The auditor is not asking for a dashboard. The request, stripped of polite phrasing, is to show everything that happened to the lot. In many plants the reply starts with folders, exports, and a manual stitch across systems that were never designed as one package. The audit retrieval gap is not “missing data.”
It is the inability to assemble, in workable time, a single attributable package of what occurred to an identified lot (materials, process, exceptions, controls, and changes) without reconstructing the crosswalk between systems and folders by hand. That is different from never having recorded anything. The records can sit in three systems and still fail the review.
This article uses two illustrative diagnostic models: fifteen minutes as a stress clock, and lot 2847 as an example identifier. They are not a legal deadline, not a real plant case, and not a WizeeMind SLA. They help locate where retrieval breaks. In the EU food framework, Regulation (EC) 178/2002 (identifier CELEX:32002R0178) sets a chain minimum; in GxP settings, guides such as MHRA and Annex 11 speak to availability, completeness, and access during retention.
Do not mix scopes: 178/2002 is food law; Annex 11 is GMP; U.S. CFR appears only as contrast. WizeeMind can prepare or retrieve evidence and show gaps; it does not release lots, prove root cause, or stand in for the auditor. Applicable law, approved SOPs, and decisions by authorized personnel prevail.
The auditor’s question and the retrieval gap
Picture the meeting room. The auditor points to identifier 2847 (illustrative) and asks for the full trail. Someone opens MES. Someone else digs for the batch-record PDF. A third person tries to align historian alarms with an exception spreadsheet. The fifteen minutes of the diagnostic model pass, and the package still does not exist as one attributable unit. Daily capture is not necessarily what failed. Retrieval under pressure is.
MHRA’s GxP data-integrity guidance expects data to be readily available for review or inspection (MHRA GxP Data Integrity Guidance). “Readily available” does not quantify minutes. It does make clear that a file assembled only after hours of phone calls fails the test of availability. The same guidance states that raw data should permit full reconstruction of the activities (MHRA GxP Data Integrity Guidance). Reconstructing activities is not inventing a persuasive story.
It means being able to show what happened, who intervened, and what is missing.
In parallel, Regulation (EC) No 178/2002 defines traceability as the ability to trace and follow a food, feed, food-producing animal, or substance intended to be incorporated into food or feed through all stages of production, processing, and distribution (OJEU text via BOE). That definition anchors the vocabulary of “follow the trail.” It does not by itself turn a multi-system dossier in a chemical or pharmaceutical plant into a universal checklist.
If your plant is not a food business, the regulation does not bind you; it still shows why “traceability” and “recoverable audit package” get confused so easily.
The fifteen-minute model forces an operational question: is there a closed perimeter (identifier, time window, systems in scope) and an owner of the assembly, or does each function drop a fragment while nobody closes the package? The cost of searching for plant information explains the daily wear of that hunt. The focus here is narrower: retrieval under audit or inspection, not generic search productivity.
It is also not the quality-deviation investigation clock: that piece covers OOS investigation time; this one covers the lot package when someone asks for “everything.”
A common pattern: the batch record looks complete on paper or PDF, yet exceptions live in email, alarms sit in the historian, and recipe changes sit in another system. The auditor receives three partial stories. The gap appears when nobody can show, in workable time, that those pieces belong to the same illustrative 2847 and that gaps are declared.
WizeeMind can help gather material and flag holes; it does not turn fifteen minutes into a commercial promise or a regulatory deadline. The EUR-Lex CELEX entry for 178/2002 keeps the legal identity of the food-law text separate from whatever local folder culture your plant still runs.
What counts as recoverable complete traceability
“Complete” on the plant floor does not mean “infinite.” It means the package can reconstruct what happened to the identified lot inside the agreed perimeter, with gaps stated explicitly. MHRA requires a complete set of data and expects raw data to support full reconstruction of activities (MHRA GxP Data Integrity Guidance). Data completeness is not automatically a release report or a closed root cause.
As a U.S. documentary contrast (not automatic Spanish or EU law), 21 CFR 211.188 requires batch production and control records with complete information relating to the production and control of each batch, including an accurate reproduction of the appropriate master record and documentation of each significant step (21 CFR 211.188). In ES/EU contexts, EU GMP and local rules prevail; CFR only helps show what “complete batch information” implies in another frame.
