Recall Readiness: The Data You Need in the First Four Hours

The Four-Hour Standard Is Ours, Not the Regulator’s

Let us be plain about this before anything else. There is no regulation anywhere that gives a pharmaceutical company four hours to assemble recall data. FDA does not set one. The EU GMP guide does not set one. The MHRA does not set one. If you go looking for the four-hour rule, you will not find it, and you should be suspicious of anyone who tells you otherwise.

Four hours is a readiness target this article proposes, and the reason to propose it is arithmetic rather than regulation. Look at what the regulations do say about speed. EU GMP Chapter 8 states that recall operations should be capable of being initiated promptly and at any time, and adds that in certain cases recall operations may need to be initiated before the root cause and the full extent of the quality defect have been established.¹⁰ That second half is the part people skip. The guide contemplates a decision made on incomplete information, which means the information you do have has to be in front of the decision-makers fast.

Then look at the notification clocks that follow the decision. Once a national competent authority in the EU acts on a Class I recall, transmission of the rapid alert to the rest of the network must be concurrent with the national action and in all cases within 24 hours of the national notification.¹¹ In the United States, an applicant holding an approved NDA or ANDA must submit a Field Alert Report within three working days of receiving information about a significant chemical, physical, or other change or deterioration in a distributed drug product, or a failure of a distributed batch to meet specifications.¹⁴ The MHRA’s Defective Medicines Report Centre runs a 24-hour service and expects a license holder to notify immediately on becoming aware of a defect that could result in a recall.¹²

Set those clocks against a normal Monday. A complaint arrives at 9am. The quality unit needs to decide whether this is a defect that could result in a recall. To decide, it needs to know the extent: how many batches, where they went, whether anything similar has been reported before, and whether the affected component appears in other finished lots. If assembling that picture takes a day, the notification decision is made on Tuesday, the regulator conversation happens Tuesday afternoon, and the recall communication goes out Wednesday. Product has been in the market three extra days, and none of that delay came from the decision itself. It came from retrieval.

Why Companies With a Recall SOP Still Lose a Day

The recall SOP is usually a good document. It names the recall committee. It defines classification criteria. It sets out who signs, who calls the agency, who drafts the customer letter, and how the effectiveness checks get logged. It has been reviewed, approved, trained, and audited. And it still does not prevent the lost day, because of four specific gaps that show up again and again.

There is a fifth pattern worth naming separately, because it is less about systems and more about how quality organizations spend their attention. Where a site carries a large open deviation and investigation backlog, the records that would tell you whether a defect was already known are buried in that backlog rather than trended. The signal exists. It is just not visible in a form anyone can act on inside four hours. That is a separate subject with its own remedies, and it is covered elsewhere in this series, but it is worth flagging here because a recall decision made without checking the backlog is a recall decision made on partial information.

Similarly, the specific case where the defect originates in labeling or artwork data, and the case where serialization data lets you narrow a recall to specific serial number ranges rather than whole lots, are each covered separately in this series. This article stays on the general question: what data does a recall decision need, and can you get it.

The Data a Recall Decision Needs

Start from the questions rather than the systems. Within the first four hours, a recall decision needs answers to nine questions, and each answer comes from a different place.

Lot and batch genealogy, backward and forward

Backward genealogy is the question most systems answer well. Take a finished lot, walk back through the bulk lot, the intermediates, the active ingredient lot, and the excipient and packaging component lots. Most manufacturing execution systems do this because it is what batch record review needs.

Forward genealogy is the question that decides the size of your recall, and it is the question systems answer badly. If the defect is traced to a single excipient lot, the recall is not one finished lot. It is every finished lot that consumed any part of that excipient lot, across every product and every packaging configuration. EU GMP Chapter 8 is explicit about this expectation: if a quality defect is discovered or suspected in a batch, consideration should be given to checking other batches and in some cases other products, and in particular other batches which may contain portions of the defective batch or defective components should be investigated.¹⁰

The practical failure is that forward genealogy is frequently possible but not productized. Someone can write the query. Nobody has written it in advance, validated the output, or documented who runs it. Under time pressure, an unfamiliar query written by a stressed analyst is a data integrity risk as well as a delay. The fix is unglamorous: build the report once, qualify it, document how to run it, and run it during every mock recall so its output stays trusted.

