Why companies move change control into software
Paper and spreadsheet change control works until the volume grows. Then the same problems appear: changes stuck waiting for a signature, actions that nobody tracks to completion, impact assessments copied from the last change, and no way to see which open changes affect a batch about to be released.
Change control software, usually a module of an electronic quality management system (eQMS), addresses these by routing changes, enforcing required steps, tracking actions and linking changes to documents, training, deviations and CAPA. ICH Q10 describes change management as one of the four core elements of a pharmaceutical quality system, alongside process performance monitoring, CAPA and management review. Software that links them is more useful than one that handles change control in isolation.
What GMP change control software must do
The software has to support the process that ICH Q10 section 3.2.3, EU GMP Annex 15 section 11 and 21 CFR 211.100(a) describe. Core functions:
| Function | Why it matters | Regulatory anchor |
|---|---|---|
| Structured change request | Consistent description of what changes, from what, to what | Annex 15 11.2 (written procedures for planned changes) |
| Classification rules | Consistent routing by risk | ICH Q10 (effort proportional to risk) |
| Impact assessment templates by change type | Ensures all areas are considered, with reasoning | ICH Q10 3.2.3; Annex 15 11.4 |
| Multi-function review | Expert teams contribute before approval | ICH Q10 3.2.3 (“evaluated by expert teams”) |
| Quality approval before implementation | Prevents implementation without approval | 211.100(a); Annex 15 11.5 |
| Action plan with owners and due dates | Every identified impact has an action | Annex 15 11.6 (supporting data before final approval) |
| Regulatory assessment field | Records reporting category and markets | 21 CFR 314.70 |
| Effectiveness check scheduling | Confirms the change achieved its objective | ICH Q10; Annex 15 11.7 |
| Links to documents, training, CAPA, deviations | Shows the full chain | ICH Q10 PQS elements |
| Batch or product impact view | Shows which batches are affected before release | 211.192 (release review) |
| Reporting and trending | Shows recurring changes, cycle times and overdue actions | ICH Q10 management review |
Required electronic record controls
Change control records are GMP records, so the software is in scope for electronic record rules.
21 CFR Part 11 applies where the records replace paper:
- Validation of the system (11.10(a))
- Secure, computer-generated, time-stamped audit trails where “record changes shall not obscure previously recorded information” (11.10(e))
- Operational checks that enforce step sequence (11.10(f)), so a change cannot be implemented before it is approved
- Authority checks so only authorized users can approve (11.10(g))
- Electronic signatures that show name, date and time, and the meaning of the signature (11.50)
EU GMP Annex 11 requires validation across the lifecycle, audit trails that are “regularly reviewed” (section 9), controlled changes to the system itself (section 10) and periodic evaluation (section 11). The 2025 consultation draft of a revised Annex 11 adds more detail on audit trail review.
Medical devices. Since February 2, 2026, the QMSR (21 CFR 820) incorporates ISO 13485:2016 and keeps Part 11 for electronic records and signatures. NAMSA notes that under the QMSR, management review, quality audit and supplier audit reports are no longer exempt from FDA inspection, which raises the bar for what the QMS software holds.
Validating change control software
Most change control software is configurable off-the-shelf or SaaS. A proportionate validation approach:
- Define intended use. Which change types, sites and workflows the system will handle, and which GMP decisions it supports.
- Assess the supplier. Quality system, development practices, release process, hosting and security. For SaaS, the quality agreement should cover update notification and data ownership.
- Assess risk by function. Approval enforcement, signature controls and audit trails are high risk. Report layouts are lower.
- Test proportionately. Scripted tests, including negative tests, for high-risk functions (can a change be implemented without approval? can an unauthorized user sign?). Lighter testing for configuration that does not affect GMP decisions.
- Validate the configuration, not just the product. Workflows, classification rules and templates are your configuration and need your testing.
- Plan for updates. SaaS vendors release often. Assess each release for impact on validated functions.
FDA’s September 2025 guidance on Computer Software Assurance describes this risk-based approach for production and quality system software. It is written for medical device manufacturers, but many drug manufacturers use it as a reference when justifying their validation scope. GAMP 5 Second Edition (ISPE, 2022) supports the same approach.
Questions to ask vendors
- Can workflows enforce quality approval before implementation, and can that rule be bypassed?
- Can impact assessment templates differ by change type, and are “no impact” answers required to have reasoning?
- Does the system link changes to documents, training records, CAPA and deviations natively?
- Can it show which open changes affect a product or batch?
- How are regulatory assessments recorded and reported?
- What Part 11 and Annex 11 controls are built in? Can we review the audit trail?
- What validation documentation do you provide, and how do you handle release updates?
- How is data exported if we leave?
- If AI features are offered, what do they do, and how are outputs reviewed by people?
Where software alone falls short
Software enforces steps. It does not make an impact assessment good. A system can require that every field is completed and still accept “N/A” in all of them. Quality comes from the people assessing the change, the templates that guide them, and the reviewers who challenge weak reasoning. Track measures such as the share of changes reopened after closure, effectiveness checks that fail, and deviations traced back to a change, to see whether the software is improving outcomes or just recording them.
Change control software selection checklist
- Intended use and change types in scope defined
- Quality approval before implementation enforced by the system
- Impact templates configurable by change type
- Links to documents, training, CAPA and deviations
- Regulatory assessment captured
- Effectiveness checks scheduled and tracked
- Part 11 / Annex 11 controls verified
- Supplier assessed; quality agreement covers updates and data
- Risk-based validation plan, including negative tests
- Outcome metrics defined, not just cycle time
Check the quality of your change records with AskDona
Change control software tells you whether steps were done. AskDona checks whether they were done well. It reads change requests, impact assessments and supporting evidence, exported from any system, and flags missing impact areas, unreasoned “no impact” answers and actions without evidence, linked to the source page. Run a sample change control assessment on records exported from your current system. AskDona shows the evidence; your quality unit decides.
FAQ
What is change control software? Software, usually part of an eQMS, that manages change requests through assessment, approval, implementation and effectiveness checks, with electronic records and signatures.
Does change control software need validation? Yes. It holds GMP records and enforces GMP decisions, so it must be validated for its intended use under Part 11 and Annex 11.
Can spreadsheets be used for change control? They can, but enforcing approval order, audit trails and signatures in a spreadsheet is difficult, and those controls are required for electronic records.
What is the difference between change control software and an eQMS? Change control is usually one module of an eQMS, which also covers documents, deviations, CAPA, training and audits.
Does CSA apply to drug manufacturers? FDA’s CSA guidance is written for medical device manufacturers. Drug manufacturers often use it as a reference for a risk-based approach, but should justify that in their own validation policy.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| ICH Q10 (FDA) | ICH guideline | Change management as a PQS element; section 3.2.3 |
| EU GMP Annex 15 (2015) | EU GMP guideline | Section 11 change control |
| EU GMP Annex 11 (2011) | EU GMP guideline | Sections 9, 10, 11 |
| Draft revised Annex 11 (2025 consultation) | EU draft guideline | Audit trail review detail |
| 21 CFR Part 11 (eCFR) | US regulation | 11.10 and 11.50 controls |
| 21 CFR Part 211 (eCFR) | US regulation | 211.100(a), 211.192 |
| 21 CFR 314.70 (eCFR) | US regulation | Regulatory reporting |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR effective date; Part 11; inspectable reports |
| RQA, FDA issues final guidance on Computer Software Assurance | Professional association news | CSA guidance date and scope |
| European Pharmaceutical Review, GAMP 5 update | Trade journal | GAMP 5 Second Edition |