A recoverable lot package usually follows a bounded sequence: fix the identifier and time perimeter; gather material and process records; attach exceptions, alarms, and interventions; keep authorship and change metadata; mark explicit gaps before handing the package to the authorized person. That sequence is operational. In GMP scopes, Annex 11 requires access during retention and the ability to restore data; an intelligible audit trail strengthens reconstruction of relevant changes.
Outside GMP, an “attributable and recoverable package” remains useful plant discipline without pretending Annex 11 binds every industry.
Here the food-chain minimum meets its boundary. Article 18.1 of Regulation (EC) 178/2002 requires ensuring the traceability of food, feed, food-producing animals, and substances intended to be incorporated into them at all stages of production, processing, and distribution (OJEU text via BOE).
Food and feed business operators must be able to identify any person from whom they have been supplied with a food, feed, food-producing animal, or relevant substance, and have systems and procedures to make that information available to the competent authorities on request (OJEU text via BOE). They must also identify the businesses to which they have supplied their products and make that information available on request (OJEU text via BOE).
The European Commission summarizes that the General Food Law requires businesses to identify at least the immediate supplier of the product and the immediate subsequent recipient (with the exception of retailers toward the final consumer), under the “one step back-one step forward” model, unless more demanding sector rules apply (Food law general requirements).
In the EU food frame, Regulation (EC) 178/2002 defines traceability as the ability to trace and follow through all stages, and requires identifying at least the immediate supplier and immediate customer (“one step back / one step forward”), without turning that minimum by itself into a full plant dossier.
That distinction prevents an expensive mistake: meeting the chain minimum and believing you already own the internal audit package. The minimum answers “who supplied / who received.” The plant dossier answers “what happened inside”: dosed materials, executed steps, alarms, interventions, control results, recipe or equipment changes, and who signed what. When the auditor asks for “everything about the lot,” the request usually sits in the second domain. State the perimeter.
If you can only prove supplier and customer, say so; do not invent process continuity.
Where the package breaks
The package breaks in prosaic places. First is identity: MES uses one lot code, LIMS another alias, the historian tags by manufacturing order, and the batch-record PDF carries a third “almost the same” identifier. Without a governed map between IDs, the crosswalk is human judgment. Second is time: different time zones, unreconciled clocks, events at different levels of precision. An alarm at 14:02 on the server and an intervention at 14:00 local can invert the apparent sequence.
Third is perimeter: materials yes, exceptions no; process yes, recipe changes in a separate folder.
When SCADA, historian, MES, and ERP do not share an operational language, someone becomes the translator. The article on SCADA, historian, MES, and ERP without communication explains why the layers fail to talk. The effect here is direct: without a usable join, the lot package does not assemble in workable time.
According to NIST IR 8107 (Yan Lu, KC Morris, and Simon Frechette, Systems Integration Division), the ability of disparate systems to exchange, understand, and exploit product, production, and business data rests critically on information standards (NIST IR 8107; NIST page). Without that exchange, the “lot story” is invented by whoever can paste screenshots.
Excel often shows up as a symptom, not the sole cause. An intermediate workbook may be the only place where someone reconciled IDs. The Excel trap in production covers governance; here it is enough to say that retrieval that depends on a personal workbook is fragile under audit. ISA-88 supplies batch vocabulary (recipe, equipment, execution) so conceptual layers are not mixed (ISA-88).
It is not an error catalog; if you need recurring batch-automation failures, that is another article (recurring batch automation errors).
Exceptions and alarms often live outside the “official” lot record. If the package only shows the path without incidents, it is not recoverable in the reconstruction sense. MHRA insists that data permit reconstruction of activities and that the set be complete (MHRA GxP Data Integrity Guidance). Omitting a silenced alarm or a temporary bypass is not “simplifying.” It is leaving a hole. Declaring the gap beats faking continuity.
This is also not the place for lot-to-lot correlation tables of intermittent deviations (intermittent quality deviation patterns). The object here is one identifier under retrieval pressure. A simple local test: pick a recent closed lot, time the path to the first attributable package with declared gaps, and note which system forced a phone call. That stopwatch is diagnostic. It is not a sector benchmark or a product promise.
