Risk-Based Life Cycle Management of Master Production and Control Records to Strengthen Data Integrity and GMP Inspection Readiness Part 1: Regulatory Framework, Inspectional Findings, and Documentation System Evaluation

The World Health Organization (WHO) defines manufacturing instructions as a “Master Formula,” an approved master document that describes the complete manufacturing process for a specific product and batch size.1 Equivalent terminology is used globally across good manufacturing practice (GMP) frameworks, including guidance from the WHO, European Union (EU), Pharmaceutical Inspection Co-operation Scheme (PIC/S), and Health Canada.2-5 Although terminology varies across regions and regulatory organizations, these documents serve the same fundamental purpose: to ensure that manufacturing activities are performed in a consistent, controlled, and reproducible manner. For the purposes of this article, the term master production and control record (MPCR), as defined in 21 Code of Federal Regulations (CFR) 211.186, is used.6

An MPCR is required for each product and batch size and forms the basis for the execution of batch production and control records (BPCRs). A batch or lot, as defined in WHO GMP guidance, is a defined quantity of material produced in a single process or series of processes such that it is expected to be homogeneous.2 Although the term batch commonly refers to intermediates or bulk products and lot to finished packaged products, the terms are often used interchangeably within GMP frameworks.1

The MPCR is intended to ensure uniformity from batch to batch by providing complete, accurate, and approved manufacturing instructions. During batch execution, the MPCR is reproduced as a BPCR, which documents the actual manufacturing activities, materials, equipment, in-process controls, and critical process parameters associated with a specific batch. Under US current good manufacturing practice (CGMP) requirements, 21 CFR 211.186 establishes expectations for MPCR content, while 21 CFR 211.188 requires accurate and complete reproduction of the approved MPCR during batch execution.6

Regulatory inspections frequently identify deficiencies in MPCRs and executed BPCRs, including incomplete documentation, omission of critical process parameters, lack of standardization, legibility issues, and inadequate second-person verification. Such deficiencies may compromise data integrity, delay batch release, and increase compliance risk. Inspection observations also indicate that these issues are often associated with inadequate document design, insufficient governance controls, and inconsistent application of electronic tools used to generate MPCR templates.

MPCRs may be implemented using paper-based, hybrid, or fully electronic formats. Paper-based systems remain widely used but are more susceptible to transcription errors, legibility challenges, and extended review timelines. Hybrid systems combine electronic templates with paper execution and are commonly used in industry; however, they may introduce additional complexity in document control and data management. Fully electronic MPCR and BPCR systems, when implemented in compliance with electronic records and signatures requirements under 21 CFRPart 11,7 can reduce documentation errors and enhance data integrity. However, such systems may require greater upfront investment, more extensive validation, and formalized change management processes, resulting in increased implementation complexity and resource requirements.

Spreadsheet-based applications are frequently used to support MPCR development across all documentation formats. When properly designed, validated, and governed, spreadsheet-based systems can provide structured data entry, automated calculation capabilities, improved standardization, and flexibility to accommodate manufacturing and regulatory changes. Compared with database-driven systems, spreadsheet-based tools may enable more efficient implementation of lower-risk changes and require fewer resources. Nevertheless, appropriate validation, access controls, and change management procedures remain essential to maintain GMP compliance.

The development and maintenance of MPCRs are closely linked to process validation and life cycle management. Changes to materials, equipment, processes, facilities, or procedures may require revision of MPCR templates to ensure continued assurance of product identity, strength, quality, purity, and potency. Effective MPCR design and governance support compliance with CGMP requirements, facilitate efficient review by quality units (QUs), and enable consistent execution of validated manufacturing processes.

This article presents a risk-based approach to the development, execution, and life cycle management of MPCRs, with emphasis on alignment with US CGMP requirements and internationally harmonized pharmaceutical quality system guidance, including International Council for Harmonisation (ICH) Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients, ICH Q9 Quality Risk Management, and ICH Q10 Pharmaceutical Quality System.8-10 Particular focus is placed on MPCR design, governance, and change management practices that support accurate execution of BPCRs, enhance data integrity, and reduce compliance risk throughout the product life cycle. The US Food and Drug Administration (FDA) guidance on data integrity further emphasizes the importance of reliable, complete, and traceable manufacturing documentation.11

