1. Management of Change Control

2. Overview Changes – Good or bad? Forced or voluntary? The Importance of Change Control Major Changes to both legacy company documents Scope and Responsibilities according to our new Directive General Requirements The Process with the detailed Requirements Changes – Good or bad? Forced or voluntary? The Importance of Change Control Major Changes to both legacy company documents Scope and Responsibilities according to our new Directive General Requirements The Process with the detailed Requirements

3. Changes - Good or Bad? A pharmaceutical company is built on both Quality and Consistency  To always get the right product quality  To follow the established process But a successful firm has also to perform changes  To make continuous improvements and implement innovations  To remain competitive and ultimately stay in business A pharmaceutical company is built on both Quality and Consistency  To always get the right product quality  To follow the established process But a successful firm has also to perform changes  To make continuous improvements and implement innovations  To remain competitive and ultimately stay in business

4. Changes - Forced or Voluntary? Some items must be changed – where you have no option  Supplier cannot deliver the material  Raw material no longer available Other items can be changed – where we do have an option  Change of site, scale, or equipment  Change of QC test method We need to consider the risk versus benefit of each change But the biggest risk by far is an uncontrolled change Even the smallest changes can cause very high risk if not properly controlled Some items must be changed – where you have no option  Supplier cannot deliver the material  Raw material no longer available Other items can be changed – where we do have an option  Change of site, scale, or equipment  Change of QC test method We need to consider the risk versus benefit of each change But the biggest risk by far is an uncontrolled change Even the smallest changes can cause very high risk if not properly controlled

5. The Importance of Change Control Changes must be controlled, managed and followed up to ensure that they are processed according to GMP requirements and Health Authority regulations This includes changes initiated by site or other company internal decisions as well as changes resulting from regulatory requests The change control process must ensure quality, efficacy and safety of the product throughout its life cycle and updated regulatory files. Changes must be controlled, managed and followed up to ensure that they are processed according to GMP requirements and Health Authority regulations This includes changes initiated by site or other company internal decisions as well as changes resulting from regulatory requests The change control process must ensure quality, efficacy and safety of the product throughout its life cycle and updated regulatory files.

6. In other words : Change Control Process has To evaluate the impact of proposed changes on the quality, efficacy and safety of the final product To evaluate the equivalence of changes of facilities, equipment, manufacturing process, and technical transfer To assess the impact on changing specifications and/or analysis methods of all materials used To determine appropriate actions before the change is implemented To evaluate the impact of proposed changes on the quality, efficacy and safety of the final product To evaluate the equivalence of changes of facilities, equipment, manufacturing process, and technical transfer To assess the impact on changing specifications and/or analysis methods of all materials used To determine appropriate actions before the change is implemented

7. Scope This scope applies to all manufacturing sites, affiliates and subcontractors It applies to all modifications of a product or a process covering the following not limited to :  Raw materials (Change of suppliers, process, specs….)  Formula of drug products  Manufacturing process  Specifications and control procedures of components, bulk and finished product  Primary packaging, storage and labelling  Medical devices  Equipment (incl. computerized automated systems)  Facilities, utilities and environment  GMP documentation (e.g., SOPs, MBR, batch records) This scope applies to all manufacturing sites, affiliates and subcontractors It applies to all modifications of a product or a process covering the following not limited to :  Raw materials (Change of suppliers, process, specs….)  Formula of drug products  Manufacturing process  Specifications and control procedures of components, bulk and finished product  Primary packaging, storage and labelling  Medical devices  Equipment (incl. computerized automated systems)  Facilities, utilities and environment  GMP documentation (e.g., SOPs, MBR, batch records)

8. Responsibilities (1) Site Management is responsible for ensuring that any modification to their operations is documented, evaluated and approved from a technical, scientific, quality and regulatory point of view Site Quality Management along with other appropriate functions are responsible for coordinating change control activities in their respective areas to ensure that there is an assessment of all proposed changes and that approved changes are communicated to all affected parties. Site Management is responsible for ensuring that any modification to their operations is documented, evaluated and approved from a technical, scientific, quality and regulatory point of view Site Quality Management along with other appropriate functions are responsible for coordinating change control activities in their respective areas to ensure that there is an assessment of all proposed changes and that approved changes are communicated to all affected parties.

