FDA Inspection Reference · 21 CFR 211.100

FDA 483 — Change Control Authorization: Why Complete Packages Still Generate Observations

FDA 483 Observation

"The firm failed to establish adequate control over changes impacting product quality. No formal authorization record was produced identifying who reviewed the totality of evidence, the regulatory standard governing the quality impact determination, or the basis for concluding the change was acceptable for implementation."

The change control package was complete.

The authorization record did not exist.

Produce the Change Control Authorization Record — $149

→ Produce the Record

If your inspection is within 90 days, this record either exists now or it does not.

If this record does not exist today, it will not exist at inspection.

Change control failures do not produce minor observations.

They produce product risk, regulatory exposure, and escalation beyond the inspection — including recalls, warning letters, and enforcement action.

The Decision FDA Investigators Are Actually Examining

Before the change was implemented, someone made a call.

Approve the change or reject it.

Authorize implementation or delay it.

Accept the risk or escalate it.

That decision exists. The record of that decision usually does not.

An FDA investigator reviewing a change control package will ask two distinct questions.

The first is about the process. Was the impact assessment conducted, were the right reviewers involved, was validation performed, were approvals obtained at each stage. The package answers that. It was designed to.

The second is about the quality impact determination itself. Who reviewed the totality of evidence and concluded this change would not adversely affect product quality. What they reviewed at the moment they made that determination. What regulatory standard governed their conclusion. What residual risk they accepted and why.

The package does not answer that question as a standalone document. The reasoning behind the quality impact determination is distributed across multiple documents rather than captured as a single authorization record created at the time the determination was made.

FDA Change Control — What Investigators Actually Require

FDA change control requirements Require documented evaluation and approval of changes impacting quality — including a formal authorization record for the quality impact determination, separate from the package.

Change control FDA 483 example Occurs when changes are implemented without a standalone authorization record — not when the impact assessment is deficient.

21 CFR change control documentation Requires formal assessment of impact, risk, and approval before implementation — and a contemporaneous authorization record for the quality impact conclusion.

Change control approval requirements FDA Requires a named decision-maker, the evidence reviewed in totality, the regulatory basis for the conclusion, and documented rationale — not a workflow signature alone.

Change control FDA 483 documentation failure Change control is one of the most frequently cited inspection areas. Failures are tied to inadequate decision documentation — not process execution.

What the Observation Is Actually Citing

The change control package documents that the required process steps were taken. The observation is written against what the package does not produce: a standalone authorization record showing who made the quality impact determination, what they reviewed, and why implementation was authorized.

Under 21 CFR 211.100, changes must be documented and justified. The justification investigators require is not the impact assessment — it is the authorization behind the conclusion the assessment supported. Those are two different documents. Most change control systems produce one.

What a Defensible Authorization Record Contains

Named Decision-Maker Not who approved the change at each workflow stage. Who reviewed the totality of evidence and made the quality impact determination — by name and role — at the time the conclusion was reached.
Evidence Reviewed in Totality The specific documents, data points, and risk assessments evaluated at the moment the quality impact conclusion was reached — explicitly listed, not implied by the package.
Regulatory Standard Governing the Determination The specific CFR provision or internal standard that defined what "no adverse effect on product quality" requires under these circumstances. Not assumed — stated explicitly.
Residual Risk Accepted The formal acknowledgment of remaining risk and the documented basis for concluding that risk was acceptable for implementation authorization.
Authorization Rationale The explicit reasoning connecting the assembled evidence to the conclusion — created as a formal record at the time the determination was made, not reconstructed from the package later.

This is the record investigators ask for — not the change control package.

→ Produce the Change Control Authorization Record

Why QMS Systems Don't Produce This Record

Change control management systems track workflow completion. They ensure the impact assessment is conducted, the validation is executed, the approvals are obtained. They generate a complete, audit-ready package.

They are not designed to generate a standalone authorization record for the quality impact conclusion. The reasoning behind the determination is distributed across the package — in the risk matrix, the validation report, the approval signatures — rather than captured as a single document.

The authorization record requires a deliberate act. The accountable decision-maker must create it at the time of the determination, in a form designed to stand alone under direct investigator scrutiny.

The Reconstruction Problem

Reconstruction is not a formal authorization record.

When a validation manager answers an investigator's question about the quality impact determination by walking through the reasoning, describing who was involved, and explaining what was reviewed — she is reconstructing a decision from the package and from memory.

That reconstruction may be accurate in every detail. The reasoning may have been fully defensible. But it does not have a timestamp from the moment the determination was made. It was not created at the time. Investigators know the difference. The observation is not about the quality of the work. It is about the absence of a formal authorization record for the conclusion the work supported.

If Your Inspection Is Within 90 Days

The authorization records behind your change control quality impact determinations either exist now or they do not. A document created after an investigator asks the question is a reconstruction — not an authorization record.

The package will hold. The assessments are thorough. The question the investigator will ask is about the record that proves the quality impact determination was defensible at the moment it was made. That record has to exist before the inspection starts.

Produce the Change Control Authorization Record — $149

→ Produce the Record

FDA Change Control Authorization — Frequently Asked Questions

What does FDA require for change control documentation under 21 CFR 211.100?

Changes to written procedures must be drafted, reviewed, and approved by designated authority. Beyond the procedural requirements, investigators require a formal authorization record for the quality impact determination — showing who reviewed the totality of evidence, what standard governed the conclusion, and why implementation was authorized. The package demonstrates the process. The authorization record demonstrates the decision was defensible.

Why does a complete change control package still generate a 483 observation?

A complete package documents that the required process steps were executed. A 483 is written when investigators cannot find a formal authorization record for the quality impact determination — a standalone document showing who made the quality impact call and what they reviewed. The package proves the work happened. The authorization record proves the decision was defensible. Most systems produce one, not both.

What is the difference between a change control approval and an authorization record?

An approval is a signature authorizing a specific step in the workflow. An authorization record is a standalone document capturing who made the quality impact determination, what assembled evidence they reviewed, what regulatory standard governed their conclusion, and why the change was acceptable. Approvals prove the process was followed. The authorization record proves the decision was made correctly, at the time it was made.

Can the change control package serve as the authorization record?

No. The package documents that the required steps were taken. It does not constitute a formal authorization record because the reasoning behind the quality impact determination is distributed across multiple documents. When an investigator asks who made the determination and what they reviewed, the answer requires reconstructing the decision from the package — which is not a contemporaneous authorization record.

What causes an FDA 483 for change control quality impact assessment?

The most common 483 for change control is not a deficient assessment — it is a missing authorization record for the quality impact determination. Investigators cite firms when no standalone document exists showing who reviewed the totality of evidence and concluded the change would not adversely affect product quality. Change control is one of the most frequently cited inspection areas, with failures tied to inadequate decision documentation, not process execution.