Regulatory Framework and Risk-Based Evaluation of MPCR and BPCR Systems

Inspectional observations, regulatory requirements, and industry practices related to the development and execution of MPCRs and BPCRs were evaluated to assess alignment with CGMP requirements. The evaluation focused on the completeness, accuracy, control, and reproducibility of MPCR templates, consistent with MPCR requirements described in 21 CFR 211.186 and master production instructions described in ICH Q7 Section 6.4. The evaluation also examined the accurate and complete execution of BPCRs in accordance with batch production and control record requirements described in 21 CFR 211.188 and batch production record expectations described in ICH Q7 Section 6.5.6,8 Additional evaluation criteria included documentation and record retention requirements under 21 CFR 211.180 and QU responsibilities for production record review, investigation of discrepancies, and approval or rejection of records under 21 CFR 211.22 and 211.192.6

FDA Laboratory Information Bulletins (LIBs) describing spreadsheet design, validation, and electronic record controls were also reviewed to evaluate spreadsheet governance and validation practices applicable to MPCR template development and life cycle management.12-14 These practices were evaluated within the regulatory framework established under 21 CFR Parts 210 and 211 for CGMP documentation requirements and 21 CFR Part 11 for electronic records and electronic signatures.6,7

The assessment examined documentation control, data integrity safeguards, and the inclusion of critical manufacturing and control elements. These elements included document version control; identification of critical process parameters; yield calculations and theoretical yield ranges; environmental conditions, such as temperature and relative humidity, where applicable; storage conditions; documentation of deviations and investigations; second-person verification of critical process steps; and documentation of change history. Additional factors evaluated included record legibility, completeness, consistency of entries, and controls designed to prevent unauthorized modification, omission, or backdating of records, consistent with regulatory expectations for data integrity.6,11

Documentation governance practices were also evaluated, including QU oversight of production record review and approval. The extent to which production records were reviewed for completeness, discrepancies, and compliance with established procedures was assessed in accordance with CGMP and pharmaceutical quality system requirements.6,8,10

MPCR and BPCR systems were further evaluated across different implementation formats, including paper-based, hybrid (paper and electronic), and fully electronic systems. The assessment considered the ability of each format to support document control, traceability, data integrity, and life cycle change management. Spreadsheet-based tools and database-driven systems were evaluated as representative electronic documentation approaches, including considerations for validation, version control, access control, audit trail functionality, and implementation of electronic records and electronic signature controls under 21 CFR Part 11.7

Spreadsheet Governance Policies and Template Standardization for MPCR Development

Inspectional observations identified variability and incomplete reproduction of MPCR templates during BPCR execution, consistent with deficiencies in documentation controls required under 21 CFR 211.186 and 211.188.6 The absence of defined software governance policies and standardized template controls contributed to documentation inconsistencies, transcription errors, and increased QU review burden.

Implementation of standardized spreadsheet governance policies improved MPCR template standardization, reproducibility, and documentation accuracy. Spreadsheet templates provided structured data entry, controlled formatting, and automated calculation capabilities, which reduced manual transcription errors and improved documentation consistency. Spreadsheet governance and validation practices were evaluated in accordance with established spreadsheet validation principles and documentation controls described in FDA LIBs.12-14

Spreadsheet validation and governance controls included defined template structure, protection of calculation cells, standardized formatting, controlled formula implementation, data validation rules, conditional formatting, and documented version control and change management procedures. When implemented as electronic systems, additional controls such as audit trails, electronic signatures, and access restrictions were evaluated in accordance with 21 CFR Part 11 requirements for electronic records and electronic signatures.7

These governance practices improved documentation reliability, enhanced data integrity, and supported life cycle management of MPCR templates consistent with CGMP requirements and pharmaceutical quality system expectations.6,8,10

Risk-based principles consistent with ICH Q9 were applied to evaluate the impact of documentation design and system controls on data integrity, operational consistency, and compliance risk.9 Life cycle management considerations consistent with ICH Q10 were also evaluated, including the ability of MPCR systems to support controlled change management, process updates, version control, and continued maintenance of validated manufacturing processes throughout the product life cycle.10

These evaluation criteria provided a structured regulatory and risk-based framework for assessing MPCR and BPCR documentation systems throughout the pharmaceutical manufacturing life cycle.