9. Responsibilities (2) The site Quality Head is responsible for ensuring that there are systems and procedures to comply with applicable Directives The site Quality Head is responsible for approving or rejecting a proposed change at site level following an assessment by the site Change Control Committee. The site Quality Head is responsible for ensuring that there are systems and procedures to comply with applicable Directives The site Quality Head is responsible for approving or rejecting a proposed change at site level following an assessment by the site Change Control Committee.

10. Responsibilities (3) It is the responsibility of site Quality Management (QM) to ensure that the regulatory evaluation assesses any potential impact the change may have on the registration file If the change has a potential regulatory impact, it is the responsibility of the Regulatory Site Officer (RSO) to involve the appropriate functions for further activities If the change has a no regulatory impact, the implementation /closing is handled by the site QM/RSO For non-local products (i.e. products under the responsibility of Corporate), the RSO is responsible to initiate the assessment of the proposed change via the Corporate Change Control Committee It is the responsibility of site Quality Management (QM) to ensure that the regulatory evaluation assesses any potential impact the change may have on the registration file If the change has a potential regulatory impact, it is the responsibility of the Regulatory Site Officer (RSO) to involve the appropriate functions for further activities If the change has a no regulatory impact, the implementation /closing is handled by the site QM/RSO For non-local products (i.e. products under the responsibility of Corporate), the RSO is responsible to initiate the assessment of the proposed change via the Corporate Change Control Committee

11. QM Responsibilities for Change Control QM is responsible for ensuring a robust and easy to handle Change Control system  Defining clear roles and responsibilities (initiator, reviewer, approver)  Creating a simple procedure with flow-charts  Defining the needed activities (internally and externally)  Ensuring that all needed functions are involved  Training and education of all employees involved QM is responsible for ensuring a robust and easy to handle Change Control system  Defining clear roles and responsibilities (initiator, reviewer, approver)  Creating a simple procedure with flow-charts  Defining the needed activities (internally and externally)  Ensuring that all needed functions are involved  Training and education of all employees involved

12. Change Control Management needs Training QM is responsible for managing the site Change Control system Change control is a topic in which every employee involved in the manufacturing process needs to be trained Good change control will be as good as the training and education received Focus the training on the serious potential for negative impact of any uncontrolled change We do not want anyone making unauthorised changes to any activity that has Quality and/or Compliance impact QM is responsible for managing the site Change Control system Change control is a topic in which every employee involved in the manufacturing process needs to be trained Good change control will be as good as the training and education received Focus the training on the serious potential for negative impact of any uncontrolled change We do not want anyone making unauthorised changes to any activity that has Quality and/or Compliance impact

13. A Strong Reminder Change made and intended to improve can result in a worse situation or even in a disaster. Therefore, all consequences must be considered With a “good” change you can create other related problems and also high amount of costs Even minor changes or those that are considered to be minor, can have a big impact to product quality and regulatory compliance And finally, all changes need to be closed-out. Change made and intended to improve can result in a worse situation or even in a disaster. Therefore, all consequences must be considered With a “good” change you can create other related problems and also high amount of costs Even minor changes or those that are considered to be minor, can have a big impact to product quality and regulatory compliance And finally, all changes need to be closed-out.

14. General Requirements (1) Any change, which can affect a product with respect to its qualitative and/or quantitative composition, quality (including bioavailability, tolerance), purity, appearance, functionality and/or stability must be assessed for its potential impact prior to its implementation and processed according the result of the assessment There must be a procedure in place at the site for periodic assessment that incremental changes have not altered the overall process. Any change, which can affect a product with respect to its qualitative and/or quantitative composition, quality (including bioavailability, tolerance), purity, appearance, functionality and/or stability must be assessed for its potential impact prior to its implementation and processed according the result of the assessment There must be a procedure in place at the site for periodic assessment that incremental changes have not altered the overall process.

