Complaint Handling Modernization in Medical Products

Complaint Handling Is a Data Problem Wearing a Workflow Costume

Ask a quality leader to describe their complaint handling process and you will usually get a flow diagram. Intake, triage, acknowledgment, assessment, investigation, response to complainant, closure. Ask what the process produces and the answer is usually a set of cycle time metrics: average days to acknowledge, average days to close, percentage closed within target, backlog aging. Those numbers are real and they matter for resourcing. They tell you almost nothing about whether the product is behaving as it should.

The regulation has never described complaint handling as a service function. Under 21 CFR 211.198, written procedures for handling all written and oral complaints must exist and be followed, the quality control unit must review any complaint involving a possible failure of a drug product to meet its specifications, and a determination must be made as to whether an investigation under 211.192 is needed. The same section requires a review to determine whether the complaint represents a serious and unexpected adverse drug experience that must be reported to FDA.¹ That single sentence is the dual-path obligation, written into the GMP rule rather than the safety rule, and it is the piece most often handled by a checkbox rather than a designed handshake.

The European position is framed the same way. EudraLex Volume 4 Chapter 8 covers complaints, quality defects and product recalls together, and the 2014 revision built quality risk management principles into how complaints are assessed, how quality defects are classified, and how recall decisions are made.² ICH Q10 places complaint handling inside the pharmaceutical quality system as one of the inputs that feeds corrective and preventive action, process and product monitoring, and management review, which is to say it is expected to be a source of evidence about the state of control, not a customer relations queue.³

So the framing is settled in the regulation and unsettled in practice. Why? Because complaint handling touches the two functions least likely to share a system: commercial customer service, which owns the phone number and the inbox, and quality, which owns the consequence. Pharmacovigilance sits in a third place with its own database, its own vocabulary, and its own clocks. When three functions each own part of a record, the record fragments, and once it fragments the data quality problem becomes invisible because every function sees only its own portion and every portion looks complete.

The three failures that follow from bad framing

Every complaint handling remediation we have been asked to look at comes down to some combination of three problems, and all three are data problems.

Unusable intake. The record exists but cannot be used. There is a narrative and no lot number. There is a defect description in free text and no category. There is a date of entry and no date of receipt. Each of these is a small omission at the point of capture and a permanent limitation afterward, because you cannot go back and ask a caller from eleven months ago which lot they had.

Path divergence. A single contact contains a product quality issue and an adverse event. It is entered into one system, routed to one owner, and the other process never sees it. Or it is entered into both systems by two people from the same call notes, and from that moment the two records drift: different event dates, different seriousness assessment, different follow-up, different closure. At the next inspection someone asks for the reconciliation and there is no key to reconcile on.

Count-based trending. Complaints are counted, plotted, and compared month over month with no denominator. Distribution volume changes, a new market launches, a call center script is rewritten, an online reporting form goes live, and the count moves. The quality organization interprets a movement in reporting behavior as a movement in product performance, or misses a genuine change because a volume increase masked it.

Intake Quality: The Minimum Structured Record

Intake is where the value of the entire process is decided. Everything downstream is constrained by what the first person captured, and that person is usually the least trained, most time-pressured participant in the chain. They are often on a phone, often working from a script written by a commercial team, and often measured on call handling time.

A complaint recorded as “product did not work” is not a complaint record. It is a note. It cannot be trended because it does not map to a category. It cannot be linked to a batch because there is no lot number. It cannot support an investigation because there is nothing to compare against the batch record. And it cannot be assessed for safety reportability because nobody asked whether a patient took the product and what happened afterward.

The fields that have to be mandatory

21 CFR 211.198(b) sets a floor for the written record: name and strength of the drug product, lot number, name of complainant, nature of the complaint, and the reply to the complainant, along with the findings of the investigation and follow-up, or the documented reason no investigation was necessary and the name of the person who made that determination.¹ That is the floor, not the design. A record that satisfies the floor and nothing else will still fail every analytical use you have for it.

Free text is evidence, not data

None of this argues against free text. The narrative is often the only place the real information lives, and a good narrative is what makes an investigation possible six months later. The point is that free text is evidence and structured fields are data, and the two do different jobs. A narrative supports a human reading one case. Structured fields support a machine comparing ten thousand.

The practical design rule is that every structured field must be derivable at the moment of capture and every narrative must be preserved verbatim. Do not let intake staff summarize the caller. Do not let a category selection replace the description. And do not let a system force a category before enough is known, because a forced early category is worse than a blank one: it is wrong and it looks confident.

