BMRBatch Manufacturing Record

A Batch Manufacturing Record (BMR) — also called a Batch Production Record (BPR) or Batch Record — is the complete, chronological, attributable file of evidence that proves a specific batch of a regulated product was manufactured in accordance with its approved Master Manufacturing Record. Every weighing, every dispense, every in-process check, every deviation, every signature, every label print, every yield calculation, every QC result for that one batch lives in the BMR. It is the file an FDA investigator asks for by batch number when they want to know what really happened on the floor on a particular day.

The BMR is required by 21 CFR 211.188 for finished pharmaceuticals, by 21 CFR 111.255 for dietary supplements, by 21 CFR 117 for human food, by 21 CFR 507 for animal food, by ICH Q7 for active pharmaceutical ingredients, and by EU GMP Chapter 4 and Annex 16 for any product that ships into the EU. The names differ — Batch Production Record (BPR), Process Order Record, Executed Batch Record — but the regulator expectation is the same: one batch, one record, complete and contemporaneous.

211.188(a) sets the headline rule: 'Batch production and control records shall be prepared for each batch of drug product produced and shall include complete information relating to the production and control of each batch. These records shall include … (1) An accurate reproduction of the appropriate master production or control record, checked for accuracy, dated, and signed.' The phrase that matters is 'accurate reproduction'. The BMR is not a free-form diary; it is a structured file whose skeleton is the approved MMR.

211.188(b) then enumerates what every BMR must contain on a step-by-step basis:

1. Dates and, when appropriate, times of performance of each significant step.
2. Identification of each person who performed, directly supervised or checked each significant step.
3. Identification of major equipment and lines used.
4. Specific identification of each batch of component or in-process material used.
5. Weights and measures of components used in the course of processing.
6. In-process and laboratory control results.
7. Inspection of the packaging and labelling area before and after use.
8. Statement of actual yield and a statement of percentage of theoretical yield at appropriate phases of processing.
9. Complete labelling control records, including specimens or copies of all labelling used.
10. Description of drug product containers and closures.
11. Any sampling performed.
12. Identification of the persons performing and directly supervising or checking each significant step in the operation.
13. Any investigation made according to 211.192.
14. Results of examinations made in accordance with 211.134.

These thirteen items are the floor, not the ceiling. Any time the manufacturing process makes a decision, that decision and its rationale belong in the BMR. A reviewer who finds a step with no recorded outcome will record a deviation; a step that was performed but for which the BMR has no entry is a 211.188 finding.

'Accurate reproduction of the appropriate master production or control record' is the most-cited phrase in 211.188. The word 'appropriate' is the trapdoor. The MMR can be revised at any time, but the BMR for a batch must reproduce the MMR version that was in force when the batch was released — not the version that is in force when the BMR is reviewed and signed, which may be weeks later.

Two architectural approaches handle this. The wrong one is to keep the BMR as a live reference back to the MMR record — when the MMR is revised, every open BMR's content silently shifts under it. The right one is to snapshot the MMR into the BMR at the moment the work order is released, and then for the life of the batch the BMR renders against the snapshot, not against the live MMR.

PIC/S PI 041 makes the snapshot model the de facto industry standard. EMA's Annex 11 (computerised systems) and the FDA's data-integrity guidance both expect the relationship between MMR and BMR to be reproducible months later, which only the snapshot model delivers.

Every entry in a BMR must be Attributable, Legible, Contemporaneous, Original, and Accurate — the ALCOA principles, extended to ALCOA+ with Complete, Consistent, Enduring, and Available. The FDA, EMA, MHRA, PIC/S and WHO all use ALCOA+ as the lens through which they read 211.188. A BMR that captures everything but does it after the fact violates the contemporaneous rule even though the data may be correct.

Contemporaneous means at the time of the act. An operator who weighs a component at 09:14 and signs the entry at 09:14 is contemporaneous. An operator who weighs at 09:14 and signs at 11:30 because the touchscreen was unattended is not. A paper BMR is structurally weak here because the paper is not next to the scale; an eBMR run from a kiosk at the scale is structurally strong.

Attributable means the system knows who did it. Shared logins, group accounts and supervisor-signs-for-operator practices are the classic ALCOA failures. Every weighing must be tied to a logged-in user whose identity is verifiable from the audit trail.

Original means the BMR holds the raw data, not a transcribed copy. The scale reading captured directly from the load cell is original; the value rekeyed from a printed slip is a transcription and is one degradation removed from original. Original is a defensible audit-trail position; transcription is not.

Modern BMRs organise per-step capture into a fixed shape so reviewers can scan a thousand-page record in minutes rather than days. Every step in the MMR projects into a step container in the BMR with the following fields.

Header

Step number, step description (from the MMR snapshot), the operator's logged-in identity, the equipment used, the materials consumed (lot numbers, weights), the parameters set (with the MMR-defined range), the in-process check performed and its result, the start and end timestamps, any comments.

Evidence

Photographs of the kiosk-mounted scale display, of the equipment cleaning verification, of the labelling. Every photograph carries its capture timestamp and the user who captured it. Photos cannot be substituted later; the audit trail records the original capture.

Deviations

Any departure from the MMR step is logged as a deviation with category (planned, unplanned), severity (minor, major, critical), description, immediate action, and a reference to the deviation record that owns the investigation.

