GMP Audit for Change Control: Managing Change Without Risk

What Change Control Audits Cover

Change control is the system through which a company evaluates, approves, implements, and verifies changes to products, processes, systems, and facilities. It is essential because change is constant, and unmanaged change creates risk.

A GMP audit for change control assesses whether changes are identified, whether impact is assessed, whether approvals are obtained, whether implementation is controlled, and whether effectiveness is verified. The scope includes change requests, impact assessment, regulatory assessment, approval, implementation, and effectiveness checks.

Also read: GMP Audit for Deviation Management: From Detection to CAPA

The Regulatory Context

EU GMP Chapter 1 and Chapter 4

Chapter 1 of EudraLex Volume 4 requires a pharmaceutical quality system that includes change control. Chapter 4 covers documentation, including change control records.

FDA 21 CFR 211

The FDA requires that changes be controlled. Section 211.100 covers written procedures for production and process control, and section 211.160 covers laboratory controls.

ICH Q9 and Q10

ICH Q9 provides the framework for risk assessment in change control. ICH Q10 links change control to continual improvement.

MHRA and Change Control

The MHRA expects prospective assessment of changes, including impact to licence and capacity, and effectiveness checks after changes.

PIC/S and WHO

PIC/S Guide PE 009 and WHO GMP guidelines cover change control as part of the broader GMP framework.

What Audits Focus On

Change Identification

Changes should be identified and documented. The audit should check that staff are trained to recognize changes and that reporting is encouraged.

Impact Assessment

Impact should be assessed for quality, safety, efficacy, and regulatory status. The audit should check that assessments are thorough and documented.

Regulatory Assessment

Changes that affect regulatory filings should be identified and filed. The audit should check that regulatory impact is assessed and that filings are made.

Approval

Changes should be approved by authorized persons. The audit should check that approvals are obtained and documented.

Implementation

Changes should be implemented as approved. The audit should check that implementation is controlled and documented.

Effectiveness Checks

Changes should be verified as effective. The audit should check that effectiveness checks are defined and performed.

Documentation

Change records should be complete. The audit should check that documentation is contemporaneous and traceable.

Common Findings in Change Control Audits

Impact Assessments That Are Incomplete

Regulatory Impact That Is Not Assessed

Approvals That Are Not Obtained

Implementation That Does Not Match Approval

Effectiveness Checks That Are Not Performed

Documentation Gaps

Introducing GxP Cellators for Change Control Audits

GxP Cellators provides GMP audits for change control covering identification, impact assessment, regulatory assessment, approval, implementation, effectiveness checks, and documentation.

We work across FDA, EMA, Health Canada, MHRA, WHO, and PIC/S frameworks, and we adapt the audit scope to the systems in use. Our auditors bring regulatory inspection and industry quality experience, and we deliver clear, prioritized reports with practical remediation guidance.