By the PharmaTradz BD Team. Published October 2026.
Change control in pharma is the formal system a manufacturer uses to propose, assess, approve, implement and review any planned change that could affect product quality, from a new raw-material supplier to a new tablet press. A deviation is the opposite case: an unplanned departure from an approved procedure, specification or standard that has already happened and must be recorded, investigated and closed. Put simply, change control manages what a company decides to change, and deviation management deals with what went wrong without anyone deciding it.
Both sit at the heart of good manufacturing practice (GMP), and for a buyer they show whether next year's product is still the one you approved.
Change control vs deviation: the core difference
ICH Q10, the international guideline on the pharmaceutical quality system, defines change management as "a systematic approach to proposing, evaluating, approving, implementing and reviewing changes". ICH Q7, the GMP guide for active pharmaceutical ingredients (APIs), defines a deviation as a "departure from an approved instruction or established standard". The US GMP rules say the same in their own words: 21 CFR 211.100 requires that written procedures, including any changes, are reviewed and approved by the quality control unit, and that any deviation from them is recorded and justified.
| Change control | Deviation | |
|---|---|---|
| Nature | Planned and deliberate | Unplanned, already happened |
| Timing of review | Before the change is made | After the event is discovered |
| Key question | Is this change safe, justified and allowed by the registration? | What happened, why, and which batches are affected? |
| Typical examples | New API source, new equipment, revised test method, new site, new pack material | Missed in-process check, temperature excursion, wrong line clearance, equipment breakdown mid-batch |
| Main output | Approved change plan, updated documents, effectiveness review | Investigation report, batch decision, corrective and preventive actions |
The two are linked: a deviation often ends in a corrective action, and that action is usually a change, so it goes through change control.
How change control works, step by step
ICH Q7 (section 13) and ICH Q10 (section 3.2.3) describe the same basic cycle. Each company writes it into its own standard operating procedure (SOP).
1. Proposal. The person or department wanting the change raises a change request. It states what will change, why, and which products, sites and documents are affected.
2. Impact and risk assessment. Experts from production, quality, engineering and regulatory affairs assess the change against criteria set in advance. The assessment uses quality risk management as described in ICH Q9(R1), the revised guideline adopted in January 2023. Q9(R1) defines risk as the combination of the probability of harm and the severity of that harm. It lists change management as a direct application: judging a change's impact on quality and on product availability, and deciding what testing, validation or regulatory communication is needed. The formality of the assessment should match the level of risk.
3. Regulatory assessment. The change is compared with the marketing authorisation (the registered dossier). ICH Q10 is explicit: there should be an assessment of whether a change to the regulatory filing is required. This decides whether a variation or supplement is needed.
4. Approval. The quality unit approves the change before it is implemented. Many companies classify changes as minor or major here, which ICH Q7 recognises as a way to set the level of testing and validation.
5. Implementation. Documents are revised, staff trained, equipment qualified, validation or stability batches run, and regulatory approval obtained where needed. ICH Q7 asks that all affected documents are updated and that the first batches made or tested under the change are evaluated.
6. Effectiveness review and closure. After implementation, the company checks that the change achieved its aim. ICH Q10 asks for confirmation that "the change objectives were achieved" and that there was "no deleterious impact on product quality". EU GMP Annex 15 (section 11) likewise requires an evaluation of the effectiveness of the change.
A simple worked example
A tablet manufacturer wants to add a second supplier for its API because the current one has long lead times. It raises a change request. The risk assessment notes that the new source uses a different route of synthesis, so the impurity profile and particle size may differ. The plan: audit the new supplier, test three API batches, make three tablet batches with them, compare dissolution and impurities, and start stability. Regulatory affairs checks each market where the tablet is registered and finds that the new source needs a variation in Europe and a supplement to the FDA in the US, so tablets made with it cannot be sold in those markets until the filings allow it. The quality unit approves. Once data and approvals are in hand, the first commercial batches are reviewed and the change is closed. Customers whose quality agreements require notice are told before any affected batch ships.
How deviations are classified and investigated
Regulations do not prescribe a fixed classification, but most companies use three levels in their SOPs, based on the potential impact on product quality and patient safety.
| Class | Typical meaning | Example |
|---|---|---|
| Critical | Could seriously affect product quality, patient safety or data integrity | Sterility assurance breach in an aseptic fill; wrong label applied to a batch |
| Major | Could affect quality, but is unlikely to harm patients once controlled | Failure to perform a required in-process test; unapproved equipment setting used |
| Minor | Unlikely to affect quality; a procedural or documentation slip | Late signature on a record where the activity was correctly performed |
Whatever the class, the event is recorded promptly and affected material is held until the quality unit has evaluated it. ICH Q7 requires critical deviations to be investigated with the investigation and conclusions documented. In the US, 21 CFR 211.192 requires any unexplained discrepancy to be "thoroughly investigated, whether or not the batch has already been distributed", and the investigation must extend to other batches that may be affected.
A good investigation contains the problem, gathers facts, finds the root cause (often with tools such as the "5 whys" or a fishbone diagram), assesses impact on this and other batches, decides on release or rejection, and defines actions. EU GMP Chapter 1 adds that if human error is blamed, the company should justify it and make sure process or system failures have not been overlooked. A laboratory result outside specification follows its own route, the OOS investigation, which feeds into the same system.
