Part 17

Change control is one of the principal mechanisms for maintaining the qualified state after a facility, utility, equipment, automated system, or process has been qualified.

Your master source specifically requires Part 17 to explain qualification-impact assessment for changes involving:

Component replacement, instrument replacement, PLC change, software upgrade, HMI modification, SCADA modification, recipe change, utility change, equipment relocation, process change, capacity change, new product, new operating range, and material-of-construction change.

The required lifecycle is:

Change → GMP Impact → Risk Assessment → Qualification Impact → Required Testing → Documentation Update → Approval → Implementation → Verification → Closure.

This section expands that source requirement into a practical pharmaceutical qualification framework.

17.1 What Is Change Control?

Change control is a documented process used to:

• describe a proposed change;
• understand why it is required;
• evaluate its GMP and technical impact;
• identify associated risks;
• determine qualification/validation impact;
• define required verification or testing;
• update affected documentation;
• obtain appropriate approval;
• implement the change in a controlled manner;
• verify successful implementation;
• formally close the change.

From a qualification perspective, the fundamental question is:

Does this change affect the evidence previously used to establish that the system is fit for its intended GMP use?

17.2 Why Change Control Is Critical to Qualification

Qualification demonstrates the suitability of a specific system configuration.

Consider:

Equipment Configuration A
        ↓
IQ
        ↓
OQ
        ↓
PQ
        ↓
Qualified State

Later:

Configuration A
        ↓
CHANGE
        ↓
Configuration B

The qualification evidence was generated against Configuration A.

The organization must therefore determine:

Which parts of the existing qualification remain valid for Configuration B?

That is the qualification-impact assessment.

17.3 Qualification Is Not Permanent Regardless of Change

A common misconception is:

“The equipment was qualified five years ago, so it remains qualified.”

Qualification status depends upon maintaining the state of control.

Your master source’s complete lifecycle specifically places:

Routine Operation → Change Control + Calibration + PM + Monitoring → Periodic Review/Requalification.

Therefore, change control is one of the mechanisms connecting initial qualification with continued qualified status.

17.4 Core Change-Control Principle

The correct question is not:

“Do we need full requalification?”

The first questions should be:

What changed?

What could the change affect?

Which previously verified requirements/functions are potentially impacted?

What evidence is required to demonstrate continued suitability?

Only after these questions are answered should the requalification scope be determined.

17.5 Required Change-Control Lifecycle

Based directly on the source-required sequence:

CHANGE PROPOSED
      ↓
GMP IMPACT ASSESSMENT
      ↓
RISK ASSESSMENT
      ↓
QUALIFICATION IMPACT
      ↓
REQUIRED TESTING
      ↓
DOCUMENTATION UPDATE
      ↓
APPROVAL
      ↓
IMPLEMENTATION
      ↓
VERIFICATION
      ↓
CLOSURE

Each stage has a distinct purpose.

17.6 Stage 1 — Change

The proposed change should first be clearly defined.

The description should answer:

What exists now?

Current configuration.

What is proposed?

Future configuration.

Why is it changing?

Business, technical, quality, safety, obsolescence, maintenance, capacity, regulatory or other reason.

Where is the change?

Equipment/system/subsystem/component.

When will it occur?

Implementation plan.

17.7 Weak vs Strong Change Description

Weak

Replace sensor.

Better

Replace the existing product-temperature sensor identified as TT-101 with the proposed replacement instrument due to obsolescence. The change will include replacement, configuration, calibration, installation verification and assessment of affected control/alarm functions.

The second description provides sufficient information for meaningful impact assessment.

17.8 Current vs Proposed State

A useful change-control table is:

The comparison helps identify actual differences.

17.9 Stage 2 — GMP Impact Assessment

The source requires GMP Impact as the first formal assessment after identifying the change.

Consider potential impact on:

• product quality;
• patient safety;
• product identity;
• strength;
• purity;
• quality;
• CPPs;
• CQAs;
• GMP records;
• data integrity;
• contamination control;
• cross-contamination;
• environmental conditions;
• critical utilities.