Designing the controlled vocabulary

Most complaint categorization schemes fail because they mix two different questions into one list. “Broken tablet”, “wrong count”, “label illegible”, and “no effect” are not the same kind of statement. The first three describe an observable attribute of a physical unit. The last describes an outcome in a patient.

Separate the vocabulary into independent axes and code each one:

• What was observed. The physical or performance observation, described in the complainant’s terms and mapped to a controlled term.
• Where it was observed. The product component: drug product itself, primary container, closure, secondary packaging, labeling, insert, delivery component, shipper.
• When in the life of the unit. On receipt, during storage, at the point of preparation, during administration, after administration.
• Whether a patient was exposed. A yes, no, or unknown that is captured separately from the defect itself and never inferred from it.

With those four axes you can answer questions that a flat list cannot. Is the increase in “damaged product” complaints concentrated in one shipper configuration? Are labeling complaints coming from one market where a translated insert changed? Is a rise in delivery-component complaints happening only after a component supplier change? A single flat category list gives you a bar chart. Four axes give you a hypothesis.

The Dual Path: When One Contact Is Both a Quality Complaint and an Adverse Event

This is the heart of the problem, and it is the part most complaint handling projects underestimate because it does not look like a technology issue until you try to solve it.

A single phone call arrives. A patient says the tablets in the last bottle looked different from usual, and that after taking them for three days she developed a rash. That contact contains a product quality complaint and a suspected adverse reaction. They are not the same thing, they are assessed by different people against different criteria, they carry different regulatory clocks, and they may or may not be causally related. What they share is one caller, one product, one lot, and one moment in time.

Now consider what has to happen. The quality organization needs a complaint record with the lot number, the appearance description, and a request for the returned sample. Pharmacovigilance needs an individual case safety report with an identifiable reporter, an identifiable patient, a suspect medicinal product, and a suspected adverse reaction, which are the four elements that make a case valid for reporting under GVP Module VI.⁴ The two records need to reference each other, follow-up needs to be coordinated so the patient is not called twice by two departments asking overlapping questions, and if the investigation finds a subpotent or mislabeled lot, that finding has to travel back to the safety assessment.

How the dual path actually fails

The design that fixes it: one contact, two children

The pattern that holds up is straightforward to describe and takes real discipline to implement. Every inbound contact creates one canonical contact record with a unique contact identifier, an immutable receipt timestamp, and the verbatim narrative. That contact record is not a complaint and not a safety case. It is the record of the interaction.

From that contact record, the intake process creates child records: a product quality complaint if the contact contains any product quality content, a safety case if the contact contains any adverse event content, and both if it contains both. Every child record carries the parent contact identifier. That identifier is the reconciliation key, and it exists from the first second rather than being constructed later.

The boundary cases that decide how good your design is

Four situations separate a designed dual path from a diagram.

Lack of effect. A patient reports the medicine stopped working. Is that a quality complaint about potency, a safety case about therapeutic failure, both, or neither? Under most safety frameworks, lack of efficacy is reportable in defined circumstances, and under GMP it may indicate subpotency in a specific lot. The correct answer is that it enters both paths and each assesses it on its own criteria. Notably, ISPE excluded lack of effect from the total complaint rate metric in its quality metrics pilot, which tells you the industry has long recognized that this category behaves differently from physical defect complaints.⁵

An adverse event with no product quality content. A patient reports nausea. Nothing about the tablet, the pack, or the label. This is a safety case only. But the complaint system should still be able to see it, because a rise in a specific reaction concentrated in one lot is a quality signal even when no complainant ever mentioned the product’s appearance.

A quality defect with no patient. A pharmacist reports a cracked vial before dispensing. No patient exposure. This is a complaint only, and it may still trigger a Field Alert Report and a quality defect notification depending on what the investigation finds.

A medication error. A wrong dose was administered because two strengths of the same product have nearly identical cartons. This is simultaneously a labeling and packaging quality complaint, a potential safety case, and a design issue that belongs in a product risk file. It also sits explicitly within the scope of the ICH E2D framework for post-approval safety data, and the E2D(R1) revision published for consultation in 2024 addressed exactly this widening of data sources and definitions.⁶

Reporting Clocks and the Awareness Timestamp

The dual path also carries two sets of regulatory clocks that start from different definitions of the same moment, and this is where well-run organizations still get caught.

