FSMA 204 Recordkeeping and FDA Information Requests

Understand the general retention period and its exceptions

The rule generally requires covered records to be maintained for two years, with exceptions and specific provisions that must be checked in the current regulation. Do not apply a single retention rule to every business record without reviewing the record type and relevant section. The recordkeeping system should preserve legibility, protect records from loss or deterioration and make the information needed to understand a record available alongside it.

Prepare for an FDA request

FDA explains that records required by the rule, along with information needed to understand them, must be made available within 24 hours after a request or within a reasonable time agreed with FDA. In specified circumstances, an electronic sortable spreadsheet containing relevant traceability information must also be provided. The rule does not mean firms must routinely upload all traceability data to FDA; the request and applicable provision govern the response.

Test the full chain from record to export

Prepare an incident workflow before it is needed. Identify the response lead and backup, the system permissions required, the location of source records, the process for reconciling supplier/customer data, the approved export format and the method for quality-checking the response. A person should be able to retrieve records even if the usual administrator is unavailable or the business is operating outside normal hours.

Mock tests should measure more than elapsed time. Confirm that the selected lot can be traced one step back and forward where applicable, that transformations preserve input-output relationships, that supporting records open, and that the export can be sorted without manual reconstruction. Record gaps, assign owners and retest after correction.

Record retrieval drill: measure completeness, not just speed

A retrieval drill should start with a clearly identified lot or event and record the time the request is received, who is contacted, which systems are searched, which supporting records are needed and when the complete response is assembled. Internal targets can be stricter than the legal response requirement, but label them as internal service levels rather than quoting them as law.

Check whether records remain readable and interpretable after export. A file that opens but omits linked attachments, truncates lot codes or uses unexplained abbreviations may not be useful to the recipient. Include a data dictionary or explanatory context where needed to understand the record, and ensure links to supporting documents are functional for the person who must review them.

After the drill, classify each gap: record absent, record present but inaccessible, data inconsistent, lot relationship unclear, export incomplete, or responsibility unclear. Assign a distinct corrective action to each cause and repeat the drill to confirm the fix.

Records that need context as well as data

A record may be technically present but still difficult to interpret if the field names are unexplained, units are missing, a location code has no lookup, or the lot relationship is stored in a separate file with no reliable join key. Identify the supporting context needed to understand the record and ensure that it is retained and retrievable with the required information.

If records are maintained by a third-party service provider, confirm the contract, access rights, export format and business continuity arrangements. Test retrieval without depending on the individual who originally configured the account. Where electronic links are used, test the links from the perspective of the person who must respond to a request, including the permissions they will have at that time.

After a retention period expires, follow the organisation’s documented disposition process and any other applicable legal holds or recordkeeping obligations. Do not delete records solely because a general two-year period appears to have elapsed without checking the record type and the current rule.

Design records for people who did not create them

Good records should be understandable outside the team that generated them. Define abbreviations, maintain a location directory, document how internal identifiers map to traceability lot codes, and retain enough context to interpret date and quantity fields. If a record depends on a separate lookup table, preserve the version that applied to the transaction or ensure that historical values remain resolvable.

Access control should not make the record unavailable during an incident. Identify the primary and backup responders, test permissions, and define a process for obtaining records held by a vendor or partner. Where a system outage is possible, document the approved backup method and how manual records are reconciled after service returns.

Keep response drills as evidence: the request scenario, selected lot, records retrieved, export, gaps, time taken, corrective actions and retest. A drill report that only states “completed successfully” gives little insight into whether the record chain actually worked.

Example: the primary system is unavailable

An outage procedure should state who authorises the backup method, how the affected transaction is identified, where temporary records are stored and how they are reconciled after service returns. Define how duplicate entry is prevented and how the final record shows the source and any correction. The backup method should preserve the required data and lot links rather than capture only a product name and quantity.

Test the recovery process by creating a controlled offline record, restoring the system and reconciling the data. Verify that the record can still be retrieved in the same way as ordinary records and that the export does not omit backup transactions.

Keep the test evidence and update the procedure if staff cannot follow it without improvisation. A continuity plan that has never been exercised may not work when the business is under pressure.