An example of a standardized spreadsheet-based MPCR template implementing these governance controls is provided in Supplementary File S1. This template illustrates structured data-entry fields, standardized formatting, controlled formula implementation, and defined documentation controls designed to support reproducibility, data integrity, and life cycle management consistent with CGMP requirements, 21 CFR Part 11, and the principles described in ICH Q7, Q9, and Q10.6-10

Inspectional Findings and Documentation System Evaluation

Between 2012 and subsequent evaluation periods, approximately 80 inspections were evaluated across manufacturers of sterile and nonsterile drug products, biotechnology products, APIs, and finished drug products. These evaluations included assessment of MPCRs and executed BPCRs to determine their completeness, reproducibility, and alignment with current CGMP requirements.6

The evaluation identified recurring deficiencies related to MPCR development, standardization, and BPCR execution. Common findings included inadequate document control, lack of standardized MPCR templates, and inconsistencies between approved MPCRs and executed BPCRs. In some cases, additional pages were added to or removed from batch records without appropriate authorization or control, compromising documentation integrity. Documentation deficiencies also included omission or incomplete identification of critical process parameters, missing or incorrectly calculated theoretical yield ranges, incomplete documentation of environmental conditions such as temperature and relative humidity, and absence of defined storage conditions. Additional issues included incomplete documentation of manufacturing deviations and investigations, lack of documented change history, and inconsistent implementation of second-person verification for critical process steps. These deficiencies are inconsistent with CGMP documentation requirements under 21 CFR 211.186 and 211.188.6 Common documentation deficiencies are summarized in Table 1.

Record legibility and completeness were frequent concerns in paper-based systems, particularly where handwritten entries, corrections, and cross-outs reduced clarity and traceability. These practices increased the risk of transcription errors and reduced the efficiency of production and QU review. Data integrity risks were also identified, including incomplete or inconsistent entries and insufficient controls to ensure appropriate documentation practices. In addition, QU review practices did not consistently ensure thorough review of production records for completeness, discrepancies, and compliance with established procedures, as required under 21 CFR 211.22 and 211.192.6

The evaluation further examined the impact of documentation format on MPCR and BPCR management. Paper-based systems, commonly generated from word-processing templates and completed manually, were associated with increased risk of transcription errors, legibility challenges, and extended review timelines. Hybrid systems, which combine electronic templates with paper execution, provided some improvements in documentation management but introduced additional complexity in maintaining document control and traceability. Fully electronic systems, when implemented with appropriate validation, access controls, and audit trail functionality, supported improved documentation consistency, traceability, and data integrity in accordance with electronic records requirements under 21 CFR Part 11.7 MPCR implementation formats and their associated characteristics are summarized in Table 2.

An assessment of documentation technologies used across inspected facilities found that both word-processing and spreadsheet applications were commonly used to develop MPCR templates and execute BPCRs. Spreadsheet-based templates demonstrated improved standardization, structured data entry, and enhanced document control compared with word-processing templates, which were more frequently associated with formatting inconsistencies and manual entry variability. Spreadsheet systems were observed to support implementation across paper-based, hybrid, and fully electronic documentation environments. When used in paper-based and hybrid formats, spreadsheet templates improved template consistency, record legibility, and document maintenance.

When implemented as fully electronic systems, spreadsheet-based MPCR templates required additional controls to support compliance with electronic records and electronic signatures requirements under 21 CFR Part 11, including audit trail functionality, electronic signatures, access controls, and system validation.7 In some facilities, supplementary software tools were implemented to provide audit trail and electronic signature functionality for spreadsheet-based MPCR and BPCR templates operating within electronic documentation environments. A comparison of documentation technologies, including word-processing, spreadsheet-based, and database-driven systems, is provided in Table 3.

Implementation of structured spreadsheet governance controls—including standardized template design, controlled formatting, validation, protected formula implementation, and defined change control procedures—supported improved MPCR template reproducibility, enhanced documentation accuracy, and strengthened data integrity controls. These governance practices aligned with CGMP documentation requirements6 and electronic records requirements under 21 CFR Part 11.7 Spreadsheet governance controls supporting MPCR template standardization and regulatory compliance are summarized in Table 4.

A representative example of a standardized MPCR spreadsheet template implementing these controls is provided in Supplementary File S1.

MPCR development and management challenges varied by product type. Drug substance manufacturing, particularly for multistep synthesis processes, presented increased documentation complexity due to repeated processing steps, extended production timelines, and the need for precise control of critical process parameters. Biological product manufacturing similarly presented documentation challenges due to the complexity and number of process steps and associated control requirements. These factors increase the importance of structured documentation systems and standardized MPCR templates to support consistent execution and documentation reliability.

Across all evaluated systems, implementation of structured governance practices, standardized MPCR templates, and validated electronic documentation controls was associated with improved reproducibility of batch records, enhanced data integrity, and increased efficiency of production and QU review processes. Systems incorporating structured data entry, controlled template management, and appropriate validation and security controls demonstrated improved consistency between MPCR templates and executed BPCRs, supporting more reliable documentation and improved alignment with regulatory expectations.

