Compliant. Connected. Complete.

White Paper:
Change Control – Continuous
Quality Improvement in FDA and ISO
Environments
Introduction
Globalization of the marketplace has greatly intensified competition. It has increased the pressure on manufacturers to
develop innovative, high-quality products faster and at a lower cost. To stay competitive, manufacturers must be quick to
meet customer demands and even quicker in adapting to changing market conditions.

The situation could not be more acute than in the FDA and ISO environments, where manufacturers must contend not
only with cutthroat competition and a dynamic market, but also stringent regulatory requirements. Consider the fiercely
competitive pharmaceutical industry. Only one of every 10,000 potential medicines investigated by American research-
based pharmaceutical companies makes it through the rigorous FDA approval process, according to the Pharmaceutical
Research and Manufacturers of America. It takes about 15 years at a cost of more than $800 million before a new
medicine is approved.

The road toward product development — and FDA approval or ISO certification — is clearly long, arduous, and costly.
After a product is launched in the market, the manufacturer must continue to comply with regulatory requirements to stay
in business. Regulations exist to ensure the safety and reliability of products. In this context, any change that affects the
“purity” and effectiveness of the approved product is critical.

Definition of Change
In the manufacturing environment, change refers to any modification in equipment, manufacturing materials, facilities,
utilities, design, formulations, processes, packaging/labeling, computer systems, and all associated documentation (SOPs,
quality manual, etc.).

A change may be a simple adjustment brought on by a new customer specification, or an updated document, or a part
replacement, or other production needs. It may be caused by a deviation from an approved regulatory filing or written
procedures. A change may be temporary or permanent, routine or emergency, innocuous or serious enough to shut down
production.

The fact that change is inevitable makes control a critical factor, especially in FDA and ISO-environments, where
inappropriate or “uncontrolled” changes could affect the safety and reliability of products and directly impact public
health and safety.

Here’s an example. On Oct. 24, 2005, the FDA announced a voluntary recall of certain models of Omron instant
thermometers because the thermometer tips could potentially overheat and pose risk to young children using the device.
The FDA noted that the overheating was a result of a change in the manufacturing process. The agency’s press release was
brief and did not describe the circumstances of the change that caused the quality problem, but it illustrates the critical
implications of change in the manufacture of medical devices in this case, or any other product for that matter. Whether
it’s a car or a computer or a pacemaker, the goal of regulatory bodies is to protect public safety by ensuring the highest
quality standards. For this reason, the concept of change control is closely interweaved with FDA and ISO compliance.

Regulatory Requirements
Change control requirements for medical device companies are outlined in FDA’s 21 CFR Part 820.30 (design changes),
820.40 (document changes), and 820.70 (production and process changes). 21 CFR Part 820 requires that manufacturers
establish written change control procedures, which describe company-approved procedures.

For pharmaceutical companies, written procedures are considered part of Current Good Manufacturing Practice (CGMP)
outlined in 21 CFR Part 210-211. Any changes in production and processes must be controlled — meaning recorded,
reviewed, and approved by the quality control unit. CGMP requirements are meant to prevent harm by building quality
into the development and production of medicines.

FDA & ISO Change Control Page  White Paper

Manufacturers certified to ISO 9000:2000 and ISO 13485 standards are required to ensure that any changes affecting the
quality management system (including product requirements, design, and development changes) should be controlled.

The underlying message in these regulations is that all changes should be made according to approved (approval implies
successful testing or thorough review/investigation) written company policies and procedures. Change control procedures
have to be written as a way of standardizing instructions. Written procedures are also more reliable compared with passing
on information verbally. “Uncontrolled” change in this context refers to modifications made without review and approval
of the quality control unit and other departments affected by the change.

In the FDA and ISO environments, strict adherence to approved policies and procedures is key in keeping manufacturing
operations in a state of control and it is what makes change control crucial.

Elements of Change Control

Change is typically introduced by an initiator or originator. Depending on the company and industry, the initiator may
or may not be the person who will carry the change through implementation. Initiating a change usually involves filling
in a change request form, which then moves through a process or system of review and approval. Most organizations
have a change control committee or board, which may be a single entity for an entire company, or there may be one
for a company’s every manufacturing site. The committee usually includes representatives from different departments
involved in production, such as quality, manufacturing, regulatory affairs, and engineering. Depending on the change, the
committee may also involve legal, sales, or marketing departments.

For pharmaceutical companies, the CGMP requires that all changes should be reviewed and approved by the quality
control unit. In these companies, there may be a “change administrator,” a role usually assumed by the quality unit.

Change control records usually cover: identification of the item/entity being changed, a description of the change,
identification of the affected documents, signatures of the approvers, approval date, and effective date.

In the medical device industry, each modified device, accessory, labeling, packaging, and process must be thoroughly
verified and or/validated by the appropriate department. The change control committee then reviews the test results and
other pertinent information.

Challenges
A change control system is necessary to prevent inappropriate modifications. While this sounds simple, implementation
can be complex and an inadequate system can cause internal confusion, noncompliance, or worse, a product recall or a
product liability lawsuit.

What makes change control so challenging? There are many factors, but the following are the most common issues:

Poor Communication – Lack of communication between departments, failure to follow up or escalate change
requests, and delayed or inappropriate notification of changes made by suppliers are some of the communication-
related issues that impact the change control process. Companies using a paper-based change control system
are likely to rely on face-to-face exchanges, such as change control board meetings, to discuss changes. The
effectiveness of these meetings depends on their frequency and the availability of members to meet as emergency
changes arise.

