Part 01 · The Question→Part 02 · The Record→Part 03 · The File
← All Case Files
Inspection Case File · CF05 · Quality Systems

Change Control Risk Determination: The 483 Most Teams Don't See Coming.

A documented deviation. A signed CAPA. A closed investigation. And a single question, asked on day two of inspection, that the file does not answer.

What you'll see in this case file
  • The exact 483 observation language
  • The five required authorization fields
  • A complete reference DDR record
  • The blank template for your facility
See What Defensible Looks Like → Free to read. No payment to continue.
Citation · 21 CFR 211.100 ICH · Q9 Used by Quality leaders preparing for FDA inspections
The Scene

Day three of the inspection.

. The investigator pulls Change Control CC-2024-0156. A supplier change for microcrystalline cellulose used in Metoprolol Tartrate Tablets 50 mg.

The change was categorized as low-risk. A like-for-like supplier substitution. The change was reviewed by the Change Control Board, approved, and implemented. No additional studies required.

The investigator turns to the conclusion.

Investigator
"Low risk — like-for-like substitution."
She reads the conclusion twice. Then she sets the file down and looks up.
Investigator
"Who authorized the low-risk categorization? On what evidence specifically did the team conclude this was like-for-like? Were physical and chemical properties formally compared? And what was the documented basis for waiving additional studies?"
She listens to the verbal answer. Then she asks for the documented reasoning.
Pause

Most QA teams answer this question verbally. The file does not contain the documented reasoning. That is the gap.

Skip ahead to the record format →
Why this matters now

FDA observations on supplier and material changes are frequently tied to undocumented like-for-like determinations. The pattern: low-risk categorization assigned, formal comparison of attributes not on file, original determination cannot be reconstructed.

What the file contained

The change control was complete. The CCB approval was on file. The implementation was documented.

A risk assessment template was completed. The categorization was assigned. The CCB chair signed the approval. The change was implemented in the next manufacturing campaign.

What the file contained was the conclusion.

What the file did not contain was the decision.

A risk categorization template was completed. A low-risk conclusion was reached. A signature appeared on the CCB approval. But the rationale for treating this specific supplier substitution as like-for-like, the formal comparison of physical and chemical properties, and the named individual who authorized the categorization are not in the file.

The conclusion belongs in the file. The decision belongs in the record.

What the investigator is evaluating
21 CFR 211.100 requires that changes be evaluated. The standard is not whether the team performed a risk categorization. The standard is whether the categorization was authorized on a documented basis.

Under ICH Q9 risk-based decision-making, the rigor required for like-for-like determinations is documented evidence comparing the previous and new materials across each performance-relevant attribute.

The change control must demonstrate — in writing, contemporaneous with the categorization — that physical and chemical properties were formally compared, that performance-relevant attributes were assessed against established specifications, and that the named authorizing individual reviewed the evidence before approving the categorization.

A completed template is data. A completed template is not, on its own, a documented categorization decision.

Investigator
"I am not asking whether the change was acceptable. I am asking whether the low-risk categorization was authorized — and on what evidentiary basis."
The Quality Director cannot produce the record.
The Gap

The change may have been like-for-like. The file does not show the work behind the categorization.

The change control file documents the approval. It does not document who decided this was like-for-like, on what evidence, against what alternatives, and under what authority.

Ready to see the record format?
See the five fields the investigator expects to find →
The 483
"Failure to document the scientific and risk-based rationale used to justify the risk categorization of the change, including the specific evidence supporting the determination that revalidation, requalification, or regulatory notification was not required. The change control record establishes that the change was approved but does not reconstruct the reasoning that justified the risk classification."
21 CFR 211.100 — applied regulatory framework.
Continued · Part 02 of 03

That 483 was avoidable.

See the record that prevents it.

The five fields the investigator expects to find. The alternative-causes evaluation that distinguishes a decision from a signature. A complete reference example from the Vancomycin scenario.

Show Me the Record →
✓ Free to read · No payment required to continue

Used by Quality and Validation leaders preparing for FDA and EMA inspections. Built around 21 CFR 211.192 and ICH Q9.