Common Pitfalls in Change Control Traceability and How to Compensate

January 17, 2023 Michelle Wu

Common Pitfalls in Change Control Traceability and How to Compensate


Change is constant, especially in the medical device lifecycle. These changes can be initiated by a manufacturer voluntarily, such as exchanging a component to decrease overall COGS or improve reliability. Or occur involuntarily, like when a supplier discontinues a component or regulations are revised. No matter the reason for the change, manufacturers must be able to assess and document the impact of the change.

This blog will focus on common pitfalls associated with change assessment, specifically the traceability from risk assessments and the design, and how to compensate.

Pitfall number 1: Memories are fleeting

Team members come and go. Whether it’s the design engineers that have moved on to the next development project, or folks have left the company, it’s expected that team members will change. Thus, companies can’t rely on having infinite access to the ‘historic knowledge’ stored in someone’s memories to assess a change. Even if team members do remain, over time they won’t remember, or won’t remember correctly, all the details associated with a particular design decision or associated risk. This tacit knowledge is hard not only to retain, but also to transfer to others at the right time. Thus, documentation is key in retaining and transferring this information.

Pitfall number 2: Improper assessment of the risk of a change

For many reasons, manufacturers don’t fully assess the risk of a change. When a change is proposed, the risk assessments for that device and manufacturing process should be reviewed to understand the impact; impact to safety and effectiveness of the users, first and foremost, and also impact to the organization and business.

For example, a manufacturer is notified by its supplier that a cooling fan is coming to its end of life and a different fan is suggested as the replacement. While the manufacturer does assess that the physical dimensions and power requirements of the new fan work, the manufacturer fails to review their risk assessment files, and proceeds with the change. Unfortunately, they miss that the lifetime reliability of the fan is important to the overall lifetime of the device. The new fan had a lower lifetime that was half than the lifetime specified as a design input to the overall device. The change is implemented and some time later, the manufacturer then began seeing device failures earlier than expected in the field.

RELATED: Carnegie Mellon University Software Engineering Program Teaches Modern Software Engineering Using Jama Connect®

Pitfall number 3: Incomplete and hard to use design and risk documentation and traceability matrices

Many organizations view their medical device design history and risk management files as a check-the-box activity and don’t fully embody it as practical tools and methods to design, build, and maintain medical devices with the appropriate level of safety. As a result, content is often lacking in context and is hard to cross reference and search when needed, such as to assess the impact of changes. I often remind folks that while the engineering and design work is important, the documentation is just as, if not more important than, the end product. The documentation takes a substantial amount of time and must be planned in as part of the engineering effort and not started after the product is finalized. See below where we reference establishing design controls proactively!

Even those manufacturers that do understand the value of these activities and documents beyond its purpose to fulfill regulatory compliance, their documents are often disparate and separate, resulting in manual or near-manual searching when the need to understand the impact of a change arises.

Compensating for these Pitfalls

Being able to perform a strong change control assessment and compensating for these pitfalls starts with establishing a strong foundation of traceability from design through manufacturing. These include 1) traceability of design inputs to design outputs by establishing design controls proactively; 2) traceability of design to manufacturing requirements, and 3) traceability of risk assessments through the design inputs and manufacturing requirements.

And just as important is keeping all this traceability and requirements organized and easy to reference.

Jama Connect® is a great tool for traceability and requirements management. Having one place where risk and requirements and inputs are linked avoid the need to manually cross-reference across separate documents. Its visual mapping makes it easier to find how a particular component is linked to a particular design input, manufacturing requirement, and risk assessment line item. The effort can then more quickly focus on the change itself, instead of time spent trying to find all the connections to design inputs, risk, and manufacturing requirements.

A robust change control process and procedures also is necessary. A comprehensive set of questions, such as the ones below, can prompt folks to consider and consult their various traceability tools. Here are some sample product design and manufacturing questions:

  • Is the change associated with a critical output or essential output?
  • How is the risk impacted? Consider risk from the use, design, and process perspectives.
  • What design input(s) is associated with the change? What is the impact to design verification or design validation?
  • What manufacturing requirement(s) is associated with the change? What is the impact to process validation?
  • How is sterilization impacted by the change? What about other areas such as packaging, serviceability, maintenance?

RELATED: Requirements Traceability Benchmark


Avoid the risk associated with making incomplete assessments of product and process changes. Ensure your traceability is complete and kept up to date, in a manner that is both compliant and practical for your team to use and ensure your change control procedures incorporates a robust risk analysis.

Previous Article
Jama Software® Is the First to Deliver a Complete Requirements Authoring Solution
Jama Software® Is the First to Deliver a Complete Requirements Authoring Solution

Jama Software® Is the First to Deliver a Complete Requirements Authoring Solution Requirements can now be a...

Next Article
Understanding Integrated Risk Management for Medical Devices
Understanding Integrated Risk Management for Medical Devices

In this blog, we’ll recap our whitepaper, “Understanding Integrated Risk Management for Medical Devices” – ...