What a recall actually asks for

Current good manufacturing practice binds an outsourcing facility, not a 503A compounding pharmacy, which is exempt under 21 U.S.C. 353a(a). It states the requirement in one sentence: written distribution procedures shall include "a system by which the distribution of each lot of drug product can be readily determined to facilitate its recall if necessary" (21 CFR 211.150(b)). A 503A pharmacy carries no equivalent federal duty; what follows is the record set its own written procedure and its state board have to build instead, aimed at the same recall that sentence describes.

A recall is a records event with a quality cause. FDA defines it as a firm's removal or correction of a marketed product the agency considers to be in violation, and separates it from a market withdrawal, a minor violation not subject to legal action (21 CFR 7.3(g), (j)).

The questions are published and they are short. A firm initiating a recall gives FDA the product identity, the reason for the deficiency, a risk evaluation, the amount produced and the amount still in distribution, the number and identity of direct accounts, the proposed strategy, and a named contact (21 CFR 7.46(a)). Most of the nine come out of records that exist before the phone rings or do not exist at all.

That information sets the depth of the recall, whether it runs to the wholesale, retail, or consumer level, and the level of effectiveness checks (21 CFR 7.42(b)). Level A is 100 percent of consignees contacted, B more than 10 and less than 100 percent, C 10 percent, D 2 percent, E none. A consignee is anyone who received, purchased or used the recalled product (21 CFR 7.3(n)). Level A is a demand for a complete, contactable list keyed to one lot, on the timescale of a recall rather than of a quarter.

The first join: a supplier certificate and the container in front of you

For a 503A pharmacy the certificate of analysis is not a courtesy. It is a statutory condition of the exemption. Section 503A conditions that exemption on bulk drug substances meeting one of three tests read in order: they comply with the standards of an applicable United States Pharmacopoeia or National Formulary monograph if a monograph exists, together with "the United States Pharmacopoeia chapter on pharmacy compounding"; if no monograph exists, they are components of drugs approved by the Secretary; and if neither, they appear on the list the Secretary develops by regulation. Whichever prong carries the substance, it must be manufactured by an establishment registered under section 510, and it must be "accompanied by valid certificates of analysis for each bulk drug substance" (21 U.S.C. 353a(b)(1)(A)(i) through (iii)). The USP compounding chapters sit inside the statute the pharmacy compounds under.

Part 211, which governs an outsourcing facility, is exact about what a supplier's paper can do. At least one test verifies the identity of each component (21 CFR 211.84(d)(1)). For purity, strength and quality, "a report of analysis may be accepted from the supplier of a component, provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier's analyses through appropriate validation of the supplier's test results at appropriate intervals" (21 CFR 211.84(d)(2)). A supplier certificate is admissible against an identity test run on receipt, and not otherwise.

The join breaks on filing, not on testing. A certificate arrives as an attachment named for the compound, is saved in a folder named for the compound, and the supplier lot number lives inside the document rather than in a field. When a supplier issues a correction against one lot, no query returns the preparations made from it. A certificate issued with the lot, carrying the lot number on its face, gets filed by lot without anyone deciding to. A certificate issued after the fact, named for the compound, gets filed by compound.

The receiving record needs the supplier lot number as a field of its own, beside the internal container identifier the pharmacy assigns, the expiration or retest date, the establishment named on the certificate, and the identity result produced in the pharmacy. Two lots of one substance are two records. An inventory that merges them has already lost the recall.

The second join: the master formulation record and the compounding record

USP General Chapter 797 requires that a compounding record be created and maintained for compounded sterile preparations; General Chapter 795 is the parallel authority for nonsterile ones. The two are not copies of each other, and only one of them exists for every preparation. A master formulation record is required for a preparation compounded in a batch or made more than once, and for a patient-specific single dose the medication order may stand in its place if it carries the required elements and is readily retrievable; the compounding record has no such exception. The master formulation record is the constant: what the preparation is, what goes into it, in what quantities, by what steps, to what beyond-use date, under what storage condition. The compounding record is the variable: what happened on one occasion, including which lots were opened to do it.

That distinction is where lot traceability lives, because only one of the two carries a lot number. North Carolina's guidance on compounding records, written when USP Chapter 797 did not yet specify the elements of the record, states the reason plainly: "Documenting lot numbers and expiration dates of the ingredients must be done for all ingredients in all compounded products in order to facilitate recalls of compounded sterile products containing recalled components." That board's element list requires the source, lot number and expiration date of each component, the internal identification number, the initials of everyone involved at each step, and a duplicate container label. USP has since revised Chapter 797, and the revised chapter carries its own element list, so a pharmacy building a record today reads both and takes the longer of the two.

The failures that follow are filing failures, not testing failures. A record that names the component and the supplier but not the lot turns a lot recall into a date-range recall. A lot number written only on the container label leaves the building with the preparation. At an outsourcing facility the distribution record that follows carries the consignee's name and address, the date and quantity shipped, and the lot or control number (21 CFR 211.196). A 503A pharmacy is exempt from current good manufacturing practice under 21 U.S.C. 353a(a), so Part 211 requires none of that of it. The same fields have to come from its own written procedure and from its state board, or nothing requires them at all.

The third join, and the DSCSA gap underneath it

Many pharmacies assume the Drug Supply Chain Security Act closes the chain around a compounded preparation. It does the opposite. DSCSA defines product as a finished prescription drug requiring no substantial further manufacturing, and the definition expressly "does not include ... a drug compounded in compliance with section 353a or 353b of this title" (21 U.S.C. 360eee(13)). A bulk drug substance is not a finished prescription drug either, so the chain is open at both ends.

