Change Control in Pharma: Complete Guide to Process and Approval

In short: Change control is the system that makes sure every change to a product, process, method, material, equipment, facility, system or document is assessed, approved by Quality before it is made, carried out as planned and checked afterwards. This guide takes QA officers, production and QC staff and students through the full cycle: classification, risk and regulatory assessment, validation, effectiveness checks, a fictional worked example, a printable form and FAQs.

What is change control?

Change control is the formal route through which a proposed change is evaluated and approved before it is put into use. Its aim is simple: no change should reach the shop floor, the laboratory or a registered dossier unless people with the right expertise have looked at what it could affect, and Quality has agreed that it is safe to go ahead.

ICH Q10 (§3.2.3) calls this the change management system. It expects expert teams from development, manufacturing, quality and regulatory affairs to evaluate each change against criteria set beforehand, an assessment of whether the regulatory filing must change, and an evaluation after implementation to confirm the objective was met. A formal system should be in place for commercial manufacturing, with quality unit oversight to assure scientific, risk-based assessments.

If you want the step-by-step procedure written as an example SOP, see change control: an example SOP and process. This guide is the wider view: how to classify, assess and prove a change, and what goes wrong.

What counts as a change

Typical triggers include new materials or suppliers, process parameters, batch size, equipment, test methods, specifications, software, documents, sites and contract acceptors, and actions arising from a CAPA, audit finding or technology transfer. EU GMP Annex 15 (§11.2) lists planned changes to a starting material, product component, process, equipment, premises, product range, method of production or testing, batch size, design space, or any other change during the lifecycle that may affect product quality or reproducibility. A useful working rule is: if you are not sure whether it is a change, raise it and let QA decide.

Planned, temporary and emergency changes

Temporary changes have a habit of becoming permanent without anyone deciding so, so track their end dates. The emergency route is not a shortcut for poor planning: implementing a change first and “regularising” it later is a classic inspection observation.

Classifying changes

Classification decides how much assessment, who approves and whether the regulator must be told. A common three-level scheme (example in-house criterion; use the levels and examples that fit your own quality system):

Classification is provisional: QA confirms or changes it after the impact assessment, and the initiator should not be the only one deciding that a change is “minor”. Record the justification.

The change control process end to end

1. Change request

A good request has a unique number, the date, the department, the current and proposed state, the reason and the affected products, areas, equipment, systems and documents. “Update SOP” is too thin; “extend the hold time of blended granules of Product X from 48 to 72 hours, to match the packing schedule” can be assessed.

QA logs the request, assigns the number and a provisional class, and decides who needs to assess it.

2. Impact and risk assessment (ICH Q9(R1))

Annex 15 §11.4 says quality risk management should be used to evaluate planned changes for potential impact on product quality, the pharmaceutical quality system, documentation, validation, regulatory status, calibration, maintenance and any other system, so that unintended consequences are avoided and any process validation, verification or requalification can be planned.

ICH Q9(R1) supports this: the effort, formality and documentation should match the level of risk. In practice:

• Use a structured tool suited to the question, such as FMEA for a process or equipment change or a simple impact checklist for a document change. See quality risk management in the pharmaceutical industry.
• Ask the same questions each time: product quality, patient safety, validated status, registered details, stability, other products on shared equipment, data integrity, training and supply.
• Record the reasoning. “No impact” needs a sentence saying why, and the people who know the work, not only the initiator, should contribute (ICH Q10 §3.2.3).

3. QA review and approval

QA checks the assessment for completeness, challenges weak conclusions, confirms the class and decides: approve, approve with conditions, request more data or reject. Annex 15 §11.5 says changes should be authorised and approved by the responsible persons or relevant functional personnel under the pharmaceutical quality system, and §11.6 says supporting data should be reviewed to confirm that the impact of the change has been demonstrated before final approval.

In the US, 21 CFR 211.100(a) requires written procedures for production and process control and says that these procedures, including any changes, must be drafted, reviewed and approved by the appropriate organisational units and reviewed and approved by the quality control unit. EU GMP Chapter 1 §1.4 (xii) expects the pharmaceutical quality system to have arrangements for the prospective evaluation of planned changes and their approval before implementation, taking into account regulatory notification and approval where required.

4. Regulatory impact

A change that touches registered particulars may need to be notified to or approved by the regulator before it is used for marketed product. Regulatory affairs should compare the change against the approved dossier and the applicable rules and record the result.

