Data Quality in Sterile Fill-Finish: The Records That Actually Get Cited

Why Fill-Finish Records Get Cited More Than Any Others

Sterile fill-finish is the one part of pharmaceutical manufacturing where the finished product cannot be tested into compliance. A sterility test on a handful of vials from a batch of a hundred thousand tells you very little about the batch. Regulators know this, and both the FDA aseptic processing guidance and the revised EU GMP Annex 1 say it plainly: monitoring and testing alone do not give assurance of sterility.¹³¹⁴ Assurance comes from the design of the process, the discipline of the people running it, and the records that show both were in place for every batch.

That is why the inspection of a fill-finish suite is, in practice, an inspection of records. The investigator cannot watch the batch that was made six months ago. What they can do is pull the batch record, the intervention log, the continuous particle monitoring trace, the viable air and surface plates, the media fill report, the sterilizer printout for the stoppers, the visual inspection worksheet, and the lyophilizer cycle chart, and ask one question of each: does this record let me reconstruct what happened, when, and by whom, with enough detail to judge whether the product was protected?

The enforcement data shows what happens when the answer is no. A 2026 review of FDA enforcement reports published in the journal BioTech found that “lack of assurance of sterility” was the primary driver of sterile drug recalls, with 641 citations in the dataset, and that sterility-related recalls rose from 95 in the 2012 to 2019 period to 106 in 2019 to 2025.²¹ On the EU side, MHRA’s 2019 GMP deficiency data (the most recent full dataset the agency has published) shows five of the ten most frequently cited references were clauses of Chapter 4, Documentation, and three Annex 1 clauses appeared in the top references cited in relation to critical deficiencies.¹⁹ Documentation and sterility assurance are not two separate inspection topics. In fill-finish they are the same topic.

One more reason these records get cited so often: they live in different systems, owned by different departments, and nobody is responsible for the joins between them. The intervention log belongs to production. The environmental monitoring plates belong to the microbiology lab. The sterilizer records belong to engineering or component preparation. The visual inspection worksheet belongs to a separate inspection area, sometimes a separate building. The lyophilizer runs on its own control system. The batch record is supposed to tie them all together, and on most sites it does so through a stack of paper attachments and a reviewer’s signature. That is the seam inspectors pull on.

The Seven Records Inspectors Ask For First

The table below lists the seven fill-finish records this article covers, the regulatory hook an investigator uses to cite them, and the specific expectation in the revised Annex 1. Annex 1 came into operation on 25 August 2023, with one clause (8.123, on lyophilizer loading) deferred to 25 August 2024.¹³ Both dates have now passed, so every expectation in the table is in force for EU-supervised sites, and FDA investigators cite the same concepts under 21 CFR 211.

Two things stand out in that table. First, none of the Annex 1 clauses ask for anything exotic. They ask for time, duration, identity, linkage, and trending: the basic attributes of a good record. Second, every one of the FDA citations is a regulation that has existed for decades. The revised Annex 1 did not invent these expectations. It wrote down, in more detail, what inspectors on both sides of the Atlantic were already citing.

Record by Record: What Gets Cited and the Data Failure Behind It

This section takes each of the seven records in turn. For each one the pattern is the same: what the warning letter or 483 actually said, and then the data quality failure sitting underneath the finding. The letters quoted here are all public documents on the FDA website. Company names are given because they are part of the public record, not as commentary on any of the firms involved. Every site in this section had the same problem: the record could not carry the weight the sterility assurance claim placed on it.

1. Aseptic intervention logs

The intervention log is the record inspectors open first, because interventions are where contamination enters an aseptic process. The FDA aseptic processing guidance is direct about what the record has to contain: line stoppages and any unplanned interventions should be documented in batch records with the associated time and duration of the event, and interventions involving machine adjustments or repairs “should be documented with more detail than minor events.”¹⁴ Annex 1 clause 8.17 adds the operators involved.¹³

