Warehouse Management in GxP: The Requirements Teams Forget

Where the Generic Warehouse Template Breaks Down

Most warehouse implementations in pharma start from a partner’s accelerator package. The package contains a configured inventory model, standard put-away and picking strategies, a receiving flow, a cycle count program and a set of mobile transactions. It is genuinely good work. It has been proven across hundreds of sites. And it was built for warehouses where the only reason to stop a pallet is that someone sold it twice.

The gap opens at the scoping workshop. A logistics consultant asks how many put-away strategies you need, how you want to slot fast movers, and whether you want wave picking or cluster picking. Those are the right questions for the first eighty percent of the build. Nobody in that room asks whether the system needs to physically prevent a picker from selecting a lot that has an open deviation against it, because in a distribution center for consumer goods that concept does not exist. Quality is invited to the design review two months later, by which point the inventory model is set and the answer to a late requirement is a workaround.

The regulatory expectations here are not new and they are not ambiguous. EU GMP Chapter 3 says storage areas should have enough capacity for the orderly storage of the various categories of materials and products, and it names them: starting and packaging materials, intermediate, bulk and finished products, and products in quarantine, released, rejected, returned or recalled.¹ That is a nine-state model, stated in a single sentence, in a guideline published in 2014. A generic warehouse template has two states: available and unavailable.

The regulators already accept a system in place of a wall

The most useful thing to understand before a URS review is that none of these frameworks demand a physical cage. They demand equivalent control. Chapter 3 puts it directly: where quarantine status is ensured by storage in separate areas, those areas must be marked and access restricted, and any system replacing the physical quarantine should give equivalent security.¹ ICH Q7 says the same thing about API warehousing: unless there is an alternative system to prevent the unintentional or unauthorized use of quarantined, rejected, returned or recalled materials, separate storage areas should be assigned for their temporary storage.⁸ The EU good distribution practice guidelines allow product nearing expiry to be withdrawn from saleable stock physically or through other equivalent electronic segregation.³

Read those three together and the design principle is clear. The system is allowed to replace the fence. It is only allowed to replace the fence if it actually works. That means the requirement is not “the system shall support a quarantine status.” It is “the system shall prevent a transaction that would consume, pick, ship or otherwise use material in quarantine status, and shall record the attempt.” Those are two very different acceptance tests, and the second one is the one an inspector will ask you to demonstrate.

What inspectors actually cite

The most recent published deficiency dataset from the UK MHRA good distribution practice inspectorate covers 2016 and is drawn from a sample of 148 inspections out of 1,428 conducted that year.¹⁵ It is old, and MHRA has not published a comparable GDP dataset since, but it remains the best public evidence of what storage and distribution inspections find.

Two things stand out. Temperature control is cited more often than storage itself, which tells you where the pressure is. And the categories that dominate are the ones that cut across systems rather than falling inside one process. A quality system deficiency is rarely a missing procedure. It is usually a procedure that the systems do not support, so people work around it.

The rest of this article is organized as eight requirement areas. For each one, the pattern is the same: what the generic template gives you, what the regulation expects, and the specific requirements to write down before the configuration is frozen.

Status Control: Quarantine, Released, Rejected, Hold

This is the foundation. Get it wrong and every other requirement in this article becomes a workaround.

EU GMP Chapter 5 requires that incoming materials and finished products be physically or administratively quarantined immediately after receipt or processing, until they have been released for use or distribution.² That word “administratively” matters. It is the permission to use a system rather than a cage. 21 CFR 211.142 requires written warehousing procedures that include quarantine of drug products before release by the quality control unit.⁴ ICH Q7 requires that a system be in place to identify the status of each batch.⁸

The label is not the control

Chapter 5 has a paragraph that quality teams quote often and that IT teams almost never see. Paragraph 5.13 says labels applied to containers, equipment or premises should be clear and unambiguous, and that it is often helpful to use colors to indicate status, giving quarantined, accepted, rejected and clean as the examples.² Two paragraphs earlier, at 5.32, the guideline lists what a starting material label in the storage area should carry, including the status of the contents, and then adds a sentence that reframes the whole discussion: when fully computerized storage systems are used, all the above information need not necessarily be in a legible form on the label.²

That sentence is the license to move status control into the system. It is also the obligation that comes with it. If the label no longer carries the status, the system has to carry it with at least the same reliability, which means the system has to be the thing that stops the transaction.

