Changes That Lurked in the Shadows

🕯️ Welcome back to another chilling tale from the Audit Crypt.Professor Rallis-Daw here, with a cautionary tale about changes those seemingly harmless little modifications that can quietly creep through your Quality Management System unnoticed…Until an auditor comes looking for them.

​

⚰️ Deep within the halls of MedTech Manor, everything appeared to be under control. R&D engineers had made a few improvements to the device. Manufacturing had optimized a process. A supplier had changed. A material was changed as it would no longer be available. Nothing significant, everyone agreed. After all…“It was only a minor change.” But then the auditor arrived. And from deep within the crypt came the question: “Please provide me with a list of all design and manufacturing process changes since the last audit.” The room fell silent. R&D engineers opened the change control system. Manufacturing produced another list. Quality began searching through change orders. Regulatory looked concerned. Because somewhere along the way…the changes had disappeared into the shadows. Some were classified as just document changes. Others were buried within manufacturing records. A supplier change was lurking inside a change order. And several changes had been implemented without anyone clearly documenting whether they were design changes, manufacturing process changes or other pertinent change types. But something even more sinister was waiting.The auditor selected a change and asked: “Where is the regulatory assessment?” Silence. The change had been reviewed by Engineering. Approved by Quality. Implemented by Manufacturing. But no one had adequately assessed whether the change required notification to a regulatory authority.

👻 And suddenly, that harmless little change wasn't looking quite so harmless anymore. Because changes to your device, manufacturing process, supplier, material, software, sterilization process, manufacturing location or even labeling may have regulatory consequences. Not every change requires notification. But you need an adequate assessment to determine whether it does. And that assessment needs to consider every market where the device is placed on the market: FDA, Your Notified Body, Health Canada, TGA, ANVISA. Or any other applicable regulatory authority. Because a change considered acceptable in one market may trigger regulatory action in another. Don’t forget those ghostly country specific requirements in MDSAP. And beware of one particularly dangerous phrase often heard echoing through the Audit Crypt: “It doesn't affect form, fit, or function.” Perhaps not. But did you assess its impact on: Risk? Biocompatibility? Sterilization? Human Factors and Usability engineering? Software? Packaging? Shelf life? Validation? Labeling? Regulatory submissions? “Minor change” is a conclusion. The risk-based documented assessment is how you get there.

💀 Moral of the Audit Crypt. Your change control system should allow you to clearly and quickly identify: What changed. Why it changed. Whether it is a design change or manufacturing process change. What the change could impact including other documents, parts on order, product in the field, etc. What verification or validation is required. And most importantly…Whether regulatory notification, submission, or approval is required prior to implementation. Because if your auditor asks: “Show me all of your design and manufacturing process changes from the last 12 months.”…and your organization has to summon five departments, three spreadsheets, and a séance to find them…​You may already have a ghost in your change control system as if you can't clearly identify your changes, how can you demonstrate that you adequately assessed them?

🕷️ Don't decide a change is minor and then skip the assessment. Do the assessment and let the evidence tell you whether the change is minor. And make sure your system allows you to clearly identify what changed and demonstrate that the appropriate regulatory assessment was performed. Because otherwise…That “tiny little change” you made six months ago…might just come crawling back out of the Audit Crypt. ☠️

🕯️ Until next time…Stay vigilant. Stay traceable. Assess before you implement.

​

👻 And remember, the changes you fail to assess properly and thoroughly today may be the findings that come back to haunt you tomorrow.