The findings track that expectation exactly. FDA’s May 2026 warning letter to Pharmathen International states that the firm “does not document non-routine interventions in the batch record, nor does it document whether vials are removed due to an intervention,” and separately describes an operator who “blocked first air” while removing fallen vials, after which “exposed vials were not discarded.”¹ The April 2026 letter to Par Health and Endo describes barrier lines requiring “hundreds of interventions, including numerous lubrications” during batch production, and operators reaching over the line with sleeves, head, and shoulders.² Going further back, the 2019 letter to Akorn found that “certain interventions performed on the ISO 5 filling line were not documented in your intervention log records, as per your procedures,” and asked the firm to explain how it would “remediate your system for recording interventions.”¹⁰

The Catalent Indiana Form 483 from April 2026 adds a design-level version of the same finding. Observation 3 states that the firm’s “intervention risk assessments and written SOPs do not adequately and comprehensively characterize and document requirements during the performance of interventions,” and that the intervention risk assessment “continues to allow for interventions which may include occluded surfaces.”⁴

The data failure underneath: incomplete intervention descriptions. An entry that reads “stopper jam cleared” with a single timestamp fails on three counts. It has no duration, so nobody can tell whether the intervention took twenty seconds or four minutes. It has no unit count, so the line clearance cannot be verified. And it has no identity, so the entry cannot be matched to a gowning qualification or a media fill participation record. On paper logs the field is usually there and left blank. On electronic logs the field is often absent because the form was designed to copy the paper.

2. Environmental monitoring and its linkage to the batch

Environmental monitoring (EM) is the record most often cited in sterile warning letters, and the data failure is almost always the same: the result exists, but it is not tied to the batch that was in production when the sample was taken. Annex 1 clause 9.3 states that the information from the monitoring program “should be used for routine batch certification/release,” and clause 9.31 requires that organisms detected in grade A and B areas be identified to species level and their potential impact on product quality evaluated “for each batch implicated.”¹³ Clause 9.24 requires that continuous viable monitoring in grade A be performed “in such a way that all interventions, transient events and any system deterioration would be captured.”¹³ Every one of those phrases assumes the EM record and the batch record can be joined.

The Amman Pharmaceutical Industries letter from February 2024 is the clearest example of the gap between what happened and what was recorded. The firm told FDA it had “no alert, action, out of tolerance, or out-of-limit findings” over two years. FDA investigators documented that “over 50 microbial excursions occurred (including out-of-limit recoveries from ISO 5 and ISO 7 areas)” and observed “numerous actionable recoveries” in ISO 5 environments, more than 20 instances, during four days of inspection. Contamination was visible on ISO 5 plates but “microbiology analysts failed to document those results in lab records.”⁸

The July 2025 letter to Exela Pharma Sciences describes a smaller and in some ways more instructive failure. On November 6, 2024, an analyst “recorded fewer colony forming units for active air environmental monitoring samples than what was observed by our investigator,” and “an independent review of the plate count by a second analyst to assure accuracy of the data was not conducted.”⁷ That is a single plate, a single number, and a missing second signature. It was enough for a 211.194(a) citation. The May 2025 letter to Excelvision Fareva shows the linkage question from the other direction: on September 25, 2024, an operator working on an installation inside the grade A zone “tested positive for Penicillium citrinum mold species on their right glove,” and FDA listed mold recoveries in filling rooms going back to 2022. The question an investigator asks of that record is which batches were on the line during each recovery, and whether the batch record shows it.¹²

Then there is the facility monitoring data that is never recorded at all. The Pharmathen letter states that the firm “failed to routinely record basic facility monitoring data, including differential pressure, temperature, and humidity,” because the “monitoring devices displayed real-time data only and lack data storage capability.”¹ The Somerset Therapeutics letter from September 2025 found “at least 16 aborted air samples” in February 2025 and a data retention capacity of “only 115 entries,” which FDA said limited “timely and appropriate investigation.”⁶ The Catalent 483 states that “environmental monitoring is not always performed in response to interventions located and/or impacting critical surfaces” and that the firm lacks “comprehensive trending analysis regarding your environmental monitoring program.”⁴

The data failure underneath: unlinked records. The EM system knows the sample location and the time. The batch record knows the batch and the shift. The intervention log knows when the operator reached into the grade A zone. On most sites no single record holds all three, and the linkage is reconstructed after the fact by a reviewer who was not there. When the reviewer cannot make the join, the finding writes itself.

