1What change control is.
ICH Q10 defines change management as “a systematic approach to proposing, evaluating, approving, implementing and reviewing changes”. Innovation, continual improvement, process and product monitoring and CAPA all drive change, and the change management system should give “a high degree of assurance there are no unintended consequences of the change”.¹ EU GMP Annex 15 defines change control as a formal system in which “qualified representatives of appropriate disciplines review proposed or actual changes that might affect the validated status of facilities, systems, equipment or processes”.² FDA’s quality systems guidance calls it a CGMP concept “that focuses on managing change to prevent unintended consequences”, provided for in the regulations mainly through the responsibilities of the quality control unit.³
2What the regulations and guidelines require.
| Source | Status | What it asks |
|---|---|---|
| 21 CFR 211.100(a) | US regulation | Written production and process control procedures, “including any changes”, are drafted, reviewed and approved by the appropriate units and reviewed and approved by the quality control unit⁴ |
| 21 CFR 211.160(a) | US regulation | The same for any change to specifications, standards, sampling plans, test procedures or other laboratory controls⁵ |
| 21 CFR 211.22(c) | US regulation | The quality control unit approves or rejects all procedures and specifications that affect identity, strength, quality and purity⁶ |
| EU GMP Chapter 1, 1.4 (xii) and (xiii) | EU guideline | Planned changes evaluated and approved before implementation, taking regulatory notification and approval into account, and evaluated after implementation⁷ |
| EU GMP Annex 15, section 11 | EU guideline, in operation since 1 October 2015 | Written procedures for planned changes, assessed with quality risk management, approved by the responsible persons, and checked for effectiveness² |
| ICH Q7, section 13 | ICH guideline for active substances | A formal change control system for all changes that may affect the production and control of an intermediate or API⁸ |
| ICH Q10, section 3.2.3 | ICH guideline | Risk-based evaluation, assessment against the marketing authorisation, expert review and evaluation after implementation¹ |
3The steps of the change control process.
- Propose the change. Record what will change and why. ICH Q7 lists what written procedures should cover: changes in raw materials, specifications, analytical methods, facilities, support systems, equipment, processing steps, labelling and packaging materials, and computer hardware and software.⁸
- Assess the impact and the risk. Use quality risk management, with effort and formality commensurate with the risk.¹ Annex 15 asks for the potential impact on product quality, the quality system, documentation, validation, regulatory status, calibration, maintenance and any other system to be evaluated, and for any validation, verification or requalification to be planned.² Among the uses of quality risk management in change management, ICH Q9(R1) lists evaluating the impact on the availability of the final product and deciding the actions needed before implementation, such as additional testing, requalification, revalidation or communication with regulators.⁹
- Classify it. ICH Q7 allows changes to be classified, for example as minor or major, depending on their nature, extent and likely effect on the process, to set the testing, validation and documentation needed.⁸ Decide whether the regulatory filing has to change under regional requirements.¹
- Review and approve. Proposed changes should be evaluated by experts from the relevant areas, such as development, manufacturing, quality, regulatory affairs and medical, with evaluation criteria set in advance.¹ The quality unit reviews and approves GMP-relevant changes,⁸⁴ and supporting data should be reviewed to confirm the change’s impact has been demonstrated before final approval.²
- Implement. Revise all documents the change affects.⁸ Where a change needs prior approval from the regulator, such as a major change to an approved US NDA, product made with it can’t be distributed until the supplement is approved.¹⁰
- Evaluate after implementation. Confirm the change met its objectives with no deleterious impact on product quality.¹⁷ For active substances, evaluate the first batches made or tested under the change, and evaluate whether a critical change could affect established retest or expiry dates; if necessary, samples made by the modified process can go on an accelerated stability programme or into the stability monitoring programme.⁸
- Review over time. The EU product quality review looks again at all changes made to processes or analytical methods in the review period.⁷
4When the regulator must be told.
Internal approval is not permission to market the changed product. In the US, an NDA holder must notify FDA about each change in a condition established in the approved application, beyond the variations it already provides for, and must assess the effects of a manufacturing change before distributing product made with it.¹⁰ The route depends on the potential for an adverse effect on identity, strength, quality, purity or potency:¹⁰
| Change | Potential adverse effect | How FDA is told |
|---|---|---|
| Major | Substantial | Supplement approved before distribution |
| Moderate | Moderate | Supplement submitted at least 30 days before distribution, or on receipt for categories FDA designates |
| Minor | Minimal | Described in the next annual report |
FDA’s quality systems guidance cites 21 CFR 514.8 and 601.12 alongside 314.70 for the major manufacturing changes that need regulatory filings and prior approval.³ In the EU, Chapter 1 asks for planned changes to be evaluated “taking into account regulatory notification and approval where required”.⁷ ICH Q10 notes that working within an approved design space is not a change from a regulatory filing point of view, but every change should still go through the company’s change management system.¹
5How formal it should be.
