BPRBatch Production Record

A Batch Production Record (BPR) is the complete, chronological, attributable file of evidence that proves a single batch of a regulated product was manufactured in accordance with its approved Master Manufacturing Record (MMR) and the facility's written procedures. Every ingredient weighed, every CCP monitored, every in-process check, every deviation, every signature for that one batch lives in the BPR. It is the file an FDA investigator (or an SQF, BRCGS or FSSC 22000 auditor) asks for by batch or lot code to reconstruct exactly what happened on the floor.

The term Batch Production Record is the name used by 21 CFR Part 111 for dietary supplements, by 21 CFR Part 117 for human food, by 21 CFR Part 507 for animal food, and by ICH Q7 for active pharmaceutical ingredients. The pharma-finished-product world calls the same artefact a Batch Manufacturing Record (BMR) under 21 CFR Part 211. The shape is the same; only the predicate rule and a handful of terminology choices change.

Choosing the wrong rule is the most common audit finding for facilities making both food and supplements out of the same plant. The rules are not interchangeable: 111 is stricter on identity testing, 117 is stricter on environmental monitoring, ICH Q7 imposes change-control language that 111 does not. Map every product to a single primary rule, and document the mapping in the quality manual.

Where a single facility runs more than one regime — e.g. a co-manufacturer that does supplements under 111 and OTC drug product under 211 — the BPR template must encode the rule, the rule-specific fields, and the rule-specific retention. Trying to use one template across regimes will fail at least one of them.

111.255(b) is the section every supplement BPR must enumerate against. It requires each BPR to include identity of equipment and processing lines used, date and time of maintenance/cleaning/sanitisation, lot numbers of every component and each in-process material, weights and measures of each component used, identification of each person who performed and supervised or checked each step, in-process and finished tests, the actual yield with a statement of percent of theoretical yield, documentation of any failure to meet specifications and the resulting investigation, and documentation of the disposition of any rejected material.

111.260 then governs review: the BPR for every batch must be reviewed by quality control personnel before the product is released. The reviewer must verify the BPR is complete, the data supports release, and any deviations have been properly resolved. Like 211.192, this review must be by a qualified person independent of the operators who performed the work.

111.205 governs the upstream MMR that the BPR must reproduce. Approval of the MMR requires the signature of one qualified person and verification by a second qualified person — the dietary-supplement equivalent of the 211.186 two-signature MMR approval. The BPR inherits the MMR version that was in force at release.

Part 117 is structured differently from 111 or 211. It does not enumerate a 'batch production record' clause the way the other rules do. Instead, the cGMP and the Preventive Controls subparts together require records sufficient to demonstrate the food was produced in accordance with the written food safety plan.

In practice this means the BPR for a 117-regulated food product must show: the lot codes of raw materials used, the monitoring records for every preventive control (CCP, sanitation control, supply-chain control), the corrective actions taken for any deviation, the verification records (e.g. records of CCP equipment calibration), and the records of holds and dispositions for non-conforming product. 117.190 requires records to be retained for at least two years past the date the food was sold.

FSMA 204 (the Food Traceability Rule, effective January 2026 for FTL foods) extends the BPR's reach: facilities making or holding any food on the Food Traceability List must maintain KDE (Key Data Element) records for CTE (Critical Tracking Events). The BPR is the natural home for the production-step KDEs.

ICH Q7 §6.5 governs batch production records for active pharmaceutical ingredients. The required elements parallel 211.188 but with API-specific additions: a complete copy of the appropriate master production instruction; the identity and quantity of each material added; dates and times of major steps; identity of equipment used; sampling and in-process testing; signatures of persons performing and directly supervising; statement of actual yield; reconciliation of label use where labels are used; documentation of any deviation; results of investigations conducted under 6.7.

Q7 imposes a stricter change-control discipline than 111: any change to the master production instruction must be controlled under §13, and the BPR must always render against the version in force at release. Q7-regulated facilities therefore default to the MMR-snapshot model rather than live-link rendering.

111.255(b)(1), 211.188(a), ICH Q7 §6.5 and 117.190 all rest on the same idea: the BPR must accurately reproduce the master at the version in force when the batch was released. This is the source of the most architecturally important decision in an eBPR — does the BPR render against the live MMR or against a snapshot taken at release?

Live rendering means a mid-campaign MMR revision silently changes the meaning of every open BPR. Two batches released a week apart can be reviewed against different procedures even though both reference the same MMR ID. This is the most common audit finding in modern paperless plants.

Snapshot rendering means at release the system copies the active MMR onto the work order and from then on the BPR is built against the snapshot. Subsequent MMR revisions create new versions but do not touch in-flight batches. PIC/S PI 041 and the FDA Data Integrity guidance both treat the snapshot model as the de facto standard.

Every entry in a BPR must be Attributable, Legible, Contemporaneous, Original and Accurate — the ALCOA principles, extended to ALCOA+ with Complete, Consistent, Enduring and Available. The FDA, EMA, MHRA, PIC/S and WHO all use ALCOA+ as the lens through which they read every batch-record clause. A BPR that captures everything but does it after the fact violates contemporaneous even if the data is correct.

