GMP Change Control in Manufacturing: ICH Q12 and Real Risks
GMP Change Control in Manufacturing: from “like for like” to Established Conditions
The question that puts even mature sites under pressure during an audit
“How did you manage the PLC update on the line...?”
“Under which Change Control did you assess the impact of the new gasket supplier...?”
During audits, the issue I see most often is not that the change is completely missing. It is that the change was treated as maintenance, or “absorbed” into a deviation, without a real impact assessment on quality, validation, and dossier implications. The result: the inspector concludes that the actual process is no longer the approved one, or at least that this has not been demonstrated.
This article enters a zone that is often overlooked: Change Control as a lifecycle management tool, not as bureaucracy.
Note: in the GuideGxP technical guide, the lifecycle/change topic is explicitly recalled in the ICH context, including ICH Q12, and in the operational management of documents and process changes.
The myth to dismantle: “It’s like-for-like, so no Change Control is needed”
An outdated and risky practice is to consider any replacement “like-for-like” and therefore not formalize it.
Why is this dangerous in GMP?
- “Same” for purchasing does not mean equivalent for the process, whether in tolerances, roughness, chemical compatibility, firmware, or control algorithm.
- Many “invisible” changes generate slow drift that does not immediately explode as a deviation, but appears months later as OOT results, rejects, instability, or complaints.
- In an audit, the inspector does not evaluate your intention. They evaluate the documentary evidence that the impact was understood and controlled.
Contrarian insight: the phrase “nothing changes” is often the signal that you did not look in the right places, such as software, calibrations, product-contact materials, control parameters, or condition ranges.
Why ICH Q12 changes the way you should think about changes, even on the shop floor
Many manufacturing sites experience Change Control as “a form to close.” ICH Q12 pushes a more mature concept: some process conditions are Established Conditions (ECs), meaning elements that, if changed, require a structured pathway, including regulatory handling in some cases.
From a Manufacturing Manager’s perspective, this becomes a practical question:
“Does this modification affect an Established Condition? And if yes, what strategy are we using to manage it?”
At the same time, ICH Q12 introduces tools such as PACMP (Post-Approval Change Management Protocol). If prepared properly, these can make certain changes far more predictable and manageable.
Change, Deviation, Maintenance: the table that avoids endless discussions
| Situation | Correct output | Typical trigger | Risk if you choose the wrong “container” |
|---|---|---|---|
| Maintenance (restore qualified state) | Work order + maintenance record | wear-part replacement, lubrication, replacement of consumable parts | “Maintenance in disguise” = no GMP impact assessment |
| Deviation (unexpected event) | Deviation + RCA + CAPA | alarm, parameter out of limit, operator error | deviation used to introduce a stable change = finding |
| Change Control (intentional modification) | Change request + impact assessment + verification plan | new supplier, software patch, SOP change, setpoint change | change without verification = loss of state of control |
From a manufacturing perspective, when delivery pressure is high, the temptation is to say: “Put it in a deviation and restart.” But if the change remains over time, it is no longer a deviation.
The core of inspector-grade Change Control: Impact Assessment, not the narrative
A robust impact assessment is not a long text. It is a decision grid that leads to verifiable evidence.
Impact Assessment checklist — “shop floor” version
Explicitly assess:
- Impact on product quality: CQA/CPP, impurities, yield, variability, contamination, container closure integrity, including CCIT where applicable.
- Impact on validation/qualification: Is requalification needed? Targeted IQ/OQ? An engineering run with defined acceptance criteria?
- Impact on computerized systems: configuration management, audit trail, access, release notes, regression testing.
- Impact on cleaning and cross-contamination: Does cleanability change? Does the surface or gasket change? Are there new dead legs?
- Impact on regulatory affairs / CMC: Does it affect CTD Module 3 or the CMC dossier? Does it require a Type IA/IB/II variation or notification?
- Impact on supply chain: Is there a change in critical material? Does the Quality Agreement need updating? Has supplier notification been formally managed?
- Impact on training: SOPs, MBR, settings, in-process controls.
In the GuideGxP guide, the expectation is explicit that changes to documents and parameters must be managed through formal control and aligned with the dossier and quality system.
Audit-ready “change pack”: what they really want to see
In an audit, it is not enough to say “we assessed it.” You need to open a file and demonstrate it.
| Artifact | What the inspector checks | Typical red flag |
|---|---|---|
| Change request + rationale | why it is needed and what changes | vague purpose such as “improvement” |
| Change classification (minor/major, temporary/permanent) | consistency between risk and controls | “minor” with no rationale |
| Risk assessment (ICH Q9) | methodology and mitigations | “low risk” with no data |
| Test / verification plan | clear acceptance criteria | generic testing with “all ok” |
| Evidence of test execution | logs, reports, related deviations | absence of raw data |
| Training record | who was trained and when | training completed after go-live |
| RA impact statement | linkage to CMC / regulatory dossier | RA not involved |
| Closure + effectiveness check | post-change monitoring | immediate closure with no follow-up |
Practical case, real in dynamics, not a textbook example
Scenario: firmware update of the checkweigher in packaging to reduce false rejects.
Common mistake: handled as IT/Engineering maintenance. No Change Control because “the target weight does not change.”
What happens 6–8 weeks later
- “silent” increase in rejects, then small delivery delays,
- borderline reconciliations on packaging components,
- during the audit, the inspector asks: “When did you change the reject algorithm? Where are the regression tests?”
Correct handling, the way I would set it up
- Change Control with classification, since software on GMP equipment = at least medium risk
- impact assessment on data integrity, audit trail, versioning, process controls, and reconciliation
- tests: targeted FAT/SAT plus an engineering run with a challenge set of known-weight samples and documented acceptance criteria
- effectiveness check: trending of rejects and false rejects over 3 campaigns, plus event review
Box: remember this
- Like-for-like is a hypothesis to be demonstrated, not a shortcut.
- A technically “small” change can be large from a GMP/RA perspective if it affects Established Conditions or computerized systems.
- Good Change Control is not long. It is traceable, testable, and defensible.
FAQ
1) When does maintenance become Change Control?
When you are not simply restoring the qualified state, but changing materials, control logic, parameters, ranges, suppliers, or the operating mode.
2) How should a Temporary Change be managed under production pressure?
A temporary change must be managed as such: with duration, limits, mitigations, return criteria, and retrospective assessment. If it remains in place, it must be converted into a permanent change.
3) What are Established Conditions, and why do they matter to Manufacturing?
They are process or product conditions that, if changed, require rigorous management, often including RA involvement. On the shop floor, this means knowing what you cannot change “on the fly” without a formal strategy.
If you want to turn Change Control into an operational tool rather than a bureaucratic exercise, in the Manufacturing Manager Technical Guide you will find frameworks, examples, and checklists that can be used directly on the shop floor.