ICH Q10 notes that change management generally differs in formality before and after the initial regulatory submission, after which changes to the filing may be required. In development, change is documented with formality suited to the stage; in commercial manufacturing a formal change management system should be in place, with quality unit oversight “of appropriate science and risk based assessments”; and changes after a product is discontinued still go through change management.¹ Across all of it, the level of effort, formality and documentation should match the level of risk.⁹
6How it runs in Seal.
In Seal, change control connects a revision to every record it affects, such as the execution form, qualifications and controlled copies, and to planned verification cases with their actual results. Approval, implementation and permission to use the new revision are separate decisions: the effective point is set only after the evidence is reviewed, work in progress keeps its recorded version, and the effectiveness review is defined before implementation. A corrective action from a CAPA can be carried as a change to the workflow people run, not only to the document.
Neil traces what a change affects and drafts the revised workflow with its verification cases; your team confirms the scope and approves. Neil can also check implementation readiness, following an approved change into forms, training, controlled copies and verification, and propose the training an SOP change needs for each affected role. The change owner and QA authorise effective use.
References
- 1ICH Q10, Pharmaceutical Quality System, ICH, 4 June 2008, section 3.2.3, Table III and glossary. https:/
/ database. ich. org/ sites/ default/ files/ Q10%20Guideline. pdf (read 6 November 2026) - 2EudraLex Volume 4, Annex 15, Qualification and Validation, European Commission, 30 March 2015, in operation from 1 October 2015, section 11 and glossary. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ 2015- 10_ annex15_ 0. pdf (read 6 November 2026) - 3Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations, FDA, September 2006, section III.E. https:/
/ www. fda. gov/ media/ 71023/ download (read 6 November 2026) - 421 CFR 211.100, Written procedures; deviations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 100 (read 6 November 2026) - 521 CFR 211.160, General requirements (laboratory controls), eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 160 (read 6 November 2026) - 621 CFR 211.22, Responsibilities of quality control unit, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 22 (read 6 November 2026) - 7EudraLex Volume 4, Part I, Chapter 1, Pharmaceutical Quality System, European Commission, in operation from 31 January 2013, sections 1.4 and 1.10. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ vol4- chap1_ 2013- 01_ en_ 0. pdf (read 6 November 2026) - 8ICH Q7, Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, ICH, 10 November 2000, section 13. https:/
/ database. ich. org/ sites/ default/ files/ Q7%20Guideline. pdf (read 6 November 2026) - 9ICH Q9(R1), Quality Risk Management, ICH, adopted 18 January 2023, section 3 and Annex II.1. https:/
/ database. ich. org/ sites/ default/ files/ ICH_ Q9%28R1%29_ Guideline_ Step4_ 2023_ 0126_ 0. pdf (read 6 November 2026) - 1021 CFR 314.70, Supplements and other changes to an approved NDA, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 314. 70 (read 6 November 2026)
AQuestions and answers
What is the difference between change control and change management?
Very little in practice. ICH Q10 speaks of a change management system for proposing, evaluating, approving, implementing and reviewing changes, while EU GMP Annex 15 and ICH Q7 use change control for the formal system that reviews changes. ICH Q9(R1) uses both terms together.
What is a change control board?
ICH Q10, ICH Q7 and EU GMP Annex 15 don’t use the term, but they describe the job. ICH Q10 asks for proposed changes to be evaluated by expert teams from areas such as development, manufacturing, quality, regulatory affairs and medical, and Annex 15 describes qualified representatives of appropriate disciplines reviewing changes. In the US, the quality control unit must still review and approve changes to procedures and specifications.
Does every change need regulatory approval?
No. Every change goes through your own change control, but only some change the regulatory filing. For a US NDA, major changes need a supplement approved before distribution, most moderate changes a supplement filed at least 30 days before, and minor changes go in the annual report. Working within an approved design space is not a filing change.
What makes a change minor or major?
Inside the company, ICH Q7 lets you classify changes, for example as minor or major, by their nature, extent and likely effect on the process, to decide how much testing, validation and documentation they need. For a change to an approved US NDA, FDA classes them by their potential to have an adverse effect on identity, strength, quality, purity or potency: substantial, moderate or minimal.
Who approves a change in GMP?
In the US, the quality control unit reviews and approves changes to production procedures and laboratory controls after the responsible units have drafted and reviewed them. ICH Q7 asks for GMP-relevant changes to be approved by the quality unit, and EU Annex 15 by the responsible persons set out in the pharmaceutical quality system.