Questions that arrive through the contact form, answered here so the next person does not have to ask. Each answer cites the clause. Ask your own at the bottom.
Does a like-for-like replacement need a change control?
It needs a documented equivalence assessment, and most sites run that through the change system as a like-for-like class with a short form. What it does not need is the full cross-functional assessment, provided someone with the competence to judge has compared the two items on function, materials of construction, specification, supplier and, for anything with software, firmware and configuration, and recorded the comparison.
The finding inspectors write is not 'like-for-like replacements were made'. It is 'like-for-like was declared without an assessment'. If the only evidence is the phrase on a work order, the site has an uncontrolled change.
What makes a change minor rather than major, and who decides?
The site's procedure should define the criteria: typically, whether the change could affect product quality, the validated state, a registered particular or a quality agreement. QA decides, on the change owner's proposal, and the rationale is written into the record. A classification with no rationale is the one inspectors challenge, because it looks like the class was chosen to avoid the work.
Keep site classification and regulatory classification separate. A change can be minor for the site and still be a Type IB variation, or major for the site and not touch the dossier at all.
How do we know whether a change affects the marketing authorisation?
Someone from regulatory affairs reads the registered particulars for every affected market and says so in writing. That is the only defensible method. The variations classification guideline under Regulation (EC) 1234/2008 gives the categories, and Type IA, IB and II each carry a different implementation constraint, but the question of whether a specific change touches a specific dossier section can only be answered against the dossier.
A regulatory assessment that says 'no impact' with no name from regulatory affairs and no reference to the sections checked is the most common regulatory finding in change control.
Reg. (EC) 1234/2008 Articles 8 to 10 and the classification guidelineRead the full guide
Is a temporary change a change control or a planned deviation?
If the site intends to return to the approved state, it is a temporary change and belongs in the change system with an end date, the same assessment as a permanent change and a verification that the original state was restored. Some sites call this a planned deviation, which EU GMP 5.15 allows for a one-off departure, but the name does not reduce the assessment required.
The trap is the temporary change that is extended twice and then forgotten. Set a hard end date, permit one extension with QA approval, and make any second extension a permanent change request with full assessment.
The change was already made. Can we raise the change control now?
Raise a deviation. The change control system exists to assess before implementing, and a record opened afterward cannot do that whatever tense it is written in. The deviation investigates why the change bypassed the system, assesses the impact on everything produced since, and its CAPA may well be a change control to make the change properly or to reverse it.
Sites that allow retrospective change controls train people that the assessment is optional. Inspectors read the dates and reach the same conclusion.
Do routine software patches and vendor updates need change control?
Yes, for any validated computerised system. Annex 11 section 10 requires every change, including patches and configuration changes, to be assessed, authorised and documented, and GAMP 5 second edition expects the assessment to be scaled to risk rather than skipped. A well-run site has a fast track for low-risk patches with pre-agreed regression tests, not an exemption.
What inspectors check is the audit trail against the change log. A version number that changed on a date with no corresponding change record is the finding.
What does an effectiveness check for a change actually look like?
A measure, a period and a criterion, defined when the change is raised. If a filter change was made to reduce bioburden excursions, the check is the excursion rate over the next twenty batches against the rate before, with a pass threshold. If a procedure was rewritten to stop a recurring error, the check is the error count over three months. 'Change implemented, no issues observed' is a completion note, not an effectiveness check.
Close the change on the check result, not on the last action being ticked. A change whose check has not yet run stays open in a distinct status so that the open-change count stays honest.
We are a medical device company. Does this apply to us?
The vocabulary differs (design change under ISO 13485 7.3.9, QMS change under 4.1.4, substantial change notified to the notified body under MDR Annex IX) but the discipline is the same: describe the proposed state, assess the impact across validation, regulatory and customers, approve before implementing, verify what was implemented and check that it worked. The device rules are stricter in one respect: design changes must be verified or validated before implementation, without exception. The course is written around EU GMP and ICH Q10 and calls out the device equivalents where the expectations differ.
ISO 13485:2016 4.1.4, 7.3.9; MDR 2017/745 Annex IX
Have a question that is not here?
Ask it. A person answers within two working days, and if it is a good question it gets added to this page.