Acknowledgment

The author acknowledges Tyson Mew, president of Ofni Systems Inc, for technical consultation regarding spreadsheet-based electronic documentation systems and implementation considerations related to electronic records, audit trails, and data integrity controls. His technical perspective contributed to the practical context discussed in this article. The author also acknowledges his former colleagues at the FDA for their dedication to advancing pharmaceutical quality, regulatory compliance, and data integrity practices.

Conflict of Interest

The author declares no conflicts of interest.

Disclaimer

The views expressed in this article are those of the author and do not represent the official position of the US Food and Drug Administration.

References

1. World Health Organization. Guide to Master Formulae. Guidance Document. WHO/FWC/IVB/QSS/VQR; 2011. Accessed April 7, 2026. https://studylib.net/doc/18121346/guide-to-master-formulae---world-health-organization
2. WHO. Good manufacturing practices for pharmaceutical products: main principles. WHO Technical Report Series No. 908, Annex 4, 2003. Geneva, Switzerland. Accessed April 7, 2026. https://gmpua.com/World/WHO/Annex4/trs908-4.pdf
3. European Commission. EudraLex; The Rules Governing Medicinal Products in the European Union, Volume 4: EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use, Chapter 4: Documentation. Brussels, Belgium: European Commission. Current version. Accessed April 7, 2026. https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en
4. PICS. Guide to Good Manufacturing Practice for Medicinal Products (PE 009-17), Part I and Part II. Effective August 25, 2023. Geneva, Switzerland. Accessed April 7, 2026. https://picscheme.org/docview/660
5. Health Canada. Good Manufacturing Practices Guide for Drug Products (GUI-0001). July 1, 2020. Accessed April 7, 2026. https://www.canada.ca/en/health-canada/services/drugs-health-products/compliance-enforcement/good-manufacturing-practices/guidance-documents/gmp-guidelines-0001/document.html
6. FDA. Code of Federal Regulations, Title 21, Part 210: current good manufacturing practice in manufacturing, processing, packing, or holding of drugs; general; and Part 211: current good manufacturing practice for finished pharmaceuticals. Updated April 30, 2026. Accessed April 7, 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-210
   https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211
7. FDA. Code of Federal Regulations, Title 21, Part 11: Electronic Records; Electronic Signatures. Updated April 30, 2026. Accessed April 7, 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11
8. International Council for Harmonisation. Q7. Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients. November 10, 2000. Accessed February 23, 2026. https://database.ich.org/sites/default/files/Q7%20Guideline.pdf
9. International Council for Harmonisation Q9(R1) Quality Risk Management. January 18, 2023. Accessed February 23, 2026. https://database.ich.org/sites/default/files/ICH_Q9%28R1%29_Guideline_Step4_2023_0126_0.pdf
10. International Council for Harmonisation. Q1. Pharmaceutical Quality System. June 4, 2008. Accessed February 23, 2026. https://database.ich.org/sites/default/files/Q10%20Guideline.pdf
11. FDA. Data Integrity and Compliance with Drug cGMP: Questions and Answers: Guidance for Industry. December 2018. Accessed April 7, 2026. https://www.fda.gov/media/119267/download
12. Cantellops D, Bonnin E, Reid, A. Spreadsheet design and validation for the multi-user application for the chemistry laboratory, Part I. Laboratory Information Bulletin No. 4317. FDA. 2003. Accessed April 7, 2026. https://www.spreadsheetvalidation.com/pdf/LIB_Design_Multi-User2A.pdf
13. Cantellops D. Spreadsheet design, verification and validation, use and storage of single-user workbook files in the US FDA laboratories, Part II. Laboratory Information Bulletin No. 4349. FDA; 2005. Accessed April 7, 2026. https://www.spreadsheetvalidation.com/pdf/LIB_Part_II_Single-User.pdf
14. Cantellops D, Kage E, Manzano MJ, et al. Evaluation of ExcelSafe to implement part 11 rules in FDA analyst workbook files. Laboratory Information Bulletin No. 4524. FDA. 2012. Accessed April 7, 2026. https://www.ofnisystems.com/LIB-4524-FDA-431-and-ExcelSafe.pdf

About the Author

Dennis Cantellops is an independent GMP and data integrity consultant and a former consumer safety officer for the US Food and Drug Administration.