Change Control Pitfalls: Legal and Regulatory Risks in FDA-Regulated Industries

Obtaining FDA clearance or approval is just the beginning of a company’s regulatory journey. As FDA-regulated products evolve, changes to software, labeling, manufacturing processes, and design are a natural part of the product lifecycle. Managing these changes effectively requires a robust and well-documented change control process. This process is essential not only for ensuring product quality and safety but also for meeting FDA regulatory requirements.

Improperly managed changes can have serious consequences, including FDA enforcement actions, product recalls, and litigation. To avoid rendering a product adulterated or misbranded under the Federal Food, Drug, and Cosmetic Act (FDCA), changes must be carefully evaluated and documented.

Why Change Control Matters

The FDA requires manufacturers to implement change control systems that ensure modifications, regardless of scope, do not compromise product quality, safety, or effectiveness. Inconsistent or informal practices can result in:

• FDA Form 483 observations
• Warning Letters
• Product recalls
• Import alerts
• Civil or criminal enforcement
• Product liability litigation

FDA Enforcement in Action

Failure to follow change control procedures is a frequent finding in Form 483s and Warning Letters. Here are several recent examples:

• Software Update Without Validation
  A neurodiagnostic company deployed a software update without properly verifying or documenting the change. FDA issued a Warning Letter.
• Unapproved Design Modification
  An orthopedic firm modified a hip implant component without documenting or verifying the change. The modification was not cleared through a new 510(k), resulting in a Warning Letter, instructions to stop manufacturing immediately, and a recall.
• Labeling Change Mismanagement
  A recall was initiated after a knee implant label included an incorrect Unique Device Identifier (UDI). The issue was traced to inadequate labeling change controls, rendering the device misbranded.
• Process Changes Without SOP Compliance
  An OTC drug manufacturer altered its temperature range and added manufacturing steps without following its own change control procedure. The FDA issued a Warning Letter.

Litigation Risks from Change Control Failures

Regulatory noncompliance is only part of the risk. Poor change control can also expose companies to product liability and consumer protection claims:

• Cumulative Device Changes Without PMA Review
  A patient filed suit after suffering injuries from a Class III device that underwent multiple PMA supplements. The complaint alleged the changes significantly altered the device’s risk profile and were not cumulatively assessed or submitted to the FDA.
• Undisclosed Design Modifications
  Thousands of lawsuits were filed over complications from permanently implanted devices. Plaintiffs alleged that the manufacturer made unapproved design changes without conducting clinical testing or submitting to the FDA, leading to allegations of failure to warn and product defect.
• OTC Product Reformulation Without FDA Notification
  An OTC company faced litigation after adverse events linked to a reformulated product. The suit claimed the company failed to submit an NDA supplement or conduct appropriate validation, resulting in the marketing of an unapproved drug.

Best Practices for Manufacturers

To mitigate risk, manufacturers should implement and maintain a rigorous change control process:

• Establish SOPs
  Define clear procedures for how changes are proposed, evaluated, approved, implemented, and documented.
• Use Standardized Forms or Templates
  Include fields for:
  • Change description and rationale
  • Affected products, processes, or documents
  • Risk assessment and mitigation strategies
  • Regulatory pathway evaluation
  • Verification and validation plans
  • Training and implementation tracking
• Involve Cross-Functional Teams
  Include representatives from regulatory, quality, engineering, clinical, and operations to ensure thorough evaluation.
• Document Everything
  Maintain audit-ready records of decision-making, assessments, approvals, and post-change monitoring.
• Link to Risk Management
  Evaluate whether the change introduces new hazards or alters existing risks. Update the risk file and reassess the benefit-risk profile as needed.
• Monitor Cumulative Impact
  Small, incremental changes can materially alter the product. Periodically review whether the product remains consistent with the approved version.
• Consider a PCCP
  For certain product types, a Predetermined Change Control Plan (PCCP) can streamline regulatory submission for anticipated changes.
• Audit the Process
  Conduct regular internal audits and incorporate lessons learned from recalls, FDA inspections, and prior errors.

Minor Changes, Major Consequences

Regulatory scrutiny does not end with FDA clearance or approval; it continues throughout the entire product’s lifecycle.

“Some companies approach change control as a routine administrative task instead of a meaningful risk management tool,” said Amanda Johnston, who advises FDA-regulated companies on compliance. “But even seemingly minor changes can carry significant implications if they aren’t evaluated through the appropriate regulatory lens.”

Effective change control must be proactive, cross-functional, and well-documented. When overlooked or poorly implemented, inadequate change control can lead to enforcement actions, import holds, recalls, litigation, and reputational harm.

How Gardner Law Can Help

Gardner Law advises FDA-regulated companies on strengthening change control processes to meet current FDA expectations. Whether you're evaluating the impact of prior modifications or planning a future change, our regulatory attorneys provide practical, risk-based guidance.

We recommend an independent audit of your change control process and a regulatory assessment of prior changes to identify any potential regulatory risks. Our regulatory team can support this effort, while David Graham is available to assist with litigation matters if concerns escalate.