So a compounded preparation carries no DSCSA product identifier, the standardized graphic carrying the standardized numerical identifier, lot number and expiration date (21 U.S.C. 360eee(14)). No transaction information travels with it, and transaction information is where a lot number would otherwise sit (21 U.S.C. 360eee(26)(F)). The only link between a supplier lot and the patient who received the preparation is the pharmacy's own compounding record. No trading partner holds a duplicate.

The same pharmacy is still a dispenser for everything else it buys (21 U.S.C. 360eee(3)), and those duties are live. A dispenser must capture transaction information, including lot level information if it was provided, along with transaction history and transaction statements, as necessary to investigate a suspect product, and must maintain them "for not less than 6 years after the transaction" (21 U.S.C. 360eee-1(d)(1)(A)(iii)). The lot number reaches that file only if the previous owner sent it, which is the second reason a pharmacy cannot treat DSCSA as its lot traceability system. Suspect product is quarantined and investigated (d)(4)(A). Product determined illegitimate is notified to FDA and to all immediate trading partners "not later than 24 hours after making such determination" (d)(4)(B)(ii).

FDA's exemption for small dispensers, a dispenser whose owning company has 25 or fewer full-time pharmacists and pharmacy technicians, now runs to November 27, 2027. It reaches certain requirements of section 582, and is not a suspension of the duties already in force. The six-year retention is one of those.

How long each record has to live

There is no single retention period, which is why the question is usually answered wrong. Each record runs on its own clock, set by a different authority and started by a different event, and the governing period is the longest one reaching it.

Setting one retention policy at the shortest applicable period is the common way a compliant pharmacy becomes a non-compliant one: DEA's two-year floor is shorter than California's three, and California's three is shorter than the DSCSA's six. Nothing here surveys the states; the point is only that the floors differ and are set by different authorities, so the policy is written per record against the authority that reaches it, never once at the shortest number in view. And retained is not the same as available. Part 211 requires records to be "readily available for authorized inspection during the retention period at the establishment where the activities described in such records occurred" (21 CFR 211.180(c)). A carton in a storage unit two counties away satisfies the first word and fails the second.

Where the chain breaks

None of the common failures is a testing failure. Each is a place where a lot number stopped being a field and became text inside a document, and text is not queryable at recall speed. To find which of the five is live, take one supplier lot number at random from last quarter and time the reconstruction: every preparation made from it, every consignee holding one, and the certificate that released it. That drill is what 21 CFR 7.46(a) asks for.

• The certificate of analysis is filed under the compound rather than the lot, so a correction issued against one lot returns nothing.
• The compounding record names the component and the supplier but not the lot, which turns a lot recall into a date-range recall.
• Two supplier lots are merged under one internal container identifier at receipt, so the chain forks and neither branch was written down.
• The consignee list cannot be queried by component lot, so Level A effectiveness checks become a manual reconstruction against the clock.
• One retention period is applied to every record, so the shortest clock governs the longest obligation.

What this means for a buyer

Half of this chain is bought rather than built, the supplier half is set at the point of purchase, and no filing system corrects it afterward. Four things make incoming material traceable on arrival.

A certificate of analysis issued with the lot and carrying the lot number on its face. The manufacturing establishment named on the lot record rather than described in general terms. A retention sample from the same fill, held long enough to answer a late question. And a route back to the supplier that takes a lot number as its input, because that is the only key a recall hands anyone. A supplier searchable only by compound name has passed its filing problem to the buyer.

None of that replaces the incoming check. A supplier's release document, from GradeBio or from anywhere else, is a claim about a lot until it is read against an identity result produced in the receiving pharmacy. The certificate closes the join. It does not release the container.

A recall-ready file is not a binder. It is a property: one lot number, entered anywhere in the chain, returns everything on both sides of it. The certificate and the establishment behind it, the preparations made from it, the consignees holding them. A pharmacy with that property has already written most of its recall procedure. A pharmacy without it writes one during the recall, from paper.

Sources

1. Federal Food, Drug, and Cosmetic Act, section 503A 21 U.S.C. 353a(b)(1)(A)(i) through (iii)
2. FDA current good manufacturing practice, testing and approval or rejection of components 21 CFR 211.84(d)(1) and (d)(2)
3. FDA current good manufacturing practice, distribution procedures 21 CFR 211.150(b)
4. FDA current good manufacturing practice, distribution records 21 CFR 211.196
5. FDA current good manufacturing practice, records and reports, general requirements 21 CFR 211.180(a) and (c)
6. FDA recall regulations, definitions 21 CFR 7.3(g), (j), (n)
7. FDA recall regulations, recall strategy 21 CFR 7.42(b)
8. FDA recall regulations, firm-initiated recall 21 CFR 7.46(a)
9. FDA guidance for industry and FDA staff, final Initiation of Voluntary Recalls Under 21 CFR Part 7 Subpart C (March 2022)
10. Drug Supply Chain Security Act, definitions 21 U.S.C. 360eee(3), (13), (14), (26)
11. Drug Supply Chain Security Act, dispenser requirements 21 U.S.C. 360eee-1(d)(1)(A)(iii), (d)(4)(A), (d)(4)(B)(ii)
12. FDA, Exemptions under the Drug Supply Chain Security Act Small dispenser exemption, running to November 27 2027
13. DEA, maintenance of records and inventories 21 CFR 1304.04(a)
14. California Business and Professions Code Section 4081
15. North Carolina Board of Pharmacy Guidance Document, Compounding Record and Master Formulation Record for Sterile Compounds