Poor Turnaround – Timeliness can make or break a product’s chances of succeeding in the market. Companies
that rely on a manual system to generate data and to route and track submissions and change orders are likely to
have poor turnaround for change implementation because the system requires more time and effort. The problem
becomes worse when there is an unexpected change — a deviation — and supporting data is not generated in a

FDA & ISO Change Control Page  White Paper

 timely manner. Delays may also result because of failure to recognize the urgency of a change and absence of a
contingency plan for certain types of changes.

Ineffective Documentation – A manual system makes it more difficult to update documentation, including
revision history, and to find/retrieve necessary data to support a change. The proposed change may be delayed
when an outdated record does not show revision history, or testing may be duplicated because documentation has
not been updated with results of a previous testing.

Training not Integrated with Change – Adequate training of personnel is a prerequisite in both FDA and
ISO environments. When training control is not connected to the rest of the quality process (such as in manual
systems), keeping training current with procedures that have changed can be difficult. Training tasks can easily
fall through the cracks if employees are not as vigilant in seeking them.

The MasterControl Solution

MasterControl Change Control™ is a robust solution designed to simplify the change control process by automating and
effectively managing every step of the way, from submission through actual implementation, verification, and close of
project. Here’s how MasterControl’s powerful features address major challenges in change control:

Improved Communication – Communication breakdown is likely to happen in companies that rely on tools and
processes that are not connected. MasterControl is an integrated solution that connects different departments with
each other and with data and processes under a secure and centralized system. This connectivity vastly improves
communication and increases efficiency through automatic task assignment, routing, scheduling, notification, and
escalation of overdue tasks. MasterControl is Web-based, so even suppliers and others outside the company (off-
site or traveling employees) who need to participate in change control can do so from virtually anywhere.
Faster Turnaround – MasterControl integrates and streamlines the entire change control process for faster
turnaround.

• A pre-configured, multi-page form helps collect and track data from submission through close of project. The
form incorporates priority level by identifying the change as routine or temporary or emergency. It prompts
risk assessment by asking the initiator to evaluate the change in terms of
training, validation, and regulatory requirements.

• MasterControl’s Organizer, similar to Windows Explorer, is an easy-to-use tool for search and retrieval of
documents. All SOPs and other documents related to a particular change can be grouped together. Users
can create virtual folders within Organizers that will automatically retrieve documents based on pre-defined
queries.

• MasterControl’s reporting capabilities provide real-time status for all change control tasks.

Effective Documentation – MasterControl automates documentation and reporting functions for increased
efficiency and effectiveness.

• It automatically provides revision history through the InfoCard, a MasterControl tool that provides basic
information about a document. The InfoCard also provides the document’s approval history. All changes made
to the InfoCard of every document are tracked, including reason(s) for every change.

• MasterControl maintains a secure, time-stamped audit trail as required by FDA’s 21 CFR Part 11. The audit
trail documents the identity of anyone who creates or modifies an electronic record, when the action occurred,
and the changes made to the record.

FDA & ISO Change Control Page  White Paper

 Integrates Training with Change Control – With MasterControl, the change control process can be integrated
with training control. Any change to a document or process that warrants new training will automatically invoke
training tasks upon approval of the change. MasterControl can automate the process of distributing online exams
with the training, and even includes automatic grading.

Conclusion
In this Age of the Internet, consumers worldwide have become more aware about product quality. In response,
manufacturers are changing their business philosophy. Customer satisfaction and continuous improvement of product
quality have become the objectives not only of regulatory bodies, but manufacturers themselves. At the operational level,
the focus is moving from detection to prevention. Companies recognize that it’s their primary responsibility to determine
if a proposed change could significantly affect safety or effectiveness of a product — and not for the FDA inspector or
ISO auditor to spot. Manufacturers increasingly realize that effective change control is integral to continuous quality
improvement, which can ultimately help them increase customer satisfaction and prevent product recalls, product liability
actions, and regulatory violations.

FDA & ISO Change Control Page  White Paper

About MasterControl Inc.
MasterControl Inc. has been at the forefront of providing quality management software solutions since 1993. Hundreds of
companies worldwide use MasterControl to help ensure compliance with FDA regulations such as 21 CFR Parts 11, 210-
211, 820, 606; ISO quality standards such as ISO 9000, ISO 13485, ISO 14000; and Sarbanes-Oxley Act requirements.
In addition to providing off-the-shelf products, MasterControl also offers comprehensive technical and customer support,
including product training, implementation, and validation services.

For additional industry white papers about automating quality and regulatory processes, visit www.mastercontrol.com,
or call, 800-825-9117.

MasterControl’s integrated quality management system helps connect quality processes enterprise-wide. The solution
provides automatic triggers to ensure tasks for handling quality-related incidents don’t fall through the cracks.
MasterControl’s integrated architecture ensures that the completion of one system process automatically launches the next
quality sub-system until the process loop is closed. Managers have analytical and reporting capabilities at their fingertips
to track and manage each quality process through completion.

© 2006 MasterControl Inc. All rights reserved.

FDA & ISO Change Control Page  White Paper

MasterControl Inc.
6340 S. 3000 E. Suite 150
Salt Lake City, UT 84121

P. 800.825.9117
F. 801.942.7088
www.mastercontrol.com