Change Control - Compliance with FDA 21 CFR Part 820

#1
Hello Everybody,

I have been working in QA for 7 months now and have been tasked with updating our change control procedure. We are ISO13485 certified and also need to comply with FDA 21 CFR Part 820. We don't currently have enough controls in place with change - we are able to amend specifications, process and product without any input from QA/RA as these can be handled at departmental level so long as they don't impact on other areas.

As part of this procedure I am incorporating the following:

- Amended change classification system (minor, moderate, major/significant)
- QA review and approval of all changes
- Change control board approval for major changes
- Streamlining multiple change control procedures into one systematic procedure so we are taking a consistent approach.

However, with no previous experience I have no knowledge of how this would work out in practise. Ideally, I would like to escalate the larger changes to the change board for review and approval. This will be held on a weekly basis however I am now wondering whether this needs to be a physical meeting at all (Obviously for some it would be where resource, coordination, regulatory issues are more questionable).

As an alternative (where actions are straight forward), would it be appropriate to document the action plan within the change request form, which can then be approved electronically by QA and appropriate reviewers/impacted areas (CCB reps)? The change request form also includes reason, impact assessment, documentation, etc. and is currently already 4 pages long without the action plan. Is it standard practise to ask change initiators to document action plans with change requests? This seems like a quicker way of getting these approved.

Also, we don't currently inform our notified body of any changes we make to product/process. I have looked online but I am really struggling to distinguish between changes that require notification and those that do not. Does anybody know of any solid guidance on this, or an example decision tree/flow depicting how this decision is made in their own organisation? I'm also unsure as to "how" this communication should be provided to them, i.e. is email sufficient or should we have a controlled template for notifications to notified bodies?

I have to have this in place within 4 weeks as part of a NC so am slightly panicking now. I have come across this forum today so thought it would be worth a shot. I have tried to ask management for guidance on this but I can't seem to get a straight answer except for "it's up to you" :(

Thank you in advance for any help or guidance anyone can offer!
 
Elsmar Forum Sponsor

yodon

Staff member
Super Moderator
#2
I'm confused as to how you can be compliant with 13485 and say you don't have change controls in place.

The QSR very much parallels the 13485:2016 standard . The QSR states procedural requirements for:
* identification of change - same as 13485
* documentation of change - same as 13485
* validation or verification - same as 13485
* review - same as 13485
* approval -same as 13485

(13485 goes on to talk about change impact assessment to constituent parts, product in process, product delivered, risk management, and product realization.)

Don't make it too complicated. A change is a change. They ALL need to be done in compliance with the standard / regulations.
 

Mark Meer

Trusted Information Resource
#3
Hello neanybean, welcome to the forum! :bigwave:

First, if you are strictly concerned about 21 CFR 820 compliance, the change-control requirements are pretty straight forward. The suggestions you've proposed, while good practice, aren't really required by the regulations.

Did you get a NC sited by the FDA? If so, I'd be curious to know exactly what they identified as non-conforming. Otherwise, I'd suggest looking over the regulations - do a search for "Change", and just ensure that your system handles each one of the requirements.

It's difficult to give any specific advice without knowing details/needs/challenges of the organization, but I'm happy to give some general feedback...

...we are able to amend specifications, process and product without any input from QA/RA as these can be handled at departmental level so long as they don't impact on other areas.
This is definitely cause for concern! Unless there are people qualified to make quality and regulatory assessments of changes in each department, QA/RA should always be at the very least notified of changes.


As part of this procedure I am incorporating the following:

- Amended change classification system (minor, moderate, major/significant)
- QA review and approval of all changes
- Change control board approval for major changes
- Streamlining multiple change control procedures into one systematic procedure so we are taking a consistent approach.
All good improvements, I'd say. Especially the last - will simplify things tremendously.

...Ideally, I would like to escalate the larger changes to the change board for review and approval. This will be held on a weekly basis however I am now wondering whether this needs to be a physical meeting at all (Obviously for some it would be where resource, coordination, regulatory issues are more questionable).
What is the purpose of your "change board", if not to review and approve? Are they always the same people, or just parties that are impacted?

I agree, this doesn't have to be in physical meetings, and mandating weekly scheduling (or scheduling at all) is ill-advised, as the queue of changes, and nature of changes will inevitably vary.

