Change control is the formal process a quality system uses to request, assess, approve, implement, and verify changes — so that nothing changes a product, process, or document without someone evaluating the impact first. It’s one of the most important disciplines in a QMS, because uncontrolled change is one of the biggest sources of quality problems and audit findings. This guide explains what change control is, why it matters, the step-by-step process, how it differs from change management and document control, and how software keeps it from falling through the cracks.

What is change control?

Change control is a structured way of managing change so it’s deliberate rather than accidental. When someone proposes a change — to a procedure, a specification, a supplier, a piece of equipment, or a product design — change control ensures the change is documented, its impact and risk are assessed, the right people approve it, it’s implemented in a controlled way, and the result is verified. The point isn’t to make change hard; it’s to make sure change is safe and that everything affected (documents, training, records) stays consistent afterward.

Why change control matters

Most quality incidents trace back to a change that wasn’t properly controlled: a procedure updated without retraining the team, a material swapped without assessing the effect, a “small tweak” with consequences nobody evaluated. ISO 9001 builds change control into the standard — Clause 6.3 covers planning of changes, Clause 8.5.6 covers control of changes during production, and Clause 7.5 governs changes to documented information. Auditors probe change control because it reveals whether your system actually governs itself or just reacts. A disciplined change process is also what keeps your document control honest — every approved change should flow into the right document revision and the training that goes with it.

The change control process, step by step

• 1. Request the change. Capture what’s being changed, why, and who’s requesting it.
• 2. Assess impact and risk. What does this change affect — documents, training, validation, suppliers, other products? What could go wrong? This step is the heart of change control.
• 3. Review and approve. The right stakeholders evaluate and authorize (or reject) the change. High-impact changes need broader review.
• 4. Implement in a controlled way. Make the change, update affected documents, and carry out any required actions.
• 5. Update training. Anyone affected by a revised procedure is re-trained on the new version, with proof.
• 6. Verify and close. Confirm the change was implemented correctly and had the intended effect, then close the record with that evidence.

For engineering and product changes specifically, this takes a more detailed form; see our guide to the engineering change control process.

Change control vs change management vs document control

• Change control is the formal process for evaluating and approving a specific change to a product, process, or document.
• Change management is the broader organizational discipline of planning and guiding change — often including the people/communication side.
• Document control governs the lifecycle of documents (versioning, approval, distribution). Change control often triggers a document revision, but it’s the wider decision process around the change, not just the document update.

In practice they interlock: a change control decision drives a document revision, which drives training — one connected chain.

Examples of change control

• Procedure change: A work instruction is revised. Change control assesses who’s affected, routes it for approval, and ensures the team is retrained on the new revision before it takes effect.
• Supplier change: Switching a raw-material supplier triggers an impact assessment (quality, qualification, risk) before approval.
• Equipment change: Replacing a production tool is evaluated for validation and calibration impact.
• Design change: A product design update flows through change control into the relevant records and, for devices, the design file.

How QMS software manages change control

Change control fails most often at the seams — a change gets approved but the document, the training, or the record doesn’t get updated to match. QMS software closes those seams by running change control as a connected workflow: a change request carries its impact assessment and approvals, then drives the affected document revisions, assigns the resulting training automatically, and lands the whole thing in one audit trail. Nothing gets approved and then forgotten. That connected control is a core part of an eQMS, and it’s how TLM keeps change deliberate and traceable for small-to-mid regulated teams. To see a change move from request to verified closure — with documents and training following automatically — book a demo.

Frequently asked questions

What is change control?

Change control is the formal process a quality system uses to request, assess, approve, implement, and verify a change to a product, process, or document. It ensures no change happens without its impact and risk being evaluated first, and that everything affected — documents, training, records — stays consistent afterward.

What is the difference between change control and change management?

Change control is the formal process for evaluating and approving a specific change (to a product, process, or document). Change management is the broader organizational discipline of planning and guiding change, often including the people and communication side. Change control is one mechanism within the wider practice of change management.

What are the steps in the change control process?

Request the change; assess impact and risk; review and approve with the right stakeholders; implement in a controlled way and update affected documents; update training for anyone affected; and verify the change worked before closing the record with evidence. The impact/risk assessment is the heart of the process.

Does ISO 9001 require change control?

Yes. ISO 9001 addresses change in several clauses: 6.3 (planning of changes), 8.5.6 (control of changes during production and service provision), and 7.5 (control of changes to documented information). Auditors examine change control because it shows whether a quality system genuinely governs itself.

How does change control relate to document control?

They interlock. Change control is the decision process around a change; document control governs the document lifecycle. An approved change typically triggers a document revision, which in turn drives the training that goes with the new version — one connected chain rather than separate steps.