Biologics and cell therapy products add a layer, because the genealogy extends back into cell banks and, for autologous products, forward and backward to an identified patient. Those chains have their own retrieval characteristics and are worth treating as a distinct design problem.

Distribution records to the consignee level, and how far visibility reaches

US requirements here are specific and often underread. 21 CFR 211.150 requires written distribution procedures that include a system by which the distribution of each lot of drug product can be readily determined to facilitate its recall if necessary.⁵ 21 CFR 211.196 requires that distribution records contain the name and strength of the product and description of the dosage form, name and address of the consignee, date and quantity shipped, and lot or control number.⁶ FDA’s recall guidance adds practical detail: distribution records should identify the direct accounts that received the recalled product by name, physical address where the product was delivered, and a contact telephone number.¹

Read those three together and a gap appears in most ERP configurations. The ERP holds the sold-to party, which is a commercial entity. The regulation is interested in where the product physically went. When a distributor with one billing entity operates eleven warehouses, the sold-to record answers the wrong question. The recall extract needs the ship-to location, and it needs it as a physical address, not a customer code.

The harder honesty is about depth. Your own records reach your direct accounts. Beyond that, you are dependent on the distributor’s records and the distributor’s willingness to cascade. FDA’s guidance says that any direct accounts that further distribute the product should maintain records of their own direct accounts so that the recalling firm’s instructions are extended to all consignees in the chain.¹ The EU good distribution practice guidelines place the equivalent duty on wholesale distributors, with the responsible person accountable for coordinating and promptly performing recall operations.¹³ That is the right allocation of responsibility. It is also a dependency, and dependencies should be tested rather than assumed. If your mock recall stops at your own direct accounts, you have tested the part you control and none of the part you do not.

Complaint and adverse event linkage to the affected lots

21 CFR 211.198 requires written procedures for handling written and oral complaints, review by the quality unit of any complaint involving a possible failure to meet specifications, and a written record that includes, where known, the name and strength of the drug product, the lot number, the name of the complainant, the nature of the complaint, and the reply.⁷ EU GMP Chapter 8 requires that quality defect investigations include a review of previous quality defect reports or any other relevant information for indications of specific or recurring problems.¹⁰

Both requirements assume you can query complaints by lot. Many companies cannot, reliably, because the lot field is optional, free text, or populated from what a caller read off a carton. A complaint recorded as “lot 4471A” and a batch recorded as “04471-A” do not join. The consequence during a recall is that the “have we seen this before” question is answered by a person reading titles rather than by a query, and reading takes hours and misses things.

The fix is boring and effective: make lot number a controlled field with validation against the actual lot master, allow an explicit “not provided” value rather than free text, and run a monthly completeness report. This is one of the highest-return data quality changes available in a quality management system, and it pays out precisely when it matters most.

Adverse event linkage runs through the safety database rather than the quality system, and the two are usually separate. The link between a case and a manufacturing lot frequently exists only where the reporter supplied it. Setting the expectation with the safety group that lot capture matters for quality reasons, not only for pharmacovigilance reasons, is a conversation worth having before you need the data.

Retained and reserve sample locations

21 CFR 211.170 requires reserve samples of each active ingredient lot and each finished drug product lot, in the marketed container and closure system or one with essentially the same characteristics, retained for defined periods and examined visually at least once a year for evidence of deterioration.⁸ EU GMP Chapter 8 states that checking or testing reference and retention samples should be considered as part of determining the extent of a quality defect.¹⁰

The recall question is not whether the samples exist. It is whether you can locate and retrieve them within hours. Reserve sample inventory is frequently tracked in a spreadsheet outside the validated systems, with location recorded as a room or a shelf rather than a position. When the sample room holds several years of retains across dozens of products, the difference between “row 14, position 6” and “sample room B” is an afternoon.

