Medical Device Change Control Process Best Practices

December 3, 2019

Change is the one thing that remains constant in the medical device world and our ability to manage those ongoing changes is the only thing that keeps us from losing control of design and manufacturing processes. The FDA and other regulatory agencies have long mandated that medical device manufacturers maintain a formal and systematic approach to control changes to products, processes, procedures, equipment and systems. The entire process is predicated on the expectation that manufacturers will continually improve their products and processes.


If you have renewed any existing MDD CE certificates in advance of the EU Medical Device Regulation (MDR) going into effect in May 2021, you’ll want to read this post about what Article 120(3) of the MDR defines as a “significant” change that could jeopardize the validity of your MDD certificate.

At its core, change control exists to prevent unintended consequences not create more paperwork. A breakdown in the change control process can result in product recalls, regulatory penalties, negative publicity, and in extreme cases, injury or death to patients.

Change control procedures apply to all aspects of the device life cycle.

There are few areas of the medical device design and manufacturing process that are not subject to change control procedures.

Change Steps

Basic steps involved in change control

1 – Identify a need for a change

2 – Justify the proposed change

3 – Review the proposed change internally

4 – Finalize the change by securing management approvals

5 – Document all steps above

6 – Communicate the change to relevant parties

7 – Train employees affected by the change

8 – Implement the change

9 – Evaluate the change and its effects

Planned vs unplanned changes

By its very nature, a change control system covers planned changes. Anything else is considered a deviation or nonconformity. All employees must be trained to distinguish between a deviation and a change control request. With regard to planned changes, it is important that you carefully document steps 1-3 above and have the appropriate management review and approve (step 4) any changes before making them. It is imperative that you have full management buy-in to this process. It’s very easy to slip into a bad habit of “just making a quick change” in an effort to be nimble but those shortcuts may come back to bite you when an FDA inspector or Notified Body asks to see the documentation. Make sure you file change documentation somewhere that other team members can find it easily if requested.

US FDA and international regulations covering change control

The need for robust change control is outlined in three specific subparts of FDA 21 CFR Part 820 (aka, Quality System Regulation) and throughout ISO 13485:2016. The regulation and standard require that manufacturers establish written change control procedures that describe company approved procedures.

US FDA QSR (21 CFR Part 820)

ISO 13485:2016

  • Control of documents and records (4.2.4 and 4.2.5)
  • Quality management system planning (5.4.2)
  • Management reviews (5.6.1 and 5.6.3)
  • Review of product requirements (7.2.2)
  • Design and development changes (7.3.9)
  • Purchasing process (7.4)
  • Process validation (7.5.6 and 7.5.7)
  • Need for change (8.5.1)

The proper way to initiate a change

So, what’s the right way for an employee to float a proposed change? The first step seems obvious – they need to submit an official request. No that doesn’t mean via email. This should be an official form that allows space for the employee to make a clear and specific description of the proposed change including products affected and lot numbers if possible. There should also be space for the employee to justify why the change is needed. Changes need to have a clear benefit and this needs to be articulated. One tip about this form. Don’t make the change request form so onerous that employees take one look at it and run. Make it easy for employees to understand and use and they will become more engaged in the continuous improvement process.

Classifying changes by impact and necessity

Once that form is received, it needs be reviewed (step 3) on its merits. If the change seems reasonable, a thorough assessment of all possible effects and risks needs to be conducted. At this point you should have a procedure in place to broadly categorize proposed changes. Many companies use a simple three tier system.

Classifying Change
You’ll also need to figure out if any special equipment or personnel is needed to make the change. One word of caution here. If you have EU MDD CE certificates that you have recently renewed,
read this article before making any significant changes.

Reviewing the proposed change

If the change will involve the device or manufacturing process, it’s important that a technical review be conducted to ensure there are no unintended impacts on patient health or safety. This review should be done by people who understand the potential effects of the change (example: R&D, engineering). The technical review should determine if justification for the change is sufficient, the need for revalidation, drawings, and potential risks, including cost and downtime. After the technical review, the proposed change should be reviewed by other departments that may be affected as well. Again, these individual department reviews need to be documented and the date recorded.

Who is ultimately responsible for assessing risks associated with a change?

Pretty much every person who is involved in making a change is also responsible for assessing the risk to patients and, just as importantly, documenting their assessment and the data on which it was based. Ultimately the decision of whether to pursue a change is made by a QA professional (maybe you!). Depending on the nature of the change and risk classification of the product, sometimes consultation with a medical officer will be required.

Making sure your change control procedure has all the basic elements

Your change control procedure must specify which groups will be involved in reviewing a proposed change and the responsibility of each group. Typically the Regulatory Affairs, QA and Facilities departments are involved, and depending on the change, staff from R&D/Engineering, Safety, and Environmental. Your change control record must include a description of the proposed change, identify affected documents, have the signature of the appropriate management person, an approval date and when the change goes into effect. It should also include procedures for updating primary and secondary documentation. This “secondary” documentation (e.g., component drawings, IFU, and packaging) often gets forgotten.

All that being said, it’s easy to get carried away when creating a procedure. Your goal should be to create a procedure that’s easy to understand, clearly defines the levels of justification and approval needed, and the specific responsibilities of the people responsible for approval. You should also Include provisions for handling emergency changes when speed is of essence. Ultimately the design of your change control system will be a function of the type and complexity of your products and operations, plus size and structure of the company.

Six common mistakes caught by FDA inspectors and Notified Bodies

1 – Not describing a proposed change clearly and specifically
2 – Not justifying a proposed change
3 – Not sufficiently evaluating the effect of the proposed change
4 – Failing to ensure that the appropriate departments are consulted about the change
5 – Not evaluating the effectiveness of the implemented change
6 – Neglecting to close out the change

Getting more participation

In general, proposed changes should be encouraged but vetted with extreme care. You want employees to suggest changes in the name of continuous improvement but clearly not all change requests offer enough benefits to offset the risks. Rather than handling every change in an ad hoc manner, consider holding monthly change control meetings so people with requests can submit their proposals. It would be best if all people responsible for approving requests were present along with representatives from QA & RA. Provide all supporting materials in advance so appropriate people can think about the proposal and have a chance to ask relevant questions during the meeting.

Training is also essential to the success of any change control system. Employees and managers must know how the change control system and be willing to use it. With regard to the latter, this means having change control request forms that don’t look like mortgage applications. All employees should be able to initiate changes and giving employees opportunities to practice is far better than providing remedial training after problems occur.

Want to learn more?

There’s a lot to know about change control best practices and we have only scratched the surface. If you would like to learn more best practices for process mapping and writing standard operating procedures, consider this training course. Our course on medical device CAPA is also quite popular. We have a wide variety of medical device training courses, all of which can be seen here.

Our team is here to help. Call 1.800.472.6477 or contact us online ›