Why Batch Release Fails FDA Inspection After the Lot Has Already Shipped

The investigator is holding one lot. Not a random one — the one with the deviation. An environmental excursion during the fill. A deviation opened, investigated, and closed before the product shipped. The batch record is complete, and the lot went to market eleven months ago. Then the question comes flat: this batch had an event — who decided it was releasable, on what evidence, and why. The room goes quiet.

That is where a release failure surfaces — not at the lot that was bad, but at the lot that was never required to explain why it was good enough to ship. The batch was made. The testing passed. What is in question is the judgment made the moment the disposition was signed, and whether it survives reconstruction.

Release is treated as the end of the work. The batch record is reviewed, the deviation is closed, the results conform to specification, and someone with release authority signs the disposition. The organization experiences this as the lot clearing the line. An investigator experiences it as a decision that has already been made — and now has to be defended.

The 483 that follows a release failure does not cite bad product.¹ It cites the absence of documented disposition logic. The lot exists, the record is complete, the testing is in the file. What does not exist is the record of why the deviation was judged not to compromise the lot, what standard the excursion was measured against, and what residual risk was accepted — at the moment the release was authorized, by the person accountable for authorizing it.

What that looks like in a released batch file

In most facilities, release produces this in the QMS:

QMS BATCH DISPOSITION RECORD

Lot Number: 2026-0554
Product: [Sterile Injectable, 10 mL]
Deviation: DEV-2026-0188 (closed)
Disposition: RELEASED
Released By: [QA Reviewer]
Release Date: 2026-05-28
Status: Distributed
Notes: Batch record reviewed. Deviation
investigated and closed. Lot meets specification.
[Signature]

That entire record is workflow, not authorization. Workflow systems document that the process completed — the lot was made, the record reviewed, the deviation closed, the disposition signed, the lot shipped. Authorization documents the judgment behind the disposition. Why the recorded event was judged not to affect the product, what standard the excursion was held against, what residual risk was accepted as tolerable — none of that lives in the file. The workflow completed. The authorization was never recorded.

When an FDA investigator pulls that disposition record and asks, “This lot carried a deviation — why did you release it, and on what basis?”, the releaser can answer verbally. The answer might be sound.

But verbal doesn’t survive inspection.

The left column is what the QMS produces by default. The right column is what an investigator reconstructs. A facility can have the entire left column intact — a clean record, a closed deviation, a conforming lot — and fail the inspection on the absence of the right.

What QA leaders are already telling you

The pattern shows up the same way across facilities. A release authority will describe their disposition practice and name the exact gap without realizing it:

We review every batch record before release, and the workflow captures who signed and when the lot shipped. What I can’t always point to, going back into a released lot that carried a deviation, is why we judged the event wouldn’t affect the product — what we weighed, what standard we held it to. I know the team thought it through. I’m not sure we wrote down what they concluded.

The quote separates it precisely. What the system recorded was process completion — signer, date, disposition, status. What it never recorded was the reasoning behind the disposition: why the excursion was judged immaterial, what acceptance criteria it was measured against. The thinking existed. It was never written where an investigator can reconstruct it. The release authority already named the gap. What they’re missing is the artifact that closes it.

What investigators actually look for

What investigators look for at release is not proof that a disposition was signed. The existence of the release is not in question — the lot is on the market. What they evaluate is whether the act of releasing it was a governed decision or an administrative signature. Those produce identical QMS entries and entirely different inspection outcomes.

The evaluation runs along three lines, and each one is a place where the disposition record either holds or collapses.

Disposition: why this lot shipped despite the event

A lot that runs clean and releases is one thing. A lot that carried a deviation and released anyway is a statement that the organization judged the event did not compromise the product. The investigator’s question is direct: what made this lot releasable. If the answer is “the deviation was closed and the lot met specification,” that is two facts sitting next to each other, not a judgment recorded. A closed deviation explains that the investigation ended. It does not explain why the event was immaterial to the lot. The record has to show that someone looked at the excursion, weighed it against the product’s quality attributes, concluded release was warranted — and signed their name to that conclusion.

Impact: why the deviation was judged not to compromise the lot

Every released lot that carried an event has a quiet assumption inside it: that the event did not reach the product. Investigators are not evaluating whether the deviation was closed. They are evaluating whether its impact on the lot was assessed and the assessment recorded — which attribute the excursion could have touched, what evidence shows it did not, and who confirmed that read before the lot shipped. A deviation closed without a documented impact-to-product basis is a finished investigation attached to an unreasoned release.

Standard: what the lot was measured against

The disposition is a position the organization took: that the excursion fell on the acceptable side of a line. The investigator reads the release as that position and asks for the line.² What acceptance criteria the event was judged against, what would have forced a reject or a hold, and how close the call was. A release with no documented standard is not a conservative disposition or an aggressive one — it is an undocumented one, and at inspection, undocumented and indefensible are the same finding.

The consequence is rarely confined to the one lot. Trace it forward.

A disposition signed with no recorded rationale becomes the reason the next finding lands harder. The decision made in the time it takes to sign sets the ceiling on everything the release can defend afterward.

Disposition logic is not the signature that released the lot. It is the record of the judgment the signature cannot make for you — why this event, against this standard, with this residual risk, was authorized by this person. The batch record proves the lot was made correctly. The release record defends the decision to ship it. Inspection only ever asks for the second one.

The cross-examination the release record has to survive

The way to test a disposition record is to read it the way an investigator reads it — as a witness that can only say what was written down. Four exchanges decide whether the record holds.

Each exchange follows the same arc. The company points to what the QMS captured. The investigator evaluates the decision behind it. The distance between the two is the observation. None of these gaps mean the lot was bad. They mean the release cannot be reconstructed — and a decision that cannot be reconstructed cannot be defended.

What a defensible release record contains

The fix is not a better disposition dropdown or a longer notes field. It is a record built at the moment of release that captures the reasoning the QMS leaves out — the same six elements that make any compliance decision reconstructable, applied to the act of releasing the lot:

• The decision being authorized — release of this specific lot for distribution, stated explicitly, not implied by a signature on the disposition line.
• The accountable authorizer — the release authority, named by role and individual, distinct from the batch-record reviewer.
• The evidence considered — the certificate of analysis, the deviation investigation, the in-process record, the environmental or comparable-lot data.
• The disposition logic — why the recorded event was judged not to compromise the lot’s identity, strength, quality, or purity.
• The standard basis — the acceptance criteria the excursion was measured against, and the threshold that would have forced a reject or a hold.
• The risk basis — the residual risk accepted and why it was tolerable, captured contemporaneously.

That is the record an investigator cannot widen, because it answers the question before it is asked. The reasoning is documented. The disposition is justified. The standard is on the record. The release withstands the part of the inspection that happens long after the lot has already shipped.

The decision the record defends

The release decision is made once, in the time it takes to sign, by someone who already knows why the lot is fit to ship. Inspection reconstructs that decision months or years later, from a file that kept the workflow and discarded the reasoning. If the disposition logic, the standard, and the risk basis were never written down, they do not become defensible under questioning — they become indefensible retroactively. The lot may have been perfectly fit to release. By the time it is examined, fit is no longer the standard. Reconstructable is.

Batch records were never built to hold that reasoning, and a longer notes field will not save it. The Inspection-Ready Record (IRR) preserves the authorization moment as it happens — the disposition logic, the standard applied, the evidence considered, the named release authority — contemporaneously, in the form the inspection will demand. One decision, sealed when it is made, so it never has to be reconstructed from memory.