A second and quieter problem is completeness. Where a lot was packaged in several configurations, the reserve sample may exist for one configuration only. If the defect is packaging-related, that gap changes what you can test. Reconciling reserve sample inventory against the lot master is a useful annual exercise regardless of recall readiness.

In-process and release testing records for the affected lots

Once the extent question is answered, the next question is whether the affected lots showed anything at the time. That means the certificate of analysis, the in-process results, any out-of-specification or atypical results and their investigations, and the release decision with its supporting rationale.

The retrieval problem here is fragmentation rather than absence. The certificate is in one place, the chromatographic raw data in another, the investigation record in the quality system, and the release approval in a workflow tool. Assembling the package is a series of small retrievals, each fast, adding up to something slow. The fix is a pre-defined lot data package with a named owner and a documented assembly path, tested during mock recalls. Companies that have built this find it useful far beyond recalls, because it is the same package an inspector asks for.

Equipment and line history for the period

21 CFR 211.182 requires written records of major equipment cleaning, maintenance, and use in individual equipment logs showing the date, time, product, and lot number of each batch processed.⁹ The regulation already asks for lot number in the log, which means the data model for the answer exists on paper.

What breaks is the direction of the query. Equipment logs are organized by equipment and by date. A recall asks the reverse question: for this lot, what else ran on that line before and after, and did anything happen to the equipment in that window. Where the logs are paper, answering that question means pulling binders. Where the logs are electronic but not indexed by lot, it means a date range query and manual matching.

This matters more than it appears, because line history is where cross-contamination and mix-up hypotheses are confirmed or eliminated. A recall that cannot eliminate the adjacent lots on the same line has to include them, and every lot added to a recall carries real financial and supply consequences.

Quantity reconciliation: produced, distributed, on hand, returned

EU GMP Chapter 8 requires that the progress of a recall be recorded until closure and a final report issued, including a reconciliation between the delivered and recovered quantities of the products and batches concerned.¹⁰ FDA’s recall status report expectations run in the same direction: number of consignees notified, number responding and quantity on hand, number of products returned or corrected by each consignee, and the quantity of products accounted for.³

Reconciliation is the arithmetic that closes a recall, and it is almost always the part nobody has practiced. Quantity produced comes from the batch record. Quantity distributed comes from the ERP. Quantity on hand comes from the warehouse system and from each consignee’s response. Quantity destroyed or returned comes from a mix of internal records and third-party certificates. The four numbers rarely reconcile without adjustment, and the adjustments have to be explainable.

Running the reconciliation during a mock recall, against a real historical lot, is the single most revealing exercise in this whole area. It surfaces sample issuance that never went through order management, stability pulls that were not deducted, and returns processed against the wrong lot. Those are all findable. They are just not findable in an afternoon while a recall is running.

Consignee contact data and its accuracy

EU GMP Chapter 8 sets a standard here that is easy to read past. Distribution records should be readily available to the persons responsible for recalls and should contain sufficient information on wholesalers and directly supplied customers, with addresses and telephone numbers for both inside and outside working hours, and batches and amounts delivered, including for exported products and medical samples.¹⁰

Out-of-hours contact numbers. That phrase alone is worth an audit. Most commercial customer masters hold a business number and an email address, both maintained for order-to-cash rather than for a Saturday night recall. The contact decays continuously as people change roles, and nobody notices because nothing depends on it until something does.

Recall contact data should be treated as a distinct controlled data set with a named owner and a refresh cycle, populated from but not identical to the commercial customer master. That framing also makes it easier to justify the maintenance effort, because it becomes a quality system obligation rather than a commercial nicety. The broader discipline of governing shared reference data across commercial and quality systems is a well-established practice, and recall contact data is one of its clearest applications.

