Change control classification determines how much review, testing, and approval a change requires before it goes into effect. Under FDA QMSR (21 CFR Part 820) and ISO 13485, regulated companies must assess every proposed change to a product, process, or system and assign it a classification tier. Major changes require full impact assessment and often regulatory notification. Minor changes need documented review but not the same depth of validation. Administrative changes are low-risk corrections that move through a lighter approval path. Getting the classification wrong in either direction creates real problems: under-classifying a major change invites regulatory citations; over-classifying everything bogs down your quality team and slows the business.

What is change control classification?

Change control classification is the process of assigning a risk tier to a proposed change before that change is implemented. The classification tells the quality team how much investigation, review, and approval the change requires, and whether the change must be communicated to regulators or notified to customers before it goes live.

Most regulated quality management systems divide changes into three tiers: major, minor, and administrative. Some companies use four tiers or label them differently, but the underlying logic is the same. A higher-risk change requires more controls. A lower-risk change moves faster through the system.

Process change notifications are a direct output of this classification work. When a change is classified as major, a formal notification may need to go to regulators, customers, or both before the change takes effect.

Why classification matters under FDA QMSR and ISO 13485

FDA’s Quality Management System Regulation (21 CFR Part 820, commonly called QMSR) requires manufacturers to establish and maintain procedures for change control. Section 820.70 requires that changes to manufacturing processes, equipment, materials, and procedures go through documented review and approval before implementation. FDA expects the approval process to be proportionate to the risk of the change.

ISO 13485 Section 7.3.9 addresses design and development changes, and Section 4.1.2 requires documented procedures for controlling changes to the quality management system itself. Notified bodies conducting ISO 13485 audits regularly test whether a manufacturer’s classification criteria are defensible and consistently applied.

The practical consequence: if FDA inspectors find a change that affected product performance or safety was implemented without adequate classification and review, that becomes a 483 observation and potentially a warning letter citation. The 2023 and 2024 FDA warning letters issued to medical device manufacturers repeatedly cited inadequate change control procedures and failure to assess the effect of changes on validated processes.

Major changes: definition and requirements

A major change is any modification that has a meaningful potential to affect product safety, product efficacy, compliance status, or the validated state of a process or system. If you cannot confirm the change is safe without additional testing, qualification, or regulatory review, it is a major change.

Common examples of major changes in life sciences include:

• Changes to a critical raw material or API source
• Changes to a manufacturing process step that affects product quality attributes
• Changes to sterilization parameters for a medical device
• Software changes to a 21 CFR Part 11-compliant system that affect audit trail integrity, access control, or data integrity functions
• Changes to the design specifications of a finished device
• Changes to validated cleaning procedures for shared equipment
• Modifications to a product label that affect regulatory clearance or approval conditions

Major changes require a full impact assessment before implementation. The assessment must document what the change affects, what testing or validation is required to confirm the change does not introduce new risk, and what regulatory or customer notification is needed. For FDA-regulated devices, major changes to a cleared 510(k) device may require a new or supplemental submission before the change is implemented commercially.

The approval workflow for a major change typically runs through quality, engineering, regulatory affairs, and senior management. The audit trail on a major change record must be complete: who initiated the change, who reviewed it, who approved it, when it was approved, and what conditions were attached to the approval.

Minor changes: definition and requirements

A minor change is a modification that is unlikely to affect product safety or performance but still requires documented review and approval to confirm that assessment. Minor changes fall outside the threshold that would trigger regulatory notification, but they cannot be implemented informally or without a quality record.

Common examples of minor changes include:

• Changes to an internal work instruction that do not alter the process outcome
• Changes to packaging materials that are aesthetically different but functionally equivalent
• Substituting an approved supplier’s equivalent material within pre-defined specifications
• Updating test equipment calibration intervals based on historical performance data
• Non-critical software configuration changes that do not affect GxP functions
• Changes to training materials that reflect existing procedures, not new ones

A minor change still needs a written rationale confirming why it does not rise to the level of a major change. That rationale must be reviewed and approved by at least quality assurance before the change is implemented. The review should document what was considered, not just the conclusion.

A common classification mistake is treating minor changes as a faster path to skip risk thinking. A change is minor because the risk assessment confirms it, not because the requestor wants it to move quickly. When in doubt, a change should temporarily receive the higher classification and be downgraded only if the impact assessment supports it.

Administrative changes: definition and requirements

An administrative change is a correction or update that carries no product, process, or compliance risk. These are typically clerical in nature: fixing a typographical error in a document, updating a job title reference, correcting a form number, or revising a document control header to reflect an updated format.

Administrative changes do not require the same depth of review as major or minor changes, but they still require a change record and approval. In most QMS procedures, administrative changes are approved by the document owner or a designated quality representative, without requiring sign-off from engineering, regulatory affairs, or management.

A well-designed quality management system makes the administrative change path easy to access so teams stop routing low-risk corrections through the full major-change workflow, which wastes time and creates backlog. The flip side: administrative change criteria must be specific enough that only genuinely low-risk changes use this path.

How to build defensible classification criteria

Regulators and auditors want to see classification criteria that are written down, specific, and consistently applied. A procedure that says “major changes require additional review” without defining what triggers that review gives an inspector nothing to audit against and gives your team no guidance when a borderline change comes in.

