before it is approved. A change to one parameter rarely stays contained: a new raw-material grade can shift a process, revalidate an analytical method, alter a cleaning limit, and trigger a regulatory filing all at once. The assessment asks what is affected — validation status, specifications, stability, other products on shared equipment, documents, training, and the regulatory dossier — and what must be done, and in what order, to keep the state of control intact.
Quality risk management is the engine here: ICH Q9(R1) frames how the significance of a change is judged and how much evaluation and control it warrants, so effort is proportionate. That is what lets a system classify changes — major changes needing extensive assessment and often revalidation, minor changes managed more lightly — without treating a like-for-like bolt replacement the same as a new manufacturing site. The classification is not bureaucracy; it is how the process focuses rigour where the risk to the patient actually is.
The regulatory dimension: what you can decide, and what you must file
Some changes a company can evaluate, approve, and implement entirely within its own quality system. Others change something the regulator approved in the marketing application and therefore require notification or prior approval before they take effect — the world of variations and supplements. Missing that a change needed a regulatory filing is a serious compliance failure: the product on the market no longer matches its authorised description.
This is where ICH Q12 reshaped the landscape. By formalising **established conditions** — the elements of a process legally binding on the application, distinct from the supporting detail a company can manage in its own quality system — Q12 gives a defensible basis for deciding which changes need a regulatory submission and which can be handled through the pharmaceutical quality system under change control. A mature change-control process reads a change against its established conditions and routes it correctly: filed when it must be, managed internally when it may be.
Closure: a change is not done when it is implemented
As with CAPA, implementing a change is not the same as completing it. Change control closes only when the actions from the impact assessment are complete *and* the change has been verified to have achieved its intent without unintended consequences — the revalidation passed, the new supplier’s material performs, the updated system behaves as specified. Closing a change on "implemented" leaves the verification undone and the assumption that it worked untested.
This makes change control a control point that touches almost everything else: it is the mechanism through which technology transfer, equipment qualification, computerised-system updates, and supplier changes all stay inside the validated state, and it feeds management review with the metrics — open changes, aging, overdue verifications — that show whether change is being managed or merely logged. An operation that cannot say, on demand, which changes are open and whether their effectiveness was confirmed is an operation whose state of control is a claim rather than a fact.
WORKED EXAMPLE — SPEQ SYNTHESIS
A hypothetical plant wants to replace the agitator seal on a validated formulation vessel with a different design from another supplier, because the current part has a long lead time. Engineering describes the change as like for like.
Describe the change in terms of what is different, not what is the same
List the differences: materials in contact with product, the seal geometry, lubrication, cleanability and how it is installed. “Like for like” is a conclusion; the change record needs the comparison that would support it.
Assess impact across everything the vessel’s validated state rests on
Product contact and extractables, cleaning validation, steam-in-place, mixing performance and maintenance procedures each depend on the seal. Ask of each one whether the new design could change the result, and record the answer with its basis.
Decide what evidence the change needs before use
The impact assessment sets the work: perhaps a material compatibility review, a cleaning verification run, an SIP temperature check at the seal, and updated drawings and spare-part records. The scale of the work follows the risk, not the size of the part.
Approve, implement and verify in that order
Approval comes from the functions the assessment named, before the part is fitted. After implementation the planned checks are executed and their results reviewed against the acceptance criteria written before the work.
Close only when the documents match the plant
Drawings, the spare-parts list, procedures and the equipment history must show the new seal. A change whose records still describe the old part leaves the next engineer to repeat the same reasoning without knowing it was done.
A change record holding the comparison, the impact assessment by validated attribute, the evidence plan and its results, approvals in sequence, and updated documents. Whether the vessel returns to use is the organisation’s determination, made on that record.
WHAT WOULD CHANGE THIS
- If the new seal changes a product-contact material, the change may need regulatory assessment against the marketing authorisation as well as the internal impact assessment.
- If the replacement is genuinely identical — same part number from the same manufacturer through a different distributor — the change may fall under supplier management rather than equipment change control.
FREQUENTLY ASKED
What is the difference between change control and a deviation?
A change is intentional and managed before it happens; a deviation is an unintended departure from the approved state, investigated after the fact. Change control governs the changes you choose to make; deviation management responds to the departures you did not plan. Implementing a change without raising change control turns a planned change into an unmanaged one — a common and serious finding.
What is an impact assessment in change control?
A structured, cross-functional evaluation, done before approval, of everything a proposed change could affect — validation status, specifications, stability, shared-equipment products, documents, training, and the regulatory dossier — and the actions needed to keep the state of control intact. Its rigour is scaled to risk under ICH Q9(R1).
When does a change require a regulatory filing?
When it alters something the regulator approved in the marketing application. ICH Q12’s concept of "established conditions" gives a defensible basis for separating changes that need a variation or supplement from those that can be managed internally through the pharmaceutical quality system under change control.
When is a change control closed?
Only when the impact-assessment actions are complete and the change has been verified to have achieved its intent without unintended consequences — revalidation passed, new material performs, updated system behaves as specified. Closing on "implemented" leaves the verification undone, the same failure mode as closing a CAPA on "action complete."
The inspection-readiness playbook for this topic
PUT THIS PLAYBOOK TO WORK
- HOW-TO GUIDEHow to Manage a Change Control →Make a change deliberately — assessed, approved, and verified — not quietly.
- TEMPLATEChange Control Request Form →
- HOW-TO GUIDEHow to Build a Post-Approval Change Management Protocol →Pre-agree how a future manufacturing change will be made and reported.
- TEMPLATEPACMP & Change-Classification Protocol →
A free account keeps what you save, remembers where you are across devices, and can send you the weekly regulatory briefing. Create a free account