Change Control: Introducing Changes in a Controlled Manner

The change request describes a specific difference

In the fictitious case RM-427, a damaged seal was found on container 3. The investigation pointed to a probable weakness: the inspection step in SOP-WE-12 V3 does not describe the handling of damaged seals clearly enough. The CAPA derived from this reads “Clarify the inspection step for damaged seals.”

The change request turns this action into a specific new instruction. It names the affected SOP, the previous version, the proposed change, and the reason for it. V4 is to describe unambiguously how a damaged seal is recorded, how the affected container is identified, and how the follow-up inspection is initiated.

A precise request shows the difference between the previous and the new requirement. “Optimize goods receipt” would be too general. Instead, the example compares the old and new versions of the inspection step: Which observations are documented, what immediate containment is required, and which role decides on the next review?

Annex 15, sections 11.2–11.7 describe change control governed by written procedures, with impact assessment, approval by those responsible, and appropriate follow-up review. It covers quality-relevant changes to materials, procedures, equipment, and test methods, among others. ^[1]

The change governs the future requirement

Deviation management investigates the finding already identified for RM-427 and assesses its consequences. Change control, by contrast, specifies the conditions under which work will be performed under V4 going forward. This keeps it clear which decision concerns the material received and which concerns the working procedure.

A new version does not retroactively change earlier executions. The container inspection of RM-427 was documented under SOP-WE-12 V3. This record remains in place. For new tasks, the organization specifies the date from which V4 applies and how tasks already in progress are handled.

A deviation that is foreseeable in advance also needs to be clearly categorized. If a procedure is to be performed differently in the future, the planned change must be assessed first. A short-term need does not replace this assessment. The operational procedure defines who assesses an urgent change and which prerequisites must be met before it is applied.

In the example, the line between this and the material decision must also remain clear. The revised SOP describes how to handle a finding. Whether RM-427 may be used is decided by the responsible Quality Control function on the basis of the investigation. The version change itself does not release the material.

Impact assessment covers all affected interfaces

For SOP-WE-12, the first step is to define the scope of the affected workflow. The change concerns the container inspection at goods receipt but may also affect Quality Control tasks, the documentation of containment measures, and the handover to the follow-up inspection. Role-based process control helps assign this review to the responsible departments.

The assessment asks what actually changes as a result of the new wording. Are existing criteria merely described more clearly? Are additional mandatory entries required? Does the sequence of steps change, or who is authorized to take the next step? The answers determine which evidence is required before the change is introduced.

ICH Q10 section 3.2.3 links change management to risk-based evaluation by appropriate experts. Changes must also be evaluated against the marketing authorization; necessary regulatory steps must be clarified. After implementation, the change should be evaluated to confirm that its objective was achieved and that there was no adverse impact on product quality. ^[2]

For RM-427, the responsible function assesses whether V4 merely explains the existing inspection or changes information relevant to the marketing authorization. § 29 AMG governs notifications of changes, changes requiring approval, and new marketing authorizations; its subsections 4 and 5 set out how it relates to EU procedures, including Regulation (EC) No 1234/2008. ^[3] Even a national marketing authorization therefore cannot automatically be assigned to the purely national change procedure.

Impact assessment also considers other affected documents. If training materials, templates, or other work instructions contain the previous wording, their revision is planned as well. The change record names the affected versions and the person responsible for each, so that the change does not stop at a single file.

Risk determines the evidence required

For RM-427, the depth of review is derived from the protective function of the seal, possible quality consequences, and remaining uncertainty. ICH Q9(R1) links this assessment to scientific knowledge and patient protection. ^[4] The risk classification in deviation management provides the starting point; change control adds the assessment of the new requirement, its interfaces, and the review effort required.

Approval sets the conditions for introduction

In the example, the responsible persons review the draft of V4 and the associated impact assessment. Open points are assigned to an owner. An unresolved question about material identification is therefore addressed before the change is introduced, and its outcome is documented.

The approval names the approved version and the conditions for its application. These may include completed reviews, available training materials, and a defined effective date. These conditions must be carried over into implementation planning so that it can later be verified that they were met.

EU GMP Chapter 4, section 4.3 requires instruction documents to be approved by appropriate authorized persons, clearly identified, and given a defined effective date. Section 4.5 addresses their regular review and updating. ^[5]

In the US CGMP context, 21 CFR 211.100(a) governs the drafting, review, and approval of written procedures for production and process control, including changes, by the appropriate organizational units and the quality control unit. ^[6] The operational procedure takes the applicable scope into account.

