Change Control: What Happens When Your Formula or Supplier Changes

What is change control, in one paragraph?

Change control is the documented process a manufacturer uses to assess, approve and record any alteration to a product — its formula, a raw material supplier, a packaging component, a piece of equipment or a production step — before that alteration reaches a commercial batch. It exists because changes that look trivial on paper can move a product outside the conditions under which it was tested and approved. For a brand owner, the practical consequence is simple: every document the brand relies on, from the certificate of analysis to the regulatory notification, describes one specific version of the product. Change the version without changing the paperwork, and the paperwork quietly becomes wrong.

Key takeaways

• Change control is a standard element of cosmetic and supplement Good Manufacturing Practice, not an optional courtesy from the factory.
• The changes that cause the most damage are usually the ones classified as “like-for-like” — a second supplier for the same ingredient, a bottle from a different mould.
• Three questions decide how serious a change is: does it alter the product, does it invalidate an existing test, and does it change what was declared to a regulator.
• Brand owners have no automatic right to be told about a change. That right is created by a clause in the manufacturing agreement, or it does not exist.
• The cheapest time to catch a change is before the batch is made; the most expensive is after it is on a shelf.

Who this article is for

This article is written for brand owners, founders and product managers who outsource manufacturing to an OEM (Original Equipment Manufacturer), ODM (Original Design Manufacturer) or contract manufacturer, and who are one or more production runs past their launch. It is most useful to readers deciding what to write into a supply agreement, or trying to understand why a repeat batch does not look, smell or behave like the first one. It is general educational analysis, not regulatory or legal advice for a specific product.

Why does a manufacturer need a formal change process at all?

A formal change process exists because a manufacturing site runs many products at once, and an informal change made for one product tends to travel. The reasoning behind it is codified in the standards that govern the sector. ISO 22716, the international Good Manufacturing Practices guideline for cosmetics published by the International Organization for Standardization, treats change control as a defined activity alongside deviations, complaints and internal audits — changes are expected to be requested, evaluated and approved by authorised personnel, and the outcome recorded. In the United States, the Food and Drug Administration’s current good manufacturing practice regulation for dietary supplements, 21 CFR Part 111, applies the same principle from the documentation side: master manufacturing records and specifications are controlled documents, and modifications to them require quality-unit approval rather than an operator’s discretion.

The common logic in both is worth stating plainly. A product that has been tested, notified and sold is an assembly of decisions — this ingredient, from this supplier, at this grade, mixed at this temperature, filled into this container. Testing validates the assembly, not the individual parts. Swap a part, and the validation no longer strictly applies to what is in the bottle.

Which changes actually matter?

The changes that matter are the ones that can alter the product, invalidate an existing test result, or contradict something already declared to a regulator or printed on the pack. Most factories sort changes into rough tiers, and while the labels differ between sites, the logic is consistent.

Type of change	Typical trigger	What usually has to be revisited
New supplier for an existing raw material	Price, shortage, lead time	Incoming specification, supplier qualification, a trial batch, sometimes colour and odour
Change of ingredient grade or origin	Availability, certification scope	Formula record, ingredient declaration, Halal or other certification chain, stability
Formula adjustment	Texture complaints, cost, reformulation	Stability programme, preservative efficacy, safety assessment, regulatory record
Different primary packaging	Mould change, supplier switch, cost	Formula–pack compatibility, stability in the new container, fill volume, artwork dimensions
New or relocated equipment	Capacity, breakdown, line expansion	Process parameters, cleaning validation, a qualification batch
Change of manufacturing site	Volume growth, consolidation	Almost everything — including the site details recorded in the product’s regulatory file
Artwork or label text	Rebrand, marketing, corrected claim	Mandatory particulars, claim substantiation, print proof approval

The row that generates the most disputes is the first one. A second supplier of, say, glycerine at the same pharmacopoeial grade is genuinely a like-for-like substitution on paper. In the mixing vessel it can still behave differently, because trace impurity profiles, particle size or residual odour differ between producers even when both certificates comply. That is why a certificate of analysis is necessary but not sufficient — a point examined at length in this guide to reading a certificate of analysis.

When does a change require a regulatory step?