The status model to specify

A generic template will offer a blocked or unavailable flag. That is not enough, because the reason for the block drives what is allowed next. A rejected lot may be moved to a destruction area but never picked. A lot on quality hold may be sampled but not shipped. A lot in quarantine may be moved within the receiving area but not consumed. Specify the states, and specify the transactions each state permits.

Requirements to write down

• The system shall enforce status at the point of transaction, not at the point of display. A blocked transaction must fail with a message naming the status and the blocking rule. Reason: EU GMP Chapter 3 paragraph 3.21 requires equivalent security when a system replaces physical quarantine.¹
• Status shall be settable only by the roles authorized in the quality system. Release to saleable or usable status must be restricted to the quality control unit. Reason: 21 CFR 211.142 ties release to the quality control unit; Chapter 5 paragraph 5.34 restricts use to materials released by quality control.²⁴
• Every status change shall be captured in the audit trail with user identity, date, time, previous value, new value and reason. Reason: Annex 11 clause 9 expects a record of GMP-relevant changes with a documented reason, and clause 12.4 expects the identity of operators entering, changing, confirming or deleting data along with date and time.⁹
• A status change shall be capable of being applied at batch or lot level across every location at once, including material in transit, staged for picking, or already allocated to an open order. Reason: a recall or a quality hold that only reaches the pallets nobody is touching is not a hold.
• The system shall record and report blocked transaction attempts. Reason: an attempt to pick a quarantined lot is a signal about training or process, and it is also the evidence that the control is working when an inspector asks you to demonstrate it.

Temperature Excursions and the Pallets They Touched

Almost every pharma warehouse has continuous temperature monitoring. Very few have a system that connects an excursion to the specific pallets that were exposed to it and holds them automatically. The monitoring system and the warehouse system are usually bought separately, from different vendors, in different years, and the link between them is a person reading an alarm email and deciding what to do.

That person is doing the hardest part of the job by hand. To act on an excursion they need to know which locations were affected, which license plates or pallets were in those locations for the duration, what lots were on those pallets, whether any of those lots have already been picked, shipped or consumed, and whether the product concerned has a defined excursion tolerance. In a warehouse of any size, reconstructing that from a monitoring report and an inventory extract takes hours. During those hours, product keeps moving.

What the regulations require

21 CFR 211.142 requires storage of drug products under appropriate conditions of temperature, humidity and light so that identity, strength, quality and purity are not affected.⁴ EU GMP Chapter 3 paragraph 3.19 requires storage areas to be maintained within acceptable temperature limits, and where special storage conditions are required, that those be provided, checked and monitored.¹ The EU good distribution practice guidelines add the mapping requirement: an initial temperature mapping exercise should be carried out under representative conditions, and temperature monitoring equipment should be located according to the results of that mapping.³

MHRA’s inspectorate has written plainly about how that works in practice. Mapping data should be recorded and risk assessed to determine the most appropriate positions for the permanent monitoring probes, and those positions should cover the areas with the widest temperature fluctuations. Mapping should be done before stock is stored where possible, repeated to cover seasonal variation, and repeated if the storage area is later reconfigured.¹⁴ The WHO technical supplement on temperature mapping of storage areas gives the same structure and places the initial mapping inside installation and operational qualification.¹³

Requirements to write down

• The system shall hold a maintained relationship between each monitoring sensor and the storage locations it represents, derived from the qualification mapping study and placed under change control. Reason: without it, an excursion cannot be resolved into affected inventory. Reason for the change control: Annex 15 paragraph 3.2 makes the user requirements specification a reference point throughout the validation life cycle, and remapping after reconfiguration is expected.¹⁰¹⁴
• An excursion event shall generate a list of every pallet and lot present in the affected locations for any part of the excursion window, including material that has since moved. Reason: exposure is a property of where the material was, not where it is now.
• Affected inventory shall be placed on quality hold automatically, pending disposition, with a manual override restricted to quality and fully recorded. Reason: the time between alarm and hold is the window in which exposed product ships.
• Where affected material has already been shipped or consumed, the system shall produce the downstream trace to customer, order and batch. Reason: 21 CFR 211.150 requires a system by which the distribution of each lot can be readily determined to facilitate recall.⁵
• The excursion record shall link to the deviation record and shall not permit release of the held inventory until the linked record reaches an approved disposition. Reason: this is where the audit trail of the decision is recorded, and a hold that can be lifted independently of the investigation is not a control.
• Cumulative exposure shall be tracked per lot, not per event, where the product has a stated mean kinetic temperature or cumulative excursion allowance. Reason: three excursions that each pass individually may fail together.