These impact areas are consistent with the source’s system/GMP impact-assessment framework.

17.10 GMP Impact Questions

Ask:

Product

Could the change affect product quality?

Process

Could it affect a CPP or process-control function?

Equipment

Could it affect critical equipment functionality?

Cleaning

Could it affect cleanability or cleaning validation?

Utilities

Could it affect utility quality or capacity?

Automation

Could it affect PLC/HMI/SCADA functionality?

Data

Could it affect GMP records or data integrity?

Safety

Could it affect safety systems/interlocks?

Validated Processes

Could it affect process, cleaning or computerized-system validation?

17.11 Stage 3 — Risk Assessment

The source requires risk assessment to follow GMP-impact determination.

The master source’s Part 5 states that qualification risk assessment should determine:

What needs to be tested, why it needs testing, how extensively it should be tested, and where documented supplier/commissioning evidence may be leveraged.

That same principle applies when determining qualification scope after change.

17.12 Risk Assessment Should Drive Testing

Avoid the automatic rule:

Any change = Repeat IQ/OQ/PQ

Instead:

Change
   ↓
Potential Failure Modes
   ↓
GMP/Critical Functions Affected
   ↓
Existing Controls
   ↓
Risk
   ↓
Required Verification

The scope should be scientifically and risk justified.

17.13 Example — Risk-Based Assessment

Change:

Replacement of temperature transmitter.

Potential risks:

• incorrect temperature measurement;
• wrong PLC input scaling;
• alarm activation at incorrect value;
• incorrect process control;
• incorrect GMP record.

Potential verification:

• instrument identification;
• installation;
• calibration;
• range;
• PLC scaling;
• displayed value;
• alarm/setpoint response;
• associated recording where applicable.

The scope follows the actual impact.

17.14 Stage 4 — Qualification Impact Assessment

This is the heart of Part 17.

Determine whether the change affects:

DQ

Has the approved design changed?

IQ

Has installation/configuration changed?

OQ

Has functionality, range, alarm, interlock, control or software changed?

PQ

Could actual performance under routine operating conditions change?

Process Validation

Could process performance or CPP/CQA relationships be affected?

Cleaning Validation

Could product-contact surfaces or cleaning parameters change?

Computerized-System Controls

Could software, configuration, records, interfaces or data-integrity controls change?

17.15 Qualification Impact Matrix

This is a practical risk-screening model, not a source-mandated classification.

17.16 Stage 5 — Required Testing

Once qualification impact is understood, define required verification.

Possible outcomes include:

• documentation review only;
• calibration;
• engineering verification;
• partial IQ;
• partial OQ;
• functional testing;
• alarm/interlock testing;
• regression testing;
• partial PQ;
• full PQ;
• process validation assessment;
• cleaning validation assessment;
• computerized-system testing;
• utility qualification;
• full or partial requalification.

17.17 Testing Should Match the Change

A useful principle is:

Test the changed element, its affected interfaces, and any functions whose previous qualification evidence could reasonably have been invalidated by the change.

Do not unnecessarily repeat unrelated tests.

At the same time, do not test only the physical component when downstream functions are affected.

17.18 Stage 6 — Documentation Update

The source explicitly requires Documentation Update before implementation completion.

Potentially affected documents include:

• URS;
• risk assessment;
• design specification;
• functional specification;
• drawings;
• P&IDs;
• electrical drawings;
• instrument list;
• equipment list;
• software/configuration specifications;
• traceability matrix;
• SOPs;
• calibration records;
• preventive-maintenance program;
• spare-parts list;
• training material;
• qualification documents.

17.19 As-Built Documentation

Where the physical system changes, the final documentation should represent the actual installed state.

Example:

Original P&ID
     ↓
Piping Change
     ↓
Approved Modification
     ↓
Installation
     ↓
Verification
     ↓
Updated As-Built P&ID

An outdated drawing can create future qualification, maintenance and inspection problems.

17.20 Stage 7 — Approval

The proposed change and required actions should be appropriately approved before controlled implementation according to the company’s PQS.