A change requires regulatory action whenever it contradicts a particular that was declared when the product was registered or notified. In Malaysia, cosmetic products are placed on the market through a notification held by a responsible person, and the National Pharmaceutical Regulatory Agency’s Guidelines for Control of Cosmetic Products in Malaysia set out both what is declared in that notification and how notified particulars are handled afterwards. The distinction that matters commercially is between a change that can be recorded against an existing notification and one that is treated as a different product requiring a fresh notification. Manufacturer, ingredient composition and product name sit on the sensitive side of that line; exactly which changes fall where is set by the guideline in force, so readers should check the current edition rather than rely on a summary.

Supplements, functional foods and medical devices each run on separate regulatory tracks with their own variation rules, and a brand manufacturing across categories can hold products under several regimes at once. The practical failure mode is rarely ignorance of the rules — it is sequencing. A change is implemented on the factory floor in week one, the paperwork is raised in week six, and the batches made in between were produced against a record that no longer matched the notification. Where a change touches a notified or registered particular, the assessment belongs with whoever holds the regulatory affairs responsibility for the product before the production order is released, not after. The related documentation duty on the cosmetic side is covered in this article on the Product Information File, which has to reflect the current version of the product rather than the launch version.

When does a change require re-testing?

Re-testing is required whenever a change could affect the property that the original test was designed to measure. Three programmes come up most often.

• Stability. A new container, a new emulsifier supplier or a change in preservative system can all alter how a product ages. Stability data belongs to the formula-and-pack combination that was tested, not to the formula alone. The mechanics are set out in this guide to stability testing and shelf life.
• Preservative efficacy. Any change to the preservative system, the pH, the water activity or the packaging’s exposure to air is a reason to repeat challenge testing rather than assume the previous result carries over.
• Compatibility. A packaging change is a chemistry question before it is a design question — interaction between formula and container is why the same cream can be stable in one bottle and separate in another.

The awkward part of re-testing is time. A real-time stability study cannot be compressed to fit a purchase order, which is why a change driven by a raw material shortage often forces a genuine choice between waiting and accepting a documented risk. That decision is a commercial one, but it should be made explicitly and written down, with the testing scope agreed before the change is implemented rather than reconstructed afterwards.

Who is entitled to approve a change — the factory or the brand?

Both, on different questions, and confusing the two is a common source of friction. The manufacturer approves the technical question: whether the change is safe, feasible and compliant with its own quality system. The brand owner approves the commercial and identity question: whether the resulting product is still the product the brand agreed to sell. A factory can be entirely correct that a substitution is technically equivalent and still be wrong to make it without asking, if the brand has built marketing around the original ingredient’s origin or certification.

This is a contractual matter, not a matter of goodwill. Unless the manufacturing agreement says otherwise, a contract manufacturer is generally free to manage its own supply chain. A workable change-notification clause usually specifies three things: which categories of change trigger notice, how much notice is required before implementation, and which categories require the brand’s written consent rather than mere notification. Related clauses are examined in this breakdown of contract manufacturing agreement terms.

What goes wrong when change control is informal?

The characteristic failure is not a dramatic one. It is a repeat batch that is slightly off — a shade darker, a little thinner, a fragrance that fades faster — and no one can say why, because nothing was recorded as having changed. Without a change record, the investigation has to work backwards from the finished product through every input, which takes weeks instead of hours. Traceability is what makes that reconstruction possible at all, as described in this article on batch numbers and traceability.

The second failure is reputational rather than technical. A brand that has advertised a specific ingredient origin, a certification, or a “free-from” position discovers after the fact that an equivalent substitution moved the product off that position. The formula still performs. The claim no longer holds. The cost lands on the marketing side rather than the factory side, which is precisely why the brand owner has to sit inside the approval loop.

A practical checklist for brand owners

1. Ask, during supplier selection, to see the manufacturer’s written change control procedure. Its existence and its scope are more informative than a certificate on the wall.
2. Put a change-notification clause in the agreement, with a defined notice period and a defined list of changes requiring written consent.
3. Keep an internal record of the product’s current version — formula reference, key suppliers, pack specification, artwork revision — so that a change can be recognised as a change.
4. Ask what a proposed change does to stability data and to the regulatory record before agreeing to it, not after the batch is scheduled.
5. Treat a raw material shortage as a change trigger. Shortages are where informal substitutions usually begin.
6. Where a change is accepted with incomplete data, record the decision, the reason and the residual risk in writing.