FEFO, FIFO, Expiry Dates and Retest Dates

Stock rotation is where the generic template comes closest to being right, and then misses on the detail that matters most.

Every warehouse product supports first in, first out. US CGMP requires it explicitly for components, containers and closures: they shall be rotated so that the oldest approved stock is used first, with deviation permitted if temporary and appropriate.⁶ The same rule appears for finished product distribution at 21 CFR 211.150, which requires a procedure whereby the oldest approved stock of a drug product is distributed first.⁵ ICH Q7 paragraph 7.42 says materials should normally be controlled so that the oldest stock is used first.⁸

The EU good distribution practice guidelines require something different. Section 5.5 says stock should be rotated according to the first expiry, first out principle.³ Oldest received and first to expire are not the same lot. They diverge whenever a supplier ships a lot with a shorter remaining shelf life than something already in the rack, which happens routinely with imported material, with reworked batches, and with anything that has sat in a distributor’s warehouse before reaching you.

The word “approved” is not decoration

Note the phrasing in both US regulations: the oldest approved stock. A FIFO or FEFO strategy that sorts on receipt date or expiry date alone, without filtering on status first, will happily allocate a quarantined lot because it is the oldest one. The picking strategy has to be status-aware before it is date-aware. This sounds obvious written down. It is a genuinely common configuration defect, because the allocation engine and the status field are configured by different people in different workshops.

Retest dates behave differently from expiry dates

This is the requirement that generic templates almost never handle, because outside pharma and chemicals it does not exist. An expiry date is terminal. A retest date is not. EU GMP Chapter 5 paragraph 5.34 says only starting materials released by quality control and within their retest period should be used.² Paragraph 5.32 says the storage label should carry, where appropriate, an expiry date or a date beyond which retesting is necessary.²

US CGMP takes the same position from the other direction. 21 CFR 211.87 requires components, containers and closures to be retested or reexamined, as appropriate, for identity, strength, quality and purity, and approved or rejected by the quality control unit, after storage for long periods or after exposure to air, heat or other conditions that might adversely affect them.⁷ ICH Q7 paragraph 7.50 requires re-evaluation as appropriate to determine continued suitability for use, giving prolonged storage or exposure to heat or humidity as the triggers.⁸

Requirements to write down

• The system shall support FEFO allocation as the default for finished product, with FIFO available where the material has no expiry date. Reason: EU GDP section 5.5.³
• Allocation shall filter on released status before applying any date-based sort. Reason: 21 CFR 211.86 and 211.150 both specify the oldest approved stock.⁵⁶
• Any deviation from the rotation rule shall require a recorded reason and shall be reportable. Reason: both US regulations permit deviation only if it is temporary and appropriate, which means you have to be able to show how often it happens and why.⁵⁶
• The system shall hold expiry date and retest date as separate fields with separate behavior, and shall support extension of a retest date by quality following a successful retest, with full audit trail. Reason: Chapter 5 paragraph 5.34 and 21 CFR 211.87.²⁷
• Approaching expiry and approaching retest shall generate separate work queues at configurable lead times. Reason: EU GDP section 5.5 expects product nearing expiry to be withdrawn immediately from saleable stock; you cannot act immediately on something you learn about on the day.³
• Expired material shall move to a controlled population with reconciliation until the destruction record is complete. Reason: expired stock that simply disappears from the system is an inventory difference nobody can explain during an inspection.
• Order allocation shall support a minimum remaining shelf life rule by customer or by market. Reason: this is a commercial commitment that the warehouse has to keep, and enforcing it in a spreadsheet is how short-dated product reaches a customer.

Sampling Areas, Reference Samples and Retention Samples

Sampling is where the warehouse and the laboratory share physical space and share nothing else. It is also an area with a live regulatory change.

EU GMP Chapter 3 paragraph 3.22 says there should normally be a separate sampling area for starting materials, and that where sampling is done in the storage area it should be conducted so as to prevent contamination and cross-contamination.¹ ICH Q7 paragraph 7.35 says containers from which samples have been withdrawn should be reclosed carefully and marked to indicate that a sample has been taken.⁸ EU GMP Chapter 5 paragraph 5.33 makes the same point about identifying bulk containers that have been sampled.²

Every one of those statements has an inventory consequence. Material moved to a sampling booth has left its storage location but has not left quarantine. A container that has been opened for sampling is not identical to an unopened one. The quantity withdrawn for the sample has to come out of the lot balance somewhere, and if it does not, the physical count and the system count diverge by a small amount on every single receipt, forever.

