How do I ensure my unit-to-case aggregation with serialization software is compliant with DSCSA and audit trail rules?

To make a unit-to-case aggregation process compliant with DSCSA and audit trail expectations, focus on three things:

1. Accurate parent-child relationships
2. Tamper-evident, time-stamped event history
3. Validated system controls and exception handling

Here’s a practical checklist.

1) Capture aggregation at each packaging level

Your serialization software should record and preserve the hierarchy, for example:

• Unit → serial number
• Bundle / inner pack → parent-child link to units
• Case → parent-child link to units or bundles
• Pallet → parent-child link to cases

Each scan or association event should create a durable record showing:

• child serial number
• parent serial number
• event type
• date/time
• operator or system user
• workstation/device ID
• site/line/packaging order

This is the core of compliance for traceability.

2) Maintain a complete audit trail

Your system should log:

• creation of serial numbers
• commissioning
• aggregation
• decommissioning
• rework/repack
• packing exceptions
• corrections/voids
• user logins and permission changes
• interface imports/exports
• failed scans and overrides

Audit trail records should be:

• time-stamped
• attributed to a specific user or system process
• non-rewriteable or protected from alteration
• retained per your quality record policy and legal requirements

If a change is made, the system should preserve the original record and record the correction as a new event rather than overwriting history.

3) Verify data integrity between unit and case

For DSCSA compliance, the aggregation record must reliably support:

• shipment traceability
• product verification
• recall investigations
• saleable returns verification, where applicable

That means you need controls to ensure:

• a unit is linked to only one active parent at a time
• case contents match what was physically packed
• voided or rejected serials are excluded from the final hierarchy
• rework creates a new controlled record trail

4) Use validated serialization software

To support regulated use, the software should be validated under your quality system, typically with:

• user requirements specification
• risk assessment
• installation/operational/performance qualification, as appropriate
• test evidence for aggregation, exceptions, security, and audit trail behavior
• change control for upgrades and configuration changes

If the software is part of a GxP environment, align validation with your internal CSV approach and applicable regulations.

5) Implement access control and segregation of duties

Use role-based access so only authorized users can:

• commission/decommission
• rework aggregation
• approve corrections
• administer master data
• export records

Strong access control helps satisfy audit trail expectations and reduces the risk of unauthorized changes.

6) Handle exceptions with controlled procedures

Common noncompliance risks come from exceptions like:

• missed scans
• duplicate scans
• damaged labels
• relabeling
• line stops and partial cases
• mixed-content cases
• returns to inventory

Create SOPs for:

• reconciliation of physical vs. system counts
• rework/repack
• exception approval
• investigation and QA review
• disposition of orphaned or duplicate serials

7) Retain records and make them retrievable

You should be able to quickly produce:

• unit-level pedigree/aggregation history
• case contents
• packing event history
• audit trail for a specific serial number
• export files/messages sent to trading partners or repositories

Retention should follow your record retention policy and applicable regulatory expectations. Retrieval should be fast enough to support audits and investigations.

8) Reconcile and review regularly

Perform routine checks for:

• missing parent-child links
• duplicate serials
• open or incomplete packaging events
• discrepancies between MES/serialization system and warehouse or ERP
• failed interface transmissions
• unauthorized audit trail entries

Periodic review of audit trails and aggregation exceptions is important to show ongoing control.

9) Confirm trading-partner data expectations

DSCSA focuses on transaction data, transaction history, and transaction statements in the supply chain context. Make sure your aggregation process does not break the ability to provide or receive required transaction information and product tracing data.

10) Document everything in SOPs

At minimum, document:

• how aggregation is performed
• who is authorized to approve exceptions
• how audit trails are reviewed
• how corrections are made
• how records are backed up and restored
• how serialized data is transmitted and verified
• how recalls and investigations use the aggregation records

---

Quick compliance test

Your process is in good shape if you can answer “yes” to these questions:

• Can you trace every case back to exact unit serial numbers?
• Are all aggregation events uniquely time-stamped and attributable?
• Can no one silently overwrite a packing record?
• Are exceptions handled under SOP with QA oversight?
• Can you reconstruct packaging history for any serial number during an audit?
• Is the system validated and access-controlled?

If you want, I can also give you:

1. a DSCSA/serialization audit checklist,
2. a sample SOP outline for aggregation, or
3. a validation test script for unit-to-case aggregation and audit trail.