15. General Requirements (2) The Corporate Change Control Committees must address all changes with regulatory impact, evaluate all technical, quality and regulatory aspects and decide The Corporate Change Control Committees must decide on the :  Worldwide strategy based on the technical and/or scientific, quality and regulatory information available at the Corporate Change Control Committee level  Identification of Department/Person in charge of writing the dossier  Action plan including timelines until submission More details later ! The Corporate Change Control Committees must address all changes with regulatory impact, evaluate all technical, quality and regulatory aspects and decide The Corporate Change Control Committees must decide on the :  Worldwide strategy based on the technical and/or scientific, quality and regulatory information available at the Corporate Change Control Committee level  Identification of Department/Person in charge of writing the dossier  Action plan including timelines until submission More details later !

16. Initiation of the Change Control Request at the Site Level (1) For an effective primary technical, scientific, quality and regulatory evaluation, the following systems and processes must be implemented : An evaluation system which allows the assessment of all changes proposed by the site on a regular basis. This must include the creation of a change control committee at site level involving appropriate site functions/experts Use of a Change Control Request Form (CCRF) and follow-up tool (e.g. via electronic mails) as described in the company procedure on change control. For an effective primary technical, scientific, quality and regulatory evaluation, the following systems and processes must be implemented : An evaluation system which allows the assessment of all changes proposed by the site on a regular basis. This must include the creation of a change control committee at site level involving appropriate site functions/experts Use of a Change Control Request Form (CCRF) and follow-up tool (e.g. via electronic mails) as described in the company procedure on change control.

17. Initiation of the Change Control Request at the Site Level (2) The CCRF must be submitted to the site’s change control committee Proposed changes must be justified by adequate and sufficient supporting data and documentation must allow complete understanding and the implications of the planned change to ensure adequate assessment The technical and/or scientific evaluation of the change is under the responsibility of the concerned departments (Technical, Production and/or Development departments) at the site level. The CCRF must be submitted to the site’s change control committee Proposed changes must be justified by adequate and sufficient supporting data and documentation must allow complete understanding and the implications of the planned change to ensure adequate assessment The technical and/or scientific evaluation of the change is under the responsibility of the concerned departments (Technical, Production and/or Development departments) at the site level.

18. Initiation of the Change Control Request at the Site Level (3) The quality and regulatory evaluation is under the responsibility of the Head of Quality and the site regulatory officer. Advice provided by experts such as the regulatory representative responsible for the product may be requested If the proposed change has a regulatory impact and is approved by the Head of Quality, the completed CCRF must be routed by Quality Management and site regulatory officer to other appropriate functions outside the site for coordination of a complete assessment of the technical and/or scientific, quality and regulatory actions required to enact the change, including timing of implementation. The quality and regulatory evaluation is under the responsibility of the Head of Quality and the site regulatory officer. Advice provided by experts such as the regulatory representative responsible for the product may be requested If the proposed change has a regulatory impact and is approved by the Head of Quality, the completed CCRF must be routed by Quality Management and site regulatory officer to other appropriate functions outside the site for coordination of a complete assessment of the technical and/or scientific, quality and regulatory actions required to enact the change, including timing of implementation.

19. Processing of the Change Control Request after Site Approval (1) Changes approved by the Head of Quality must be supported by a detailed time and events schedule that has been agreed upon by the Change Control Committee or directly with affiliate RAs The Change Control Committee (CCC) addresses all changes with regulatory impact for all active pharmaceutical ingredients and all quality changes that may have an impact for the pharmaceutical product (ex: crystallography) Changes approved by the Head of Quality must be supported by a detailed time and events schedule that has been agreed upon by the Change Control Committee or directly with affiliate RAs The Change Control Committee (CCC) addresses all changes with regulatory impact for all active pharmaceutical ingredients and all quality changes that may have an impact for the pharmaceutical product (ex: crystallography)