Reference and retention samples are inventory too

Reference and retention samples are held in a warehouse or a controlled store, they consume space under defined conditions, they have retention periods, and they have to be findable on demand. The EU treats them under Annex 19. The Commission adopted a revised Annex 19 on 23 June 2026 as C(2026) 4135 final, published it on 24 June 2026, and set it to come into operation three months from publication, which is 24 September 2026.¹¹¹² The stated reason for the revision is guidance on reference and retention samples for parallel imported, parallel distributed and parallel traded products, recommended jointly by the GMP/GDP Inspectors Working Group and the PIC/S Committee.¹¹

Those three retention rules do not share a clock. One counts from a product expiry date, one counts from a finished product release event, and one counts from a shelf life. A sample store managed on a spreadsheet will get one of them wrong, and the failure mode is destroying a sample early, which cannot be corrected.

Requirements to write down

• Sampling locations shall be modeled as distinct storage locations that are not saleable or issuable, and material in them shall retain its quarantine or on-test status. Reason: EU GMP Chapter 3 paragraph 3.22 expects a separate sampling area with controls against cross-contamination.¹
• Sample withdrawal shall decrement the lot balance and record the quantity, the sampler and the purpose. Reason: without it the book-to-physical difference grows on every receipt and nobody sees it happen.
• A container that has been opened for sampling shall be flagged at container level, not only at lot level. Reason: ICH Q7 paragraph 7.35 and EU GMP Chapter 5 paragraph 5.33 both require sampled containers to be identified as such.²⁸
• Reference and retention samples shall be held in dedicated locations with their own storage condition monitoring and their own access control. Reason: Annex 19 section 5 ties storage conditions to the marketing authorization, and section 2.4 requires traceability records available to competent authorities.¹¹
• The system shall calculate a destruction eligibility date per sample type using the correct clock, and shall block destruction before that date. Reason: the three retention rules in Annex 19 sections 3.1 and 3.2 run from different events.¹¹
• Sample records shall be retrievable by batch, by product, by market and by date range within a working session. Reason: samples are pulled during complaint investigations and inspections, which are both time-boxed.

Returns, Damaged Goods and Recall Holds

A return in a consumer goods warehouse is a reversal. A return in a GxP warehouse is a decision, and the default answer is no.

EU GMP Chapter 3 paragraph 3.23 requires segregated areas for the storage of rejected, recalled or returned materials or products.¹ The EU good distribution practice guidelines are more specific about the decision. Product returned to saleable stock has to satisfy conditions that include the secondary packaging being unopened and undamaged and the product not being expired or recalled, a return within an acceptable time window for returns from non-wholesale customers, documented evidence that the product was transported, stored and handled in line with its requirements, and examination and approval by suitably trained and authorized personnel, with evidence that the distributor supplied the product originally and no suspicion of falsification.³ Products returned to saleable stock must also be placed so that the first expiry, first out system continues to operate correctly.³

In the US supply chain there is an additional identifier-level requirement. Under the Drug Supply Chain Security Act, wholesale distributors have a verification obligation for saleable returned product. FDA issued a compliance policy guidance on this, revised in September 2023, which extended the previously announced enforcement discretion for the requirement from 27 November 2023 to 27 November 2024.¹⁸ Any distributor or manufacturer handling returns into the US supply chain needs the warehouse system to support product identifier verification as a gate on the return decision, not as a report produced afterward.

Damaged goods and the receiving dock

EU GMP Chapter 5 paragraph 5.4 requires that damage to containers, and any other problem that might adversely affect the quality of a material, be investigated, recorded and reported to quality control.² Paragraph 5.30 requires that for each delivery of starting material the containers be checked for package integrity, including tamper evident seals where relevant, and for correspondence between the delivery note, the purchase order, the supplier’s labels and the approved manufacturer and supplier information, with the receiving checks documented.²

That is a structured receiving inspection, and it produces a record. Most warehouse templates capture damage as a free-text exception on a receipt line. That is not enough to satisfy a paragraph that requires investigation and reporting to quality control.