Contemporaneous means at the time of the act — the operator weighing a component at 09:14 and signing the entry at 09:14, not bulk-signing at end of shift. Paper BPRs are structurally weak here; an eBPR running from a kiosk at the scale is structurally strong.

Attributable means the system knows who did it. Shared logins and supervisor-signs-for-operator practices are classic ALCOA failures. Every weighing must be tied to an authenticated user whose identity is recoverable from the audit trail.

Original means the BPR holds the raw data, not a transcribed copy. The scale reading captured directly from the load cell is original; the value rekeyed from a printed slip is a transcription, one degradation removed from original and inadmissible as the record of record.

Modern BPRs organise per-step capture into a fixed shape so reviewers can scan a thousand-page record in minutes. Every step in the MMR projects into a step container in the BPR with the following fields.

Header

Step number, step description (from MMR snapshot), operator's authenticated identity, equipment used, materials consumed (lot numbers, weights), parameters set with the MMR-defined range, in-process check and result, start and end timestamps, comments.

Evidence

Photographs of the kiosk-mounted scale display, of equipment cleaning verification, of finished labelling. Every photo carries its capture timestamp and capturing user. Photos cannot be substituted later; the audit trail records the original capture.

Deviations

Any departure from the MMR step is logged as a deviation with category, severity, description, immediate action, and a reference to the deviation record that owns the investigation.

Signatures

Per-step signatures where the MMR requires them. Two-component electronic signatures per 21 CFR 11.200 — operator identifier plus a second component such as a password — carrying their regulated meaning ('weighed', 'verified', 'released').

111.260 (supplements), 211.192 (pharma), and 117.190/507.206 (food) all place the same obligation on the reviewer: confirm the BPR is complete, confirm the data supports release, confirm any deviations have been investigated and resolved. The reviewer is the quality unit, qualified, and independent of the operators.

Crucially the reviewer cannot close out a discrepancy privately. Discrepancies generate a deviation record, the deviation drives an investigation, the investigation outcome is appended to the BPR, and the release signature is conditional on the deviation being closed (or formally accepted).

The release e-signature is the final inspection-grade artefact in the BPR. A reviewer who released a batch with an open major deviation is a finding the regulator will pursue personally.

1. Non-contemporaneous entries — clustered end-of-shift timestamps give it away.
2. Shared logins or generic operator accounts — attribution impossible.
3. BPR rendered from live MMR rather than from a release-time snapshot.
4. Missing per-step signatures where the MMR snapshot says 'check required'.
5. Yield reconciliation done only when out of range — 111.255(b)(11)/211.188(b)(8) require actual yield at every appropriate phase.
6. Labelling control records reference an artwork system not under change control — drift cannot be reconstructed.
7. Material lot numbers entered as free text rather than validated against inventory — typos propagate into the recall report.
8. Deviations recorded as comments rather than deviation records — the investigation chain is broken.
9. BPR closed by the same operator who performed every critical step — independence broken.
10. Print-and-archive workflow — BPR signed in the system then archived as PDF only; the system audit trail becomes inaccessible and retention is incomplete.

Retention rules differ by predicate. 111.605 requires supplement BPRs to be retained for one year past the labelled shelf life, or two years from the date of distribution if no shelf life is declared. 117.315 requires food records to be retained for at least two years past the date the food was sold, with longer retention for some sanitation and supplier records. 211.180 requires pharma BMRs to be retained for one year past expiration. ICH Q7 §6.16 mirrors the pharma rule for APIs.

Retention applies to the BPR as a complete record — the data, the audit trail, the e-signatures, the photographs, the deviation records, the QC results — not to the rendered PDF in isolation. A system that purges audit trails after a year violates retention even if PDFs are kept.

In V5 the BPR is generated continuously across the life of the work order rather than authored at the end. At release, the system snapshots the approved MMR onto the work order and the BPR is built against the snapshot for the life of the batch.

• Industry-aware terminology — V5 reads the workspace's industry profile and renders 'BPR' for supplements/food/APIs, 'BMR' for pharma, 'DHR' for devices. The underlying data model is the same.
• MMR snapshot at release means a mid-campaign MMR revision can never silently change a BPR's structure.
• Every kiosk action carries the operator's authenticated user_id and a server-side timestamp. Shared logins are impossible because authentication is per-session.
• Two-component e-signatures (identifier + password) carry the regulated meaning enum and bind to the BPR row at the database tier.
• Photographs captured at the kiosk are stored with their original capture timestamp; the audit trail records the operator, the device, the file size and hash.
• Deviations raised from the kiosk generate a deviation record that links into the BPR view and blocks release sign-off until closed or formally accepted with rationale.
• Release uses the same two-component e-signature primitive and carries the meaning 'reviewed and released'. The reviewer cannot be one of the operators on the batch (independence enforced at the database tier).
• On release V5 emits a regulated-report PDF for archive. The PDF is a representation; the record of record is the structured data and its audit trail, retained for the full predicate-rule period.

See below for regulator-grade answers to the questions buyers ask most often when evaluating an eBPR.