Understanding Medical Device Change Control (FDA and ISO 13485)

Change is essential and necessary for any organization, especially medical device manufacturers. Organizations need to be constantly aware of changes to materials, suppliers, processes, specifications, and other items related to their products. Not only are medical device companies required to be mindful of changes, but they must implement change control to maintain the function of their QMS and meet regulatory requirements.

Change control is a term that is heard throughout the medical device industry. It can be found in FDA warning letters, job postings, and quality policies. Change control is one of the most important elements in maintaining the safety and effectiveness of medical devices. And when changes are not properly controlled, there can be serious consequences related to devices breaking or causing patient injury.

This article will cover ISO 13485 and FDA requirements for medical device change control. By following this guide, you can help your company implement a change control procedure that is compliant and helps your company achieve its goals.

What changes require change control?

Changes can come from an enormous variety of sources. They can be the result of regulatory changes, device improvements, supplier changes, material upgrades, and more. With medical device companies having so many different types of changes, it is important to learn what changes must go through an organization’s change control process.

To help understand the different types of changes, we will cover four different areas for changes related to medical devices; document changes, design changes, production process changes, and regulatory changes.

Document Changes

Any changes related to controlled documents must go through change control. The changes to the document need to be identified, reviewed, and approved by the same functions that initially released the document. This is to ensure that the full impact of the document changes can be properly understood.

While controlled documents require change control, the process does not need to be the same as the process to change the design or production process. Many times organizations have an extremely in-depth design control process that requires different gate reviews and impact assessments. This can be overboard if you are making a simple change to a quality procedure or related document.

If you’d like to learn more about implementing an ISO 13485 document control procedure, check out our article Document Control for ISO 13485 Explained.

Design Changes

Any changes related to the device, specifications, materials, packaging, or labeling need to go through a company’s change control process. While document changes are important to a well-running medical device QMS, design changes should have the highest area of focus for medical device companies. This is because unintended or improperly controlled changes can directly affect the safety of medical devices, and draw the ire of the FDA.

Many different types of changes fit into this section. A good indication that a design change will require change control is that the area being changed is part of the Device Master Record (DMR), or was included in the initial device submission.

Let’s cover a few different areas related to design control that need to be included in a company’s change control process:

• Specification changes. Even if the change should not impact the fit, form, or function of the device if a part print or specification is changing, it needs to go through the design control process. The specification changes can be the result of customer complaints, improvements in manufacturability, or changes in supplied parts.
• Material changes. Any changes related to the material of any component of a medical device should go through the change control process to understand the impact and risks related to the material change.
• Packaging changes. In the event of packaging changes coming from a supplier, process improvements, or as a result of shipping concerns, the packaging changes should be documented through the change control process.
• Labeling changes. Labeling is an important element of medical devices. While labeling can sometimes be considered a document change, either way, a change to the labeling will need to follow the change control process.
• Supplier changes. In the event that the company must change the supplier for a part, the change should be reviewed and approved through the design control process.

Production and process changes

The next type of medical device change that needs to be included in a company’s change control process is change related to the production process. While the production process is rather broad, FDA 21 CFR 820.70 provides some hints about what is included in this section.

Below are a few different process changes that would require change control.

• Changes to work instructions / SOPs related to the manufacturing of a medical device. This is related to document control, so the changes can go through the document change process.
• Changes to facilities or buildings where medical devices are being manufactured.
• Changes related to inspection. This could include changes in the AQL criteria of a device, the inspection method, or the equipment being used during the inspection.
• Environment changes. One example would be a company switching its manufacturing to a different class of cleanroom.
• Process-related changes. Here we are talking about specific changes to the manufacturing process, such as switching manufacturing methods or equipment. Depending on the extent of the change, the change may also need to go through the design control process, and the process will likely require re-validation.

Regulatory changes

The final type of change we will review is regulatory changes. Some types of regulatory changes are self-explanatory, such as design changes related to updated standards. However, a medical device company can be impacted by many different types of regulatory changes.

One example would be if a company starts selling into a country with different regulatory requirements. Another example would be if a company switches medical device dealers or authorized sponsors (this would apply to companies selling medical devices in Australia). These types of changes should also go through the company’s change control process to ensure they are properly reviewed and documented.