Requirements to write down

• Returns shall be received into a dedicated returns location in a returns status and shall not enter saleable stock without a recorded disposition. Reason: EU GMP Chapter 3 paragraph 3.23 and EU GDP section 6.3.¹³
• The return disposition screen shall require an explicit answer to each GDP condition for restocking, and shall record the answers, the evidence reference and the approver. Reason: EU GDP section 6.3 makes restocking conditional, and an unrecorded condition check is not a check.³
• Where product identifier verification applies, the system shall verify before permitting restock. Reason: the DSCSA verification requirement for saleable returned product, addressed in FDA’s compliance policy guidance.¹⁸
• Restocked returns shall re-enter the FEFO sequence on their own expiry date, not on the return date. Reason: EU GDP section 6.3 requires the FEFO system to keep operating effectively for returned product.³
• Receiving shall capture a structured damage and integrity inspection result, including seal integrity and document correspondence, and shall raise a quality notification on failure. Reason: EU GMP Chapter 5 paragraphs 5.4 and 5.30.²
• A recall shall apply as a single action across every location and every open transaction for the batch, including allocated, staged and in-transit inventory, and shall produce a reconciliation of quantity dispatched against quantity recovered. Reason: 21 CFR 211.150 requires that lot distribution be readily determinable to facilitate recall, and ICH Q7 paragraph 10.24 requires the same for APIs.⁵⁸

Recall data has requirements of its own that go beyond warehouse configuration, and this batch covers them separately in the article on recall readiness data. Here the relevant point is narrower: whatever the recall process needs, the warehouse system has to be able to freeze a batch everywhere in one action.

Cold Chain, Controlled Substances and Other Segregated Populations

Beyond status, a GxP warehouse has to segregate populations of material for reasons that have nothing to do with quality disposition. A generic template handles this with zones and picking restrictions. That works until two segregation rules conflict, at which point somebody has to decide which one wins, and the system needs to know.

Cold chain

The design requirement here is less about the refrigeration and more about the gaps in it. A cold room is monitored. A refrigerated truck is monitored. The dock between them frequently is not, and the time a pallet spends staged for shipment is where cumulative exposure builds. EU GMP Chapter 3 paragraph 3.20 requires receiving and dispatch bays to protect materials and products from the weather.¹ The EU good distribution practice guidelines require premises designed or adapted so that required storage conditions are maintained.³

The practical requirement is a maximum permitted time out of refrigeration, enforced by the system, per lot, cumulative. That means the staging transaction has to start a clock and the loading transaction has to stop it, and the difference has to accumulate against the lot record rather than resetting each time.

Controlled substances

Controlled substances add a second, separate compliance regime with its own physical requirements. In the US, DEA regulations at 21 CFR 1301.72 set physical security controls for storage areas used by non-practitioners, including construction standards for vaults and for cages, and alarm requirements.¹⁷ The EU good distribution practice guidelines require that products requiring special storage conditions and special authorizations, such as narcotic and psychotropic substances, be stored in dedicated areas.³

The warehouse system implications are specific and they are usually treated as an afterthought: a location model that reflects the secure area, a running balance that reconciles to the physical count on a defined cycle, transactions that require a witness, and reporting that supports the schedule-specific record keeping obligations. None of that arrives with a generic template.

Highly active and hazardous material

EU GMP Chapter 3 paragraph 3.24 requires highly active materials or products to be stored in safe and secure areas.¹ Paragraph 3.25 says printed packaging materials are critical to the conformity of the medicinal product and warrants special attention to their safe and secure storage.¹ Chapter 5 paragraph 5.46 adds that printed materials should be stored in adequately secure conditions excluding unauthorized access, that cut labels and loose printed materials should be stored and transported in separate closed containers, and that packaging materials should be issued for use only by authorized personnel following an approved documented procedure.²

Printed packaging is the population most often forgotten in a warehouse scope, because it looks like low-value consumable stock. It is the material most likely to cause a mix-up that reaches a patient, and it is the material with the tightest issuance controls in the entire guideline.