Integrity and recovery: ALCOA+ and access during retention
Integrity without recovery is a dead archive. Recovery without integrity is a collage. MHRA defines ALCOA+ as Attributable, Legible, Contemporaneous, Original, and Accurate, plus Complete, Consistent, Enduring, and Available (MHRA GxP Data Integrity Guidance; MHRA portal). In ALCOA+, “Available” means data should be readily available for review or inspection. “Complete” requires an intact set. None of that sets a fifteen-minute SLA. It does give you a way to tell governed retrieval from improvisation.
EU GMP Annex 11, within EudraLex Volume 4, requires ensuring access to data throughout the retention period, performing regular backups, and checking the integrity, accuracy, and ability to restore (retrieve/restore) the data (Annex 11). It also states that, based on a risk assessment, a record of GMP-relevant changes and deletions (audit trail) should be considered, with documented reason, available, convertible to an intelligible form, and regularly reviewed (Annex 11). Scope: GMP activities.
If your plant is not under EU GMP, do not invent a universal duty; you can still treat access during retention and a tested restore as a desirable capability when an auditor asks for the lot years later.
A typical failure: the backup exists, but nobody has tested restore of the record tied to the lot. Another: the audit trail sits in the system, yet it is neither intelligible nor reviewable in inspection time. Availability in the MHRA sense and recoverability in the Annex 11 sense touch each other: if an IT specialist is required to “pull” the lot, operational availability is weak even when the bit lives on disk.
As U.S. pharmaceutical contrast, 21 CFR 211.192 requires the quality control unit to review and approve production and control records before release, and requires any unexplained discrepancy or failure of a batch or any of its components to meet specifications to be thoroughly investigated, with a written record of the conclusions and follow-up (21 CFR 211.192). That separates two acts: assembling the package and deciding on it. A retrieval tool does not replace QA review.
In ES/EU, apply your local frame; CFR only illustrates the boundary between evidence and disposition.
In practice: each datum in the package should answer who, when, from which system, under which revision, and whether it is original or a controlled copy. If you cannot, declare the gap. WizeeMind can prepare evidence and mark holes; it does not certify legal integrity or approve the lot.
Digitization by capability, not by catalog
Useful digitization is judged by capability, not by brand catalog: stable lot identifiers, provenance by source system, coherent clock and time zone, retention with verifiable access, and reconstruction of GMP-relevant changes without ad hoc exports. Buying an MES or a data lake does not close the gap if the lot ID remains local to each silo.
The purchase may even hide the gap for a while, because demos look clean until someone asks for lot 2847 under the fifteen-minute stress clock.
Capability checklist (not a vendor list):
- Stable lot identity shared across systems, or a governed map.
- Provenance: each datum cites source system and version when applicable.
- Time: timestamps with time zone; documented reconciliation when multiple clocks exist.
- Perimeter: materials, process, exceptions/alarms, controls, relevant changes.
- Integrity aligned with ALCOA+ where the scope requires it (MHRA).
- Retention and access: tested restore/retrieve where Annex 11 applies.
- Changes: intelligible audit trail or equivalent for critical changes.
- Explicit gaps: the package states what is missing.
- Roles: who assembles versus who decides disposition or answers the auditor.
- Batch vocabulary where it applies: ISA-88 models so recipe, equipment, and execution stay distinct.
Score the plant against those ten items before comparing software features. If identity and time fail, no dashboard will assemble an attributable package. If roles are unclear, the first complete-looking PDF may still lack an owner who can speak to the auditor.
ISA-88.00.01 establishes a consistent set of models and terminology for batch control systems, is technology-agnostic, and applies across a wide range of batch industries, easing communication among process engineering, control, and IT (ISA-88). That reduces language confusion; it does not by itself guarantee package recovery.
NIST IR 8107 holds that the ability of disparate systems to exchange, understand, and exploit product, production, and business data depends critically on information standards, and situates the standards landscape in integration along product, production-system, and business dimensions (NIST IR 8107). Prefer measurable capabilities (can I recover lot X with declared gaps without calling three shifts?) over platform demos.
The cost of searching for information and the SCADA-MES-ERP islands are symptoms of the same capability deficit.
Limits, roles, and next step
Neither the illustrative fifteen-minute model nor an evidence-preparation tool releases the lot, proves root cause, or replaces the auditor. Applicable legislation, approved procedures, and decisions by authorized personnel prevail. 21 CFR 211.192, as U.S. contrast, leaves review and documented investigation with the quality unit (21 CFR 211.192). MHRA availability speaks to data ready for review, not to software that closes the inspection (MHRA GxP Data Integrity Guidance).