3. Media fill (aseptic process simulation) documentation

The media fill is the record that proves the intervention log and the line clearance procedure describe a process that actually works. Annex 1 clause 9.47 sets the documentation standard: all APS runs “should be fully documented and include a reconciliation of units processed,” and “all interventions performed during the APS should be recorded, including the start and end time of each intervention and the involved person.”¹³ Clause 9.34 requires that inherent and corrective interventions in the APS be performed “in a manner and frequency similar to that during the routine aseptic process.”¹³ PDA’s Technical Report 22, revised in 2025, covers the same ground from the practitioner side, including inherent and corrective interventions and how intervention-related containers are handled.²⁴

The Par Health and Endo letter states that the firm’s “media fills failed to accurately simulate aseptic manufacturing operations,” that the number of units in the simulations was “substantially smaller than some of your aseptically produced batch sizes,” and closes with the sentence quality leaders should keep on the wall: “media fills cannot justify unsuitable manufacturing lines and processing conditions.”² The Catalent 483 makes the same point in the language of an observation: media fills “are not designed to ensure they provide worst case conditions to the aseptic filling process including but not limited to worst case interventions.”⁴

The 2018 Celltrion letter is the one that shows how the record itself fails. FDA found the firm “rejected integral vials” during simulated power failures, against its own procedure, and reminded the firm that “you should not remove more units during a media fill intervention than would be cleared during a production run.” It also found the firm “did not keep adequate records that document which personnel performed the examinations” of the incubated units.¹¹ The Somerset letter adds a reporting failure: after a September 2024 media fill produced “visually cloudy vials” around September 30, 2024, no Field Alert Report was filed until after the inspection closed, against a three-working-day requirement.⁶

The data failure underneath: the media fill record and the production intervention log are built to different templates and cannot be compared. If the media fill records “stopper bowl intervention, 3 units removed” and the production log records “adjustment,” there is no way to show the simulation covered the routine. The 2004 FDA guidance already required that intervention procedures be “clear and specific (e.g., intervention type; quantity of units removed), providing for consistent production practices and assessment of these practices during media fills.”¹⁴ The two records have to share a vocabulary.

4. Line clearance

Line clearance in fill-finish means two things: the removal of units that may have been exposed during an intervention, and the clearance of the line between batches or products. Inspectors cite the first far more often. The 2004 guidance states that written procedures “describing the need for line clearances in the event of certain interventions, such as machine adjustments and any repairs, should be established,” and Annex 1 clause 9.41 says that units may be discarded during a media fill and not incubated “only if production SOPs clearly specify that units must be removed under the same circumstances (i.e. type of intervention; line location; specific number of units removed).”¹³¹⁴

The findings are consistent. In the Celltrion letter, an operator used RABS gloves “to remove a jammed stopper by reaching over exposed sterile stoppers in the stopper bowl,” after which “the filling line was restarted, but the affected stoppers were not cleared.”¹¹ The Aspen Pharmacare letter from February 2025 describes operators who “blocked first air by placing their gloved hands directly over open sterilized bottles” and “used their gloved hands instead of using appropriate sterile tools to remove jammed bottles.”⁵ The Akorn letter describes personnel who performed work “over open vials without clearing them.”¹⁰

The data failure underneath: the line clearance record is usually a checkbox, and a checkbox cannot carry a number. If the SOP says “remove 10 units after a stoppering station intervention,” the record has to show 10 units removed, at that station, at that time, by that person, and the reconciliation at the end of the batch has to account for them. When the record is a tick mark, the reconciliation cannot close, and the media fill exclusion logic in clause 9.41 cannot be applied because there is no evidence that production practice matches it.

