ComplianceWorxs ← All Case Files
Inspection Case File · Quality System Exposure
Case File #05

Change Control Approval

The Change Was Implemented. The Authorization Never Existed.

Regulatory Citations21 CFR 211.100(a) · 21 CFR 314.70 · ICH Q10
Decision FailureRisk classification and filing determination not documented
Operational ConsequenceProduct removed from distribution · Remediation cost >$2.4M
Inspection Trigger

Investigator reviewed Change Control CC-2023-0156 for Metoprolol Succinate Extended-Release Tablets 50 mg, NDA 021856, including the change control record, supporting risk classification, and regulatory filing determination.

Decision Failure

The firm could not produce a risk assessment supporting the Minor classification, a CQA impact analysis, or a regulatory filing impact determination with its documented basis.

Regulatory Exposure

21 CFR 211.100(a) requires written procedures for production and process controls. 21 CFR 314.70 governs supplements and changes to approved applications. Absent documentation identifying who authorized the risk classification and filing impact determination, the change control decision cannot be verified during inspection.

Decision Defense Record

A change control authorization documenting the CQA impact analysis, regulatory filing determination with its specific regulatory basis, and named decision owner would have prevented implementation without required prior approval.

The inspector pulled the change control record. The change was approved. Then they asked: "Who authorized this change, and how was the regulatory impact assessed?"

That question ends careers. Not because the change was wrong — but because the authorization logic was never captured as a formal record.

This case file gives you that record.

Section 01

What the Investigator Asked

483 Observation

During inspection of Change Control CC-2023-0156 covering a modification to the granulation endpoint parameter for Metoprolol Succinate Extended-Release Tablets 50 mg, NDA 021856, the investigator noted the change had been classified as Minor, implemented, and product distributed. The investigator requested documentation of the risk assessment supporting the Minor classification, who authorized that determination, the CQA impact analysis for the granulation modification, and the specific regulatory basis for determining no supplemental filing was required prior to implementation. The change control record contained a risk category checkbox marked "Minor" and a QA approval stamp but no authorization record responsive to any of these questions.

Inspector's Question

"Who authorized the Minor risk classification for this change, what CQA impact analysis was performed prior to that determination, and what specific regulatory basis supports the conclusion that no supplemental filing was required before implementation?"

For NDA-filed products, a change to a manufacturing process parameter requires evaluation against the approved design space and filed parameter ranges before implementation. The filing impact determination — whether the change requires a Prior Approval Supplement, CBE-30, or CBE-0 — must be documented with its specific regulatory basis and authorized before implementation.

A risk category checkbox without supporting analysis is not a change control authorization. It is a record that a category was assigned, not a record that the assignment was justified.
Section 02

Evidence Present vs. Authorization Missing

What ExistedWhat Was Missing
✓ Change control request CC-2023-0156 opened with technical description of parameter modification→ Risk assessment documenting the basis for the Minor classification
✓ Risk category assigned: Minor→ CQA impact analysis — dissolution, content uniformity, hardness evaluated against change
✓ Implementation plan documented and executed — granulation endpoint modified→ Comparison of modified parameter to filed NDA design space and approved ranges
✓ Product manufactured under revised parameter and distributed to market→ Regulatory filing impact determination with specific 21 CFR 314.70 basis
✓ QA approval stamp on change control closure record→ Named individual who authorized the risk classification and filing determination
A risk category checkbox on a change control form records a classification output. It does not document the classification process. Authorization identifies the accountable decision owner, the CQA impact analysis supporting the classification, and the specific regulatory basis for the filing impact determination.
Section 03The Operational Cost — Product removed from distribution. Prior Approval Supplement required. Retrospective filing impact assessment across 36 months of change controls. Remediation cost exceeded $2.4M.
Section 04DDR Reconstruction — The complete Decision Defense Record for this change control: CQA impact analysis, regulatory filing determination with specific 21 CFR 314.70 basis, named decision owner, and timestamped authorization.
Section 05Authorization Model — The six required elements for change control authorization for NDA-filed products, including the CQA impact standard and the filing impact determination structure FDA expects to see.
Section 06Preventive Control — Mandatory CQA impact template embedded in the change control system, with electronic implementation gates and separate regulatory affairs authorization required for all filing impact determinations.
🔒
Four Sections Remaining

The full inspection consequence analysis, complete DDR reconstruction, authorization model, and preventive controls are included in the Case File download.

Get the authorization framework sent to your inbox

Download the Complete Case File — $149
🔒 Secure checkout · Stripe · Instant delivery
Need all 10 decision scenarios? Get the complete series — $875 (save $615)
Decision Defensibility Infrastructure

Does your organization have authorization records that hold up under this level of scrutiny?

The Decision Ownership Assessment identifies your open decision gaps in 8 minutes.

Take the Assessment → No account required · Results delivered immediately