Change Management

A procurement team swaps to a lower-cost flour supplier mid-quarter without flagging the change to quality. The new supplier's facility processes tree nuts on shared lines. The allergen profile of the incoming ingredient has changed, but the food safety plan hasn't. A quality director at a bakery operation catches this during an internal audit, but only after two weeks of production. The reanalysis, allergen control update, and CAPA process that follow are significantly more expensive than a 20-minute change review would have been.

A mid-size beverage manufacturer's primary juice supplier relocates their processing facility across state lines. The account manager gets an email, it sits in a shared inbox, and no one routes it to the supplier qualification team. Under 21 CFR § 117.410, the receiving facility's supplier quality management obligations don't disappear when a supplier moves, they shift to a new facility that hasn't been evaluated. By the time the annual supplier review surfaces the gap, the receiving facility has a year of unvalidated supply.

A private equity-backed food group acquires a three-plant regional processor. During due diligence, they confirm the target has food safety plans, but post-close, the integration team discovers that two of the three facilities list the same individual as PCQI, and that person left the company eight months earlier. Every change approved in that period lacks compliant PCQI sign-off. The documentation gap is now a board-level conversation about inherited compliance debt.

After a CAPA finding, a plant's sanitation team adjusts the dwell time on a key chemical step. The change is implemented on the floor immediately, but the written procedure isn't updated for six weeks. When a third-party auditor asks to verify that sanitation procedures match current practice, the facility can't demonstrate it. The finding is minor on its own; combined with two other documentation inconsistencies from the same audit cycle, it contributes to a conditional certification.

The regulatory standard under 21 CFR § 117.170(d) focuses on whether a change creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard. That determination requires professional judgment by a PCQI. What matters most: the judgment call, whether it concludes a full reanalysis is needed or not, must be documented. "We looked at it and decided no revision was needed" is a defensible position, but "we didn't look at it" is not.

A PCQI must perform or oversee reanalysis under 21 CFR § 117.170(e). Operational approval typically involves Quality, Operations, and relevant subject matter experts depending on the change's scope. The PCQI requirement isn't a formality. It's the compliance anchor, one role, one sign-off, and without it the review doesn't count. Our PCQI responsibilities guide covers what that role owns in practice.

No. Supplier changes, regulatory updates, new FDA guidance, and GFSI scheme revisions can all trigger reanalysis obligations even if nothing in your own facility has changed. Changes upstream don't stay upstream: when a supplier modifies their process or facility, your food safety plan may need to reflect that change.

A change is a planned or intentional modification to a process, ingredient, supplier, or procedure. A deviation is an unintended departure from an established parameter or step. Both require documentation, but they follow different response workflows. Deviations typically route to CAPA; changes route to hazard analysis and reanalysis. The practical risk: a "temporary" deviation that becomes standard practice without going through the change management process is a compliance gap waiting to be found.

Start with an inventory of changes made in the last 12 months and check whether each has a documented hazard evaluation and PCQI review on record. Gaps there tell you exactly where your exposure sits. From that baseline, build a formal change identification step at the point of initiation, not retrospectively. The key components of food safety compliance guide covers how to structure the broader program.

Yes, with a caveat. The current compliance deadline for full FSMA 204 implementation is July 2028, though organizations making architecture decisions now should monitor FDA guidance given the rule's history of adjustment. Changes to ingredient sourcing, supplier locations, or supply chain routes intersect with Critical Tracking Events and Key Data Elements under the traceability rule. Building change management processes in isolation from your traceability program creates rework when requirements take hold. See our FSMA 204 traceability resource for current guidance.