What is batch record review by exception, and do FDA and EU inspectors accept it?

1What review by exception means.

In a review by exception, the reviewer works from a report that brings forward the entries needing judgement, instead of reading every line of the batch record. PIC/S defines the tool behind it. An exception report is “a validated search tool that identifies and documents predetermined ‘abnormal’ data or actions, which requires further attention or investigation by the data reviewer”.¹

EMA describes exception reporting as a common way to focus the review of electronic data “such as (but not limited to) electronic batch records”. It highlights “one of the most critical elements of batch review, i.e. the exceptions”, and the depth of review of the full record “can vary based on the exceptions as well as the level of confidence and experience with a particular process”.² It changes how the review is done. The review itself, and the decision to release, stay where the regulations put them.³⁴

2What EU GMP and PIC/S say.

EMA’s GMP questions and answers put the question directly: “Is a risk-based review of electronic data acceptable?” The answer is “Yes. The principles of quality risk management may be applied during the review of electronic data and review by exception is permitted, when scientifically justified.” The automated system and its batch exception report must be tested and validated so that they meet business and GMP requirements.² Elsewhere EMA notes that keeping original data in a form the reviewer can search and query supports a risk-based review, using “validated audit trail ‘exception reports’ instead of an onerous line-by-line review”.²

EU GMP Chapter 4 already allows for this. Where “a validated process is continuously monitored and controlled”, automatically generated reports “may be limited to compliance summaries and exception/ out-of-specification (OOS) data reports”, and a footnote to its definition of certificates of analysis lets certification rest, in whole or in part, on real-time summaries and exception reports from batch-related process analytical technology, as the approved marketing authorisation provides.⁵ Annex 11 asks that records supporting batch release can be printed to show whether any data “has been changed since the original entry”, and that audit trails be regularly reviewed.⁶

PIC/S lists review by exception, focused on anomalous or unauthorised activity, among the ways to target audit trail review once a company has assessed which audit trails and entries matter. Systems whose permissions prevent changes to parameters or data “may negate the need to examine related audit trails in detail”. Critical audit trails are still reviewed with the other records of the operation before batch release.¹

In the EU a Qualified Person certifies each batch. Annex 16 accepts that the QP “will need to rely on the pharmaceutical quality system” and should have ongoing assurance that the reliance is well founded. The checks behind certification may be delegated to trained staff; certification itself stays with a QP.⁴

3What FDA requires.

Part 211 does not use the term, and nor does FDA’s 2018 data integrity guidance. What the regulation fixes is the outcome. All production and control records, including packaging and labelling, “shall be reviewed and approved by the quality control unit to determine compliance with all established, approved written procedures before a batch is released or distributed”, and any unexplained discrepancy is investigated.³ The quality unit reviews records “to assure that no errors have occurred or, if errors have occurred, that they have been fully investigated”.⁷

The rules do let automation carry checks. Under 211.68(b), the degree and frequency of checks on a computer system’s input and output depend on “the complexity and reliability” of the system. Since 2008, 211.68(c) has let automated equipment satisfy the requirement for one person to perform and another to check weighing, component addition, yield calculation, equipment cleaning logs and the significant steps of 211.188(b)(11), provided the equipment is used in conformity with that section and one person checks that it performed the operation properly.⁸

FDA compares audit trail review to “assessing cross-outs on paper”. The people responsible for record review should review the audit trails that capture changes to data as they review the rest of the record, and production and control records, “which includes audit trails”, must be reviewed and approved by the quality unit. Where a regulation sets the review frequency, as 211.22 does for data review before batch release, audit trail review follows it. FDA also treats each CGMP workflow on a computer system as an intended use to be validated.⁹ So an exception report can direct a US quality unit’s review, but the approval it gives under 211.192 covers the whole record.

4What makes it defensible.

PIC/S makes the last point explicitly for situations where routine data “is reviewed manually or by a validated ‘exception report’”.¹

An exception report covers the data in the system. ICH Q7 asks for deviation, investigation and out-of-specification reports to be reviewed as part of the batch record review before release, and under Annex 16 every investigation pertaining to the batch must be complete enough to support certification.¹⁰⁴

5How it runs in Seal.

In Seal’s electronic batch records, review by exception is a configured capability: changed data, failures, alarms, overrides, missing evidence, open samples and deviations are brought to QA as the batch runs, and every instruction, value and signature stays available. Each controlled value has a range and a configured response, and the original value and the system’s evaluation stay visible even when the process continues.

Neil, Seal’s AI agent, can prepare a batch for review: it checks execution, laboratory and quality evidence against your batch-review requirements and drafts a source-linked brief with missing evidence requested. In batch release, times, durations and limits are calculated in code rather than judged by the model. QA decides the disposition and, in the EU, a QP certifies; Neil does not release a batch or replace a signature.