Change Control Best Practices

The old adage that -- the only thing constant is change -- is true. Within organizations, changes are always occurring due to market drivers, staff changes, new regulations, resource availability, and technological changes. These changes can include changes in policies and procedures, processes, systems, staff, products, services, equipment, materials, emissions, etc. Change management refers to the ability to request, analyze, and decide on a change in a document, process, or object, and then to track the status of that change.

Each time a change occurs in the organization, it will impact other areas of the organization and throughout the value chain. For example, if a new software application is installed within an organization (an audit system), new SOPs will need to be written for the system, training will need to be scheduled, and the auditee may need to be notified that their reports will look different. In order for an organization to minimize the risk that changes can have on the organization, the organization must identify these potential changes, thoroughly evaluate the impacts of the changes and the risk of not doing them, obtain the necessary approvals, communicate with the affected parties, and create action plans to implement the changes.

Change management is not just a matter of best practices, it is the law for most companies. In accordance with many regulatory standards and guidelines, change control-- or controlling or managing change within an organization-- must be conducted to ensure that the organization can maintain and improve quality by identifying changes that could improve the product, ensuring proper review and analysis of the changes, and documenting and communicating the changes to the appropriate stakesholders. For example, the ISO regulations, having a continual improvement and document control tone, infer that change should be managed. In addition, the medical device regulations of 21 CFR Part 820, specifically regulate change management.

Change Control Challenges

There are many problems associated with documentation and change control. The most frequent ones are:

Insufficient documentation
Need for keeping the documentation up-to-date (including revision history)
Poor Filing strategy decision framework
Lack of adequate review by regulatory affairs to develop a filing strategy
Lack of involvement by regulatory affairs, resulting in variances between the data developed and the data necessary for submission

Most problems can be solved by developing procedures and having those procedures embedded into the change control process. In addition, a key solution is to ensure the more narrow perspective of change control – the formal process ensuring that any changes to elements within the organization are performed in accordance with the change specification—is done within the broader framework of change management. Change management is that broader process which allows for standardization of procedures and activities for all types of changes, and the monitoring of those changes within a continual improvement mindset to minimize change-related impacts and enhance efficiency.

Best Practices for Good Automated Change Control

A good automated change control system provides these components:

Establish consistent enterprise change control procedures. Change control affects the entire enterprise. It is best practice to establish global internal policies and procedures from the top down for effective change control management of both documents and processes.
Avoid point solutions. Change control is an essential core component of your quality management systems infrastructure. Avoid one-off point solutions to address these requirements. It is recommended best practice to apply consistent change control procedures across the enterprise and standardize on a systems approach that facilitates organizational collaboration and process change.
Security. Prevents or detects unauthorized or accidental changes. This component of the change control system will address the internal control requirement that all changes require authorization prior to implementation.
Documented changes. Current best practice is to ensure that the system maintains a detailed history of all changes and records the time and dates of any changes, who made them, and their ultimate disposition (successful or deleted). This aspect of an automated change control system addresses the internal control requirement that stipulates authorization of changes and requires traceability for actual changes.
Quality assurance. The established current best practice for change control is designed to ensure consistency. Quality assurance procedures for review and approval should be applied to ensure consistency.
21 CFR Part 11 compliance. Current best practice dictates that all change control systems be designed in compliance with 21 CFR Part 11 requirements.
Comprehensive document/process lifecycle workflow. Documents and processes change over the course of business operations. Effective management and change control of processes and documents is essential to efficient business operations. Current best practice thinking for mature organizations is to automate compliance processes and manage their lifecycle while controlling all documents in support of these processes. It is recommended best practice to establish an automated change control workflow process to support both documents and processes.
Ensure validation. It is established best practice that all change control systems be deployed in validated systems environments. Change control is mandated under GMP predicate rules that require validation for all quality processes. It is important to establish a set of user requirements for the system so that all validation activities can be performed in accordance with intended use.
Built-in best change control best practices. An effective change control system includes built-in best practices to support the following regulatory requirements as mandated by cGMP predicate rules.
- Ability to define an electronic change request that includes
  - Description of change
  - Reason for change
  - Notes
  - Change category
  - Electronic signature matrix/electronic signature workflow approval
  - Controlled distribution
  - Read-and-understood capabilit

eQCM Overview