Potential functions include:

• Production;
• Engineering;
• Validation/CQV;
• QA;
• QC;
• Automation;
• IT;
• EHS;
• project team.

The master source requires the later RACI to cover these functions and clarifies that actual responsibilities depend on the company’s pharmaceutical quality system.

17.21 Stage 8 — Implementation

Implementation should follow the approved change plan.

Potential implementation evidence includes:

• work order;
• installation record;
• software deployment record;
• configuration record;
• vendor report;
• calibration;
• component certificate;
• backup record;
• updated drawing;
• engineering verification.

Uncontrolled implementation followed by retrospective paperwork weakens the evidence chain.

17.22 Stage 9 — Verification

After implementation, verify:

Was the approved change actually implemented correctly?

and:

Does the affected system continue to meet its defined requirements?

Verification can include:

Installation Verification
        +
Calibration
        +
Functional Testing
        +
Alarm/Interlock Testing
        +
Regression Testing
        +
PQ where required
        +
Document Review
        ↓
Change Verification

17.23 Stage 10 — Closure

Before closing the change, confirm that:

• implementation is complete;
• required qualification testing is complete;
• acceptance criteria are met;
• deviations are resolved/dispositioned;
• documents are updated;
• training is complete where required;
• traceability is updated;
• residual risks are acceptable;
• final qualified state is established.

17.24 Change Closure Checklist

• □ Change implemented as approved
• □ GMP impact assessed
• □ Risk assessment completed
• □ Qualification impact assessed
• □ Required testing completed
• □ Acceptance criteria met
• □ Deviations addressed
• □ Documents updated
• □ Configuration updated
• □ SOPs updated where required
• □ Training completed where required
• □ Traceability updated
• □ Residual risk assessed
• □ QA disposition completed
• □ Qualified-state impact concluded

17.25 Example 1 — Component Replacement

The source explicitly identifies component replacement as a change requiring qualification-impact assessment.

First determine whether replacement is:

• equivalent/like-for-like;
• functionally equivalent but technically different;
• upgraded;
• different material;
• different capacity;
• different operating characteristic.

Do not assume that every replacement has identical qualification impact.

17.26 Like-for-Like Replacement

Suppose a failed motor is replaced with an equivalent approved motor having the same:

• specification;
• power;
• speed;
• electrical characteristics;
• mounting;
• function.

A documented assessment may justify limited verification.

Possible activities:

Installation verification → Rotation/function check → Safety check → Relevant operational verification.

But the exact scope should follow risk.

17.27 Non-Like-for-Like Component Replacement

Suppose the replacement motor has:

• different power;
• different maximum speed;
• different VFD;
• different control characteristics.

The impact could extend to:

• operating range;
• control logic;
• alarms;
• equipment capacity;
• process performance.

The qualification scope should expand accordingly.

17.28 Example 2 — Instrument Replacement

The source explicitly lists instrument replacement.

Assess:

• manufacturer/model;
• measuring principle;
• range;
• accuracy;
• resolution;
• tolerance;
• output;
• PLC scaling;
• alarm/setpoint interfaces;
• calibration;
• GMP record impact.

Part 25 of the source separately requires evaluation of instrument range, accuracy, tolerance, traceability and calibration suitability.

17.29 Instrument Replacement Decision

Instrument Replacement
        ↓
Same Specification?
    ┌───┴───┐
   YES     NO
    │       │
Installation/   Expanded
Calibration     Impact Assessment
Verification       ↓
    │          Range/Accuracy/
    │          Interface/Control
    │             ↓
    └──────→ Define Qualification Tests

17.30 Example 3 — PLC Change

A PLC change can be particularly significant because one logic modification may affect multiple functions.

Assess:

• program version;
• logic;
• sequence;
• alarms;
• interlocks;
• calculations;
• recipes;
• HMI communication;
• SCADA communication;
• electronic records;
• interfaces.

The source specifically identifies PLC changes and separately requires PLC logic to be challenged during OQ.

