How to Set Up a Change Control Board for SME Manufacturers

What Is a Change Control Board?

A Change Control Board (CCB) is a cross-functional group responsible for reviewing and approving engineering changes within a manufacturing organisation. ISO 9001:2015 requires that design and production changes are reviewed and approved by authorised personnel — the CCB provides the formal structure for this requirement.

For SME manufacturers with 5-50 employees, the CCB does not need to be a large committee. Most SME CCBs consist of 2-4 people who already hold relevant responsibilities.

Who Should Be on the CCB?

Essential Roles

• Quality Manager — chairs the CCB in most SMEs. Ensures changes comply with ISO 9001 requirements and maintains audit-ready records
• Engineering/Design Lead — assesses technical feasibility, design impact, and drawing revision requirements
• Production Manager — evaluates production impact, tooling changes, scheduling effects, and shop floor implementation

Optional Roles (depending on change type)

• Purchasing/Supply Chain — involved when changes affect materials, suppliers, or purchased components
• Managing Director — involved for high-cost or high-risk changes, or when the CCB cannot reach consensus
• Customer-facing representative — involved when changes may affect product specifications promised to customers

Defining Authority Levels

Not every change needs the full CCB. Define authority levels based on impact:

Change Level	Example	Approver
Minor	Document formatting, non-critical dimension tolerance within spec	Quality Manager alone
Standard	Design revision, process change, new supplier qualification	Full CCB
Major	Product redesign, regulatory-driven change, customer specification change	CCB + Managing Director

Document these authority levels in your quality management system. ISO auditors check that the correct level of authority was applied to each change.

Setting Up Your CCB: Step by Step

Step 1: Define the CCB Charter

Write a short document (1-2 pages) covering:

• Purpose — review and approve engineering changes to ensure compliance with ISO 9001 and business objectives
• Members — names and roles
• Authority — what the CCB can approve, escalation criteria
• Meeting frequency — weekly, fortnightly, or as-needed (see below)
• Quorum — minimum attendance required to make decisions

Step 2: Choose a Meeting Schedule

For most SME manufacturers processing 2-8 ECRs per month, a weekly standing meeting of 15-30 minutes works well. This prevents backlogs while keeping the burden manageable.

Options:

• Weekly (recommended for 4+ ECRs/month) — consistent rhythm, short meetings
• Fortnightly (for 2-3 ECRs/month) — less meeting overhead, acceptable response time
• On-demand (for <2 ECRs/month) — called when an ECR is ready for review. Risk: delays when members are busy

Whichever schedule you choose, define a maximum response time for urgent changes (e.g., safety-related or customer-impacting changes reviewed within 48 hours).

Step 3: Create a Standard Agenda

Keep meetings structured and short:

1. Review new ECRs (5 min per ECR) — read the ECR, confirm impact assessments are complete
2. Decision — approve, approve with conditions, defer, or reject. Record the decision and reasoning
3. Implementation status — check progress on previously approved ECOs (2 min per item)
4. Close-outs — confirm completed changes are ready for close-out

Step 4: Document Decisions

Every CCB decision must be documented. At minimum, record:

• ECR reference number
• Date of review
• Members present
• Decision (approve/reject/defer)
• Conditions (if any)
• Action items and owners

This record becomes part of the change audit trail that ISO auditors review. The format does not matter — meeting minutes, a decision log, or entries in a change tracker all work, provided the information is complete and accessible.

Step 5: Establish the Impact Assessment Process

Before the CCB can review an ECR, all affected departments must complete their impact assessments. Define:

• Who assesses what — map change types to required assessments (e.g., design changes always require engineering + production assessment)
• Assessment deadline — how long each department has to respond (typically 3-5 working days)
• Assessment format — standardise the fields each assessor must complete (impact description, risk level, resource needs, recommendation)

Late or incomplete assessments are the most common cause of CCB delays. Set expectations clearly and follow up promptly.

Common Pitfalls

1. Bottleneck at a single approver — if one person must approve everything, their absence stalls the entire process. Ensure at least one deputy is defined for each CCB role
2. No escalation path — define what happens when the CCB cannot agree or when an urgent change cannot wait for the next meeting
3. Meeting without data — CCB meetings waste time when impact assessments are incomplete. Require assessments to be submitted before the meeting, not during it
4. Skipping the CCB for "minor" changes — define what constitutes a minor change and ensure the threshold is documented. Auditors check for changes that bypassed the approval process

ISO 9001 Compliance Tips

• Keep CCB records as part of your quality management system — they form the core evidence for clauses 8.3.6 and 8.5.6
• Ensure traceability from the original trigger (NCR, customer complaint, design improvement) through to the closed ECO
• Review your CCB effectiveness annually as part of management review (clause 9.3)
• If your CCB charter or authority levels change, update your quality manual and communicate the changes

Summary

A Change Control Board does not need to be complex. For SME manufacturers, a small group of 2-4 people meeting weekly can effectively manage engineering changes while satisfying ISO 9001 requirements. The key is structure: defined roles, documented decisions, and complete impact assessments before review.

Start simple, document everything, and refine as your change volume evolves.