Requirements to write down

• The system shall enforce a cumulative time-out-of-refrigeration limit per lot, accumulated across staging, loading and any other excursion from controlled storage, with a block on shipment when the limit is reached. Reason: exposure is cumulative and the dock is where it accrues unmonitored.
• Controlled substance locations shall be modeled distinctly, with transaction-level witness capture and a reconciliation cycle independent of general cycle counting. Reason: 21 CFR 1301.72 sets separate physical security expectations for these storage areas, and the record keeping obligations fall outside the GMP framework.¹⁷
• Printed packaging material shall be issued only against an authorized, documented request, with quantity reconciliation on return. Reason: EU GMP Chapter 5 paragraph 5.46 and Chapter 3 paragraph 3.25.¹²
• Where two segregation rules apply to the same material, the system shall apply the more restrictive one and record which rule governed. Reason: a cold chain controlled substance is not a hypothetical, and an implicit precedence rule is a configuration nobody can explain two years later.
• Access to segregated locations shall be controlled in the system and reconciled against the physical access control list. Reason: EU GMP Chapter 3 paragraph 3.21 restricts access to quarantine areas to authorized personnel, and Annex 11 clause 12.1 expects physical or logical controls restricting system access to authorized persons.¹⁹

Handheld Scanners and Mobile Devices Under Part 11 and Annex 11

This is the area where the gap between a logistics scope and a GxP scope is widest, and where the answer most often given in a scoping workshop is that it has already been handled because the warehouse application is validated.

The application being validated does not settle the question. The question is whether the transaction a warehouse operator creates by scanning a barcode is a GxP record, who the system believes created it, and what happens to it when the device loses connectivity. Once a status change, a pick confirmation or a temperature-controlled move is recorded electronically and relied on for a GMP decision, it is a regulated record and the controls apply to it.

Who is logged in

Warehouse operations run on shared devices. A handheld comes off a charging rack at shift start and goes back at shift end. In many implementations the device is logged in once and used by whoever picks it up. That practice is directly at odds with the requirements.

Annex 11 clause 12.4 expects management systems for data and documents to be designed to record the identity of operators entering, changing, confirming or deleting data, including date and time.⁹ Clause 12.1 expects physical or logical controls restricting access to authorized persons, listing keys, pass cards, personal codes with passwords and biometrics as suitable methods.⁹ On the US side, 21 CFR 11.300 requires maintaining the uniqueness of each combined identification code and password so that no two individuals have the same combination, periodic checking and revision of code and password issuance, loss management procedures to electronically deauthorize lost, stolen, missing or otherwise potentially compromised tokens, cards and other devices, transaction safeguards to prevent unauthorized use of passwords or identification codes and to detect and report unauthorized attempts, and initial and periodic testing of devices that bear or generate identification code or password information.¹⁶

Read 11.300(c) again with a warehouse in mind. A handheld scanner left in a truck overnight is a device that bears identification code information, and there is a stated obligation to be able to deauthorize it.

Is a scan an electronic record

Not every scan is. A scan used to navigate to a screen is not a record. A scan that confirms the operator picked lot X from location Y at time T is. The distinction that matters for the URS is which scanned transactions become part of the batch record, the distribution record or the quality decision, because those are the ones that need the full set of controls.

Annex 11 clause 6 gives a useful rule for the ones in between. For critical data entered manually, there should be an additional check on accuracy, which may be done by a second operator or by validated electronic means, with the criticality and the consequences of erroneous entry covered by risk management.⁹ A barcode scan is a strong candidate for that validated electronic means, which is one of the better arguments for scanning rather than keying. It only holds if the scan is verified against expected values rather than simply accepted.

What happens offline

This is the requirement that almost never appears in a generic template and almost always appears in a real warehouse. Coverage drops in a freezer, on a mezzanine, in a steel racking aisle, at the far end of a yard. The device buffers transactions locally and syncs when it reconnects. Three questions follow, and all three belong in the URS.

First, what timestamp does the transaction carry: the time it was captured on the device, or the time it reached the server? For a temperature excursion analysis, a picking sequence or an investigation timeline, that difference is material. Second, what happens if a transaction becomes invalid between capture and sync, because the lot was placed on hold in the interim? Third, what happens to buffered transactions on a device that is never reconnected, because it was dropped, lost or wiped?

Annex 11 clause 16 requires that for computerized systems supporting critical processes, provisions be made to ensure continuity of support in the event of a system breakdown, that the time required to bring alternative arrangements into use be based on risk, and that those arrangements be documented and tested.⁹ Clause 4.8 adds that if data are transferred to another data format or system, validation should include checks that data are not altered in value or meaning during migration.⁹ A device buffer syncing to a server is a data transfer, and the same reasoning applies.

