In pharmaceutical and biotech manufacturing, changes to processes, equipment, or materials must be handled carefully. That’s why change control is a critical part of any company’s current Good Manufacturing Practice (cGMP) system. But when change control fails, when a process is changed without proper review or when a bad decision leads to a product issue, who is legally responsible?
Is it the quality team for not catching the mistake? Operations for not following the system? Or top management for poor oversight?
Let’s look at what cGMP law says about roles, responsibilities, and accountability when change control goes wrong.
What Is Change Control?
Change control is the system used to:
- Propose changes to processes, equipment, suppliers, or documents
- Review and assess the impact of those changes
- Approve or reject changes
- Monitor the effect after changes are made
The goal is to keep product quality and patient safety intact, even when changes are necessary.
Change control applies to both small updates (like a new form) and major shifts (like replacing a manufacturing tank). cGMP law, found in 21 CFR Parts 210 and 211 for drugs and 21 CFR Part 820 for devices, requires that every change be reviewed and approved by key departments before implementation.
Key Players in Change Control
Let’s break down the main roles:
1. Quality Unit (QU)
The Quality Unit is legally required to review and approve all cGMP changes. This includes:
- Checking for risks to product identity, strength, quality, and purity
- Making sure the change does not affect regulatory filings
- Confirming that testing, validation, or qualification is planned
The QU signs off on whether a change can move forward. If the QU approves a bad change, or fails to require proper evaluation, they may share legal responsibility for the failure.
2. Operations/Manufacturing
The operations team typically proposes changes and performs the work. Their role is to:
- Clearly describe the change
- Provide reasons and expected impact
- Help assess risks
- Complete training and implementation tasks
If operations acts without approval, skips steps, or hide the risks, they can be held accountable for the outcome.
3. Engineering or Maintenance
When the change involves equipment or infrastructure, this team provides technical input. If they skip key checks or give incorrect information, it can lead to failure down the line.
4. Regulatory Affairs
If the change affects registered products or facilities, regulatory staff must decide if filings are needed (e.g., supplements, notifications). Failing to file when required can lead to FDA warnings or product seizures.
5. Senior Management
Management signs off on large changes, major capital projects, or policy updates. They also approve resources (time, staff, money) needed for safe implementation.
Most importantly, they are responsible for the overall effectiveness of the quality system. If change control is weak across the board, the FDA may hold management legally accountable.
What Happens When Change Control Fails?
Here are some examples of how change control failures happen:
- Skipping Impact Assessment: A raw material is switched to save cost, but the new material behaves differently in the process.
- Lack of Cross-Department Review: A change is made to the mixing speed, but the packaging is not informed, leading to an unsealed product.
- Untrained Staff: A new cleaning chemical is approved, but no one is trained to use it safely.
- Paperwork Gaps: Approval signatures are missing, or the wrong version of a document is used.
- Lack of Post-Change Monitoring: After a change, no follow-up testing is done to verify performance.
In any of these cases, FDA investigators will look at the entire trail, who proposed the change, who reviewed it, who signed it, and how it was carried out.
Who Is Held Legally Responsible?
Let’s break it down by team.
Quality Unit
The FDA expects the quality unit to be the final gatekeeper. If they approve a change without proper review, they can be cited in Form 483 observations, Warning Letters, or even consent decrees.
In some cases, quality leaders have lost their jobs or faced legal action if their failure led to serious harm.
Operations
If a change was implemented without approval, or someone ignored instructions, they may be disciplined, especially if the mistake was intentional or due to carelessness.
In legal terms, this can be classified as “failure to follow procedures”, which is a direct violation of cGMP.
Management
Senior leadership is often held responsible when the failure is systemic. If the FDA finds repeat problems, lack of training, or poor oversight, management is named in the inspection report. In the worst cases, executives have faced personal liability under the Park Doctrine, which allows criminal charges if they knew or should have known about violations.
How to Prevent Accountability Gaps
To avoid finger-pointing after a failure, companies must:
1. Clearly Define Roles
Each step of the change process should have assigned owners, who propose, who evaluate, who approves. These responsibilities should be documented in SOPs and visible in the change forms.
2. Require Multiple Reviews
No single person should approve a major change alone. Use a cross-functional team for review, including quality, operations, and regulatory.
3. Verify Implementation
Changes should not be marked complete until all training, testing, and documentation is finished. Post-implementation checks can catch problems early.
4. Track Metrics
Use metrics like overdue changes, rejected changes, or deviation trends after changes to spot weaknesses in the system.
5. Train Frequently
Make change control training part of ongoing staff development. This includes refresher courses and real-world examples of what can go wrong.
Conclusion: Everyone Plays a Part, but Accountability Is Clear
In the world of cGMP, change is expected, but only when it is managed carefully.
Quality, operations, regulatory, and management all have a part to play. But when things go wrong, accountability often falls on the person or group who skipped steps, ignored warnings, or failed to act. Under FDA law, each person is responsible for the duties assigned to them.
A strong change control process not only protects products and patients, it protects people from legal risk. The key is communication, documentation, and shared responsibility.