In brief, for the main markets (each submission must be classified using the official lists and guidance for the market concerned):

Under 21 CFR 314.70 the applicant must assess the effects of a manufacturing change before distributing the product (314.70(a)(2)). A change with a substantial potential to have an adverse effect on identity, strength, quality, purity or potency needs FDA approval of a supplement first (314.70(b)); a moderate change needs a supplement and distribution may begin not less than 30 days after FDA receives it, unless FDA notifies the applicant otherwise (314.70(c)(4)), or on receipt for designated categories (314.70(c)(6)); a minimal-risk change goes in the annual report (314.70(d)). ANDA holders follow the same requirements: 21 CFR 314.97(a) applies §§314.70 and 314.71 to changes to an approved ANDA.

ICH Q12 adds established conditions: legally binding information considered necessary to assure product quality, so a change to them needs a regulatory submission. Regional uptake of Q12 differs, so confirm how it applies in each market you supply.

ICH Q10 §3.2.3 notes that working within an approved design space is not a change from a regulatory filing view, although it still goes through the quality system; Annex 15 §11.3 says changes to a design space should be considered against the registered design space.

If a submission is needed, do not implement the change for marketed product until the required approval or notification period has passed, and plan for the delay.

5. Implementation plan

Once approved, the change needs a plan that names each action, owner and due date.

Typical actions are to revise and issue documents under document control and withdraw superseded versions; train everyone affected before the change takes effect; update ERP, LIMS, maintenance and calibration data; qualify, validate or verify; inform suppliers and contract acceptors; and decide what happens to stock and work in progress made under the old state. Name the first batch or date made under the new state; auditors look for it.

6. Validation, qualification and verification

Many changes need evidence before the new state can be used. Typical needs: qualification for new equipment or utilities (DQ, IQ, OQ, PQ as appropriate); process validation or a bridging study (see process validation); method validation, verification or transfer; cleaning validation assessment; computerised system validation; and new stability data for packaging, process or site changes.

EU GMP Chapter 1 §1.4 (xiii) and Annex 15 §11.7 both come into play at the end of this stage: after implementation an evaluation is carried out to confirm that the quality objectives were achieved and that there was no unintended deleterious effect on product quality. Do not release the first commercial batches under the new state without defining which data you will look at.

7. Effectiveness check

The question is whether the change did what it was meant to, without side effects. Define the measure, period or number of batches, and success criterion at the planning stage. Examples (example in-house criteria):

8. Closure

Close the change only when all actions are complete, the evidence is attached, regulatory approvals are in place where needed, the effectiveness result is recorded and QA has approved the closure. State the outcome plainly: implemented and effective; implemented with follow-up; or cancelled, with the reason.

Trend the system too: changes by class and area, overdue changes, repeated emergency changes and reopened changes. EU GMP Chapter 1 §1.10 expects the product quality review to cover all changes made to processes or analytical methods.

Record retention. Keep change control records, assessments, approvals and supporting data for at least 1 year after the expiry date of the respective product batch (EU GMP Chapter 4 §4.11, which sets 5 years after certification if longer; 21 CFR 211.180(a)). Keep them longer if local law or the marketing authorisation requires.

Link to deviation, CAPA and risk management

Deviations can show that a procedure or process needs to change; the resulting change goes through change control (see the deviation management guide and the example failure investigation SOP). A CAPA often needs a change, so link both records and do not close the CAPA before the change is implemented and checked (see the CAPA guide). OOS results can lead to method or specification changes (see the OOS investigation guide).

Common findings seen at inspection

Typical weaknesses that auditors and inspectors write up:

• A change was implemented before QA approval, or the approval date is after the first batch made under the new state.
• The impact assessment is a tick-box list with “NA” or “no impact” and no reasoning.
• Regulatory impact was not assessed, so a registered particular was changed without notification or approval.
• Validation, qualification or stability needs were missed, or not finished before batch release.
• Temporary changes continued past their end date; many emergency changes closed with thin justification.
• No effectiveness check, or one that could not fail; changes not linked to the deviation or CAPA that caused them.

Revised Schedule M under the Drugs Rules, 1945 (G.S.R. 922(E), 28 December 2023) Part I, section 8 “Change control”, expects a documented system: 8.1 a formal change control system to evaluate changes that may affect production and control; 8.3 proposals drafted, reviewed and approved by the appropriate organisational units, then reviewed and approved by the quality unit; and 8.6 evaluation after implementation.