The link to CAPA
Deviations and changes meet in CAPA, corrective and preventive action. ICH Q10 (section 3.2.2) expects a CAPA system fed by deviations, complaints, recalls, audits, inspections and trends, with a structured search for root cause. A corrective action stops a problem from happening again; a preventive action stops a potential problem from happening at all. Most CAPAs that alter a process, a document or a piece of equipment are carried out through change control. Our explainer on CAPA in pharma covers that system in detail.
When a change needs regulatory approval
A registered product is approved on the basis of a dossier that describes its site, materials, process, specifications and pack. Changing any of these may require the regulator's permission or at least a notification. The rules differ by market.
| Market and category | What it means | When the change can be used |
|---|---|---|
| EU Type IA (and IAIN) | Minor change with minimal or no impact ("do and tell") | Implement first; notify immediately for IAIN, otherwise in an annual update within 12 months |
| EU Type IB | Minor change that is neither IA nor II ("tell, wait and do") | After notification, once 30 days pass without objection |
| EU Type II | Major change that may significantly affect quality, safety or efficacy | Only after the regulator approves it |
| US Prior Approval Supplement (PAS) | Major change with substantial potential for adverse effect | Only after FDA approval |
| US CBE-30 | Moderate change ("changes being effected in 30 days") | Distribution not less than 30 days after FDA receives the supplement |
| US CBE-0 | Moderate change in categories FDA allows, such as a tighter specification | On FDA's receipt of the supplement |
| US Annual Report | Minor change with minimal potential for adverse effect | Implement and report in the next annual report |
In the EU, the categories come from the Variations Regulation (EC) No 1234/2008, amended by Regulation (EU) 2024/1701. New Commission variations guidelines have applied since 15 January 2026, with a more risk-based classification that moves some changes to lower categories. In the US, 21 CFR 314.70 sets the categories for new and generic drug applications. FDA's SUPAC guidances (SUPAC-IR, SUPAC-MR and SUPAC-SS for immediate-release solids, modified-release solids and non-sterile semisolids) explain which tests and filing category fit common changes in batch size, site, equipment and process. ICH Q12, adopted in November 2019, adds tools such as post-approval change management protocols, which let a company agree its plan for a future change with the regulator in advance.
Other regulators run their own systems, so one change can mean several filings, each with its own timeline.
Why buyers must be told about changes
A buyer or brand owner usually holds the registration or relies on the supplier's data for it. An unnotified change can put the registration out of step with the product, risking rejected shipments or recalls. ICH Q7 says current dosage-form manufacturers should be notified of changes to established production and process controls that can affect API quality. EU GMP Chapter 7 says a contract manufacturer should not make unauthorised changes, outside the terms of the contract, that could affect quality for the contract giver.
The practical tool is the quality agreement. FDA's guidance Contract Manufacturing Arrangements for Drugs: Quality Agreements (November 2016) says the agreement should set out how changes are managed and which changes the owner must review and approve before they are implemented, including changes to component suppliers, sites, processes, major equipment, test methods, lot numbering and container closure systems. The product owner stays responsible for GMP compliance whatever the contract says.
What buyers should check
- Ask for the supplier's change control and deviation SOPs, and how changes are classified and approved.
- Check that the quality agreement lists which changes need your prior approval or notice, and how much, for example a new API source, site, process or pack material.
- At audit, pick recent change records and confirm each had a risk assessment, regulatory assessment, quality approval and effectiveness check.
- Review a sample of deviations: are they classified consistently, are root causes real rather than "human error" by default, and do CAPAs close on time?
- Ask how the supplier tracks variation status by market.
- For APIs, confirm that the supplier will update its DMF or CEP and tell you when it does; our guide to CEP, DMF and ASMF explains why that matters.
Our checklist for verifying a pharmaceutical supplier covers the wider audit.
How PharmaTradz can help
Tell us which markets you hold registrations in and what change notice you need. Our documentation and quality pack helps you gather quality agreements, SOP summaries and regulatory status up front, and our dossier licensing and registration service can support variation planning. You can send us an RFQ directly, or look up other terms in our pharma abbreviations A-Z.
Frequently Asked Questions(FAQs)
What is change control in pharma?
Change control is the formal GMP system for proposing, assessing, approving, implementing and reviewing planned changes that could affect product quality, such as a new supplier, equipment, process or test method. The quality unit must approve a change before it is put into use.
What is a deviation in pharma?
A deviation is an unplanned departure from an approved instruction, procedure or standard. It must be recorded, assessed for impact, investigated to find the root cause and closed with suitable corrective and preventive actions.
What is the difference between change control and deviation?
Change control covers planned changes that are assessed and approved before they happen. A deviation is an unplanned event that has already happened and is investigated afterwards.
What are the types of deviation in pharma?
Most companies classify deviations as critical, major or minor according to their potential impact on product quality and patient safety. The exact definitions are set in each company's own procedure, and the class decides how deep the investigation must go.
What are Type IA, IB and II variations?
They are the EU categories for changes to a registered medicine. Type IA is a minor "do and tell" change, Type IB must be notified and can be made after 30 days without objection, and Type II is a major change that needs approval first.