V4 is introduced with training and a defined transition

The rollout plan links the new version to a specific date and the affected activities. For SOP-WE-12, it specifies which tasks start under V4 and how ongoing tasks are handled. Existing execution records retain the version that applied at the time.

The affected personnel receive the training required for their activities. The record names the version covered and the attendance or the planned assessment. EU GMP Chapter 2, section 2.11 requires continuing training, records, and periodic assessment of its practical effectiveness. ^[7]

In the RM-427 case, the training walks through the new inspection step using a suitable example. The participant assigns the finding to a container, documents its condition, and describes the intended handover. This shows whether the change has been understood in a realistic work situation.

Introduction also means making the current instruction available at the workstation. Old working copies and templates in use are handled according to the defined procedure. The responsible person checks whether the people performing the work actually have access to the version intended for their task and whether the accompanying documents match it.

Implementation is documented with a record of the completed prerequisites. It shows, for example, the approved V4, the effective date, the required training, and the completed revision of a task template. The change request remains linked to these results so that a later review can trace the transition.

Where training is still outstanding, the organization defines who may already take on the new task. For ongoing tasks, the organization assesses what additional guidance is required; the record of the earlier execution retains its original snapshot.

420+ preserves the version used for actual execution

In 420+, an approved SOP template is converted into specific tasks. Each task preserves its SOP version as a snapshot. For the earlier inspection of RM-427, V3 therefore remains visible as the requirement that applied at the time, even after V4 becomes active.

New tasks are planned with the template intended for their execution. For a controlled rollout, the organization specifies when the new version is used and how ongoing work transitions to it. The snapshot makes the connection between requirement and execution verifiable in the record.

Roles, independent second-person review, deadlines, and escalations are configurable defaults. If a second review is required, it has its own step recording the decision of the authorized person. The approval workflow supports this documented handover between preparation, execution, and review.

For the change to SOP-WE-12, the associated tasks and records can be viewed together: draft, review, training, and later inspections. The organization defines the technical criteria. Digital work instructions connect the recorded actions with their context; the responsible persons assess the content.

The audit trail makes the change history of entries traceable. EU GMP Chapter 4, section 4.9 requires that the original information remains legible and that changes can be attributed. ^[5] During the follow-up review, this makes it possible to distinguish what was originally documented from what was later added or corrected.

The follow-up review checks whether the goal was met and looks for side effects

After the rollout, defined criteria are used to check whether V4 has provided the intended clarity. In the example, the responsible person reviews new container inspections and the associated follow-up inspections. Process variants make it possible to compare different documented sequences for this review.

The follow-up review also looks for unintended consequences. Has the new wording made other conditions unclear? Are undamaged containers being held back unnecessarily? Is information missing for further investigation? Such observations are assessed for their significance and, where necessary, turned into further tasks.

The CAPA effectiveness check and the follow-up review of the change can use shared evidence. Their questions remain distinct: change control evaluates the controlled introduction and the effects of V4; the CAPA evaluates whether the underlying weakness is adequately controlled. The organization can coordinate the reviews without inferring results from a completion status alone.

If the information collected is not yet sufficient, the next steps are defined and justified. This may include extended observation or an additional review. The decision names the missing information and the intended path to a reliable result.

Closure connects request, version, and follow-up review

For SOP-WE-12 V4, the closure record shows the original reason, the effects assessed, the approval, the actual introduction, and the result of the follow-up review. Any remaining follow-up work is given an owner and a due date. This keeps it clear on what basis the change was closed.

EU GMP Chapter 1, sections 1.4(xii) and (xiii) link the prior evaluation of planned changes to the later review of their objectives and effects. Under section 1.10(v), the Product Quality Review takes into account changes made to processes or analytical methods. ^[8]

How much this record can demonstrate depends on suitable input data, expert assessment, and the validation required for the intended use. For RM-427, it connects the identified procedural gap with an improvement introduced in a controlled way, while preserving the earlier execution under V3.

Frequently asked questions about change control

Does every text correction require a full change control project? The organization defines an appropriate procedure. What matters is the content of the change and its possible effects. A risk-based classification needs a documented justification.

What happens to tasks under V3? Their execution records retain the V3 snapshot. For tasks still in progress, the transition to the new version is defined by the organization; a new SOP does not rewrite earlier records.

Is approval of the document sufficient? Before the new version takes effect, the defined prerequisites must also be met, such as training and availability of the current version. The planned follow-up review comes afterward.

Who decides whether the marketing authorization is affected? The responsible specialist function assesses the specific change and any necessary regulatory steps. The internal label given to a change does not answer this question on its own.