Engineering Change Management: The Complete ISO 9001 Guide

What Is Engineering Change Management?

Engineering change management (ECM) is the structured process of requesting, evaluating, approving, and implementing changes to products, processes, or documentation in a manufacturing environment. It ensures that every modification — whether triggered by a customer complaint, a design improvement, or a supplier material substitution — is properly assessed, approved, and documented.

For UK manufacturers operating under ISO 9001:2015, engineering change management is not optional. Clauses 8.3.6 (design and development changes) and 8.5.6 (control of changes) require documented evidence of change reviews, impact assessments, authorisations, and resulting actions.

Why Engineering Change Management Matters

Engineering changes are among the most resource-intensive activities in manufacturing. According to Aberdeen Group research, engineering change orders consume between one-third and one-half of all engineering capacity in product development organisations. A structured ECM process reduces this burden by standardising how changes flow through the organisation.

Without structured change management:

• Changes are communicated via email chains and paper routing slips, creating bottlenecks when key approvers are unavailable
• Impact assessments are informal and incomplete, leading to unintended consequences in production
• Audit evidence is scattered across shared drives, email inboxes, and filing cabinets
• ISO auditors must piece together change histories from multiple disconnected sources

The ECR to ECO Workflow

Engineering change management follows a structured workflow from request through implementation. Each step produces documented evidence that ISO auditors can verify.

Step 1: Engineering Change Request (ECR)

The ECR initiates the change process. It documents:

• What needs to change (drawing, BOM, process, specification)
• Why the change is needed (customer complaint, non-conformance, design improvement, regulatory update, supplier substitution)
• Who is requesting the change
• Supporting evidence (test results, customer feedback, NCR reference)

ECRs can be triggered by multiple sources: customer complaints, failed inspections, supplier quality issues, design improvements, or regulatory changes. The trigger source matters because it determines the urgency and the approval pathway.

Step 2: Impact Assessment

Once an ECR is submitted, it must be routed to all affected departments for impact assessment. Typical departments include:

• Engineering/Design — technical feasibility, drawing changes needed
• Production — process changes, tooling impact, production schedule effects
• Purchasing — supplier implications, material availability, cost impact
• Quality — testing requirements, inspection procedure updates, certification impact

Each department assesses how the proposed change affects their area and provides a recommendation. This cross-functional assessment prevents changes from being approved in isolation without understanding downstream effects.

Step 3: Change Control Board (CCB) Review

The Change Control Board is a cross-functional group that reviews impact assessments and makes the approval decision. For SME manufacturers with 5-50 employees, the CCB is typically 2-4 people: the quality manager, engineering lead, production manager, and sometimes the managing director.

The CCB evaluates:

• Combined impact across all departments
• Cost implications (one-off and recurring)
• Risk assessment
• Implementation timeline
• Resource requirements

The CCB decision is one of: approve, approve with conditions, defer, or reject. The decision and reasoning must be documented.

Step 4: Engineering Change Order (ECO)

An approved ECR becomes an Engineering Change Order. The ECO is the formal instruction to implement the change. It includes:

• Approved change description with implementation details
• Affected documents (drawings, BOMs, work instructions, inspection plans)
• Implementation plan and timeline
• Responsibility assignments
• Revision control information

Step 5: Implementation and Verification

The change is implemented according to the ECO instructions. Implementation tracking ensures all required actions are completed:

• Document revisions published
• Production processes updated
• Staff trained on changes
• Tooling or fixtures modified
• Inspection procedures updated

After implementation, verification confirms the change achieves its intended outcome without introducing new problems. Verification results are documented and added to the change record.

Step 6: Close-Out

Once verification is complete, the change record is closed. A complete change record includes:

• Original ECR with supporting evidence
• Impact assessments from all affected departments
• CCB meeting minutes and decision
• ECO with implementation instructions
• Implementation completion records
• Verification results

This complete record forms the audit evidence that ISO auditors review.

ISO 9001 Requirements for Change Control

Clause 8.3.6: Design and Development Changes

ISO 9001:2015 clause 8.3.6 requires organisations to identify, review, and control changes made to design and development inputs and outputs. Specifically:

• Changes must be identified and records maintained
• Changes must be reviewed for potential impact on conformity to requirements
• Changes must be verified and validated as appropriate
• Changes must be approved before implementation

The organisation must retain documented information on the results of the review, the persons authorising the change, and any necessary actions.

Clause 8.5.6: Control of Changes

ISO 9001:2015 clause 8.5.6 requires organisations to review and control changes for production or service provision to ensure continuing conformity with requirements. Results of the review must include:

• The person(s) authorising the change
• Any necessary actions taken as a result of the review

What Auditors Actually Check

During ISO surveillance audits, auditors typically:

1. Select 2-3 recent engineering changes and trace them from request through close-out
2. Verify that impact assessments cover all affected departments
3. Check that approvals include the correct authority level
4. Confirm that affected documents were revised to reflect the change
5. Verify the link from non-conformance reports (NCRs) through corrective actions (CAPAs) to engineering changes — this NCR-to-ECO traceability is a specific audit focus
6. Check that the change record is complete and accessible

The most common findings relate to incomplete records (missing impact assessments), gaps in the NCR-to-ECO chain, and document revisions not updated to reflect approved changes.

Engineering Change Management for SME Manufacturers

Large manufacturers use enterprise Product Lifecycle Management (PLM) systems from vendors like PTC, Siemens, and Dassault. These systems cost between £7,000 and £100,000+ per year — well beyond the reach of SME manufacturers with 5-50 employees.

Most UK SME manufacturers manage engineering changes with:

• Word templates for ECR and ECO forms
• Excel spreadsheets for change tracking and status
• Email chains for routing and approvals
• Paper routing slips with physical signatures
• Shared drive folders for evidence storage

This approach works — manufacturers have been passing ISO audits with manual processes for decades. But it is slow, error-prone, and increasingly difficult to evidence cleanly as auditor expectations evolve toward digital documentation.

Getting Started with Structured ECM

If your current change management relies on spreadsheets and email, you do not need to implement a full PLM system. Start with these practical steps:

1. Standardise your ECR form — create a single template that captures all required information (what, why, who, evidence, affected areas)
2. Define your CCB — identify 2-4 people who must approve changes. Document who they are and their authority levels
3. Create a change log — a simple register that tracks every ECR from submission through close-out
4. Establish routing rules — define which departments must assess which types of changes
5. Implement revision control — use a consistent numbering scheme and ensure all affected documents are updated

These steps create the documented process that ISO 9001 requires, whether you use paper, spreadsheets, or dedicated software.

Key Terminology

Term	Abbreviation	Definition
Engineering Change Request	ECR	Formal request to initiate a change
Engineering Change Order	ECO	Approved instruction to implement a change
Engineering Change Notice	ECN	Communication of an approved change to stakeholders
Change Control Board	CCB	Cross-functional group that approves changes
Non-Conformance Report	NCR	Document recording a product/process non-conformity
Corrective Action / Preventive Action	CAPA	Actions to eliminate the cause of a non-conformity
Bill of Materials	BOM	List of all materials and components in a product

Summary

Engineering change management is a core requirement of ISO 9001:2015 for UK manufacturers. The ECR-to-ECO workflow provides a structured, auditable process for managing design and production changes. While enterprise PLM systems are out of reach for most SMEs, the fundamental process can be implemented with standardised templates, clear routing rules, and consistent documentation.

The key is not the tool — it is the process. A well-documented manual process will satisfy ISO auditors. But as change volumes increase and audit expectations evolve, many manufacturers find that the manual burden justifies moving to dedicated change management software.