17.31 PLC Regression Testing

Example:

Change:

Modify reject logic on a tablet compression machine.

Potentially affected:

Reject Trigger
      ↓
PLC Logic
      ↓
Reject Solenoid
      ↓
Reject Confirmation
      ↓
Reject Counter
      ↓
Alarm
      ↓
HMI Display
      ↓
Batch / Electronic Record

Testing only the solenoid may therefore be insufficient.

Regression testing should consider the affected functional chain.

17.32 Example 4 — Software Upgrade

The source specifically identifies software upgrade and later requires requalification assessment after software modification.

Potential impacts:

• application functionality;
• configuration;
• interfaces;
• security;
• access controls;
• audit trails;
• reports;
• electronic records;
• backup/restore;
• data migration;
• time synchronization;
• archival/retention.

The source’s Part 20 requires these computerized-system considerations to be addressed based on applicability and risk.

17.33 Software Upgrade — Version Control

Record:

Previous Version: ______

New Version: ______

Configuration Baseline: ______

Backup Before Change: ______

Release Notes Reviewed: Yes/No

Qualification Impact: ______

Regression Scope: ______

Final Verified Version: ______

This establishes configuration traceability.

17.34 Example 5 — HMI Modification

The source explicitly lists HMI modification.

Examples:

• new screen;
• modified setpoint;
• changed user role;
• altered alarm display;
• recipe screen modification;
• changed parameter limits.

Potential qualification impact depends on what the screen controls.

A cosmetic text change may differ greatly from changing a critical process setpoint.

17.35 Example 6 — SCADA Modification

SCADA modifications may affect:

• data acquisition;
• alarms;
• trends;
• electronic records;
• user access;
• audit trail;
• reporting;
• interfaces;
• data storage;
• backup/restore.

The source specifically requires SCADA and related data-integrity functions to be considered during computerized-system qualification.

17.36 Example 7 — Recipe Change

The source explicitly lists recipe change.

First distinguish:

Routine Approved Recipe Parameter Entry

A normal operational activity within a previously qualified and procedurally controlled range.

versus

Recipe Configuration Change

A change to:

• parameter limits;
• sequence;
• calculation;
• phase;
• control logic;
• recipe structure.

The second may require qualification/validation impact assessment.

17.37 Recipe Change Questions

Ask:

• Is the parameter within the qualified operating range?
• Is the change permitted by the approved process?
• Does the recipe alter a CPP?
• Does it affect a CQA?
• Does it change sequence logic?
• Does it affect alarms/interlocks?
• Does it affect electronic records?
• Is process validation affected?

17.38 Example 8 — Utility Change

The source explicitly identifies utility change.

Examples:

• purified water modification;
• compressed-air modification;
• HVAC modification;
• nitrogen supply modification;
• clean-steam modification.

Potential impact includes:

• utility quality;
• flow;
• pressure;
• capacity;
• distribution;
• contamination;
• alarms;
• monitoring.

Part 24 of the source requires qualification considerations for PW, WFI, clean steam, compressed air, nitrogen, vacuum and process gases.

17.39 Example 9 — Equipment Relocation

The source explicitly identifies equipment relocation.

Relocation can affect:

• installation;
• leveling;
• electrical supply;
• utilities;
• exhaust;
• HVAC;
• environmental conditions;
• material/personnel flow;
• network connectivity;
• interfaces;
• process performance.

Therefore:

Same equipment ≠ automatically same qualified state after relocation.

17.40 Relocation Assessment

Equipment Relocation
       ↓
New Location Suitable?
       ↓
Utilities Equivalent?
       ↓
Installation Affected?
       ↓
Environment/HVAC Affected?
       ↓
Interfaces Affected?
       ↓
Functionality Affected?
       ↓
Performance Affected?
       ↓
Define IQ/OQ/PQ Scope

The source’s Part 18 specifically identifies requalification after relocation as a separate requalification trigger to assess.

17.41 Example 10 — Process Change

The source explicitly lists process change.

