When a later reviewer asks, “Why did Quality authorize this change?”, “the validation passed” is evidence. It is not the whole decision.
For finished pharmaceuticals, 21 CFR 211.100(a) requires written production and process-control procedures, including changes, to be drafted, reviewed, and approved by the appropriate organizational units and reviewed and approved by the quality control unit. 21 CFR 211.22 assigns the quality control unit responsibility for approving or rejecting procedures or specifications that affect drug-product identity, strength, quality, and purity.
Those regulations establish approval responsibilities and process-control requirements. They do not prescribe a ComplianceWorxs record format or say that one passing protocol, by itself, completes a change decision.
FDA guidance supplies useful, nonbinding context. The January 2011 Process Validation guidance describes validation as a lifecycle of process design, process qualification, and continued process verification. FDA's October 2006 Quality Systems guidance recommends controlling and documenting changes, evaluating the specific elements that may be affected, and monitoring a change's effects. The April 2009 ICH Q10 guidance recommends risk-based evaluation, relevant expert input, prospective evaluation criteria, and post-implementation confirmation that the objective was achieved without a harmful effect on product quality.
Separate test acceptance from change authorization.
A protocol asks whether defined work met defined criteria. A change approval asks whether the organization has enough evidence to authorize implementation within stated boundaries.
Those questions overlap, but they are not identical. A validation report may establish that equipment performed within an approved range, a process produced specified results under tested conditions, or a system met stated requirements. The change decision may also depend on interfaces, procedures, training, cleaning, maintenance, data handling, regulatory commitments, supply effects, open deviations, and the plan for confirming continued control.
The practical test is simple: if the validation report disappeared, would the change decision lose important evidence? It should. If every other change-control record disappeared, would the validation report still explain the full basis, authority, conditions, and follow-up for implementation? Often it would not.
Define the approval criteria before the final report.
Prospective criteria reduce the risk that a favorable protocol result becomes the only result that matters. Before execution, the record should make clear what evidence the authorization will consider, which deviations or unresolved questions require escalation, and what conditions could prevent or limit implementation.
This does not require predicting every possible observation. It requires naming the decision boundary while the organization can still distinguish evidence collection from outcome selection.
A thin approval record says
- “Validation completed successfully.”
- “All acceptance criteria passed.”
- “Quality approved implementation.”
A reviewable approval record shows
- What change and intended use were evaluated
- Which evidence and assumptions supported the conclusion
- How deviations and cross-functional effects were resolved
- What residual risk, conditions, monitoring, and authority governed implementation
Use the Four Lenses to test the change decision.
The Four Lenses keep a passing result from doing work it cannot do. Each lens asks a distinct question about the same authorization.
Evidence
What was known? Preserve the change objective, current-state and proposed-state information, impact assessments, approved protocol, qualification or validation results, deviations, related technical studies, training and procedure readiness, regulatory assessment, and source records.
Judgment
How was the evidence evaluated? Show why the selected studies addressed the material risks, how differences from the current process were interpreted, why deviations did or did not change the conclusion, and why the controls were considered sufficient for the intended use.
Risk
What remained uncertain? Identify untested ranges, limited operating experience, dependencies, potential unintended effects, detection limits, monitoring needs, and the point at which the change must be paused or escalated.
A practical record example
A fictional oral-solid-dose manufacturer replaces an obsolete high-shear granulator with a newer unit. Engineering documents the equipment comparison. The site executes its approved qualification and process-performance work, and the planned runs meet their protocol acceptance criteria. One minor deviation involving a temporary sensor interruption is investigated and closed before the report is approved.
The passing report is important. It does not answer every authorization question. The change record must still show whether the newer unit's geometry and control logic are adequately represented by the tested conditions, how the deviation affected confidence in the evidence, whether batch records and training are ready, whether cleaning and maintenance controls are in place, whether regulatory reporting is required, and which process indicators will be examined after implementation.
This fictional example does not determine a real change outcome. It illustrates the record question: why was implementation reasonable within the approved conditions, based on the evidence available at the time?
| Lens | What the record contains | Question before authorization |
|---|---|---|
| Evidence | Equipment comparison; approved qualification and process protocols; results; sensor-deviation investigation; cleaning, maintenance, procedure, training, and regulatory assessments. | Does the package cover the intended use and every material interface affected by the change? |
| Judgment | Why tested conditions represent the proposed operating range; why the sensor deviation did not undermine the relevant conclusions; why selected controls are sufficient. | Does the conclusion extend beyond what the studies and impact assessments established? |
| Risk | Limited commercial experience on the new unit; defined early-batch monitoring; escalation limits; owners and review timing. | What remains uncertain, and how will the site detect an unintended effect? |
| Authorization | Quality approves implementation for the stated product and range after named prerequisites, with post-implementation review after the defined observation period. | Is the responsible authority approving a bounded decision with explicit conditions and follow-up? |
Record conditions as part of the decision.
Approval need not mean “all uncertainty is gone.” It may mean the change is authorized within defined conditions because the evidence is sufficient and the remaining uncertainty is controlled.
Conditions can include completion of training, controlled document effectiveness, data migration reconciliation, enhanced sampling, review of early commercial batches, stability follow-up, supplier confirmation, or another site-defined control. The applicable conditions depend on the change; they should not be copied from a generic list.
A useful approval makes three things retrievable: what must be true before implementation, what will be monitored afterward, and what result requires escalation or reconsideration.
Close the loop after implementation.
ICH Q10 recommends evaluating an implemented change to confirm that its objectives were achieved and that it did not harm product quality. FDA's Process Validation guidance likewise treats assurance of control as a lifecycle activity rather than a one-time event.
That does not mean every change needs the same review duration or data package. It means the record should define a proportionate follow-up and preserve the later conclusion. If the change is approved subject to monitoring, the authorization is incomplete as an operating record until the owner, evidence, timing, and escalation logic are visible.
Make the authorization answer five questions.
- What exactly is changing? State the proposed state, intended use, affected products or processes, and decision boundary.
- What did the validation work establish? Identify the tested conditions, acceptance criteria, results, deviations, and limitations without overstating them.
- What else informed the decision? Connect technical, operational, Quality, and regulatory assessments to the conclusion.
- What remains uncertain? Record residual risk, implementation conditions, monitoring, and escalation points.
- What did Quality authorize? Name the decision, accountable authority, effective point, prerequisites, owners, and follow-up.
The executive conclusion
Validation can demonstrate that defined work met defined criteria. Change approval must show why the complete evidence supported implementation under stated conditions. Quality leaders should require the record to connect the test result to the impact assessment, scientific judgment, residual risk, accountable authority, and post-implementation review.
For a broader change-control review, use the change-control risk-assessment guide or the detailed record checklist. To see how the same distinction applies across completed GMP decisions, read The Record Should Explain the Decision.
Source context: Regulatory requirements: 21 CFR 211.22 and 21 CFR 211.100. Nonbinding agency recommendations: FDA, Process Validation: General Principles and Practices, January 2011; FDA, Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations, October 2006; and FDA/ICH, Q10 Pharmaceutical Quality System, April 2009. The fictional granulator example and Four Lenses review are CW editorial examples, not regulatory mandates.