Signatures

Per-step signatures where the MMR requires them (211.188(b)(11) — direct supervision or checking). Two-component electronic signatures per 21 CFR 11.200 — the operator's identifier and a second component such as a password — and the signature carries its meaning ('weighed', 'verified', 'released').

211.192 governs production-record review: 'All drug product production and control records, including those for packaging and labelling, shall be reviewed and approved by the quality control unit to determine compliance with all established, approved written procedures before a batch is released or distributed.' The quality control unit (typically QA) reviews every BMR. Approval is two-component e-signature with the meaning 'reviewed and accepted'.

Critically, 211.192 also requires investigation of 'any unexplained discrepancy or failure of a batch or any of its components to meet any of its specifications, whether or not the batch has already been distributed.' Discrepancies cannot be closed out by the reviewer privately — they must generate a deviation record, the deviation must be investigated, the investigation outcome must be appended to the BMR, and the QA reviewer's release is conditional on the deviation being closed (or formally accepted).

The QA reviewer's signature is the final inspection-grade artefact in the BMR. A reviewer who released a batch with an open major deviation is a finding the regulator will pursue personally.

1. Non-contemporaneous entries — values recorded after the fact, identifiable from clustered timestamps at end of shift.
2. Shared logins — same user_id appears on three parallel stations, impossible attribution.
3. BMR rendered from live MMR rather than from a snapshot — content drifts when the MMR is revised mid-campaign.
4. Missing per-step signatures where the MMR snapshot says 'direct supervision required' — 211.188(b)(11) finding.
5. Yield reconciliation done by exception, only when out of range — 211.188(b)(8) requires actual yield and percentage at all appropriate phases.
6. Labelling control records reference an artwork system that is not under change control — a labelling drift cannot be reconstructed.
7. Material lot numbers entered as free text, not validated against the inventory record — typos propagate into the recall report.
8. Deviations recorded as comments rather than as deviation records — 211.192 investigation chain is broken.
9. BMR closed by the same operator who performed every critical step — independence rule under 211.22 broken.
10. Print-and-archive workflow — BMR signed in the system, then printed to PDF and the PDF is the archive of record. The system audit trail becomes inaccessible.

Paper BMRs were the default until about 2015. They satisfy 211.188 on paper — literally — but they fail ALCOA+ structurally: paper cannot be contemporaneous with a scale reading taken thirty feet away, paper has no audit trail of changes, and paper review is slow enough that batches sit waiting for QA for days. The regulator does not require electronic; it requires the principles. Paper meeting the principles is rare in modern facilities.

Hybrid BMRs — paper with some electronic capture — are the worst of both worlds. The paper sheet is the record of record but the audit trail lives in the system. When the two disagree, the reviewer has no procedure. Inspectors increasingly cite hybrid systems as inherently non-compliant with the Part 11 requirement that the electronic component meet 11.10(a–k) when it is the system of record for any data element.

eBMR — the BMR is an electronic record, generated from the MMR snapshot, with every entry attributed to a logged-in user, with an immutable audit trail, with two-component e-signatures, and with PDF rendering available on demand for archive and inspection — is the modern defensible shape. The PDF is a representation, not the record of record; the system data is the record.

211.180(a) requires production records (which include the BMR) to be retained for at least one year after the expiration date of the batch, or, for active pharmaceutical ingredients without an expiration date, at least three years after distribution. For OTC drug products with no expiration date, the requirement is three years after distribution. EU GMP Chapter 4 requires at least one year past the expiry date, with a minimum of five years overall. Practical retention is therefore the maximum of all these clauses applied to the markets the product ships into.

Retention applies to the BMR as a complete record — the data, the audit trail, the e-signatures, the photographs, the deviation records, the QC results — not just to the rendered PDF. A system that purges audit trails after a year violates retention even if the PDFs are kept.

In V5, the BMR is generated continuously across the life of the work order rather than being authored at the end. At work-order release, the system snapshots the approved formula (the MMR) into work_orders.mmr_snapshot and from that point the BMR is built against the snapshot. Every dispense, every kiosk step, every QC result, every deviation appends to the work order's record.

• MMR snapshot at release means a mid-campaign MMR revision can never silently change a BMR's structure.
• Every kiosk action carries the operator's authenticated user_id, a server-side timestamp, and the relevant equipment/material context. Shared logins are impossible because authentication is per-session.
• Per-step e-signatures are two-component (identifier + password) and carry the regulated meaning enum — 'weighed', 'verified', 'released'.
• Photographs captured at the kiosk are stored with their original capture timestamp; the audit trail records the operator, the device, the lens used, and the size of the original file.
• Deviations raised from the kiosk generate a deviation record that links into the BMR view and blocks the QA release sign-off until closed (or formally accepted with rationale).
• QA release uses the same two-component e-signature primitive and carries the meaning 'reviewed and released per 211.192'. The reviewer cannot be one of the operators on the batch (211.22 independence enforced at the database tier).
• On QA release, V5 emits a regulated-report PDF of the BMR for archive. The PDF is a representation; the record of record is the structured data and its audit trail, retained for the full predicate-rule period.

See below for the regulator-grade answers to the questions buyers ask most often when evaluating an eBMR.