5. Component and stopper processing records

Stoppers, vials, and other sterilized components arrive at the filling line with a sterilization history, and the record of that history has to be complete, unique, and reviewed. Annex 1 clause 8.45 requires a record for each sterilization run with a unique identifier, with conformity “reviewed and approved as part of the batch certification/release procedure,” and clause 8.50 requires each heat sterilization cycle to be recorded “either electronically or by hardcopy, using equipment with suitable accuracy and precision,” with safeguards to detect and fail a non-conforming cycle.¹³ Clause 8.46 requires a maximum hold time for sterilized items not used immediately.¹³

The findings here divide into two groups. The first is the handling of components at the line. The Par Health and Endo letter cites “inappropriate transfer of (b)(4) stoppers to the production line,” including “failure to follow procedures to disinfect the stopper bag during transfer” and “cutting open the stopper bag and exposing stoppers to the ISO 7 environment prior to emptying the contents into the ISO 5 production line.”² The Akorn letter describes operators who “shook stopper bags inside the ISO 5 area” and “failed to disinfect stopper bags prior to their introduction into the ISO 5 area.”¹⁰ The Somerset letter describes a RABS door held open “for extended periods of time to facilitate the transfer of sterilized stopper bags to the ISO 5 area.”⁶

The second group is the component data itself. The Catalent 483 states that the firm’s “sampling of incoming stoppers is not based on appropriate statistical criteria and does not ensure that samples are representative of the lot,” and, in Observation 1, that a recurring mammalian hair contamination had a “probable root cause” attributed to stopper components on the basis of “an ongoing, aggregated trend investigation” that “has not been substantiated through complete, batch specific investigations.”⁴ The most striking component-adjacent finding is in the Aspen letter, which concerns sterilizing filter integrity tests rather than stoppers but shows the same failure mode: on August 8, 2024, operators ran “four post-use sterilizing filter integrity tests” with “three failing results and the final passing result,” and on July 25, 2024, nine tests with “five failing results, three aborted tests, and the final passing result.” In both cases “your operators only reported the passing result,” and FDA found that production and the quality unit “did not review electronic raw data and audit trails to ensure data integrity prior to batch release.”⁵

The data failure underneath: a record that reports the outcome and not the history. A sterilizer printout, a filter integrity test result, or a stopper certificate of analysis that shows only the final passing value is not an original record. It is a summary. The 2018 FDA data integrity guidance defines an audit trail as a record that tracks creation, modification, or deletion, and asks directly whether “activities documented at the time of performance” and whether “there is a record of changes to data.”¹⁵ When the instrument keeps the history and the batch record keeps only the last line, the site has built a hybrid record without deciding which half is the record.

6. Visual inspection records

Every filled container of a parenteral product has to be inspected individually, and Annex 1 clause 8.33 requires that “results of the inspection should be recorded and defect types and numbers trended,” with reject levels trended on statistical principles and “impact to product on the market” assessed when adverse trends appear.¹³ Clause 8.30 requires a maintained defect library and an investigation whenever a critical defect is found during any subsequent sampling of accepted containers.¹³ FDA’s guidance on this topic, Inspection of Injectable Products for Visible Particulates, was issued in draft form in December 2021 and, as of this writing, has not been finalized.²⁵

The visual inspection record produced the single most serious data integrity finding in this set. The November 2023 letter to Intas Pharmaceuticals states that “visual inspectors manipulated particle and other defect counts on manual visual inspection records” since 2021 to “keep the category wise rejections within limits to avoid a deviation,” with multiple operators recording an “identical number of defects listed for all drug product defect categories” across different inspectors and trays, and that a “lack of QA department review and oversight of visual inspection records” allowed the pattern to continue.⁹

The other findings concern what the record cannot show. The Par Health and Endo letter states that inspection personnel “were often not able to achieve a probability of detection of 70% for certain critical particulates larger than 150 microns,” that the firm “incorrectly categorized critical defects as major and subsequently approved products that passed acceptable quality limits (AQL) testing,” and that written procedures allowed multiple re-inspections “in support of batch release,” against FDA’s stated position that it “does not recommend more than one re-inspection in an attempt to release a batch with atypical defect levels.”² The Catalent 483 describes a classification system that treats “atypical particulates, adhered matter, light/dark particles, and dark/light fibers as intrinsic, unless determined to be extrinsic,” with the result that of the batches flagged with particulate matter during visual inspection since July 1, 2025, “only approximately 27 of these occurrences resulted in an investigation,” and a polyester particle classified as intrinsic “and no corrective actions were implemented.”⁴ The Exela letter found a defect library “not including an example of each defect type” and training whose duration “does not reflect actual visual inspection conditions as documented in your batch record visual inspection worksheets.”⁷