As an alternative (where actions are straight forward), would it be appropriate to document the action plan within the change request form, which can then be approved electronically by QA and appropriate reviewers/impacted areas (CCB reps)? The change request form also includes reason, impact assessment, documentation, etc. and is currently already 4 pages long without the action plan. Is it standard practise to ask change initiators to document action plans with change requests? This seems like a quicker way of getting these approved.
This is a good strategy, IMO, and more-or-less the way we handle. Person initiating change request documents:
- Reason for change
- What needs to be changed, and how

We also have a checklist of standard impact assessments, which allows an action plan to be formed (e.g. what verification/validation, risk management, training, etc. tasks are required?)
- Does the change require notification to regulatory bodies?
- Does the change impact sampling plans? Is validity of previous testing impacted?
- Does the change impact device DMR/technical file?
- Does the change impact risk files?
- Does the change impact production?
- Are there any disposition requirements? i.e. how does the change affect current equipment, inventory, and product (both in inventory, and in the field)?
-...

Once completed, the request is then passed on for review by all affected parties. At this point the request can be revised as necessary for completion and accuracy, and is approved. Upon approval tasks are delegated (action plan).

Also, we don't currently inform our notified body of any changes we make to product/process. I have looked online but I am really struggling to distinguish between changes that require notification and those that do not. Does anybody know of any solid guidance on this, or an example decision tree/flow depicting how this decision is made in their own organisation? I'm also unsure as to "how" this communication should be provided to them, i.e. is email sufficient or should we have a controlled template for notifications to notified bodies?
There is a MEDDEV guidance for this.
If uncertain, don't hesitate to contact your notified body.

I have to have this in place within 4 weeks as part of a NC so am slightly panicking now. I have come across this forum today so thought it would be worth a shot. I have tried to ask management for guidance on this but I can't seem to get a straight answer except for "it's up to you" :(
Been there. But embrace the responsibility. You are tasked with setting up a major process! Consider the company operations and needs, and make sure you're creating something of value that will work in the context of your organisation.

Best of luck!

MM.
 
#4
Hello,
Ive worked in change control a few years and just want to give a brief answer to your questions.
1) as far as a formal committee meeting, its up do you, all you are required to do is to make sure that each change is vetted by sme's that are relevant to the change such as validation, facilities, utilities, manufacturing or QC, and QA.we always had regulatory as it is important to know if a change has affect on the dossier or changes something submitted for certification. We had a formal meeting and then changed it to just a meeting with Quality and Operations management and whomever is leading the change. Then decide if its minor or major and assign smes (subject matter experts) which will read the proposed change (vetting part) and approval will come through the software and approval of plan, QA, management of the complete plan.
2) Risk assessments are an important component with all smes and quality.
3) Regulatory takes care of notified body
4) You will have to determine guidelines for what is minor or major and what needs regulatory or notification
5) you form sounds like it covers everything except for timelines for when the change will be implemented and closed and if an effectivess review is needed. You do not need a list of actions on the opening of the change just overall what is being done and how. The actions may not all be knownuntil the smes meet and do a risk assessment and then they MUST send a statement of what their department needs to do (this will be the actions of the change). In addition, any documents that will be changed should be listed as well as references to other documents, specs, manufacturers etc..as needed.

So, having said that there is a lot of leeway as to how you accomplish it, but the most important is quality and sme approval of the change plan, a formal meeting is not required unless you feel its beneficial as the smes, quality will meet for the risk assessment and also review and approve the final change plan online software (or you will need a signature page). You can not do notifications by email, there may be an online form but this is usually done by a regulatory or trained management person. Concentrate on defining minor and major, which sme's will be needed, when and who will approve, and how will it be documented when the actions are done and, the change implemented? meaning its back to ISO (GMP) standards. All smes's will need training as well as QA and change leaders.
Good Luck!
 
