What change control is
Change control is the system a regulated manufacturer uses to propose, assess, approve, implement and verify changes to anything that could affect product quality: materials, processes, equipment, facilities, utilities, test methods, computer systems, suppliers and documents. Its purpose is simple. A validated, approved state should not drift because of a change nobody evaluated.
In this article, change control means the GMP quality system process. The same term is used in IT service management and project management, where it covers similar steps with different rules.
What the regulations require
US drugs. 21 CFR 211.100(a) requires written procedures for production and process control, and says these procedures, “including any changes, shall be drafted, reviewed, and approved” by the appropriate units and the quality control unit. Changes to an approved application are also governed by 21 CFR 314.70, which sets reporting categories (below).
ICH Q10. Section 3.2.3 makes change management one of the four elements of a pharmaceutical quality system. It requires that “quality risk management should be utilized to evaluate proposed changes,” that “proposed changes should be evaluated by expert teams,” and that after implementation, “an evaluation of the change should be undertaken to confirm the change objectives were achieved.”
EU GMP. Annex 15 section 11 requires written procedures for planned changes, quality risk management to assess impact and the need for requalification or revalidation, authorization by responsible persons, review of supporting data before final approval, and an effectiveness check after implementation.
Medical devices. Since February 2, 2026, FDA’s QMSR incorporates ISO 13485:2016 by reference. ISO 13485 requires changes to QMS processes to be evaluated for their impact (clause 4.1.4), design and development changes to be controlled (clause 7.3.9), and revalidation of processes where changes affect validated processes (clause 7.5.6).
The change control process, step by step
Most procedures follow the same sequence, whatever the system used.
- Initiate. The requester describes the change, the reason and the scope: what is changing, from what, to what.
- Classify. The change is categorized (for example minor, major, critical) using defined criteria.
- Assess impact. Subject matter experts assess the effect on product quality, validation status, regulatory filings, documents, training, suppliers and other sites. This is the step that most often fails. See our guide to change impact assessment.
- Define actions. The plan lists every task needed before and after implementation: validation, document updates, training, regulatory submissions, stability studies.
- Approve. The quality unit approves the change and the plan before implementation. ICH Q10 and Annex 15 both require approval by responsible persons.
- Implement. Actions are completed and evidence is attached.
- Verify and close. The quality unit confirms all actions are done, including any regulatory approval needed before release of affected product.
- Check effectiveness. After a defined period, confirm the change achieved its objective and caused no harm, as ICH Q10 and Annex 15 (11.7) require.
The order matters. Quality approval comes before implementation. A change implemented first and documented later is a deviation, not a change control.
Regulatory reporting: when a change needs FDA
Internal approval is not always enough. For drugs with an approved NDA or ANDA, 21 CFR 314.70 sets three categories:
| Category | Definition in 314.70 | When product can be distributed |
|---|---|---|
| Major change (prior approval supplement) | “Substantial potential to have an adverse effect” on identity, strength, quality, purity or potency | After FDA approval |
| Moderate change (CBE-30 / CBE) | “Moderate potential to have an adverse effect” | 30 days after FDA receives the supplement, or on receipt for designated categories |
| Minor change (annual report) | “Minimal potential to have an adverse effect” | Immediately; reported in the next annual report |
ICH Q12 adds tools for planning changes ahead: established conditions, which define what is binding in the filing, and post-approval change management protocols (PACMPs), which agree on a change strategy with the regulator in advance. ECA reported in April 2026 that FDA has adopted the final ICH Q12 guideline, with reporting categories of prior approval, notification moderate, notification low and not reported.
The change control record must show the regulatory assessment. If a change needs a supplement, affected product cannot be distributed until the right regulatory step is complete.
Planned changes, temporary changes and emergencies
| Type | Example | Key control |
|---|---|---|
| Planned permanent change | New supplier for an excipient | Full assessment and approval before implementation |
| Temporary change | Use of a backup piece of equipment for two weeks | Defined end date; assessment of each affected batch; return to original state verified |
| Emergency change | Replacing a failed pump to keep a sterile line running | Documented immediately; retrospective assessment with quality involvement; no release until assessed |
| Like-for-like replacement | Identical part, same specification | Defined criteria for what qualifies as like-for-like; still recorded |
The like-for-like category is where problems hide. If the criteria are loose, real changes avoid assessment.
What inspectors find
- Changes without requalification. In a July 16, 2026 warning letter, FDA cited Island Kinetics (CoValence Laboratories) for a water system modified in October 2024 “without adequate requalification.” The firm’s response, adding a risk assessment field to its change form, was judged inadequate because it lacked a validation plan.
- Procedures changed without quality approval. Section 211.100(a) requires quality unit review of procedure changes. It was cited 162 times in FDA Form 483 observations in FY2025, per GMP Insiders, though not all of those relate to change control.
- Missed regulatory impact. A change filed as minor that should have been a supplement.
- Open actions at closure. Training or document updates listed in the plan but never completed.
- No effectiveness check. The change is closed on implementation with no follow-up.
- Change control used as a fix for deviations. A deviation is “resolved” by raising a change, without investigating why it happened.
Change control checklist
- Written procedure covers all change types, including temporary and emergency changes
- Classification criteria are defined and applied consistently
- Impact assessment covers quality, validation, regulatory, documents, training and suppliers
- Quality risk management is used to scale the assessment
- Quality unit approves before implementation
- Regulatory reporting category is decided and documented
- Action plan is complete, with evidence attached for each action
- No affected product is released before required actions are done
- Effectiveness check is defined and performed
- Change records are trended for recurring issues
Check change records with AskDona
A change control file is only as good as its weakest link: an impact area nobody considered, an action without evidence, a regulatory category that does not match the change. AskDona reads change requests, impact assessments, validation reports and SOPs and checks them against 21 CFR 211, 314.70, ICH Q10, Annex 15 and your procedures, flagging gaps with the page they come from. Run a sample change control assessment on a recently closed change. AskDona shows the evidence; your quality unit decides.
FAQ
What is change control in pharma? The GMP process for proposing, assessing, approving, implementing and verifying changes that could affect product quality or the validated state.
What are the steps of change control? Initiate, classify, assess impact, plan actions, approve, implement, verify and close, then check effectiveness.
Who approves a change control? The quality unit, with input from subject matter experts. In the US, 211.100(a) requires quality unit review and approval of changes to production procedures.
What is the difference between change control and change management? ICH Q10 uses “change management” for the system as a whole. “Change control” usually refers to the procedure and records for individual changes.
Does every change need an FDA submission? No. Under 314.70, minor changes go in the annual report. Moderate and major changes need a supplement before or within a set period of distribution.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| 21 CFR Part 211 (eCFR) | US regulation | 211.100(a) |
| 21 CFR 314.70 (eCFR) | US regulation | Reporting categories |
| ICH Q10 (FDA) | ICH guideline | Section 3.2.3 change management |
| EU GMP Annex 15 (2015) | EU GMP guideline | Section 11 change control |
| ECA, FDA adopts ICH Q12 | Industry news (April 2026) | ICH Q12 tools and categories |
| NAMSA, Industry Update: QMSR | CRO / consultancy article | QMSR effective date |
| FDA warning letter, Island Kinetics / CoValence Laboratories (July 16, 2026) | FDA warning letter | Change without requalification |
| GMP Insiders, FY2025 FDA inspection observations | Industry analysis of FDA data | 211.100(a) citation count |