The data failure underneath: a manual count with no independent check and a classification scheme that decides in advance what will not be investigated. The Intas case is the extreme form, but the Catalent and Par findings show the ordinary form: the record faithfully captures a number that was classified by a rule designed to keep the number under the limit. Trending, which clause 8.33 requires, is meaningless when the categories are built to suppress the trend.

7. Lyophilizer cycle data

Lyophilization is treated by Annex 1 as an extension of aseptic processing (clause 8.121), and its records have to carry the same weight. Clause 8.122 requires the sterilization of the lyophilizer to be validated and “the holding time between the sterilisation cycle and use appropriately challenged during APS.” Clause 8.124 requires the leak rate to be “specified and checked at the start of every cycle” and the integrity filter’s test results to be “part of the batch certification/release.” Clause 8.126 requires the loading pattern to be “specified and documented.”¹³ FDA’s lyophilization inspection guide, which is older but still the reference investigators are trained on, states that the lyophilizer “should also have the necessary instrumentation to control and record the key process parameters,” that leak rate should be monitored periodically against the value found acceptable at validation, and that “in addition to documentation of the malfunction, there should be an evaluation of the possible effects on the product.”¹⁶

Lyophilizer findings are less frequent in warning letters than intervention or EM findings, but when they appear they are about the hold time record and the cycle record. A May 2024 Form 483 issued to an outsourcing facility (a 503B compounder, not a pharmaceutical manufacturer, but the observation is instructive) describes a lyophilizer chamber cleaned and sterilized between 17:10 and 17:30 on one day, and residual liquid observed on multiple product shelves at 11:31 the following day, “approximately 19 hours later with no established hold time.” The firm “was unable to provide evidence on what the residual liquid was.”¹⁷ That is a hold time that was never defined, so it was never recorded, so it could not be defended.

The data failure underneath: cycle data that lives on the lyophilizer’s own controller and reaches the batch record as a printout or a summary. Shelf temperature, chamber pressure, condenser temperature, and the leak test are all captured by the control system with timestamps. Whether the batch record contains the trace, a printout, or a transcribed “cycle complete: yes” is a site design decision, and it is the decision that determines whether the record survives an inspection. The same question applies to the sterilization cycle of the chamber and to the hold time between that cycle and loading.

Five Data Quality Failures That Run Through Every Citation

Pull back from the individual records and five failure patterns account for nearly every finding in this article. Naming them matters because a site can fix a pattern once, across all seven records, rather than fixing each record separately.

The fifth pattern deserves its own paragraph because it is the one most specific to fill-finish: EM results not tied to the batch in production at the time. It is a special case of pattern 2, but it has a distinct cause. EM sampling is scheduled by location and frequency, not by batch. A site can run a perfectly compliant EM program, with every sample taken on time and every plate read correctly, and still be unable to answer the question “which batch was on the line when this ISO 5 excursion was recovered?” Clause 9.31’s requirement to evaluate impact “for each batch implicated” cannot be met without a time-based join between the sampling record and the production schedule, and on most sites that join is done by hand, by a microbiologist, weeks later.¹³

The Simtra BioPharma letter from March 2026 shows how patterns 2 and 3 compound. FDA found the firm “lacked raw (b)(4) integrity testing data” and “was unable to locate raw (b)(4) integrity testing data” for a period, and that “instead of reviewing raw (b)(4) testing data, your quality assurance unit relied on forms containing transcribed information.” A component “failed to meet acceptance criteria on July 1, 2025, and did not pass testing until July 19, 2025,” and “in the 18-day period between these tests, your production schedule indicated you manufactured at least (b)(4) batches.”³ The original data was missing (pattern 3), the transcribed form could not show the failure (pattern 3 again), and the batches made in the 18-day gap were not linked to the failing test (pattern 2). Three failures, one root cause: the record that quality reviewed was not the record the instrument produced.