Thread starter Similar threads Forum Replies Date
A UDI and Design Controls - Labeling change via the Design Control process 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
D Change Control - Product Name Change and its associated labeling EU Medical Device Regulations 7
U Change Management vs Change Control? Design and Development of Products and Processes 4
R Software change control process and defect tracking ISO 13485:2016 - Medical Device Quality Management Systems 1
R SaMD - Software as a Medical Device - Software change control form ISO 13485:2016 - Medical Device Quality Management Systems 3
Y Informational Change control process - Major vs Minor change - Active class III medical devices ISO 13485:2016 - Medical Device Quality Management Systems 12
T Change control and configuration management - When to create a new model/part number? Other Medical Device and Orthopedic Related Topics 0
JoshuaFroud Change Control - Minimum Requirements and Unhappy Staff ISO 13485:2016 - Medical Device Quality Management Systems 16
A Can change control can be closed if the CAPA is still open? Nonconformance and Corrective Action 3
S DHF File Change Control Requirements 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 1
C Medical Device Website Change Control ISO 13485:2016 - Medical Device Quality Management Systems 3
Y Change Control - General Processes ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 1
S Change Control Form vs. Document Change Notification ISO 13485:2016 - Medical Device Quality Management Systems 3
B IATF 16949 Clause 8.5.6.1.1 (Temporary Process Control Change) IATF 16949 - Automotive Quality Systems Standard 24
R Does anyone have any experience on change control? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
E Challenges in document control, revisional control, and change control Document Control Systems, Procedures, Forms and Templates 8
elkel Control Plan Contents - Part Number / Latest Change Level FMEA and Control Plans 2
M Document Change Control for a Very Small Business Document Control Systems, Procedures, Forms and Templates 12
S How to connect NCMR, Deviations and Change Control ? Nonconformance and Corrective Action 2
V Can Regulatory Head Initiate/Trigger the Change Control for Quality Procedures US Food and Drug Administration (FDA) 9
T Change Control Requirements when changing Suppliers IATF 16949 - Automotive Quality Systems Standard 4
drgnrider How to control documents that most likely won't change ever ? Document Control Systems, Procedures, Forms and Templates 5
T Paper Quality Manual Change Control Methods Quality Management System (QMS) Manuals 5
A Company Name Change & Control of Documents Document Control Systems, Procedures, Forms and Templates 9
L Use of checksum(s) to control product change(s) Misc. Quality Assurance and Business Systems Related Topics 1
C Change Control Forms Post Software Validation Medical Information Technology, Medical Software and Health Informatics 2
T Searching for books which have content of 7.1.4. Change Control topics Book, Video, Blog and Web Site Reviews and Recommendations 2
C Change Control in a SCRUM World Misc. Quality Assurance and Business Systems Related Topics 3
J Change in our SharePoint Document Control Process - Is this ok? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 7
S Is it possible to have a General Change Control SOP and Form? Document Control Systems, Procedures, Forms and Templates 6
H Blood Banking (CFR 21 PART 606) Change Control Requirements US Food and Drug Administration (FDA) 8
K Change Control for Software System that Controls Aspects of GMP Quality Assurance and Compliance Software Tools and Solutions 5
E Help with ECR/DCR Document Change Control Software Validation Qualification and Validation (including 21 CFR Part 11) 6
J ECO (Engineering Change Order) Control for Unreleased Products Document Control Systems, Procedures, Forms and Templates 3
A Change Ratio [Guideline in Control Limit Update] Statistical Analysis Tools, Techniques and SPC 3
L Engineering Change Control Software Systems - Recommendations? Document Control Systems, Procedures, Forms and Templates 2
T TS 16949 compliant Change Control Management Process IATF 16949 - Automotive Quality Systems Standard 3
A Document Control Procedure Change 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 3
M Internal Auditing of Area with Active Change Control Internal Auditing 14
M Change Control Process - Deviation from Standard for Parts Document Control Systems, Procedures, Forms and Templates 1
Q Document Control ECO (Engineering Change Order) or QMS? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 14
T Living Documents which change every day - Control or Uncontrolled? ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 12
A Change Control Review Management Success or Effectiveness Metric Quality Manager and Management Related Issues 3
C Change Control Plan/Procedure for Slickline/Wireline Services (Oil Field) Quality Manager and Management Related Issues 1
A Design/Change Control Procedure - How to cope with Changes during Development? 21 CFR Part 820 - US FDA Quality System Regulations (QSR) 26
A Implementing a change for a particular Process - Document & Change Control ISO 9000, ISO 9001, and ISO 9004 Quality Management Systems Standards 3
P Change Control Training - Change Control for Medical Devices Training - Internal, External, Online and Distance Learning 6
2 Minor Document Change Control - Minor text changes to work procedures Document Control Systems, Procedures, Forms and Templates 9
V Do we need to enclose Draft version of Proposed Changes in Change Control US Food and Drug Administration (FDA) 8
V Where & How to Capture Details of Periodic Reviews of Change Control & CAPAs Pharmaceuticals (21 CFR Part 210, 21 CFR Part 211 and related Regulations) 8
Similar threads


















































Top Bottom