Requirements to write down

• Every GxP-relevant mobile transaction shall be attributable to a named individual, not to a device, a shift or a generic warehouse account. Reason: Annex 11 clause 12.4 and 21 CFR 11.300(a).⁹¹⁶
• The system shall support a re-authentication interval and shall require re-authentication for quality-relevant transactions, including status changes and release confirmations. Reason: session length is the mechanism by which shared-device attribution fails.
• Lost or compromised devices and credentials shall be deauthorizable centrally and immediately. Reason: 21 CFR 11.300(c).¹⁶
• The URS shall list which scanned transactions are GxP records and shall state, for each, the retention period and the audit trail expectation. Reason: this list is the scope boundary for the validation, and if it is not written down it will be argued about during qualification.
• Offline transactions shall carry the device capture timestamp and the server receipt timestamp as separate recorded values. Reason: Annex 11 clause 4.8 expects data not to be altered in value or meaning during transfer, and a single timestamp forces a choice that loses information.⁹
• Offline transactions that conflict with server state on sync shall be quarantined for review, not auto-applied and not discarded without a record. Reason: a pick confirmation for a lot that went on hold ten minutes ago is exactly the event the hold existed to prevent.
• The system shall report unsynced device buffers by device and by age. Reason: you cannot investigate a discrepancy caused by a transaction you do not know exists.
• A documented and tested alternative arrangement shall exist for warehouse operation during system unavailability, including how paper records created during the outage are reconciled back into the system. Reason: Annex 11 clause 16.⁹

The wider question of which systems in a facility carry GMP functionality, and how that list is maintained, belongs to the computerized system inventory required by Annex 11 clause 4.3. This batch covers that separately. For the purposes of a warehouse URS, the point to carry forward is that handhelds, label printers and the middleware between them are part of the system boundary and should appear in the inventory alongside the warehouse application itself.

Taking the List Into a URS Review

A requirements list is only useful if it survives the project plan. Annex 15 paragraph 3.1 says qualification activities should consider all stages from initial development of the user requirements specification through to the end of use of the system.¹⁰ Paragraph 3.2 says the specification should be defined in a URS or functional specification, that the essential elements of quality need to be built in at this stage with GMP risks mitigated to an acceptable level, and that the URS should be a point of reference throughout the validation life cycle.¹⁰ Paragraph 3.3 says design qualification is where compliance of the design with GMP is demonstrated and documented, and where the URS requirements are verified.¹⁰

Annex 11 clause 4.4 makes the same point from the computerized systems side: user requirements specifications should describe the required functions, should be based on documented risk assessment and GMP impact, and user requirements should be traceable throughout the life cycle.⁹

Traceable throughout the life cycle is the operative phrase. A requirement that is not written down at URS stage cannot be traced, cannot be tested at design qualification, and will not appear in the traceability matrix an inspector asks to see. Adding it later means a change control against a document that has already been approved, which is why late quality requirements have a reputation for being expensive.

A short review checklist

If a QA reviewer has one hour with a draft URS and needs to find the gaps that matter, these questions surface most of them.

Conclusion

The pattern across all eight areas is the same. Regulators do not require a physical cage, a paper label or a manual check. They require control, and they explicitly allow a system to provide it. EU GMP Chapter 3 permits a system to replace physical quarantine if it gives equivalent security. Chapter 5 permits status to live in a computerized system rather than on a label. The good distribution practice guidelines permit electronic segregation in place of physical segregation. ICH Q7 permits an alternative system in place of separate storage areas. In every case the permission is conditional on the system actually doing the job, which is why the requirement to write into a URS is never “the system shall support” and always “the system shall prevent.”

The reason these requirements get missed is not that they are hard. It is that they are invisible to the people who normally scope a warehouse. A logistics template is an excellent starting point for eighty percent of the build, and the remaining twenty percent is where the regulatory obligation is. The intervention that works is early and cheap: quality in the room when the inventory model is drawn, a status and transaction matrix written before the requirements, and every requirement carrying its own regulatory basis so it survives the descoping conversation that always comes.

Sakara Digital works with pharma and biotech organizations scoping and validating the systems that carry GxP obligations, including warehouse, distribution and serialization platforms bought from outside the life sciences market. If you are heading into a warehouse selection or a URS review and want an independent read on how the regulatory requirements compare with the vendor’s template, we are happy to have that conversation.

For Further Reading