What Annex 1 and ALCOA+ Actually Require of These Records

This article is not an Annex 1 summary, and readers who want one have the full text at the European Commission’s site.¹³ What matters here is narrower: which attributes of a record Annex 1 and the data integrity guidance actually demand, so that a site can check its own records against them.

ALCOA+ is the vocabulary regulators use. MHRA’s 2018 guidance defines the acronym: Attributable, Legible, Contemporaneous, Original, and Accurate, with the “plus” adding Complete, Consistent, Enduring, and Available, and states that there is “no difference in expectations regardless of which acronym is used.”¹⁸ FDA’s 2018 guidance uses the same five core terms and anchors each in a regulation: contemporaneous recording to 211.100(b) and 211.160(a), original or true copy to 211.180 and 211.194(a), and accuracy to 211.22(a), 211.68, and 211.188.¹⁵ PIC/S adopted its own guidance on data management and integrity, PI 041-1, in June 2021, in force from July 2021, which inspectors in PIC/S member authorities use as their reference.²⁰

Mapping the seven records to the attributes is the exercise that turns a regulatory principle into a site check. The table below does that mapping using the findings in this article as the evidence for which attribute each record most often fails.

One clarification that saves a lot of argument on site. Annex 1 does not require any of these records to be electronic. Clause 8.50 explicitly allows a heat sterilization cycle to be recorded “either electronically or by hardcopy.”¹³ What Annex 1 requires is that the record has the attributes. A paper intervention log with type, location, start, end, units removed, and two signatures meets 8.17. An electronic log with a free-text field and one timestamp does not. The medium is not the point. The design of the record is.

A Record-by-Record Checklist You Can Run on Your Own Site

The checklist below is built to be run by a quality or data leader in a day, using records as they are actually filed, without a consultant and without an inspection date. For each record, pull one recent batch and one batch from at least six months ago, and answer the questions against the physical or electronic record, not against the SOP. The SOP describes the intent. The record is what the investigator reads.

Two practical notes on running the checklist. First, do the six-month-old batch first. Recent batches benefit from recent attention. The older batch shows what the system produces when nobody is watching. Second, record the time each question takes to answer. The time is the finding. A question that takes forty minutes to answer from filed records is a question an investigator will ask and a reviewer skipped.

What an MES or EBR Fixes, and What It Makes Worse

Nearly every fill-finish site that reads a list like the one above is either running an MES, implementing one, or being asked by a leadership team why it has not. The honest answer to “will an MES fix this?” is: some of it, automatically; some of it, only if you design for it; and some of it, an MES will make worse. The split matters because it determines what the implementation has to be scoped to do.

What an MES or EBR fixes almost for free

Timestamps and durations. An electronic record captures the system time on every entry without asking the operator. An intervention opened and closed in an MES has a start, an end, and a duration by construction. Pattern 1 largely disappears.

Attribution. Every entry is tied to a logged-in user. Provided the site does not use shared accounts, which FDA’s data integrity guidance specifically addresses, the attributable attribute is met by default.¹⁵

Transcription of setpoints and identifiers. ISPE’s Pharma 4.0 concept paper on alarms and audit trails describes the basic transaction: the MES sends batch and recipe parameters to the shop floor equipment at batch setup “to prevent potential transcription errors.”²² The batch number, the product, and the recipe parameters no longer pass through a human hand. That is a large share of pattern 3 removed.

Enforced completeness. A mandatory field cannot be left blank. If the intervention screen requires a type from the authorized list, a location, and a unit count before it can be closed, the “adjustment” entry is no longer possible.

What an MES fixes only if the integration is designed for it

EM linkage to the batch (pattern 5). This is the one most often assumed and least often delivered. An MES knows the batch and the time. The EM system knows the sample and the time. Unless one of them is integrated to the other, or both are integrated to a common data layer that carries the batch identifier, the join still happens in a spreadsheet. A site that implements an MES without integrating EM has solved the intervention log and left the most-cited record exactly where it was.