The regulatory notification content itself

The last data set is the one that gets assembled last and delays everything. 21 CFR 7.46 sets out what a firm is asked to provide to FDA for a firm-initiated recall: the identity of the product, the reason for the removal or correction and the date and circumstances under which the deficiency was discovered, an evaluation of the risk, the total amount of product produced and the timespan of production, the total amount estimated to be in distribution channels, distribution information including the number of direct accounts and where necessary their identity, and a copy of the recall communication issued or proposed.⁴

The MHRA publishes an equivalent list. The Defective Medicines Report Centre states it will initially require, as a minimum, the dates of manufacture and release of the affected batches to the market, an impact assessment quantifying the number of batches affected with proposals for market action, the dates of manufacture and release of any admixed product closest to the complaint batch, batch sizes and pack size, the date of first and last distribution to the market, a review of complaint records for reports of similar defects, an estimate of stock still under the company’s control, and whether the same batch went to other countries.¹²

Country of destination deserves particular attention. EU rules require the marketing authorization holder to notify the competent authority of any defect that could result in a recall and, as far as possible, to indicate the countries of destination.¹² The rapid alert dissemination itself takes account of the countries effectively concerned by the batch distribution.¹¹ If your distribution extract reports customers but not markets, somebody is going to reconstruct the market list by hand while the alert waits.

What the Regulations Require, and Where the Real Clocks Are

Having proposed a four-hour target and been clear that it is ours, here is what the regulations oblige you to do. This section is deliberately narrow and citation-heavy, because the difference between a readiness target and a legal requirement is exactly the kind of thing that gets muddled in an internal presentation and then repeated as fact.

Three observations follow from reading that table as a whole.

First, the regulations describe a capability, not a duration. Chapter 8 says promptly and at any time. Part 7 says maintain records necessary to facilitate location. 211.150 says readily determined. None of them define a number of hours, which is why setting your own number is a reasonable act of management rather than an act of compliance theater. Just do not present it as theirs.

Second, the reconciliation obligation is explicit and often unpracticed. Clause 8.29 and 21 CFR 7.53 both require you to account for quantities. This is not a soft expectation. A recall that cannot reconcile is a recall that cannot be closed cleanly, and reconciliation failures are visible to inspectors long after the event.

Third, the mock recall expectation is in the guide. Clause 8.30 asks for periodic evaluation of recall arrangements, covering out-of-hours situations, with mock recalls to be considered, documented, and justified. FDA’s guidance makes a parallel recommendation, noting that firms anticipating complex recalls may want to consider additional preparatory steps such as mock recalls to verify recall readiness, and that a firm should consider establishing metrics appropriate to its recall plan.¹ Metrics appropriate to its recall plan is as close as any regulator comes to endorsing a target like four hours, and it leaves the number to you.

Designing a Mock Recall That Tests Data Retrieval

The common mock recall starts with a lot number and asks the team to trace it. That design tests the trace, which is the part that usually works. It does not test the harder question, which is whether you can get from an ambiguous signal to a defensible extent-of-impact picture without knowing in advance which records you will need.

There is useful evidence from an adjacent sector on what a well-designed exercise reveals. In spring 2026, FDA ran a series of traceability readiness tabletop exercises under the food traceability rule, asking participants to locate records for a specific product over a short defined date range and provide the information in an electronic sortable spreadsheet within 24 hours. FDA reported that most firms responded within the window and that proactive supply chain coordination, more than any particular technology, drove the strongest results, while some challenges remained with certain data elements.¹⁵ That is a food-sector exercise, not a pharma one, and the rule differs. The transferable finding is the one about coordination: the constraint is usually relationships and agreements across the chain rather than the software.

Here is a mock recall design that tests retrieval rather than the phone tree.

The Data Readiness Checklist

Use this as a standing assessment rather than a one-time exercise. Each item is answerable yes or no, and a no is a work item rather than a finding.

Identification and genealogy

• Can you identify a finished lot from the information a caller would realistically have: product, strength, pack, partial code, and approximate date?
• Is there a defined, documented report that produces backward genealogy for a finished lot, including active ingredient, excipient, and primary packaging component lots?
• Is there a defined, documented report that produces forward genealogy from a component lot to every finished lot that consumed it, across all products?
• Do both reports work for lots produced before your current system was implemented, and is the path to legacy records documented?

