Change control discipline for process and procedure changes — 820.70(b)'s requirement for verification/validation and documented approval continues under ISO 13485 §4.1.4.
Scope expands to all QMS process changes (not only product-direct); dual-tier impact evaluation required — QMS system impact AND device impact, separately documented.
Change control records for QMS infrastructure changes (CAPA workflow, management review, supplier qualification) — 'administrative' changes without documented impact evaluations are a primary finding target.
Maps to
QMSR / ISO 13485: §820.70(b) Production and process changes.
ISO 13485: §4.1.4 Control of changes to QMS processes
Requirement text
The organization shall manage these quality management system processes in accordance with the requirements of this International Standard and applicable regulatory requirements. Changes to be made to these processes shall be: (a) evaluated for their impact on the quality management system; (b) evaluated for their impact on the medical devices produced under this quality management system; (c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements.
Why this clause exists
QMS processes do not exist in isolation — each process interacts with others, and a change to one can propagate effects throughout the system in ways that are not immediately visible to the person authorizing the change. Section 4.1.4 exists because Part 820's production and process change requirements (820.70(b)) focused narrowly on changes to specifications, methods, and procedures that directly affect product, requiring verification or validation before implementation. That scope left a structural gap: changes to QMS processes that do not directly touch a production specification — reorganizing management review, restructuring supplier qualification, changing a CAPA workflow — could occur without a systematic evaluation of whether the change degraded the QMS as a functioning system or introduced risk pathways into the devices the QMS governs.
ISO 13485:2016 clause 4.1.4 closes this gap by applying a two-tier impact evaluation obligation to all QMS process changes, not only product-direct changes. The dual scope — impact on the QMS itself, and impact on the medical devices produced under it — reflects the standard's recognition that QMS health and product safety are not separable: a weakened quality system is a product risk, whether or not any individual change modifies a device specification. FDA incorporated this requirement into QMSR because enforcement experience demonstrated that quality system degradation frequently preceded device failures — the systemic change that made the failure possible was often not subject to the change-control discipline that would have caught it.
The 'controlled in accordance with' requirement ensures that even after evaluation, the mechanics of implementing QMS process changes must satisfy the standard's own change control framework. This prevents the circular failure mode where an organization recognizes a change needs evaluation but applies a lighter-weight control because the change is 'only QMS infrastructure, not product.'
What changed
§820.70(b) — Part 820 (legacy)
"Production and process changes. Each manufacturer shall establish and maintain procedures for changes to a specification, method, process, or procedure. Such changes shall be verified or where appropriate validated according to § 820.75, before implementation and these activities shall be documented. Changes shall be approved in accordance with § 820.40."
§4.1.4 — ISO 13485:2016 (current)
"The organization shall manage these quality management system processes in accordance with the requirements of this International Standard and applicable regulatory requirements. Changes to be made to these processes shall be: a) evaluated for their impact on the quality management system; b) evaluated for their impact on the medical devices produced under this quality management system; c) controlled in accordance with the requirements of this International Standard and applicable regulatory requirements."
Δ Scope expands from production-and-specification changes to all QMS process changes. Adds mandatory two-tier impact evaluation (QMS system impact + device impact) as a structured obligation — Part 820.70(b) required verification/validation of production changes but not a dual-dimension systemic evaluation.
Common gaps (what we see in audits)
- Change Control Procedure Scoped to Product-Direct Changes Only — The organization's change control procedure applies to changes to device specifications, production procedures, and manufacturing parameters but does not cover changes to QMS process structure — for example, restructuring the CAPA workflow, changing how management review is conducted, or revising the supplier qualification process. Under ISO 13485 §4.1.4 all QMS process changes must be evaluated and controlled.
- Impact Evaluation Addresses Device Impact Only, Not QMS System Impact — When QMS process changes are evaluated, the impact assessment focuses on whether the change could affect device specifications or production parameters. The standard's requirement to evaluate impact on the QMS as a system — process linkages, documentation dependencies, monitoring coverage, record integrity — is not addressed.
- Informal Authorization of 'Administrative' QMS Changes — Changes characterized as 'administrative' or 'QMS housekeeping' — revising reporting structures, modifying document numbering conventions, changing review frequencies — are implemented without formal change control, on the reasoning that they do not affect product. ISO 13485 §4.1.4 does not recognize an administrative carve-out: all QMS process changes must be controlled.
- No Record of Impact Evaluation for Implemented Changes — QMS process changes are discussed and approved in meetings but impact evaluations are not documented as quality records. When an auditor asks to see the impact evaluation for a specific QMS process change, the organization can produce meeting minutes but not a formal documented assessment.