Change control impact assessment: a system-level method with example
A practical method for assessing a GMP change across product, process, equipment, validation, suppliers, filings, documents and training, with a worked supplier change example.
A letter arrives from purchasing: the company that moulds your HDPE tablet bottles is closing its plant, and the replacement supplier can start deliveries in ten weeks. Somebody raises a change control, ticks "packaging" and "supplier", and sends it round for signatures. Six months later a stability pull shows higher moisture uptake, the line has been running slower because the new bottles jam at the capper, and nobody told regulatory affairs that the container closure system is described in the dossier.
That outcome is what a weak impact assessment looks like. This article gives you a method for assessing a change at system level, an impact assessment template you can adapt, guidance on how much effort a change deserves under ICH Q9(R1), and a worked example of that bottle supplier change from request to effectiveness check.
What the guidance expects from a change control impact assessment
ICH Q10, section 3.2.3, describes the change management system. It says quality risk management should be used to evaluate proposed changes, with effort and formality matched to the level of risk. Changes should be evaluated against the marketing authorisation and current product and process understanding, with a decision on whether the regulatory filing needs to change. They should be evaluated by people with the right expertise from development, manufacturing, quality, regulatory affairs and medical as relevant, and prospective evaluation criteria should be set. After implementation the change should be evaluated to confirm it achieved its objectives without harming product quality.
EU GMP turns that into inspectable expectations. Chapter 1, paragraph 1.4(xii) and (xiii), asks for prospective evaluation and approval of planned changes, taking account of regulatory notification, and a post-implementation evaluation. Annex 15, section 11.4, is the most specific: quality risk management should be used to evaluate planned changes for their potential impact on product quality, the pharmaceutical quality system, documentation, validation, regulatory status, calibration, maintenance and any other system, to avoid unintended consequences and to plan validation, verification or requalification.
Medical device manufacturers have the same idea in different words. ISO 13485 clause 4.1.4 requires changes to QMS processes to be evaluated for their impact on the QMS and on the devices produced. Clause 7.4.2 expects purchasing information to include, where applicable, an agreement that suppliers notify you of changes before they implement them. Under EU MDR Annex IX section 2.4, substantial changes to the quality management system or the device range must be notified to the notified body before they happen.
Why a department checklist misses system-level impact
Most change forms list departments with a yes/no box beside each. Production: yes. QC: yes. Regulatory: no. The problem is that each department answers for its own area and nobody looks at how the change moves through the system.
A system-level impact assessment follows the change outwards. A new bottle changes a material. The material changes moisture protection, which touches stability, which touches shelf life, which is in the marketing authorisation. The bottle's dimensions touch change parts on the line, which touch equipment qualification and line speed, which touch the batch record and operator training. Each link is obvious once written down. None of them appears if you only ask "does this affect packaging?"
The practical difference is one question asked for every area: what else does this connect to? Write the answers down. That chain of reasoning is what an inspector wants to read, and it is what ICH Q10 means by assurance that there are no unintended consequences.
A system-level impact assessment template
Use the areas below as the spine of your assessment. For each one, record whether there is an impact, the reasoning, the evidence or action needed, and who owns it. "No impact" needs a reason too.
| Area | Questions to answer |
|---|---|
| Product | Could quality attributes change: identity, strength, purity, stability, appearance, device performance? |
| Process | Do parameters, controls, yields, hold times or in-process checks change? |
| Equipment and facilities | New or modified equipment, change parts, utilities, calibration, maintenance plans? |
| Validation status | Does process, cleaning, method, equipment or computerised system validation still hold? What requalification is needed? |
| Materials and suppliers | New supplier or site, specification changes, qualification and audit, quality agreement updates? |
| Regulatory filings | Is the item described in the marketing authorisation or technical documentation? Variation, notification or notified body involvement? |
| Documents | SOPs, batch records, specifications, test methods, labels, drawings, risk files |
| Training | Who needs training, on what, before the effective date? |
| Quality system | Open deviations or CAPAs linked, product quality review, complaint trending, stability programme |
| Customers and contracts | Contract givers or customers to notify under quality agreements |
The template only works if the assessor writes reasons. "Validation: no impact" invites the question an inspector will ask anyway. "Validation: process validation unaffected, as the tablet process is unchanged; packaging line requalification required for new change parts, protocol PQ-087" closes it.
