Why the impact assessment is the critical step
Every change control system has the same weak point: the impact assessment. Approvals, implementation and closure are mostly administrative. The impact assessment is where someone has to think about what the change could break. If it misses something, every later step will faithfully implement an incomplete plan.
Regulators expect this step to be driven by risk. ICH Q10 section 3.2.3 says “quality risk management should be utilized to evaluate proposed changes,” with effort matched to the level of risk, and that changes “should be evaluated by expert teams contributing the appropriate expertise.” EU GMP Annex 15 section 11.4 requires quality risk management to assess the impact of planned changes on product quality and on the need for requalification or revalidation.
When this goes wrong, it shows up in inspections. In a July 16, 2026 warning letter, FDA cited a firm for modifying a water system “without adequate requalification.” The firm’s fix, adding a risk assessment field to its change form, was rejected because it did not include a validation plan. A field on a form is not an assessment.
For a practical GMP change control impact assessment guide for pharma, see GMP Change Control Impact Assessment: A Practical Guide for Pharma. For medical device changes and when a new 510(k) is needed, see Medical Device Change Impact Assessment: When Do You Need a New 510(k)?.
What ICH Q9(R1) changed
ICH Q9(R1), which FDA finalized in May 2023, revised quality risk management guidance in four areas that bear directly on change assessments, according to RQA’s summary:
- Subjectivity: “high levels of subjectivity in risk assessments” were a recognized problem. Scores that depend on who is in the room are not reliable.
- Formality: companies were unsure how formal QRM needed to be. The revision explains that formality should scale with uncertainty, importance and complexity.
- Risk-based decision making: decisions should be traceable to the risk assessment, not made first and justified afterwards.
- Product availability: supply risks from quality problems are now explicitly in scope, which matters for changes to suppliers, sites and equipment.
For change impact assessments, this means two things. Simple changes can use a simple, checklist-based assessment. Complex or high-uncertainty changes need a more formal method and documented reasoning, not just a risk score.
The areas every impact assessment should cover
A complete assessment asks the same questions every time, even when most answers are “no impact.” Recording a reasoned “no impact” is what proves the question was asked.
| Area | Questions to answer | Typical evidence |
|---|---|---|
| Product quality | Can the change affect any CQA? Which products and batches? | Process knowledge, risk assessment, development data |
| Validation status | Does it affect a validated process, method, cleaning process, equipment or computer system? Is requalification or revalidation needed? | Validation master plan, qualification reports |
| Regulatory | Does it change anything in a filing? Which reporting category applies? Which markets? | Filed CMC sections, established conditions, regulatory assessment |
| Specifications and methods | Do specifications, test methods or sampling plans change? | Specifications, method validation reports |
| Stability | Is additional stability data needed? | Stability protocol, commitments |
| Documents | Which SOPs, master records, forms and drawings must change? | Document list |
| Training | Who needs retraining before implementation? | Training matrix |
| Suppliers and materials | Are suppliers, quality agreements or material specifications affected? | Supplier list, quality agreements |
| Equipment and facilities | Are equipment, utilities or room classifications affected? | Equipment lists, qualification status |
| Computer systems and data | Are configurations, interfaces, data migration or audit trails affected? | System inventory, validation records |
| Other sites and products | Does the same change apply elsewhere? Are shared equipment or materials involved? | Site and product matrix |
| Supply | Could it create a shortage or delay? | Supply plan |
Deciding on revalidation
Revalidation is the most expensive outcome of an impact assessment, so it is where pressure to under-assess is strongest. A clear decision path helps.
- Is the changed element part of a validated state? If not, record why and move on.
- Does the change move any parameter outside the validated range? If yes, revalidation or a new PPQ is needed.
- Is it within range but could still change performance? For example, new equipment of different design. Then requalification of the equipment and a documented assessment of process impact are needed; a limited PPQ may be justified.
- Is it a true like-for-like? Same design, same specification, same supplier part number. Requalification may be limited to installation checks, but the criteria for like-for-like must be defined in advance.
Whatever the decision, Annex 15 section 11.6 expects supporting data to be reviewed before the change gets final approval.
Deciding on regulatory reporting
For US drug applications, 21 CFR 314.70 assigns changes to categories by their potential adverse effect on identity, strength, quality, purity or potency: substantial (prior approval supplement), moderate (changes-being-effected supplement) or minimal (annual report). The impact assessment should record:
- Which filed sections the change touches
- The category chosen and the reasoning, with reference to FDA guidance on the change type
- Which other markets need to be assessed
- Whether affected product must be held until the regulatory step is complete
ICH Q12 established conditions make this easier when they are defined, because they show which elements are binding. ECA reported in April 2026 that FDA has adopted the final ICH Q12 guideline.
Common impact assessment failures
- The “no impact” default. Every box ticked “N/A” with no reasoning.
- Single-function assessment. Only the requester’s department contributed. ICH Q10 expects expert teams.
- Assessing the change, not the system. A new filter is assessed for its own validation, but not for its effect on cleaning validation or extractables.
- Ignoring other sites. The same equipment change is made at two sites, but only one assessed it.
- Score without reasoning. An RPN of 24 with no explanation of how it was reached.
- No link to actions. The assessment identifies a training need, but the action plan does not include it.
Change impact assessment checklist
- Change description is specific: from what, to what, where, which products
- Every assessment area is answered, with reasoning for “no impact”
- Assessors from each relevant function are named
- Formality of the risk method matches the change’s complexity and uncertainty
- Validation and qualification impact decided with a documented rationale
- Regulatory category and markets assessed
- Other sites, products and shared equipment considered
- Every identified impact has a matching action
- Supporting data reviewed before final approval
- Effectiveness criteria defined for after implementation
Check impact assessments with AskDona
The hardest part of reviewing an impact assessment is spotting what is missing. AskDona reads the change request, the impact assessment and related validation reports, SOPs and filings, then flags areas not addressed, “no impact” answers without reasoning, and identified impacts without matching actions, each linked to the source page. Run a sample change impact assessment on a recent change. AskDona shows the evidence; your quality unit decides.
FAQ
What is a change impact assessment? The documented evaluation, within change control, of how a proposed change could affect product quality, validated status, regulatory filings and other systems.
Who should perform a change impact assessment? A cross-functional team with the right expertise, as ICH Q10 expects, with quality unit review and approval.
Is a risk assessment the same as an impact assessment? Not quite. The impact assessment identifies what the change touches. The risk assessment evaluates how likely and how serious the effects are. Most procedures combine them.
When does a change need revalidation? When it moves a parameter outside the validated range, or could change process performance in a way the original validation did not cover.
How detailed should the assessment be? In line with ICH Q9(R1), formality should scale with the change’s complexity, uncertainty and importance.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| ICH Q10 (FDA) | ICH guideline | Section 3.2.3 change management |
| EU GMP Annex 15 (2015) | EU GMP guideline | Sections 11.4–11.7 |
| RQA, FDA Q9(R1) Quality Risk Management | Professional association news | Q9(R1) issues addressed |
| 21 CFR 314.70 (eCFR) | US regulation | Reporting categories |
| ECA, FDA adopts ICH Q12 | Industry news (April 2026) | ICH Q12 adoption |
| FDA warning letter, Island Kinetics / CoValence Laboratories (July 16, 2026) | FDA warning letter | Change without requalification |