Instrument history rather than instrument result. The Aspen and Simtra findings were about the difference between the last passing value and the full test history. An MES interface that pulls the final result from a filter integrity tester or a sterilizer reproduces the summarization problem in electronic form. The interface has to pull the history, or the MES has to hold a true copy of the instrument’s own record. The ISPE concept paper is candid about why this is hard: a process historian that reads process variables in real time “cannot understand the complete alarm lifecycle, for example, when the alarm was acknowledged at the machine level and by whom,” because “this metadata is not normally available as process variables.”²²

Media fill and production vocabulary. An MES can force the intervention list in the APS record to be the same master data as the intervention list in production. Or it can let each be configured separately, in which case the comparison problem is unchanged. This is a master data decision, and it is usually made by whoever configures the first recipe, without anyone from sterility assurance in the room.

What an MES can make worse

Intervention description quality. A paper log has one weakness: fields get left blank. An electronic log has a different weakness: fields get filled with the first item in the dropdown. A mandatory “intervention type” field with a default value produces a record that is complete, attributable, contemporaneous, and wrong. The Catalent observation about intervention SOPs that “do not adequately and comprehensively characterize and document requirements during the performance of interventions” describes a problem an MES does not touch, because the MES records whatever the SOP tells the operator to select.⁴

Audit trail volume. Every field in an EBR generates audit trail entries. A batch that produced a forty-page paper record can produce tens of thousands of audit trail lines. FDA’s guidance asks who should review audit trails and how often, and the answer it gives is that audit trail review should be part of the routine record review for release.¹⁵ If the site’s release process is “review the batch record as before, plus scroll the audit trail,” the review does not happen and the finding becomes the Aspen finding: quality “did not review electronic raw data and audit trails” before release.⁵ The alternative is review by exception, which ISPE’s Pharmaceutical Engineering describes as validated search functions that “automatically flag deviations or abnormal events,” citing the definition of an exception report as “a validated search tool that identifies and documents predetermined ‘abnormal’ data or actions, that require further attention or investigation by the data reviewer.”²³ Review by exception is a design and validation effort of its own. It does not come in the box.

Hybrid records. An MES rollout almost never covers every record in one phase. For a period, sometimes a long one, the intervention log is electronic, the EM plates are on paper, the sterilizer prints a chart, and the lyophilizer keeps its own file. MHRA’s guidance is direct: where hybrid systems are used, “it should be clearly documented what constitutes the whole data set and all records that are defined by the data set should be reviewed and retained.”¹⁸ A site that cannot state, for a given batch, which records are electronic, which are paper, and which are the original, has more data integrity exposure mid-rollout than it had before the project started.

The practical conclusion is that an MES program for a fill-finish site should be scoped as a records program, with the seven records in this article as the deliverables, rather than as a software deployment. The question for each record is not “will this record be in the MES?” but “will this record, as produced by the MES and its interfaces, pass the checklist above?” If the intervention log will pass and the EM linkage will not, the site knows exactly what the next phase has to contain.

Conclusion

The sterile fill-finish records that get cited are not obscure. They are the seven records every site already keeps, and the citations are about the same handful of missing attributes: time, duration, identity, unit count, linkage to the batch, original data rather than a summary, and a count that has not been shaped by a rule. The warning letters quoted here, from Pharmathen and Par Health in 2026 back through Aspen, Somerset, Exela, Amman, Intas, Akorn, and Celltrion, describe sites with procedures and records that could not reconstruct what happened to a batch. The revised Annex 1 wrote those attributes into clauses 8.17, 8.33, 8.45, 8.124, 9.3, 9.31, 9.41, and 9.47, and the ALCOA+ vocabulary gives a site the words to check its own records against them. None of that requires new technology. It requires deciding what each record must contain, then checking whether it does.

Sakara Digital works with pharma and biotech organizations on exactly this kind of records-first data quality work: mapping what each GxP record has to carry, finding where the linkages are being reconstructed instead of recorded, and scoping MES, EBR, and data layer projects so that they deliver records that pass inspection rather than screens that replace forms. If you are looking at your own fill-finish records ahead of an inspection or an MES program and want an independent perspective on where to start, we are happy to have that conversation.

For Further Reading