Batch records that survive an audit: what to log, keep and be able to find

A batch record template with the fields that matter, two way lot traceability from supplier to customer, retained samples, and how long the rules want it all kept.

A batch record has to answer two questions from a standing start, months or years later: what went into this particular tin, and which other tins share its history. Everything else on the sheet exists to make one of those answers possible. This page gives an eighteen field record, the yield reconciliation that catches errors the same day, the traceability chain in both directions, the retention period each jurisdiction sets, and a mock recall that tests the whole thing in an afternoon.

• 18 fields, one page
• Yield reconciliation within 2%
• 2 retained units per batch
• PIF kept 10 years after last batch
• MoCRA adverse events: 6 years

What the record is actually for

Three different people read a batch record, and none of them is you on the day. A customer with a complaint needs it to say what they were exposed to and whether anyone else got the same thing. An enforcement officer or safety assessor needs it to show the product was made the way the file says. And you, six months on and staring at a batch that behaves differently, need it to say which variable moved, which is the only way to close out batch to batch inconsistency.

All three converge on one rule: record what happened, not what was supposed to happen. A sheet reading "beeswax 150 g" because that is what the formula says is a copy of the formula. A sheet reading "beeswax 150.4 g, lot BW-2411" is evidence. The difference is four seconds a line, and it is the whole value of the exercise.

The eighteen fields

Print the record before you start and fill it in at the bench. One completed from memory at the end of the day loses exactly the things nobody remembers: the actual weights, the temperature at the pour, the reject you binned.

Batch codes that carry information

A batch code has one hard requirement, uniqueness, and one useful property, being readable without a lookup. A date-first structure such as YYMMDD-FORMULA-SEQ gives both: 260906-LBV2-01 sorts chronologically, names the formula at a glance and distinguishes a second batch made the same day. Avoid pure sequential numbering, and avoid anything a customer could misread as a best before date. The batch code generator builds and checks a scheme.

The code must be on the unit, not only the outer carton: a base label or hot-stamped lid on a tin, the bottom of the barrel on a tube. If it lives on a sticker that peels, the chain breaks exactly where somebody needs it, which makes label adhesion a compliance issue rather than a cosmetic one. What else appears alongside it differs by market, and is under labelling cosmetics in the US.

Yield reconciliation to within 2 percent

Reconciliation compares what you weighed in against what you can account for. It is the cheapest error detector available: it runs on numbers you already wrote down, and it catches mistakes before despatch rather than after.

Theoretical yield is the sum of the weighed inputs, field 8. Accounted mass is units filled times mean net fill weight, plus retains, plus weighed rejects, plus weighed residue. Reconciliation is accounted over theoretical, and the working tolerance is 98 to 100 percent.

That tolerance is only reachable if you weigh the residue. Small batch residue on jug, spatula and spout runs 3 to 8 percent of the batch, far outside any 2 percent band, so a maker who ignores it will never close a reconciliation and will conclude the exercise is pointless. Weigh the jug empty before you start and again after pouring. How that loss falls as batch size rises is on batch scaling.

Batch B is short by 141.2 g and the record narrows the cause fast. The mean fill is 2.7 percent over nominal, worth a few grams at most. The residue is normal. So about 130 g either never went into the jug or left the bench unrecorded, which in practice is one of four things: a decimal or tare error at the balance, a material weighed into a cup and never tipped in, an unrecorded spill, or units filled and discarded uncounted. Check the balance record first, because a 100 g class error is both the most common and the easiest to confirm. Calibration checks are under weighing and calibration.

Two way traceability, and the direction people get wrong

Traceability is two chains, used in different emergencies.

Backwards, from a unit to its inputs, is the direction most makers can already do. A customer reads a code off a tin, you find the batch record, the record names every supplier lot, and the goods-in file holds the certificate of analysis for each. It answers "what is in this and where did it come from", and it is well served by the discipline in sourcing ingredients.

Forwards, from a supplier lot to every affected unit, is what you need when a supplier issues a withdrawal notice, and it is the direction almost nobody can do. It needs three links a backwards-only system lacks: a goods-in log recording which batches consumed which lot, a batch record stating how many units were made, and a despatch record saying where they went. Miss one and the chain stops.

1. Log lots on receipt, not on use. A goods-in sheet with date, supplier, material, lot, quantity and your own reference takes a minute per delivery and heads the forward chain.
2. Record consumption against the lot. When a lot is opened, note the batch codes it goes into. A column on the goods-in sheet is enough.
3. Put the batch code on the despatch record. Every order, invoice and consignment note should carry the batch codes it contained. This is the link almost always missing.
4. Record market days as a batch set. You cannot identify buyers at a stall, so record which batch codes were on the table on which date. That bounds an otherwise impossible trace.
5. Reconcile the unit count. Units made must equal sold plus stock plus retained plus destroyed. If it does not balance, the forward trace has a hole.

Be honest about the market stall case. Face to face sales are untraceable to a person, so the only forward remedy is a public notice: a post on your own channels, a notice at the stall, and notification to the enforcement authority where the product was placed on the market. That is a limitation of the channel, not a failure of the record, and it is worth weighing when you decide how much stock to take to an event.

Retained samples: two units, 15 to 20 C, expiry plus six months

Keep two units of every batch, in final packaging, unopened, dark, at a steady 15 to 20 C, until the assigned best before date plus six months. The two do different jobs: one is opened when a question arises, the other stays sealed so a later question can still be answered. The six month tail exists because complaints arrive after the date has passed, and a sample destroyed on the expiry date is destroyed exactly when it becomes useful.