Examples:

• granulation time;
• mixing sequence;
• drying strategy;
• compression parameter;
• coating process;
• hold time.

Qualification impact should be distinguished from process-validation impact.

The equipment may remain mechanically qualified while the manufacturing process requires validation assessment.

17.42 Example 11 — Capacity Change

Capacity changes may include:

• larger batch;
• increased throughput;
• increased speed;
• additional equipment load;
• utility demand increase.

Assess whether the new capacity remains within:

• equipment design;
• qualified range;
• utility capacity;
• environmental capability;
• validated process range.

17.43 Example — Capacity Increase

Original qualified blender load:

200–500 kg

Proposed:

600 kg

The question is not simply:

“Can the motor turn?”

Potential impacts include:

• blend uniformity;
• motor load;
• mixing dynamics;
• equipment limits;
• process validation.

The existing PQ evidence may not cover the new condition.

17.44 Example 12 — New Product

The source explicitly lists new product.

A new product may introduce different:

• potency;
• dust characteristics;
• containment requirements;
• cleaning difficulty;
• operating parameters;
• material compatibility;
• temperature/moisture sensitivity;
• process ranges.

The equipment itself may not necessarily require full requalification, but the impact should be documented.

17.45 New Product Assessment

Consider:

Equipment Suitability + Product Contact + Containment + Cleaning + Process Range + Utility Requirements + Process Validation

The result may require:

• no equipment requalification;
• targeted qualification;
• cleaning validation;
• process validation;
• containment verification;
• a combination.

17.46 Example 13 — New Operating Range

The source specifically identifies new operating range.

Example:

Previously qualified:

20–60 rpm

Proposed:

20–80 rpm

Existing evidence covers only 20–60 rpm.

The new 60–80 rpm region requires assessment.

17.47 New Range Principle

A manufacturer’s design capability is not automatically a qualified GMP operating range.

If the equipment is capable of 100 rpm but was qualified only to 60 rpm, operating at 80 rpm may require additional evidence.

17.48 Example 14 — Material-of-Construction Change

The source explicitly identifies material-of-construction change.

For product-contact parts, assess:

• compatibility;
• corrosion;
• reactivity;
• adsorption;
• cleanability;
• surface finish;
• extractables/leachables where relevant;
• product quality;
• cleaning validation.

Example:

Product-contact component changed from one material specification to another.

This should not be treated merely as a maintenance replacement without impact assessment.

17.49 Change Classification

Companies may classify changes using categories such as:

• minor;
• major;
• critical;

or other terminology.

The source does not prescribe a specific classification scheme.

Therefore, classification should follow the approved PQS.

More important than the label is the quality of the documented impact assessment.

17.50 Qualification Impact Categories

A practical assessment might classify qualification impact as:

No Additional Qualification

Existing evidence remains valid; rationale documented.

Limited Verification

Specific installation/function checks required.

Partial Requalification

Selected IQ/OQ/PQ elements repeated.

Extensive Requalification

Broad qualification activities required.

Full Qualification

Appropriate where the system is fundamentally changed.

These are practical categories, not source-prescribed regulatory terminology.

17.51 Qualification Impact Decision Tree

CHANGE PROPOSED
      ↓
Does it affect a GMP-relevant
system/function?
   ┌──────┴──────┐
  NO            YES
   │              ↓
Document      Identify affected
rationale     requirements/functions
                 ↓
             Risk assessment
                 ↓
       Does existing qualification
       evidence remain applicable?
            ┌────┴────┐
           YES       NO/PARTIAL
            │          ↓
        Document     Define affected
        rationale    qualification scope
                        ↓
                 IQ impact?
                 OQ impact?
                 PQ impact?
                 CSV impact?
                 Process-validation impact?
                 Cleaning-validation impact?
                        ↓
                 Required Testing
                        ↓
                 Controlled Implementation
                        ↓
                     Verification
                        ↓
                  Qualified State

17.52 Requalification Scope Should Be Selective

Your source’s next Part 18 explicitly requires that requalification scope be:

Justified through documented risk assessment rather than automatically repeating every historical test.