Distribution and consignees

• Does your distribution extract produce, for a given lot, the consignee name, the physical delivery address, a telephone number, the date, and the quantity, as 21 CFR 211.196 and FDA’s guidance describe?⁶¹
• Does it distinguish sold-to from ship-to, and does it report the market or country of destination?
• Does it include product issued outside normal order management: samples, clinical supply, named-patient supply, and inter-company transfers?
• Do you hold out-of-hours contact numbers for direct accounts, as EU GMP Chapter 8 clause 8.23 expects, and when were they last verified?¹⁰
• Do your distributor agreements state the window within which onward distribution lists must be provided, and has that window been tested?

Quality and safety signals

• Is lot number a controlled, validated field on the complaint record rather than free text?
• Can you produce, in one query, every complaint associated with a given lot and with the adjacent lots on the same line?
• Can the safety group produce adverse event cases associated with a given lot, and how long does that take?
• Is there a route to check whether a similar defect appears in the open deviation or investigation population, rather than only in closed and trended records?

Samples, testing, and equipment

• Can you locate reserve samples for a given lot to a specific physical position, and is the inventory held in a queryable system?
• Do reserve samples exist for every packaging configuration of the lot?
• Is there a defined lot data package covering certificate of analysis, in-process results, out-of-specification records, and the release decision?
• Can you query equipment use logs by lot as well as by date, and identify what else ran on the line in the surrounding window?

Reconciliation and notification

• Is there a standing reconciliation report covering quantity produced, distributed, on hand, at consignees, and returned or destroyed?
• Have the known differences been documented and explained, or are they discovered fresh each time?
• Do you hold a per-product notification pack listing markets, license numbers, competent authority contacts, and local partner obligations?
• Is the 21 CFR 7.46(a) data set and the MHRA minimum data set mapped to named source systems and reports, with an owner for each?⁴¹²

Governance

• Does the recall SOP name the source system and report for each data element, or only the accountable role?
• Are the recall reports treated as controlled reports with qualification evidence, or as ad hoc queries?
• Is there more than one person who can run each report, and do they hold the necessary system access outside business hours?
• Is the periodic evaluation of recall arrangements documented and justified, as clause 8.30 requires?¹⁰

What the Mock Recall Report Should Record

Most mock recall reports say that the exercise was conducted, that the team was convened, and that the trace was completed successfully. That report is evidence of an activity, not evidence of a capability. An inspector reading it learns that you do mock recalls. It learns nothing about whether you could execute a real one.

A report that carries weight records outcomes against a standard, and it records the failures. A mock recall with no findings is either a very mature program or a badly designed exercise, and after three consecutive clean reports the second explanation becomes more likely.

One caution on measurement. Do not let the four-hour number become the objective in itself. The purpose is a trustworthy picture, not a fast one. An exercise that produces the data set in three hours but cannot attribute half of it to a source system has failed, even though the clock says otherwise. Time and attribution have to be scored together, which is why the source attribution row above matters as much as the timing row.

Conclusion

Recall readiness is usually treated as a procedural problem and it is almost always a data problem. The procedure is written, approved, and trained. What is missing is the map from each question a recall decision asks to the system that answers it, the report that produces it, and the person who can run it at 7pm on a Friday. That map does not exist in most companies, and its absence is invisible until the day it matters, at which point it consumes the margin that the short regulatory clocks leave you.

The four-hour target is worth adopting precisely because it cannot be met by effort. It can only be met by design. Build the forward genealogy report and qualify it. Make lot number a controlled field on the complaint record. Define one distribution extract that produces physical addresses and out-of-hours numbers. Hold reserve sample inventory somewhere queryable. Build the reconciliation as a standing report and resolve its differences in peacetime. Then run a mock recall that starts from a signal rather than a lot number, run one out of hours, and write a report that records what failed. Do that four times a year and the capability becomes real, and the evidence that it is real becomes something you can hand to an inspector.

Sakara Digital works with pharma and biotech organizations on exactly this kind of problem: the point where a quality obligation depends on data that lives in four systems and belongs to nobody. If you are looking at your own recall arrangements and are not confident you could produce the notification data set inside a working morning, we are happy to have that conversation and to help you find out where the time goes.

For Further Reading