Steady temperature matters more than low temperature. A retain cycling between 12 C and 26 C on a garage shelf ages differently from the stock a customer holds, which makes it a poor comparator. A frozen control is a separate thing with a separate job, the unchanged sensory reference in shelf life and stability testing, and it does not replace the ambient retain.

The storage cost is small. Twenty batches a year, two units each, held for a two year date plus six months, is about a hundred units on the shelf at steady state, which for lip balm tubes is one shoebox. Label each with the batch code and the date it may be discarded, because an unlabelled retain is landfill with extra steps.

What ISO 22716 actually asks for

ISO 22716 is the cosmetic good manufacturing practice standard, and the reference EU and UK law points to when it requires manufacture in accordance with GMP. It is written as expectations rather than specifications, which is why a domestic workshop can satisfy it. Two clauses do most of the work for records.

Clause 6, raw materials and packaging materials, expects incoming materials to be identified, accepted against defined criteria and traceable to a supplier and lot, with storage and status clear at all times. In plain terms: know what arrived, from whom, under what lot number, whether you accepted it and where it is. That is fields 6 and 7 plus a goods-in sheet.

Clause 9, the quality control laboratory, expects sampling, testing and release to follow defined, documented methods, and it is where retained or reference samples sit. It does not require a laboratory. It requires that whatever you check is specified in advance and recorded afterwards, which is fields 16 and 18: checks written down before the batch, results against them, retains held under stated conditions.

The rest surrounds those two: production records under clause 7, out of specification product under clause 10, deviations under clause 13, complaints and recalls under clause 14, documentation under clause 17. Certification is voluntary and nobody has to audit you. The standard is a purchased document, so check the clause numbering against your own copy rather than any summary. The wider system in a home workshop is under workshop hygiene.

How long to keep it, by jurisdiction

Retention periods come from different instruments in different places, and they do not agree.

Ten years is the practical answer for anyone selling into more than one market: it satisfies the strictest of these and lines up with the liability long-stop. Note that batch records are not themselves a listed component of the product information file, which must contain a description of the method of manufacture and a statement of GMP compliance. Your batch records are the evidence behind that statement, so they have to outlast it. The file is covered under selling balms in the UK and EU and its central assessment under safety assessment and the CPSR.

Two things this page cannot decide. Which regime applies to you turns on where the product is placed on the market, who the Responsible Person is and whether you import as well as make. And none of this is legal advice: the limits are set out in the safety disclaimer, and the notification duties running alongside retention under cosmetic notification portals and MoCRA duties.

The complaint log, and when a complaint becomes a report

Complaints belong in one sequentially numbered log, not an email folder. Record the date received, the channel, the customer's contact details, the product and pack size, the batch code, the complaint in the customer's own words, whether it is a quality issue or a reported skin reaction, whether a sample came back, the immediate action, the root cause, the corrective action and the date closed. The customer's own words matter: a complaint logged as "texture" when it began as "it went grainy" loses the detail that would link it to three other batches.

Some complaints are reportable, and the threshold is set by instrument rather than by your judgement. In the European Union and the United Kingdom, Article 23 of Regulation (EC) No 1223/2009 requires the Responsible Person and distributors to notify serious undesirable effects to the competent authority without delay. In the United States, MoCRA requires the responsible person to report a serious adverse event to the FDA within 15 business days of receipt. The definitions are not identical, but both centre on hospitalisation, persistent disability, disfigurement, infection or an event needing medical intervention.

A reaction report is also where claims language starts to matter, because a product described in drug-like terms invites a different regulatory reading of the same event. That line is drawn under cosmetic versus drug claims, and the insurance side under insurance and liability.

Run a mock recall this month

A traceability system that has never been tested is a hypothesis. Testing it costs an afternoon and finds the gaps while they are cheap.

1. Pick the trigger at random. Open the goods-in file, take a supplier lot received six to twelve months ago, and write the lot number down. Do not choose an easy one.
2. Start a clock. Food sector traceability schemes commonly require the exercise to complete within four hours. Borrow that bar.
3. Trace forwards. List every batch that consumed the lot, then every unit made in those batches.
4. Account for every unit. Sold against an order, sold untraceably at an event, in stock, retained, or destroyed. The figures must add to the units made.
5. Draft the notice. Write the customer email and the authority notification you would send, naming the batch codes and the risk.
6. Stop the clock and write down what broke. Then fix the record system, not your memory of it.

Where to start, and what a record cannot do

If none of this exists yet, the order of return is clear. The batch record comes first: it cannot be reconstructed and everything else joins onto it. The goods-in log with lot numbers is second, because nothing else makes a forward trace possible. Retained samples are third. Batch codes on despatch records are fourth. The mock recall comes last, once there is something to test.

Then be clear about the limit. A perfect record does not make a product safe, prove a formula works, or substitute for a safety assessment. It cannot tell you a supplier lot was contaminated, only which units it reached. It cannot show a batch was stable, which is what accelerated ageing and real time retains are for. And it will not rescue a batch poured at the wrong temperature, though it will let you diagnose that in a minute instead of reformulating, which is why every figure on the pour temperatures page belongs in field 11. A record is an instrument for answering questions, and all it guarantees is that the questions are answerable.

Reviewed and updated 6 September 2026. Spotted an error? Tell us and we will fix and log it.