Change Control
Nothing in a regulated operation stays still — equipment is replaced, suppliers change, processes are improved, software is updated. Change control is the discipline that lets those changes happen without quietly breaking the qualified, validated state that product quality depends on. Its defining feature is timing: a change is evaluated, risk-assessed, and approved *before* it is implemented, so its effect on the state of control is understood in advance rather than discovered in a failed batch. ICH Q10 names change management as a core element of the pharmaceutical quality system precisely because uncontrolled change is one of the fastest ways a validated process drifts out of control.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 23 LINKSChange control evaluates and approves a change to the validated state before it is made — a QMS and GMP element whose whole point is "before, not after," separating it from a deviation and keeping the state of control intact.
06 · QUALITY MATURITY — CHANGE CONTROL, REACTIVE TO ADAPTIVE
Changes are made and discovered later — "we just swapped the supplier" — surfacing as deviations that should never have occurred.
A change-control SOP and form exist, but impact assessment is a checkbox and changes close on "implemented" without verification.
Changes are risk-assessed and classified before approval, impact assessment is cross-functional, and closure verifies intent achieved without side effects.
Change metrics — open, aging, overdue verifications — feed management review, and established conditions route each change to filing or internal control.
Change control is the mechanism keeping transfer, qualification, and supplier changes inside the validated state, with knowledge driving proportionate rigour.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 4
Derived from the 4 standards SPEQ maps to this subject, across 2 regulatory bodies: FDA, ICH.
RECORDS & OBJECTIVE EVIDENCE
- Change requests risk-assessed and classified before implementation
- Cross-functional impact assessments covering validation, specs, stability, and the dossier
- Regulatory-filing determinations against established conditions (ICH Q12)
- Change-closure records verifying intent achieved without unintended consequences
- Change metrics (open, aging, overdue verification) into management review
COMMON INSPECTION FINDINGS
- Changes implemented without raising change control
- Impact assessment a formality that misses affected systems
- A change requiring a regulatory variation implemented without filing
- Change closed on "implemented" with verification undone
- Unplanned departures recorded as "planned changes" to avoid investigation
Change control vs. deviation — the confusion worth ending
The single most common conflation in quality systems is change control with deviation, and the distinction is simple once stated: a **change is intentional and prospective** — you decide to do something differently and manage it before it happens; a **deviation is unintended and retrospective** — something departed from the approved state and you investigate after the fact. Change control is how you *plan* a departure from the current state on purpose; deviation management is how you *respond* to one you did not plan.
Getting this backwards is a real finding. Implementing a change without raising change control — "we just swapped the filter supplier" — converts a planned change into an unmanaged one, and when it later causes a problem it surfaces as a deviation that should never have occurred. Conversely, dressing up an unplanned departure as a "change" to avoid a deviation investigation hides the failure. The two processes are complements: one governs the changes you choose, the other the departures you did not.
Impact assessment: the work that makes a change safe
The heart of change control is the impact assessment — a structured, cross-functional evaluation of everything a proposed change could touch before it is approved. A change to one parameter rarely stays contained: a new raw-material grade can shift a process, revalidate an analytical method, alter a cleaning limit, and trigger a regulatory filing all at once. The assessment asks what is affected — validation status, specifications, stability, other products on shared equipment, documents, training, and the regulatory dossier — and what must be done, and in what order, to keep the state of control intact.
Quality risk management is the engine here: ICH Q9(R1) frames how the significance of a change is judged and how much evaluation and control it warrants, so effort is proportionate. That is what lets a system classify changes — major changes needing extensive assessment and often revalidation, minor changes managed more lightly — without treating a like-for-like bolt replacement the same as a new manufacturing site. The classification is not bureaucracy; it is how the process focuses rigour where the risk to the patient actually is.
The regulatory dimension: what you can decide, and what you must file
Some changes a company can evaluate, approve, and implement entirely within its own quality system. Others change something the regulator approved in the marketing application and therefore require notification or prior approval before they take effect — the world of variations and supplements. Missing that a change needed a regulatory filing is a serious compliance failure: the product on the market no longer matches its authorised description.
This is where ICH Q12 reshaped the landscape. By formalising **established conditions** — the elements of a process legally binding on the application, distinct from the supporting detail a company can manage in its own quality system — Q12 gives a defensible basis for deciding which changes need a regulatory submission and which can be handled through the pharmaceutical quality system under change control. A mature change-control process reads a change against its established conditions and routes it correctly: filed when it must be, managed internally when it may be.
Closure: a change is not done when it is implemented
As with CAPA, implementing a change is not the same as completing it. Change control closes only when the actions from the impact assessment are complete *and* the change has been verified to have achieved its intent without unintended consequences — the revalidation passed, the new supplier’s material performs, the updated system behaves as specified. Closing a change on "implemented" leaves the verification undone and the assumption that it worked untested.
This makes change control a control point that touches almost everything else: it is the mechanism through which technology transfer, equipment qualification, computerised-system updates, and supplier changes all stay inside the validated state, and it feeds management review with the metrics — open changes, aging, overdue verifications — that show whether change is being managed or merely logged. An operation that cannot say, on demand, which changes are open and whether their effectiveness was confirmed is an operation whose state of control is a claim rather than a fact.
FREQUENTLY ASKED
What is the difference between change control and a deviation?
A change is intentional and managed before it happens; a deviation is an unintended departure from the approved state, investigated after the fact. Change control governs the changes you choose to make; deviation management responds to the departures you did not plan. Implementing a change without raising change control turns a planned change into an unmanaged one — a common and serious finding.
What is an impact assessment in change control?
A structured, cross-functional evaluation, done before approval, of everything a proposed change could affect — validation status, specifications, stability, shared-equipment products, documents, training, and the regulatory dossier — and the actions needed to keep the state of control intact. Its rigour is scaled to risk under ICH Q9(R1).
When does a change require a regulatory filing?
When it alters something the regulator approved in the marketing application. ICH Q12’s concept of "established conditions" gives a defensible basis for separating changes that need a variation or supplement from those that can be managed internally through the pharmaceutical quality system under change control.
When is a change control closed?
Only when the impact-assessment actions are complete and the change has been verified to have achieved its intent without unintended consequences — revalidation passed, new material performs, updated system behaves as specified. Closing on "implemented" leaves the verification undone, the same failure mode as closing a CAPA on "action complete."