How do I ensure my unit-to-case aggregation with serialization software is compliant with DSCSA and audit trail rules?

To make unit-to-case aggregation compliant with DSCSA and audit trail expectations, focus on traceability, data integrity, controlled serialization events, and immutable records. Here’s a practical checklist.

1) Capture the right parent-child relationships

Your software should reliably record:

• Unit serial number
• Case serial number
• Parent-child association between every unit and its case
• If applicable, pallet aggregation
• Timestamp, line, and event details for every association/disassociation

This is the core of compliant aggregation: you must be able to prove exactly which serialized units were packed into which case, and when.

2) Maintain an audit trail for every change

Your system should log:

• Who performed the action
• What action was taken
• Old value and new value
• Date/time with synchronized system time
• Reason for change, if anything was corrected
• Device/terminal or line station used

The audit trail should be:

• Tamper-evident
• Time-stamped
• Permanent or retained per your record retention policy
• Searchable and exportable for inspection

3) Prevent unauthorized edits

Use role-based access control so only authorized users can:

• Create or modify aggregation records
• Void/rework serial numbers
• Reconcile exceptions
• Approve corrections
• Release data to trading partners

Prefer workflows where corrections require:

• Supervisor approval
• Reason codes
• Audit logging of both original and corrected entries

4) Align with DSCSA data exchange requirements

Aggregation alone is not enough. Make sure your system can support product traceability data, including:

• Product Identifier (PI) elements:
  • NDC or other product code
  • Serial number
  • Lot number
  • Expiration date
• Transaction data and transaction statements where applicable
• Verification and exception handling processes

Even though DSCSA is now primarily about serialized package-level traceability and interoperable data exchange, your internal aggregation must support downstream verification and trace requests.

5) Validate the serialization system

Perform formal validation to show the software works as intended.

Typical validation activities:

• IQ/OQ/PQ
• Challenge testing for:
  • Duplicate serials
  • Missed scans
  • Wrong-child association
  • Rework and split-case events
  • Line stoppage and restart scenarios
• Confirm the audit trail cannot be altered without detection
• Confirm backups and restore procedures preserve records

Keep validation documentation available for auditors.

6) Handle exceptions in a controlled way

Your process should define what happens if:

• A unit is damaged
• A case is reworked
• A scan fails
• A case is partially filled
• A label is reprinted
• A line is restarted after interruption

For each exception, the system should:

• Record the event
• Prevent duplicate assignment
• Preserve original records
• Show why the final aggregation differs from the original attempt

7) Ensure data retention and retrieval

You need to retain serialization and audit records according to your quality system and regulatory expectations. The system should support:

• Long-term retention
• Backups
• Disaster recovery
• Rapid retrieval for investigations, recalls, and partner verification requests

8) Use secure interfaces and synchronization

If your serialization software integrates with packaging equipment, ERP, WMS, or partners:

• Use controlled interfaces and authenticated access
• Validate file/API transfers
• Track inbound/outbound messages
• Reconcile failures and retries
• Synchronize system clocks across all nodes

9) Reconcile physical and electronic inventory

At the end of each run or shift, reconcile:

• Serialized units produced
• Units aggregated into cases
• Spoiled/destroyed units
• Unused serial numbers
• Reprints and rework

Any discrepancies should be investigated and documented.

10) Prepare for audit readiness

Auditors typically want to see:

• SOPs for serialization/aggregation
• Access control matrix
• Validation package
• Audit trail samples
• Exception handling logs
• Reconciliation records
• Data retention/backup evidence
• Change control records for system updates

Recommended minimum controls

If you want a simple “must-have” list, ensure your software has:

• Unique serial generation and verification
• Immutable audit logs
• Parent-child aggregation records
• Role-based permissions
• Exception and rework workflows
• Validation evidence
• Backup/restore and retention controls
• Exportable traceability reports

If you want, I can also give you:

1. a DSCSA compliance checklist for serialization software, or
2. a sample SOP/audit trail control framework for unit-to-case aggregation.