FDA 21 CFR 820 change control requirements

An interesting aspect of change control is that it is absolutely essential to the operation of a medical device company, however, there is not a standalone FDA requirement for change control. Instead, the requirements for change control are broken into three different sections of FDA 21 CFR 820:

1. 21 CFR 820.30(i) Design Controls. “Each manufacturer shall establish and maintain procedures for the identification, documentation, validation or where appropriate verification, review, and approval of design changes before their implementation.“
2. 21 CFR 820.40(b) Document Control. “Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes shall be communicated to the appropriate personnel in a timely manner. Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date, and when the change becomes effective.“
3. 21 CFR 820.70(b) Production and process changes. “Each manufacturer shall establish and maintain procedures for changes to a specification, method, process, or procedure. Such changes shall be verified or where appropriate validated according to § 820.75, before implementation and these activities shall be documented. Changes shall be approved in accordance with § 820.40.“

The requirements are very broad and essentially state that a medical device company must have a change control process in place for each of these areas. We’ve already covered different types of changes related to each section and will cover how to set up a medical device change control procedure later in this article.

ISO 13485 change control requirements

ISO 13485 includes many different references to change control, and controlling change can be considered a theme of the standard.

Unlike FDA 21 CFR 820, ISO 13485 does include a standalone section for change control, section 4.1.4. This section states that medical device companies shall evaluate changes for both the impact on the QMS and the impact on the medical devices produced under the QMS. The changes should also be controlled in accordance with the requirements of this International Standard (referring to later parts of ISO 13485 that include change control) and applicable regulatory requirements (such as the FDA).

Being a theme of ISO 13485, change is referenced in a variety of other sections of the standard:

• 4.2.4, Control of Documents
• 5.4.2, Quality Management System Planning
• 5.6.2, in reference to Management Review Meetings and any changes that could impact the QMS.
• 7.2.2, Review of Requirements Related to Product.
• 7.3.9, Control of Design and Development Changes
• 7.4.2, Purchasing Information. This requirement specifically states that as part of supplier control, organizations should have a written agreement with suppliers that the supplier will notify the organization of any changes to purchased products before the supplier implements the change. This is typically called a Change Notification and is commonly found in the quality agreements of medical device companies.
• 7.5.6, Validation of Processes for Production and Service Provision
• 8.5.1, in reference to the need to implement Corrective or Preventive actions necessary to maintain the QMS and product safety.

As you can see, change control is a very broad process that applies to many different elements of a QMS. The root of most of the ISO 13485 requirements is that a company has a process in place to correctly control changes made to all areas of its QMS. Let’s move to the next section, where we will review some of the elements commonly included in a company’s change control procedure.

Common steps for a change control procedure

Now that we know what types of changes need to go through the change control process and the FDA and ISO 13485 requirements for changes, let’s dive into how a change control process typically functions at medical device companies.

Change Initiation

Changes may need to be initiated for an assortment of reasons. They can be the result of a supplier, a complaint, an internal improvement, or a corrective action stemming from an audit finding. When someone in the organization becomes aware of the need for a change, they should submit a documented change request (change order or other terms are often used depending on the organization).

In order to make the change control process run as smoothly as possible, the change request should include the origin of the change, why the change is needed, and who is submitting the change request. If the cost savings, expense, or resource needs are known at this time, they should be included as well. Any information that can aid the change control board in assessing the change will be helpful.

Review and Approval

Once a change request is submitted it needs to be reviewed by the change control board. The board is typically made of members from all of the different parties related to the change including quality, engineering, supply chain, production, and accounting. Sales and marketing may also need to be involved, especially if the company produces components and their customers need to be notified of the change.

Typically, the change control board meets on a weekly, bi-weekly, or monthly basis to review all of the different changes that have been submitted during that time period. They will discuss any concerns related to the change, including resource commitments, practicality, and financial benefits from a change. While a change might seem like a good idea at first, changing one component of a medical device can quickly lead to a cascade of changes that evaporates any would-be cost savings.

Once the board has made its decision it should either approve or deny the change request. The reason for the decision should be documented and the approvals of the change should be kept as records.

One thing to note is that just because a change is originally approved does not mean the change must be implemented. There can be many different unknowns involved with a change that will come out through the rest of the change control process and make the change impractical.

Justification

Once the change is approved, the justification for the change should be documented. The justification should include the exact benefits of the change in a way that will make sense both internally and to regulators. Evidence of the reason for the change should be included so that it is clear to everyone involved why the change was made.