Therefore, change control should identify exactly which qualification evidence is affected.

Example:

A pressure transmitter replacement does not automatically justify repeating:

• motor rotation test;
• equipment dimensions;
• unrelated emergency stop;
• unrelated material certificates.

Test what is affected.

17.53 But Avoid Excessively Narrow Testing

The opposite mistake is equally problematic.

Example:

PLC code changes for:

Main compression force control.

Testing only:

“PLC download successful”

is insufficient if the change could affect:

• compression force;
• alarm limits;
• reject logic;
• data recording;
• HMI display.

Scope should cover affected functions and interfaces.

17.54 Traceability After Change

The source’s Part 12 requires traceability to account for how changes affect requirements.

Example:

Before change:

After PLC modification:

This preserves lifecycle traceability.

17.55 Risk Assessment Example — PLC Change

Actual risk ranking should follow the company’s approved methodology.

17.56 Qualification Change Impact Assessment Template

A. Change Identification

Change Control No.: __________
Equipment/System: __________
Equipment ID: __________
Department: __________

B. Current State

C. Proposed State

D. Reason for Change

E. GMP Impact

• □ Product quality
• □ Patient safety
• □ CPP
• □ CQA
• □ GMP records
• □ Data integrity
• □ Contamination control
• □ Utility
• □ Safety
• □ No identified direct GMP impact

Justification: __________________

F. Qualification Impact

• □ DQ
• □ IQ
• □ OQ
• □ PQ
• □ CSV/automated system
• □ Process validation
• □ Cleaning validation
• □ Utility qualification
• □ No additional qualification

Justification: __________________

G. Required Testing

H. Documents to Update

I. Risk Assessment Reference

J. Acceptance Criteria

K. Final Verification

L. Qualified-State Conclusion

M. QA Disposition

The master source later specifically requires a Qualification Change Impact Assessment template in Part 30.

17.57 Acceptance Criteria for Change Verification

Acceptance criteria should be defined before testing where appropriate.

Typical principles:

• changed component correctly installed;
• calibration acceptable;
• functionality meets approved requirements;
• affected alarms/interlocks operate correctly;
• operating range remains controlled;
• affected electronic records remain accurate;
• regression tests pass;
• required PQ criteria are met;
• documentation reflects final state.

Avoid defining success only after seeing results.

17.58 Change Control and Deviations

Change control and deviation management serve different purposes.

Deviation

Documents and assesses an unexpected departure/failure.

Change Control

Controls an intended modification.

They can interact.

Example:

OQ Failure
    ↓
Deviation
    ↓
Investigation
    ↓
Design Modification Required
    ↓
Change Control
    ↓
Implementation
    ↓
Retest
    ↓
Deviation Closure

Part 15 of the source requires qualification deviations to proceed through impact assessment, investigation, correction/CAPA, retest and QA closure.

17.59 Change Control and CAPA

CAPA may generate a change.

Example:

Recurring sensor failure → Investigation → Mounting design identified as cause → CAPA → Engineering modification → Change control → Qualification-impact assessment → Verification.

CAPA does not eliminate the need to control the technical change.

17.60 Change Control and Calibration

If an instrument is replaced or its range changes, assess:

• calibration procedure;
• calibration range;
• tolerance;
• reference standard;
• frequency;
• alarm/setpoint configuration.

The source emphasizes that calibration supports instrument suitability and qualification, rather than a calibration sticker alone establishing GMP suitability.

17.61 Change Control and Preventive Maintenance

Changes may require PM updates.

Example:

A new motor requires:

• different lubricant;
• different bearing inspection;
• different maintenance frequency;
• different spare parts.

Therefore:

Technical Change → Qualification → PM Program

should remain aligned.

17.62 Change Control and SOPs

Potentially affected SOPs include:

• operation;
• cleaning;
• setup/changeover;
• maintenance;
• calibration;
• alarm response;
• access management;
• backup/restore;
• recipe management;
• data handling.

These categories are specifically identified in the source’s SOP-readiness section.