For a US applicant holding an NDA or ANDA, a Field Alert Report is due within three working days of becoming aware of information concerning a significant quality problem with a distributed drug product, including any incident that causes a drug product or its labeling to be mistaken for another article, and any bacteriological contamination or significant chemical, physical, or other change or deterioration in a distributed product, or any failure of a distributed batch to meet its specification.⁷ FDA maintains dedicated guidance and submission channels for FARs, and the operative word in the requirement is awareness.⁸

For a serious and unexpected adverse drug reaction, ICH E2D sets the expedited reporting expectation at 15 calendar days from the point at which the marketing authorization holder receives the minimum information needed for a valid case.⁹ GVP Module VI carries the equivalent obligations in the EU, including electronic submission of individual case safety reports to EudraVigilance and the validation and follow-up expectations that surround them.⁴

On the quality defect side, a marketing or manufacturing authorization holder must notify EMA of any product quality defect, including a suspected defect, of a centrally authorized medicine that could result in a recall or an abnormal restriction on supply, and national competent authorities operate a rapid alert system for defects that present a serious risk to public health.¹⁰ EMA publishes both the risk-based approach to classifying suspected quality defect reports and its own analysis of quality product defects arising in the centralized procedure, which are two of the more useful public documents for calibrating what regulators consider a serious defect.¹¹¹²

Investigation, Batch Linkage, and the Decision to Escalate

Once a complaint is captured properly, the next question is what to do with it, and the regulation is unusually direct here. Under 211.198(a), the quality control unit must review any complaint involving the possible failure of a drug product to meet any of its specifications and determine whether an investigation under 211.192 is needed. Where an investigation is not conducted, the record must include the reason it was found unnecessary and the name of the person who decided.¹

That last clause is quietly one of the most inspected sentences in Part 211. It converts a decision not to act into a documented, attributable determination. Inspectors read those determinations in bulk, and thin reasoning shows up quickly when a hundred records carry the same three-word justification.

What batch linkage actually requires

The lot number is the join key, and everything useful about a complaint investigation depends on it resolving to something. When it does, the investigation can pull:

• The executed batch record, including any in-process results near a limit and any manual interventions
• Release testing results and the certificate of analysis for that lot
• Open and closed deviations associated with that batch, that line, and that time window
• Stability data for the lot or its representative, including any out-of-trend results
• Retained samples, and whether a retain can be examined for the reported attribute
• The complaint history for the same lot, adjacent lots, and the same product on the same line
• Distribution records showing where the lot went, in what quantity, and through which channels
• Component and material lot genealogy, particularly for containers, closures, and delivery components

When the lot number is missing, none of that is available and the investigation becomes an exercise in describing the complaint rather than explaining it. This is why lot capture belongs in the intake design conversation and not in a data cleanup project two years later.

Investigation or trend entry: making the trigger explicit

Not every complaint needs a full investigation, and pretending otherwise produces a backlog that damages the quality of the investigations that genuinely matter. The decision needs to be a written rule with named owners, not a judgment made case by case under time pressure.

Isolated event or the visible part of a pattern

The most consequential judgment in complaint handling is whether one complaint is an isolated event or the part of a pattern you can see. You cannot answer that by looking at the complaint. You answer it by defining comparison sets in advance and checking the complaint against all of them.

Useful comparison sets are: the same lot, adjacent lots from the same campaign, the same product and presentation across a rolling window, the same manufacturing line regardless of product, the same component or material supplier lot, the same market or distribution channel, and the same defect category across the whole portfolio. A complaint that is unremarkable in five of those sets and a clear outlier in one has told you where to look.

FDA warning letters make this point repeatedly and specifically. Investigations that fail to be adequately expanded to include other potentially affected batches or products are a recurring citation, as is failure to extend a complaint investigation to other products handled on the same equipment.¹³¹⁴ Letters have also cited firms for failing to establish and follow adequate written complaint procedures and for not investigating a complaint that included an adverse reaction.¹⁵ The pattern across those citations is not that companies lacked a procedure. It is that the scope of the investigation stopped at the lot the complainant happened to have.

Trending and Signal Detection: Rates, Not Counts

Most complaint trending we see is a count of complaints per month by category, plotted as a bar chart, reviewed in a meeting, and filed. It is nearly useless for detecting change, and it is actively misleading when volume moves.

Normalize against what was distributed

A complaint rate is complaints divided by exposure. The FDA draft guidance on submission of quality metrics data described a product quality complaint rate as an indicator of product quality with respect to label claims and patient perception, calculated against distribution rather than reported as a raw number.¹⁶ The ISPE quality metrics pilot used total complaint rate excluding lack of effect, expressed per million packs.⁵ Both are telling you the same thing: the numerator alone is not a metric.

