SOP: Recipe Management and Change Control (ISA-88 / MES)

This is a ready-to-use SOP for managing master recipes and their changes in a validated Manufacturing Execution System. Replace every <<FILL: ...>> placeholder and route it through document control. A filled specimen follows. Verify each cited regulation against the current source. This is general guidance to adapt, not legal or regulatory advice.

Document control header

1. Purpose

This procedure governs the lifecycle of master recipes in <<FILL: MES/DCS name>>, from authoring through approval, change, and retirement. The master recipe is the electronic master production and control record required by 21 CFR 211.186; the executed control recipe plus its captured data is the batch production record required by 211.188. The objective is that every recipe parameter is traceable, every change is controlled, and any historical batch can be reconstructed to the exact recipe version that produced it.

2. Scope

Applies to all GMP master recipes built on the ISA-88 procedural model in the systems listed in the header. It covers master and control recipes; it does not define equipment-phase logic, which is controlled under <<FILL: automation qualification SOP-ID>>.

3. Responsibilities

The person who edits recipe content must not be the person who approves it, and the administrator who manages states must not author parameters.

4. Definitions

• Master recipe: the approved, equipment-class-bound template under change control (the master production record).
• Control recipe: one execution generated by the batch engine, bound to specific units; its completed form is the batch record.
• Critical process parameter (CPP): a parameter whose variability affects a critical quality attribute and which therefore must be controlled.
• Equipment phase: the controller-level logic the recipe references by name and passes parameters to.

5. Procedure: building a master recipe

1. Confirm the process definition (site recipe / tech transfer package) is approved and locked.
2. Confirm the equipment phases the recipe needs exist and are qualified.
3. Author the procedural structure (unit procedures, operations, phases), reusing qualified library phases.
4. Enter the formula and parameters; source every limit to a controlled document and record the link.
5. Add IPC, sampling, prompts, forced data entries, and electronic-signature points; decide which steps need second-person verification.
6. Configure exception handling for every failure mode: out-of-range entry, phase failure, hold, abort, power loss and recovery.
7. Simulate and dry-run against simulated I/O.
8. Test under an approved protocol that challenges normal flow, boundaries, and failure paths.
9. Review and approve (manufacturing, automation, QA) with electronic signatures.
10. Release with an effective date; move the prior version to superseded, retained not deleted.

6. Procedure: changing a master recipe

1. Raise the change with what is changing, why, and the requested scope; reference the trigger (CAPA, tech transfer, improvement).
2. Assess impact and criticality. Determine whether the parameter is a CPP, touches an IPC acceptance range, or affects a registered/established condition.
3. Determine regulatory impact using ICH Q12 tools (established conditions, post-approval change management); decide reporting category and whether a variation is needed.
4. Author the new version in a draft state so the current effective recipe keeps running production.
5. Test proportionate to risk: a CPP or IPC-range change gets challenge testing and a process-validation impact assessment (possible PPQ); a functional non-CPP change gets functional and failure-path testing; a cosmetic change gets documented verification. Do not over-test the trivial or under-test the critical.
6. Review and approve with the same approvers and electronic signatures.
7. Release with an effective date and supersede the prior version, retained for reconstruction.
8. Verify the first batch on the new version with heightened review, especially for critical changes.

7. Versioning and reconstruction

• Every batch record identifies the exact recipe version that produced it.
• Superseded versions are retained, never deleted, for the records-retention period.
• The recipe object audit trail records who changed what, when, old and new value, and why; it is reviewed in periodic review and at change verification, not just generated.

8. Acceptance criteria

• Every parameter and limit traces to a controlled source document.
• The recipe reuses qualified library phases; bespoke recipe-layer logic is the justified exception.
• Exception handling is defined and tested for every failure mode.
• The recipe is in an approved, version-controlled state with effective date and superseded predecessor.
• A control recipe generated from it produces a batch record matching the master one for one.
• Any historical lot can be tied to its exact recipe version.

9. Records generated

• Recipe change record (see the companion form).
• Test/validation evidence; first-batch verification record.
• Recipe audit-trail review record.

10. References

21 CFR 211.186 (master production and control records); 211.188 (batch production records); 211.100 (procedures, review of deviations). 21 CFR Part 11; EU GMP Annex 11 (computerised systems). ANSI/ISA-88 (IEC 61512) batch control models and terminology. ICH Q12 (lifecycle management, established conditions); ICH Q9 (quality risk management).

Confirm the current version and clause numbers of each reference before issue.

11. Revision history

12. Approvals

Filled specimen

The following shows a change being routed under this SOP. Details are illustrative; replace with your own.

In this example a “just a range tweak” was correctly recognised as a critical-attribute change, so it took the challenge-testing branch with statistical justification rather than the cosmetic path, and the prior version was retained for reconstruction.

Common inspection findings this SOP prevents

• Recipe edits made directly in the system with no change record.
• Parameters with no traceable controlled source.
• Inability to reconstruct which recipe version made a given lot.
• Deleted superseded versions.
• No segregation of duties between authoring and approval, or shared logins.
• Undefined exception handling.

How to adapt this SOP

1. Set your document number, owner, and effective date.
2. Name your actual MES/DCS and automation qualification SOP.
3. Align the testing branches in section 6.5 with your validation and ICH Q12 framework.
4. Confirm every regulation in section 10 against the current published version before issue.