Keep the roles boring and explicit: operations or quality assemble the package; authorized personnel decide disposition; the auditor or authority evaluates. Mix those acts and you often get two failures at once: an incomplete package presented as “closed,” or a disposition decision without attributable evidence. The plant may be in a hurry. The auditor does not have to accept a collage.
WizeeMind can prepare or retrieve evidence and show gaps. It cannot release lots, find root cause, replace the auditor, or offer a fifteen-minute SLA. If your scope is food, the chain minimum in Regulation (EC) 178/2002 does not replace the internal dossier of process, exceptions, and controls. If it is GMP, Annex 11 supplies access and restore criteria; it does not automatically make every industrial plant subject to the annex. U.S.
CFR does not displace EU GMP or Spanish rules: it is documentary contrast.
Do not use the fifteen-minute model as a vendor KPI either. An internal stopwatch shows whether the first attributable package appears without calling three shifts. A vendor who promises “complete traceability in fifteen minutes” without defining perimeter, gaps, and roles is selling a slogan, not a capability. The useful question is different: what evidence is still missing when the clock stops?
Concrete next step: pick a closed lot, define perimeter and identifiers, time the path to the first attributable package with declared gaps, and list which capability failed (ID, time, exceptions, access, roles). That diagnosis steers digitization better than a software catalog. If the failure is identity or system islands, the work does not start in the MES demo; it starts in the ID map and in who owns the package assembly.
This text is not individualized legal advice for a facility.
Frequently asked questions
Are the “15 minutes” a legal deadline or a WizeeMind SLA?
No. The “15 minutes” are an illustrative diagnostic model. They are neither a legal deadline nor a WizeeMind SLA. Lot 2847 is only an example identifier. Use the model to locate the retrieval gap; do not cite it as an EU, Spanish, or product requirement. The same caution applies to any vendor who treats the stress clock as a service promise without defining perimeter and gaps.
Does “one step back / one step forward” under Regulation 178/2002 equal reconstructing everything that happened to a lot inside the plant?
No. That chain minimum identifies the immediate supplier and the immediate customer; it does not by itself reconstruct the plant-internal dossier. The regulation text via BOE/OJEU and the European Commission interpretation fix that food-chain minimum; the package of process, exceptions, and changes is another layer. Meeting supplier-customer identification is necessary where food law applies, and still insufficient when the auditor asks what happened on the line.
What should a recoverable package contain when an auditor asks for “everything about the lot”?
Identifier and time perimeter, materials, executed process, exceptions, controls and relevant changes, authorship, and explicit gaps, ready for the authorized person. As U.S. contrast, 211.188 speaks to complete production and control information for each batch; under EU GMP, access and restore in Annex 11 condition whether that package remains recoverable through retention. State what is out of scope before you present the stack as closed.
What digitization level is needed to stop relying on manual cross-system stitching?
Verifiable capabilities: stable lot identifiers, provenance by system, coherent clock and time zone, retention with access, and reconstruction of relevant changes; not a brand catalog. ISA-88 supplies batch language; NIST IR 8107 reminds that useful exchange among systems rests on information standards. A platform purchase without shared IDs and tested access still leaves the stitch to people.
Can WizeeMind release the lot, approve disposition, or replace the auditor?
No. WizeeMind can prepare or retrieve evidence and show gaps; release, disposition, and the reply to the auditor belong to authorized personnel. The boundary between evidence and decision also appears, as contrast, in 21 CFR 211.192. Preparation tools shorten search; they do not inherit QA accountability.
Which official sources matter if the plant is neither food-only nor pharma-only?
Use the framework that applies to your scope (for example 178/2002 in food, Annex 11 in GMP, CFR only as U.S. contrast) and integrity or retrieval criteria without mixing jurisdictions. Start from 178/2002 and from MHRA or Annex 11 only when the scope justifies them; do not copy a foreign framework as if it were local law. When scopes overlap, document which rule governs each decision instead of blending citations into one undifferentiated checklist.
Talk to us
If you want to review a real lot from your plant (perimeter, IDs, gaps, and which capability fails first), talk to us. Bring a closed identifier and the map of systems that touch that lot. WizeeMind prepares and locates evidence; the decision stays at the plant.