The impact assessment is the part of a change control an inspector reads most carefully, because it is where the site either thought about the consequences or did not. The commonest weakness is an assessment that consists of a checklist of areas, each marked 'no impact', signed by the person who raised the change. That is not an assessment. It is a list of areas that were not assessed.
What the assessment has to establish
Annex 15 11.3 names the areas explicitly: product quality, the pharmaceutical quality system, documentation, validation, regulatory status, calibration, maintenance and 'any other system'. ICH Q10 3.2.3 expects the evaluation to be by 'appropriate expertise and knowledge from relevant areas' and to consider product and process understanding, regulatory implications and, for design space, whether the change stays within it. The assessment has to answer, for each area, three questions: is this area affected, what is the evidence for that answer, and what action follows.
The areas, and who answers for each
- Qualification and validation: does the change affect a qualified system, a validated process, cleaning validation, a validated method or a computerised system? Answered by validation, with reference to the affected protocol or report numbers. The action is a re-qualification or re-validation scope, or a documented rationale for none.
- Product quality and stability: could the change affect a critical quality attribute, degradation profile, container closure integrity or shelf life? Answered by QA and development, with reference to the control strategy. The action may be stability commitment batches or a formal comparability protocol.
- Regulatory: does the change alter any registered particular in any market? Answered by regulatory affairs against the current dossier. The action is the variation or supplement type and the implementation constraint that follows from it.
- Analytical: does the change affect a method, a specification, a reference standard or laboratory equipment? Answered by QC. The action may be method verification, transfer or revalidation.
- Quality agreements and customers: does a quality agreement oblige notification or approval? Answered by QA against the agreement itself. The action is the notification, and implementation waits for the response if the agreement requires it.
- Supply and materials: does the change affect approved suppliers, material specifications, inventory of the old version, or the ability to supply during implementation? Answered by supply chain and purchasing.
- Safety, environment and premises: does the change alter room classification, flows, containment, utilities load or safety cases? Answered by engineering and EHS.
- Documentation and training: which SOPs, batch records, specifications, drawings, P&IDs and training curricula change, and who must be trained before go-live? Answered by document control and the owning function.
Cross-functional means the functions, not the form
The form routes to the functions; it does not make them think. A signature from the validation manager on a change that affected a validated process does not prove the process was assessed. The record should show what each function considered: the documents they consulted, the reasoning, and the conclusion. For major changes, a change review meeting with minutes is worth more than a routed form, because it captures the interaction between functions: the regulatory constraint that changes the implementation date, the stability requirement that changes the batch plan, the cleaning question that engineering had not thought of.
Risk assessment: proportionate, not decorative
ICH Q9 (R1) is explicit that the level of effort, formality and documentation should be commensurate with the level of risk, and that risk assessments must not be used to justify a decision already taken. For a minor change, a structured set of questions answered with evidence is a risk assessment. For a major change, an FMEA or a hazard analysis on the affected process steps is appropriate. What the assessment must do is identify the specific ways the change could cause harm, judge their likelihood and detectability, and lead to controls that reduce them. An FMEA with every row scored low that was completed after the implementation date is a finding, not a control.
The scope question inspectors always ask
What else does this change touch? A change to a shared utility affects every product on it. A change to a material affects every product that uses it. A change to a method affects every specification that references it. A change to a supplier affects every site that buys from it. The assessment should list the affected products, systems and sites explicitly, and 'this product only' should be justified in the same way as 'no impact'.
Timing
The assessment is prospective. It is completed and approved before implementation begins, and it produces the action plan that the implementation follows. Assessments completed on the day of implementation, or revised after it to match what was done, are the easiest findings an inspector ever writes, because the dates are on the form. Module 3 of the course works through the assessment for four change types with a template, the functional questions for each area, and the evidence a reviewer should expect to see.