Choosing the denominator is a real decision and it depends on the product:

• Packs or units distributed works for solid oral products with a stable pack configuration and is the most common basis.
• Doses or vials is better where pack size varies widely across markets, because a per-pack rate will otherwise move whenever the market mix moves.
• Patient-days of exposure is the right basis for chronic therapies where a single pack covers very different treatment durations across strengths.
• Administrations is appropriate for products with a delivery component, where the complaint relates to use rather than to the drug substance.

Whatever you pick, three problems will bite. Distribution data lags, so the denominator for the most recent month is provisional and the rate will restate. Channel inventory means product distributed is not product used, and a launch ramp or a channel fill will suppress the apparent rate for a period. And free or sample distribution is frequently absent from the commercial data set entirely, which understates exposure and overstates the rate. None of these are reasons to skip normalization. They are reasons to document the denominator definition, hold it constant, and annotate the chart when it changes.

An increase in complaints often means better reporting

This is the point that separates a quality organization that understands its own data from one that reacts to it. A rise in the complaint rate has at least two families of explanation, and the reporting explanation is more common than the product explanation.

The pharmacovigilance literature has documented this carefully because spontaneous reporting systems are subject to exactly the same distortions. FDA safety alerts measurably increase the volume of adverse event reports submitted for the products named, an effect described as stimulated reporting.¹⁷ Notoriety bias raises reporting for specific event and product combinations after media or regulatory attention. The Weber effect describes reports rising through the first years after launch, peaking, and then declining even as prescriptions keep increasing. Analysis of spontaneous reporting in Japan documented similar structural biases in national reporting data.¹⁸ None of these effects have anything to do with the product changing.

Product quality complaints are subject to the same distortions plus several of their own.

Stratification and thresholds

Trending at the portfolio level detects almost nothing. Real signals appear when you stratify: by lot, by presentation, by manufacturing line, by market, by channel, by defect category, and by the four intake axes described earlier. The practical constraint is statistical, not technical. Slice too finely and every cell contains one or two complaints, at which point normal variation looks like a signal.

Set thresholds deliberately and document who set them. Fixed thresholds are simple and defensible but do not adjust for volume. Statistical rules on a control chart of the normalized rate handle volume properly but need enough history to establish a baseline and need a documented rationale for the rule set. For most portfolios a two-tier approach works: a low fixed threshold that triggers a review at any occurrence for high-severity categories such as contamination or mix-up, and statistical rules on normalized rates for everything else.

Whatever the mechanism, the output has to reach the pharmaceutical quality system rather than a dashboard nobody opens. ICH Q10 expects complaint data to inform process and product monitoring, CAPA, and management review, which means a complaint trend that crosses a threshold should generate a quality event with an owner and appear in the periodic product quality review and the management review pack.³

Automation and AI in Coding and Triage

Complaint intake and safety case processing are among the most credible near-term applications of AI assistance in a regulated life sciences operation, and also among the easiest to govern badly. Both things are true and the balance matters.

Where it genuinely helps

The work that consumes capacity in complaint and case processing is high volume, repetitive, language-heavy, and mostly not judgment. That is a good match.

• Structuring free text. Extracting candidate values for lot number, product, strength, dates, and reported symptoms from a narrative or an email and presenting them as suggestions for confirmation. This is the single highest-value application because it attacks the intake quality problem directly.
• Duplicate detection. Identifying that a case arriving through a distributor and a case arriving through a call center describe the same event. Duplicates inflate counts, distort rates, and are tedious to find manually.
• Coding suggestion. Proposing MedDRA terms for safety cases and controlled defect categories for complaints, with the human coder accepting, adjusting, or rejecting. Consistency of coding is what makes trending possible, and consistency is exactly what varies between human coders.
• Translation and transcription. Making non-English complaints and voice recordings available to reviewers without a delay that eats the reporting clock.
• Triage prioritization. Surfacing contacts that contain probable seriousness indicators so they reach a qualified assessor first, without making the seriousness determination.
• Reconciliation gap finding. Matching complaint records to safety cases where the shared key is imperfect, and flagging probable orphans for human review.
• Anomaly flagging in trends. Detecting rate changes across many strata simultaneously, which is genuinely hard to do manually across a large portfolio.

IQVIA’s assessment of how AI is reshaping pharmacovigilance under emerging regulatory guidance describes much the same distribution of value: material gains in case intake, coding, and duplicate handling, with regulators focused on validation, transparency, and oversight rather than on prohibition.¹⁹

Where it does not belong, at least not yet

There is a clean line and it is worth stating plainly. A model may propose. A qualified person decides, and the decision record must be separate from the model output.