Change Impact

A change can have a far-reaching impact that can affect nearly every department in a medical device company. Let’s review some of the different areas that may be impacted and should be considered when making a change:

• Other components in a device. A medical device can consist of hundreds or even thousands of different components. When a change is made to one component, the organization will need to understand how the change impacts every other component in the device. If there is no change to the fit, form, or function the change may be simple, but if there is a change to the function other components may need to be changed as well. Understanding the impact of the change on the other components will help make clear the scope of the change and if the change is worth pursuing.
• Current inventory. Will the current inventory of a part need to be used up before the change can be implemented? Is there an exact date when the old revision of a product will be scrapped? Organizations need a way of determining the impact of a change on their current inventory and need to document this decision.
• Marketing materials. While this can be overlooked by engineering, the marketing team should know when they will need to update a catalog or website during the change control process. They may also need to create a new revision of the promotional material related to the device.
• Devices in the field. While a change may seem like a good idea, implementing a change could affect the devices already in the field. It is important for organizations to understand if they will need to send the updated revision or mating parts to their customers in order for the device to continue to function correctly. If the organization performs repairs on its devices, it should understand how the change could impact the repair process, and understand when it will need to keep an older revision of a component on hand to complete repairs.
• Notifying customers. If the company is a supplier for a medical device company, it should consider when its customers will need to be notified of the change. Change notification is a specific element of ISO 13485, and the company must ensure it is not violating any of its quality agreements when it decides to move forward with a change.

These are just a few examples of the impact that a medical device change can have on an organization and is not intended to be an all-encompassing list. The organization should have a sense of how the change will impact all of the stakeholders of its device or component depending on the specific nature of the change.

Risk Assessment

Understanding risk is a key element of medical device change control. When a medical device company initiates a change, it needs to consider how the risk of the device will be impacted by the change. While a change may save the company a couple of dollars, if the change leads to the device being less safe for users the change may need to be avoided.

It is important that the organization understand the risk of moving forward with the change. The organization may initiate updates to the process or product FMEA for a device, or perform a new FMEA for the change.

The company may also choose to have two different risk assessments associated with the change. There can be a risk assessment at the beginning of the process to ensure that the company still wants to move forward with the change based on the risk level. Then, once the change is moving towards completion, another risk assessment can be performed to ensure there are not any new risks that have emerged from the change control process before the change is implemented.

Regulatory Review

Regulatory hurdles can be one of the main reasons that a company chooses to not move forward with a change. When a change is initiated, the organization should determine what regulatory steps are required. If the change has a large enough impact, the company may have to submit a new 510(k) or Special 510(k). The organization may also need to receive approval from regulatory bodies before the change is implemented.

The company could also need to notify its notified body of a change. For these reasons, any changes should be heavily reviewed by the regulatory or quality department before a change is implemented. This is especially true if the device is post-market and has already received regulatory approval.

Completing the Change

Once the change has been approved and the impact has been carefully considered, the change control process can be performed. The nature of the change control process will greatly vary depending on the nature of the change and the device being manufactured. For example, a document change may go through a different change control process than a design change.

The organization must have a well-written procedure that documents how change control will be completed. Many times change control is performed through a multi-step or gated approach, where certain actions will need to be completed before moving on to the next step. Each of these actions should be approved once they are completed so that there is evidence that the proper steps were followed.

In addition to the other actions listed above (impact assessment, risk assessment, regulatory review), the organization should determine what verification and validation actions need to be completed as part of the change control process. The organization may also need to update work instructions, bill of materials, DMRs, and a whole host of other documents related to the change. If the process is sufficiently impacted the organization may need to perform training as part of the change control process.

There should be clear documentation that includes every different step that was completed as part of the change.

Documenting the Change

Throughout the entire medical device change control process, every decision, approval, justification, and step needs to be thoroughly documented. It should be clear to an outside observer what the change was and what actions were completed as part of the change. This information should be clear and traceable and should be understood throughout the entire life-cycle of the device.

The way that an organization chooses to document a change will vary based on the document control system of the company. If the company is using a computer-based eQMS system, the eQMS may have a built-in module for completing the change. If the company is using a paper-based system, each element of the change needs to be included in the change file.

Wrapping Up

A good change control process can be the heartbeat of a QMS, and this is especially true in an industry as heavily regulated as medical devices. By following the steps in this article, an organization can be well on its way to creating a change control procedure that works for the company as well as regulators and auditors. Change control is something that is always reviewed as part of QMS audits, so it is essential that all elements of a change are carefully and deeply considered.

If you have any questions or comments about medical device change control, please leave a comment below. Also, if you found this article helpful, check out our ISO 13485 page for other ISO 13485 guides and sign up for our newsletter below.