Frequently asked questions

Does my manufacturer have to tell me if they change an ingredient supplier?

Not automatically. In the absence of a contractual obligation, supply chain management is generally the manufacturer’s own responsibility, and a like-for-like substitution at the same specification may be handled entirely inside its quality system. The obligation to inform the brand owner is created by a change-notification clause in the manufacturing agreement. Brand owners who care about ingredient origin, certification scope or marketing claims should negotiate that clause before the first production run rather than after a substitution has surprised them.

If the specification is the same, why would a different supplier matter?

A specification defines limits, not identity. Two batches of the same material from different producers can both comply while differing in trace impurities, particle size, residual solvent, colour or odour — and those differences can show up in a finished emulsion even though both certificates pass. This is why a trial or qualification batch is normal practice for a supplier change on a critical ingredient, and why a certificate of analysis is treated as evidence of compliance rather than proof of equivalence.

Does changing my packaging require new stability testing?

Often, yes, if the primary packaging changes. Stability data describes a formula inside a specific container, because the container affects light exposure, air ingress and potential interaction between the formula and the packaging material. A change of decoration, secondary carton or label usually does not require re-testing; a change of bottle material, closure type or supplier mould generally does. The safe approach is to ask the manufacturer to state in writing what existing data still applies.

How long should a change take to implement properly?

It varies widely by change type, and any single number would be misleading. A documentation-only change can be closed in days. A supplier change requiring a qualification batch commonly runs into weeks. A change requiring new stability data or a regulatory amendment is measured in months, because the study duration and the authority’s processing time cannot be shortened. Planning inventory around the slowest of these is more realistic than planning around the fastest.

What should be in a change record?

A usable change record states what is changing and what it is changing from, who requested it and why, the assessment of impact on product quality, safety, testing and regulatory status, who approved it, when it takes effect, and which batch number is the first to carry it. That last item is the one most often omitted and the one most needed later, because it is what allows a complaint or an investigation to be tied to the correct product version.

Is change control only relevant to large brands?

No. The discipline scales down more easily than it scales up. A small brand producing two or three products can maintain a version record in a single spreadsheet and still capture most of the value, because the point is not the format — it is knowing which version of the product is in the market and being able to prove it. Brands that grow for several years without a version record usually discover the gap during their first serious quality complaint or their first retailer audit.

Sources and further reading

• International Organization for Standardization, ISO 22716 — Cosmetics: Good Manufacturing Practices (GMP).
• National Pharmaceutical Regulatory Agency, Malaysia, Guidelines for Control of Cosmetic Products in Malaysia.
• United States Food and Drug Administration, 21 CFR Part 111 — Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements.

Limitations

This article describes general practice across cosmetic, personal care and supplement manufacturing and is not specific to any one product, jurisdiction or contract. The regulatory classification of a change, the documents it affects and the testing it requires all depend on the product category, the market and the edition of the guideline in force at the time. Nothing here substitutes for the manufacturer’s own quality system, a qualified regulatory assessment, or legal advice on a specific supply agreement. Readers should verify current requirements directly with the relevant authority.

---

Creaton Poh is the pen name of Poh Tze Kheng, founder of ORIZI Group — one of Malaysia's most comprehensive one-stop OEM, ODM, private label and contract manufacturing groups, spanning skincare, cosmetics, personal care, perfume and fragrance, supplements, functional food and nutrition, pet care, home care and medical devices. Across six specialised companies and three manufacturing divisions, the Group brings together 20+ years of industry experience, 5,000+ formulations, and internationally recognised quality, manufacturing and regulatory standards. These articles are written to educate, not to promote.

Written by Creaton Poh
Industry Researcher • Author • Vlogger • Manufacturing Strategist
Turning ideas into products. Turning experience into knowledge.

Connect with Poh Tze Kheng on LinkedIn.