How much effort: applying ICH Q9(R1)
ICH Q9(R1), adopted in January 2023, added sections on formality, risk-based decision making and subjectivity. The guideline treats formality as a spectrum and names three factors that drive it: uncertainty, importance and complexity. More of any of them calls for a more formal approach, such as a cross-functional team, a structured tool and a standalone risk report. Section 5.1 also says resource constraints should not be used to justify lower formality.
For change control, that gives you a defensible way to tier changes. A like-for-like replacement of a pressure gauge with the same specification is low uncertainty, low complexity and modest importance; a short documented rationale is enough. A new primary packaging supplier is moderately complex, important to product quality and full of uncertainty about how the new material behaves; it needs a team and a structured assessment. Write the tiering criteria into your change control procedure so the decision is consistent and not a matter of who happens to be assessing.
Section 5.3 deals with subjectivity, which affects change control more than people admit. Two assessors can give the same change different risk scores, and an engineer who proposed a change is inclined to see it favourably. Q9(R1) points to clear risk questions, well-designed scoring scales and maximum use of data. In practice: define the risk question before scoring, use the same scale every time, and have someone who did not propose the change review the assessment.
Worked example: changing the HDPE bottle supplier
Return to the bottle supplier. The tablets are film-coated, packed 30 to a 60 ml HDPE bottle with a desiccant canister and an induction-sealed cap. The new supplier offers a bottle to the same drawing in what it describes as an equivalent resin grade.
Classification. This is a change to a primary packaging component, so it falls in the formal tier: product quality impact is possible, the dossier describes the container closure system, and there is uncertainty about the new resin. A cross-functional team is set up with QA, QC, packaging engineering, regulatory affairs, purchasing and validation.
Product. The risk question is whether moisture protection and compatibility are unchanged. The team requests resin specifications and compares moisture vapour transmission data for both bottles. If the data are not equivalent, stability on the new bottle becomes a condition of approval.
Process and equipment. Bottle dimensions are to the same drawing, but tolerances differ slightly. Trial runs on the line check feeding, cap torque, induction seal integrity and desiccant insertion. Any new change parts go through the engineering change process.
Validation status. Packaging line qualification is reviewed. The team decides a reduced requalification is needed: seal integrity testing and a defined number of packaging runs at normal speed. Process validation of the tablet itself is unaffected, and the assessment says why.
Supplier. The new supplier is qualified under the supplier management procedure: questionnaire, audit or justified alternative, and a quality agreement that includes advance notice of changes. Incoming inspection and the material specification are updated with the new supplier's details.
Regulatory filings. Regulatory affairs checks Module 3 of each marketing authorisation. If the dossier names the supplier or describes material or specifications that differ, a variation is needed before the change can be implemented for those markets, classified under the Commission guidelines on variation categories, which were updated with new guidelines applying from 15 January 2026. UK licences go to the MHRA. The filing route and timeline usually set the critical path, so this check comes first.
Documents and training. Affected documents are listed: packaging specification, incoming inspection SOP, batch packaging record, line setup instruction. Each revision goes through a document change request linked to this change control, and operators are trained on the setup changes before the effective date.
Quality system. The stability programme adds the first commercial batches in the new bottle. The product quality review will cover the change, as EU GMP Chapter 1 paragraph 1.10 requires a review of all changes to processes or analytical methods.
Effectiveness check. Criteria are set before approval: no increase in packaging line stoppages over the first ten batches, seal integrity results within limits, incoming inspection acceptance at the expected rate, and stability results at the first time points within specification. The change stays open until those are reviewed.
Closing the change: effectiveness checks that mean something
ICH Q10 and Chapter 1 both ask for evaluation after implementation, and Annex 15 section 11.7 asks for an evaluation of effectiveness where appropriate. The weak version is a signature saying "change implemented successfully" on the day the last document went live. The useful version tests the objective and the risks you identified, with criteria written before the change was approved. If the risk was moisture, the check is stability data. If the risk was line performance, it is stoppage data. A change with a ten-week implementation and a twelve-month stability tail can close its implementation actions and keep the effectiveness check open as a tracked action.
Takeaway
Assess each change by following it through the system and writing down every connection, instead of collecting a signature from each department. Write a reason for every "no impact", scale the formality to uncertainty, importance and complexity as ICH Q9(R1) describes, put the regulatory filing check at the start, and set effectiveness criteria before approval.
If you want the document revisions, training and CAPA actions that follow a change kept in one system with an append-only audit trail, take a look at the InnoQualis platform.