17.63 Change Control and Training

If a change affects how personnel operate or maintain the system:

SOP Revision → Training → Effective Implementation

should be coordinated.

Example:

New HMI workflow implemented.

Operators should not encounter the new interface in routine GMP production before required procedural/training controls are established.

17.64 Change Control and Data Integrity

For computerized/automated systems, assess whether the change affects:

• access;
• roles;
• audit trails;
• records;
• signatures;
• data flow;
• interfaces;
• backup/restore;
• retention;
• archiving;
• time synchronization;
• security.

These are among the additional computerized-system documentation/testing considerations required in Part 20 of the source.

17.65 Backup Before Software Change

Where appropriate, before software/configuration modification:

• establish current version;
• secure current configuration;
• perform controlled backup;
• confirm recovery strategy;
• record baseline.

This enables controlled recovery if implementation fails.

The specific need and depth depend on system risk and architecture.

17.66 Emergency Changes

Sometimes urgent intervention may be required because of:

• equipment breakdown;
• safety issue;
• critical utility failure;
• significant production impact.

The exact emergency-change procedure is company-specific and is not defined by the source.

However, urgency should not eliminate the need to assess:

• GMP impact;
• qualification impact;
• implementation evidence;
• post-change verification;
• final documentation.

17.67 Temporary Changes

Temporary changes can also affect qualification.

A temporary change should clearly define:

• temporary state;
• reason;
• risk;
• duration;
• controls;
• qualification impact;
• restoration plan;
• verification after restoration.

“Temporary” does not automatically mean “no GMP impact.”

17.68 Multiple Changes

Several individually small changes may collectively affect the qualified state.

Example:

Over six months:

1. sensor replaced;
2. HMI upgraded;
3. PLC logic modified;
4. recipe limits expanded;
5. new product introduced.

Each may have been assessed individually.

Periodic review should also consider whether cumulative changes alter the overall qualification basis.

The source’s Part 19 specifically requires periodic review of change controls, software changes and qualification status.

17.69 Change Control RACI — Example

R = Responsible, A = Accountable, C = Consulted, I = Informed.

This is an illustrative RACI. The source explicitly states that actual responsibilities should depend on the company’s PQS.

17.70 Common Change-Control Mistakes

1. “Like-for-Like” Without Evidence

Two components may look similar but differ in:

• accuracy;
• material;
• range;
• software;
• output;
• capacity.

2. Change Implemented Before Approval

Creates retrospective justification.

3. No Qualification Impact Assessment

Technical implementation alone does not establish continued qualified status.

4. Full Requalification for Every Change

Creates unnecessary work and is not genuinely risk based.

5. Testing Only the Changed Component

May miss affected interfaces and downstream functions.

6. Software Change Without Regression Testing

Related functions may be unintentionally affected.

7. Drawings Not Updated

Creates mismatch between documentation and actual installation.

8. SOPs Not Updated

Routine operation may not reflect the changed system.

9. Training Not Completed

Personnel may operate using obsolete practices.

10. Change Closed Before Verification

Implementation does not equal successful verification.

17.71 Inspector Perspective — “Show Changes Since Original Qualification”

This is one of the inspection questions specifically anticipated by the source.

The inspector may be evaluating:

Can the company demonstrate that the current system remains represented by its qualification evidence?

Expected evidence may include:

• change-control history;
• impact assessments;
• risk assessments;
• qualification testing;
• updated documents;
• current configuration;
• requalification records.

17.72 Inspector Perspective — “How Was This Software Change Assessed?”

This question is also explicitly identified by the source.

A strong evidence chain is:

Change Request → Version Difference → GMP Impact → Risk Assessment → Functional Impact → Regression Scope → Approved Testing → Results → Configuration Update → Closure

A weak answer:

“The vendor upgraded it and said it was fine.”

17.73 Inspector Perspective — “Why Did You Not Requalify?”

Sometimes not repeating qualification is completely defensible.

But the company should show:

Change → Assessment → No Relevant Qualification Impact → Technical/Scientific Justification → Approval

A statement such as:

“It was a small change”

without documented reasoning is weaker.