20. Processing of the Change Control Request after Site Approval (2) In all cases, the Committee must involve representatives of appropriate functions competent to assess the proposed change request with regards to technical and/or scientific, quality and/or regulatory aspects in order to approve or to reject the proposed change or to put the proposed change on hold until supplementary information is made available The Corporate Change Control Committees must decide on the  Worldwide strategy based on the technical and/or scientific, quality and regulatory information available at Corporate Change Control Committee level.  Identification of Department/Person in charge of the writing of the dossier  Action plan including timelines until submission In all cases, the Committee must involve representatives of appropriate functions competent to assess the proposed change request with regards to technical and/or scientific, quality and/or regulatory aspects in order to approve or to reject the proposed change or to put the proposed change on hold until supplementary information is made available The Corporate Change Control Committees must decide on the  Worldwide strategy based on the technical and/or scientific, quality and regulatory information available at Corporate Change Control Committee level.  Identification of Department/Person in charge of the writing of the dossier  Action plan including timelines until submission

21. Processing of the Change Control Request after Site Approval (3) Any modification of the change must be reported to the Committee through an addendum of the initial CCRF for new assessment The Corporate Change Control Committees’ decision should have a validity period of typically 6 months. If a change is not processed during this period, a new CCRF must be initiated for re- assessment Any modification of the change must be reported to the Committee through an addendum of the initial CCRF for new assessment The Corporate Change Control Committees’ decision should have a validity period of typically 6 months. If a change is not processed during this period, a new CCRF must be initiated for re- assessment

22. Compilation of Documentation Supporting Changes with Regulatory Impact On receipt of filled-in and signed-off CCRF from either Corporate Change Control Committees or local Change Control Committees, the Affiliate Regulatory Affairs or regulatory site officer must prepare or support the preparation of submission ready documents based on the agreed regulatory assessment of the change and must provide them to the appropriate regulatory function for review and approval for file ability The appropriate regulatory function must submit the provided documentation to the appropriate Health Authorities The Affiliate Regulatory Affairs or the site regulatory officer must inform the change control committee, as applicable, of the receipt of regulatory notification or approval or rejection of submitted changes. On receipt of filled-in and signed-off CCRF from either Corporate Change Control Committees or local Change Control Committees, the Affiliate Regulatory Affairs or regulatory site officer must prepare or support the preparation of submission ready documents based on the agreed regulatory assessment of the change and must provide them to the appropriate regulatory function for review and approval for file ability The appropriate regulatory function must submit the provided documentation to the appropriate Health Authorities The Affiliate Regulatory Affairs or the site regulatory officer must inform the change control committee, as applicable, of the receipt of regulatory notification or approval or rejection of submitted changes.

23. Implementation of Changes at Site Level (1) For changes without regulatory impact, the site Change Control Committee must decide about the prerequisites and implementation timelines as well as informing the respective unit in which the change will occur. A change must only be implemented after receipt of the written approval documented on the CCRF For changes with regulatory impact, the release of the batch after implementation of the change must only be made after notification or approval of the submitted file by the respective Health Authorities (except in case of an annual reportable change for the US). For changes without regulatory impact, the site Change Control Committee must decide about the prerequisites and implementation timelines as well as informing the respective unit in which the change will occur. A change must only be implemented after receipt of the written approval documented on the CCRF For changes with regulatory impact, the release of the batch after implementation of the change must only be made after notification or approval of the submitted file by the respective Health Authorities (except in case of an annual reportable change for the US).

24. Implementation of Changes at Site Level (2) The regulatory site officer must inform affiliate regulatory affairs of the date of implementation of such a change with the specific batch number reference The change request form must be archived by site Quality Management. The regulatory site officer must inform affiliate regulatory affairs of the date of implementation of such a change with the specific batch number reference The change request form must be archived by site Quality Management.

25. Conclusion and Summary Changes need to be traceable  Who changed, What, Where, When, Why, and How  What are the consequences with respect to risks and costs, to validation status and submission to Authorities Changes need to be planned in advance, evaluated, approved, implemented and followed-up The required experts need to be involved. Don´t forget engineers and IS people! Documentation should be clear, accurate and complete Keep you manufacturing process in the validated state/ state of control when you perform changes ! Changes need to be traceable  Who changed, What, Where, When, Why, and How  What are the consequences with respect to risks and costs, to validation status and submission to Authorities Changes need to be planned in advance, evaluated, approved, implemented and followed-up The required experts need to be involved. Don´t forget engineers and IS people! Documentation should be clear, accurate and complete Keep you manufacturing process in the validated state/ state of control when you perform changes !

26. Thank You Any Questions Thank You Any Questions