Defensible classification criteria have these characteristics:

Specific triggers, not general principles

Instead of “changes that affect product quality are major,” write “changes that alter a critical quality attribute (CQA) as defined in the product specification, or that affect a validated process parameter, are classified as major.” The more specific the trigger, the more consistently your team will apply it.

A decision tree or scoring tool

Many quality teams use a simple questionnaire embedded in the change request form. Each “yes” answer to a risk question increases the classification. This approach reduces the subjectivity that leads to inconsistent classification decisions and gives auditors a documented rationale for every classification outcome.

Examples embedded in the procedure

A list of classification examples in the procedure itself helps quality reviewers calibrate their decisions. The examples should include real scenarios from your product and process portfolio, not generic ones from a template.

Clear escalation when classification is uncertain

Every classification system needs a documented escalation path for borderline cases. When the requestor and quality reviewer disagree on the classification, who resolves it? That decision authority should be written into the procedure.

The link between classification and CAPA

Change control and CAPA overlap at a specific point: when a change is initiated in response to a corrective action. A CAPA that drives a major process change must go through the full change control workflow, not a simplified CAPA-only path. Many FDA warning letters have cited companies that completed a CAPA without triggering the corresponding change control record, leaving the change undocumented under the change control procedure.

A mature QMS links CAPA records directly to change control records. When a corrective action requires a process or system change, the change control record is opened from within the CAPA, and both records reference each other. This linkage gives auditors a complete picture of what was changed and why.

Regulatory notification requirements by classification

For FDA-regulated medical devices, the requirement to notify the agency before or after a change depends on both the nature of the change and the device’s regulatory pathway. 510(k)-cleared devices require a new or supplemental 510(k) submission before implementing changes that could significantly affect safety or effectiveness. PMA-approved devices have stricter notification requirements, with some changes requiring prior approval.

FDA’s guidance document “Deciding When to Submit a 510(k) for a Change to an Existing Device” provides a decision framework for classifying device changes in terms of their regulatory notification trigger. This guidance is separate from, but must be aligned with, the company’s internal change control classification procedure.

For pharmaceutical manufacturers under FDA’s CGMP regulations (21 CFR Part 314 for drug applications), post-approval manufacturing changes are categorized as Prior Approval Supplements, Changes Being Effected in 30 Days, Changes Being Effected, and Annual Reports. These categories map to internal change classifications but are not identical to them. A change classified internally as “minor” may still trigger a Changes Being Effected supplement to FDA depending on the nature of the modification.

ISO 13485 does not directly specify notification timelines, but the standard requires that the organization assess whether changes affect product conformance to regulatory requirements. If they do, the relevant regulatory authorities must be notified per the applicable regulation in each market where the device is sold.

Common classification failures found during audits

FDA inspection reports (Form 483 observations) and ISO audit findings consistently surface the same classification problems:

Failure to document the basis for classification. Many companies classify changes correctly but do not record why the change received that classification. When an auditor asks what evidence supports the minor classification for a specific change, the team cannot point to a documented rationale. A change record should always include the question the team asked and the answer they reached, not just the classification outcome.

Inconsistent application of criteria. A change that was classified as major in January is classified as minor in July with no explanation for the difference. Classification criteria must be applied consistently. When criteria change, the revision to the procedure should be documented and the team should be trained on the new criteria.

Missing changes in the change control system. Changes implemented outside the formal change control process, often called “unauthorized changes” or “informal workarounds,” are a recurring FDA citation. Process changes that appear in batch records or production logs without a corresponding change control record indicate a systemic gap in the change control program.

Administrative changes used to avoid review. When the administrative change path has loose criteria, teams route changes through it to avoid the slower major-change workflow. Auditors who find substantive changes marked as administrative will immediately question the integrity of the entire classification system.

How a QMS platform handles change control classification

A manual change control process, whether paper-based or managed through spreadsheets and email, struggles with the consistency and traceability that regulators expect. Classification decisions get made informally, approval chains get bypassed, and the audit trail is incomplete.

A modern QMS platform like Cloudtheapp builds classification criteria directly into the change request workflow. When a user opens a new change request, they answer a structured risk questionnaire. The system applies the organization’s defined classification rules and assigns a classification automatically based on the answers. That classification, and the reasoning behind it, is locked into the record from the moment of submission.

Approval routing in Cloudtheapp is configured by classification tier. A major change triggers a multi-stage approval workflow through quality, engineering, and management. A minor change routes to quality and the process owner. An administrative change goes to the document owner. The routing is automatic, and every approval action is captured in an immutable audit trail that includes the reviewer’s identity, timestamp, and any conditions attached to the approval.

For companies managing complex QMS programs across product development, manufacturing, and post-market functions, centralizing change control in a single platform means every change, regardless of which function initiates it, follows the same classification rules and generates the same quality of documentation.

If your change control procedure is sound but your team still struggles with inconsistent classification or slow cycle times, the workflow infrastructure is often the gap. See how Cloudtheapp handles change control classification at cloudtheapp.com/demo.

Conclusion

Change control classification is one of those quality system fundamentals that looks simple on paper and proves difficult in practice. The three-tier structure of major, minor, and administrative is well-established in regulated industries, but making that structure work requires specific written criteria, consistent application, and a workflow system that captures the reasoning behind every classification decision. Companies that invest in clear criteria and proper tooling avoid the inconsistency problems that drive the most common FDA and ISO audit findings in change control.

This post created by and appeared first on Cloudtheapp