Network Change Control Master Record

Document type	Matrix
Topic area	CDMO Governance
Level	Advanced
Updated	September 2026

This is a ready-to-use master record for tracing a single change across every contract manufacturing site it touches, so no site assesses the change in isolation and no site implements ahead of the others. Replace every <<FILL: ...>> placeholder with your own specifics and route the completed record through your normal change control system as the network-level record referencing each site’s local change number. A filled specimen follows.

Document control header

Field	Entry
Document title	Network Change Control Master Record for `<<FILL: change description>>`
Document number	`<<FILL: e.g. NCC-2026-011>>`
Originating site	`<<FILL: which CDMO first proposed the change>>`
Sponsor change owner	`<<FILL>>`
Date opened	`<<FILL>>`

1. Change description

<<FILL: what is changing, the originating site's stated classification, and why>>

2. Sites touched

Site	Role in this change	Local change control reference	Local classification
`<<FILL>>`	`<<FILL: originating / downstream-dependent / not affected>>`	`<<FILL>>`	`<<FILL>>`
`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`
`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`

List every site in the network here, including a site assessed as not affected; the assessment and its basis are recorded even where the answer is no impact.

3. Per-site assessment

Site	Was this site’s process validated or qualified using the pre-change material/method/step	Bridging study needed	Bridging study status	Site’s assessment complete
`<<FILL>>`	`<<FILL: yes/no>>`	`<<FILL: yes/no>>`	`<<FILL>>`	`<<FILL: yes/no>>`
`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`

4. Network-wide regulatory reportability call

Field	Entry
Reportability category	`<<FILL: supplement / CBE / annual report, per ICH Q12 established conditions, assessed against the cumulative effect across all sites listed above>>`
Basis	`<<FILL>>`
Made by	`<<FILL: Regulatory Affairs>>`
Date	`<<FILL>>`

5. Implementation

Field	Entry
Single sponsor-managed implementation date	`<<FILL>>`
Confirmed same date at every site listed in section 2	`<<FILL: yes/no>>`
Sequencing risk identified and mitigated, e.g. upstream implementing while downstream is mid-revalidation	`<<FILL>>`

6. Closure checklist

A record is not ready to close until every line below is checked true, not merely attempted.

Requirement	Met
Every site the change touches is identified in section 2, not just the originating site	`<<FILL: yes/no>>`
Each site’s local assessment in section 3 is complete and referenced	`<<FILL: yes/no>>`
Any bridging study a downstream site’s process validation depended on has been evaluated and, if needed, executed	`<<FILL: yes/no>>`
The regulatory reportability call in section 4 reflects the network’s cumulative effect, not one site’s view alone	`<<FILL: yes/no>>`
Implementation is scheduled on one sponsor-managed date across every affected site	`<<FILL: yes/no>>`

7. Approvals

Role	Name	Signature	Date
Sponsor change owner	`<<FILL>>`
Regulatory affairs	`<<FILL>>`
Quality Assurance	`<<FILL>>`

Filled specimen

Extract from the excipient-change example described in the paired article. Company and site names are illustrative.

Field	Entry
Change	CMO Alpha’s critical excipient supplier is discontinuing the current grade; a like-grade replacement is proposed, classified by CMO Alpha alone as minor, no product impact
Sites touched	CMO Alpha, drug substance, originating; CMO Beta, fill-finish, downstream-dependent; CMO Gamma, packaging, not affected
Per-site assessment, CMO Beta	Fill process was qualified using material from the original excipient supplier, including a supplier-specific compatibility study run during CMO Beta’s own process validation; bridging study needed, yes
Reportability call	Assessed as an annual report entry, since the bridging study at CMO Beta confirmed no shift in a registered specification once the compatibility check passed; made by Regulatory Affairs after all three sites’ assessments were in hand, not at the time CMO Alpha’s notification first arrived
Implementation	Single date set after CMO Beta’s bridging compatibility check passed, both sites implementing together rather than CMO Alpha proceeding on its original timeline

The specimen shows what the closure checklist in section 6 exists to catch: read in isolation, CMO Alpha’s own minor classification was defensible on its own site’s data, but it was never the whole picture, and this record is what made the missing piece visible before implementation rather than after a fill-line deviation with no obvious link back to an excipient change.

Common inspection findings this matrix prevents

A change classified minor at the originating site with no record showing whether a downstream site’s process depended on the thing that changed.
Two sites implementing the same change on different dates, leaving a period where the process as run does not match the process as filed at either site.
A regulatory reportability call made from a single site’s local change record, with no evidence the network’s cumulative effect was actually assessed.
A closure recorded with an incomplete checklist, discovered only when a later, unrelated deviation traces back to the change that was never fully assessed.

How to adapt this matrix

Populate section 2 from your own live network map of which process step runs where; an incomplete site list makes every later section unreliable.
Do not allow any site to close its local change control record until this master record’s section 6 checklist is fully met.
Keep the bridging-study evidence referenced in section 3 attached or linked, not summarized only as a checkbox.
Route the completed record through the same change control system your local sites use, as the network-level parent record each local change references.