Worked example (fictional)

This example is invented; the product, dates and numbers are not from any real company.

Request. The packing department of a fictional site wants to replace the PVC/PVDC blister film of Product X (a 10 mg tablet) with film from a second approved supplier, because the current supplier has long lead times.

Provisional class. Critical: the primary pack touches the product and is described in the dossier.

Impact and risk assessment (summary). Moisture barrier properties could differ, so a comparative moisture-uptake study is required. Because it is a container closure change, three batches go on stability in the new pack. The supplier and film specification are in the dossier, so regulatory affairs classifies the change for each market and files before implementation. Sealing temperature may differ, so a seal-integrity study is run on three trial batches. Documents and ERP codes are revised, and the new supplier is qualified and audited before the first order.

QA review. QA approves with conditions: no commercial batch in the new film until stability data are reviewed, the regulatory filing is made and the trial batches pass.

Implementation. Regulatory affairs files for each market and the change stays open until approvals arrive; meanwhile the supplier is qualified, documents and training are updated and the trial batches are run.

Effectiveness check (example in-house criterion). The first 6 commercial batches in the new film: zero leak failures, no new complaints about blister damage, 3-month stability results within specification and not worse than the trend with the old film.

Closure. After 6 months, the leak-test data and stability results meet the criteria; regulatory approvals are on file; QA closes the change as implemented and effective and records it in the annual product quality review.

Printable change control form (example in-house)

A simple record layout that can be adapted to your own system:

Frequently asked questions

What is the difference between change control and deviation management?

Change control manages planned changes before they happen; a deviation is an unplanned departure found after the event and handled by investigation. A deviation may lead to a change. See the deviation management guide.

Does every change need regulatory approval?

No. Only changes that affect registered particulars need a notification or approval, and the type depends on the risk and the market. Regulatory affairs should decide this for each change and record it.

Who is allowed to approve a change?

The heads of the affected departments give technical approval, and QA gives the final approval or rejection before implementation. The initiator should not approve their own change.

Can a change be made before approval in an emergency?

Only under a defined emergency route in your SOP, with QA authorisation, a minimum documented risk assessment and full paperwork completed within a stated time.

How long do change control records have to be kept?

At least 1 year after the expiry date of the respective product batch (EU GMP Chapter 4 §4.11, or 5 years after certification if longer; 21 CFR 211.180(a)), and longer if local law or the marketing authorisation requires.

How does ICH Q12 relate to change control?

It introduces established conditions and tools for post-approval changes. It does not replace internal change control; it helps decide which changes need a submission.

References

1. ICH Q10, Pharmaceutical Quality System (Step 4, June 2008), §3.2.3 Change Management System. ich.org.
2. ICH Q9(R1), Quality Risk Management (adopted 18 January 2023). ich.org.
3. ICH Q12, Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management (Step 4, November 2019). ich.org.
4. European Commission, EudraLex Volume 4, EU GMP Part I Chapter 1: Pharmaceutical Quality System (in operation from 31 January 2013), §1.4 (xii) and (xiii), §1.10.
5. European Commission, EudraLex Volume 4, EU GMP Annex 15: Qualification and Validation (in operation from 1 October 2015), §11 Change Control.
6. European Commission, EudraLex Volume 4, EU GMP Part I Chapter 4: Documentation, §4.11.
7. US FDA, 21 CFR 211.100(a), Written procedures; deviations. ecfr.gov.
8. US FDA, 21 CFR 314.70, Supplements and other changes to an approved NDA; 21 CFR 314.97(a), Supplements and other changes to an approved ANDA. ecfr.gov.
9. US FDA, 21 CFR 211.180(a), General requirements for records. ecfr.gov.
10. Commission Regulation (EC) No 1234/2008 concerning the examination of variations to the terms of marketing authorisations, as amended by Regulation (EU) 2024/1701 (applies from 1 January 2025); Commission variations guidelines applicable from 15 January 2026, per the EMA revised variations framework page. ema.europa.eu.
11. Ministry of Health and Family Welfare, Government of India, Drugs Rules, 1945, revised Schedule M (G.S.R. 922(E), 28 December 2023), Part I, section 8 Change control (8.1, 8.3, 8.6). cdsco.gov.in.