17.74 Inspector Perspective — “Why Did You Perform Only Partial OQ?”

A strong response explains:

• exact change;
• affected requirements;
• affected functions;
• risk assessment;
• rationale for selected regression tests;
• evidence that unrelated functions remained unaffected.

This demonstrates science- and risk-based qualification.

17.75 Inspector Perspective — “What Is the Current Software Version?”

The organization should be able to identify:

Current Approved Version → Change Record → Qualification Evidence → Release Status

If the current version cannot be readily identified, configuration control may be questionable.

17.76 Change-Control Master Decision Matrix

17.77 Complete Change-Control Checklist

Change Definition

• □ Current state documented
• □ Proposed state documented
• □ Reason documented
• □ Affected system identified
• □ Configuration identified

GMP Impact

• □ Product-quality impact
• □ Patient-safety impact
• □ CPP/CQA impact
• □ Data-integrity impact
• □ Contamination impact
• □ Utility impact
• □ Safety impact

Qualification Impact

• □ DQ impact
• □ IQ impact
• □ OQ impact
• □ PQ impact
• □ CSV impact
• □ Process-validation impact
• □ Cleaning-validation impact
• □ Utility-qualification impact

Risk

• □ Risk assessment completed
• □ Critical functions identified
• □ Failure modes evaluated
• □ Controls identified
• □ Testing scope justified

Documentation

• □ URS
• □ Risk assessment
• □ Drawings
• □ Specifications
• □ Instrument list
• □ Software/configuration
• □ SOPs
• □ PM/calibration
• □ Traceability

Implementation

• □ Approved before implementation
• □ Installation documented
• □ Software version recorded
• □ Configuration controlled
• □ Required backup performed
• □ Training completed where applicable

Verification

• □ IQ verification
• □ OQ verification
• □ Regression testing
• □ PQ where required
• □ Process/cleaning validation assessed
• □ Acceptance criteria met
• □ Deviations resolved

Closure

• □ Final documentation updated
• □ Traceability updated
• □ Residual risks acceptable
• □ Qualified-state impact concluded
• □ QA disposition complete
• □ Change formally closed

17.78 Golden Rule of Change Control

A qualified system is qualified in a defined configuration and operating state. When that configuration or state changes, the organization must determine whether the existing qualification evidence remains valid.

The objective is neither:

Repeat everything after every change

nor:

Assume previous qualification remains valid regardless of change.

The correct approach is:

Understand the change → Evaluate GMP impact → Assess risk → Identify affected qualification evidence → Perform justified testing → Update documentation → Verify the final state.

17.79 Part 17 — Key Takeaway

Your source requires change control to evaluate qualification impact for a broad range of technical and operational modifications—including component and instrument replacement, PLC/software/HMI/SCADA changes, recipe and utility changes, relocation, process/capacity changes, new products, new operating ranges and material-of-construction changes.

The controlling lifecycle is:

Change → GMP Impact → Risk Assessment → Qualification Impact → Required Testing → Documentation Update → Approval → Implementation → Verification → Closure.

The central qualification question is:

Does the existing evidence still demonstrate fitness for intended GMP use after the change?

If yes, document why.

If partially, identify and reverify affected requirements/functions.

If no, perform the necessary extent of requalification.

This leads directly into Part 18 :

Periodic requalification, event-based requalification, requalification after major maintenance, relocation, software modification, critical-component replacement, repeated failures and adverse trends, with the scope justified through documented risk assessment rather than automatically repeating every historical test.

About the Author

Ramesh Palav is a pharmaceutical professional with 20+ years of industry experience in manufacturing, GMP, quality systems, validation, compliance, and operational excellence. Through Pharma Manufacturing Hub, he shares practical insights on pharmaceutical careers, manufacturing, quality, validation, Pharma 4.0, AI, and professional development.

His goal is to help students, freshers, experienced professionals, and career-break professionals build the knowledge and skills needed to succeed in the pharmaceutical industry.