The determinations that stay with people are the ones the regulation attributes to a named individual or a named function: the seriousness and expectedness assessment on a safety case, the reportability decision and its clock, the quality unit determination on whether an investigation is required under 211.192, the documented reason an investigation was not conducted, the conclusion of a batch investigation, and the scope of affected material. Each of those is a decision the regulator will ask a person to explain.

The governance this now requires

The governance question has moved from theoretical to concrete in the last eighteen months, and there are two documents any pharma or biotech organization introducing AI assistance into complaint or safety processing should have read.

FDA published draft guidance on 6 January 2025 titled “Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products”, covering nonclinical, clinical, post-marketing, and manufacturing uses where an AI model produces information supporting a regulatory decision about safety, effectiveness, or quality.²⁰ Its central construct is a risk-based credibility assessment framework: define the question the model addresses, define the context of use, assess model risk based on how much the model influences the decision and how consequential that decision is, then scale the evidence you generate to that risk. For complaint handling this is directly usable. A model suggesting a defect category that a coder confirms carries low model influence. A model that filters which contacts a human ever sees carries very high model influence, because the human cannot correct what never reaches them.

On the manufacturing side, the EU published draft Annex 22 on artificial intelligence on 7 July 2025 as part of a wider digital update to EudraLex Volume 4, with the consultation closing in October 2025.²¹ The draft sets expectations for intended use, validation, lifecycle management, explainability, and human oversight for AI and machine learning models embedded in critical GMP applications. It also took an initial position that dynamic models which continuously adapt during use, models returning different outputs for identical inputs, and generative AI and large language models should not be used in critical GMP applications. Following consultation feedback the drafting group has been considering whether and under what risk-based safeguards such models might be addressed, and EMA has run multistakeholder work on the guidance development.²² Published interpretation of the draft in the PDA Journal reads it as an attempt to bridge existing computerized systems validation practice and the specific behavior of learning models.²³

The practical implication for complaint handling is not that language models are off limits. It is that the more a model touches a critical GMP decision, the more constrained the acceptable design becomes, and the safest architecture keeps the model on the suggestion side of a human decision boundary that is documented and auditable.

A Modernization Sequence That Holds Up

Most complaint handling modernization programs start with a system selection and end with a system that carries the same broken records into a better interface. The sequence below is deliberately the reverse: fix what is captured and how it links before changing where it lives.

Questions worth asking before any of this

A short diagnostic will tell you where you actually are, and it does not need a project to run.

• What percentage of complaint records from the last twelve months contain a lot number that resolves to a batch record?
• What is the median gap between the receipt timestamp on the contact record and the timestamp on the quality record? What is the 95th percentile?
• Of complaints that reference a person or a symptom, what proportion have a matching safety case, and what key was used to match them?
• What denominator does the current complaint rate use, who defined it, and when was it last restated?
• How many complaint records in the last year carry a documented reason for not investigating, and how many distinct reasons appear across them?
• When the complaint rate last moved materially, what was the documented test that separated a reporting explanation from a product explanation?
• Which complaint trends appeared in the last two management reviews, and what decisions did they produce?

An organization that can answer all seven quickly has a functioning system regardless of what software it runs on. An organization that cannot answer the first one has a data problem that no system selection will fix.

Conclusion

Complaint handling deserves more attention than it gets, and it deserves a different kind of attention than it usually gets. The instinct to treat it as a workflow to be accelerated is understandable, because backlog and cycle time are visible and uncomfortable. But the value of the process is not in how fast records close. It is in whether the records, taken together, tell you something true about how your product is performing outside your control. That is a data quality question and a signal detection question, and both are answered at intake.

The three changes that matter most are unglamorous. Capture a structured record that can be joined to a batch and to a safety case. Design the dual path so a single contact containing both a quality issue and an adverse event reaches both processes from one shared record with one shared key and one shared clock. Trend normalized rates rather than counts, and test every movement against a reporting-behavior explanation before accepting a product explanation. Automation and AI assistance help meaningfully with the first of these and can help with the third, but only inside a governance frame that keeps the regulated determinations with named people and documents where the model stopped and the person started.

Sakara Digital works with pharma and biotech organizations building this kind of complaint and quality data capability, particularly where the complaint system, the safety database, and the batch record have grown up separately and now need to speak to each other. If you are looking at a complaint handling modernization and want an independent perspective on where to start, we are happy to have that conversation.

For Further Reading