Lifecycle · Practitioner guidance

Software Change Control

Assess software and configuration changes from affected GxP functions, failure scenarios, dependencies, evidence, and release conditions.

Author
Sandip Thorat
Published
12 September 2026
Last reviewed
12 September 2026
Version
1.0
Content type
Practitioner guidance
Primary references
2 linked sources in this guide

Start with the affected use

A change label such as minor, major, standard, or emergency helps route the record, but it does not determine testing by itself. Describe the change and its reason, then identify the approved intended use, affected GxP functions, records, interfaces, data, roles, security controls, procedures, and open transactions.

Minimum change-impact record

Assessment fieldWhat to document
Change description and reasonCurrent behavior, proposed behavior, components, configuration items, supplier release, defect, or urgent condition
GxP impactRegulated process, decision, calculation, control, or record that can be affected
Functional risk assessmentFailure scenario, process effect, consequence, existing controls, detectability, and remaining risk
Configuration, interface, and data impactChanged rules, integrations, mappings, transformations, open records, migrations, or reports
Electronic records and signaturesRecord meaning, audit trail, signature manifestation, record linking, retention, and accurate copy
Security and accessRoles, privileged access, identity, segregation of duties, and service accounts
Evidence and regression scopeSupplier evidence accepted, local tests, exploratory charters, automated checks, and exclusions
ReadinessDocumentation, procedure, training, deployment, rollback, monitoring, approval, and post-implementation review

Four completed fictional examples

ChangeAffected function and riskProportionate validation approachRelease conclusion
Minor configuration: add a non-GxP dashboard columnPresentation only; no calculation, status, workflow, record, or export changeConfiguration review, display check with representative roles, accessibility confirmationApproved after expected display and permissions are confirmed; no broad regression
Major workflow: revise CAPA closure routingA required Quality approval could be bypassed for legacy blank site valuesScript every material branch and unauthorized transition; explore interruption, concurrent review, API path, and open-record transitionRestricted until the legacy condition is corrected and targeted regression passes
Supplier SaaS releaseRouting engine and signed-record export changed; dashboard color also changedUse release notes and supplier regression for standard behavior; locally test configured routing and signature meaning; perform usability check for colorApprove only the supported functions after deviations close; do not apply one regression package to all three changes
Emergency security changeIdentity provider certificate expires and can block access; urgent production change is requiredRecord emergency rationale and temporary controls; verify authorized login, privileged access, signature reauthentication, service accounts, and recovery; complete retrospective reviewTime-limited approval with monitoring and post-implementation Quality review

Selecting regression scope

Trace each changed component to affected GxP functions and shared dependencies. Include unchanged functions only when the change can influence them through shared workflow engines, identity services, data models, interfaces, libraries, infrastructure, or open-state transitions. Record why excluded tests do not answer a remaining risk question.

Release and post-implementation review

Release approval should identify the implemented version, completed evidence, deviations, residual risk, restrictions, rollback or recovery readiness, required training, monitoring window, and accountable approvers. A post-implementation review is useful when production-only conditions, data volume, integrations, or emergency timing leave uncertainty that cannot be reproduced safely before release.

Reassessment criteria

Reassess when intended use, workflow, configuration, interface, data model, record or signature behavior, identity service, supplier version, known issue, operating environment, or monitoring result changes.

Regulatory and procedural context

Primary sources. FDA CSA guidance describes risk-based assurance for production and quality-management-system software. 21 CFR Part 11 addresses change control over systems documentation and controls for relevant electronic records and signatures.

Company procedure. The organization’s approved validation, change-control, supplier-management, information-security, data-integrity, records-retention, and Quality approval procedures determine the required records, roles, and approval route.

CSVtoCSA practitioner interpretation. Testing depth should follow the affected function and credible failure, not the administrative change category. This is a recommended validation approach, not a statement that every listed activity is a direct regulatory requirement.