Christian (00:00)
Season theme, closed loot traceability, supply risk.
Two questions decide how bad a supplier problem gets. The first, what does your industry actually require you to trace? The second, when a lot goes bad, how fast can you prove where it went? Most teams have a fuzzy answer to the first and a slow answer to the second. Today, we fix both.
Welcome back to the compliance lab on the QT9 QCast, where we take one messy real-world scenario and turn it into a system you can actually run. I'm your host, Christian Reyes. Today we do two things. First, we're gonna break down what traceability really requires across the major quality standards, because the bar is not the same in a machine shop as it is in a drug plant. Then we run the where use drill. We talk about what it is, how to perform it, and what it tells you.
And this is the foundation of our season theme, closed loop traceability and supplier risk.
Here's the thing that nobody says out loud. Every quality standard makes you identify product. Label it, know its status. What changes from one industry to the next is how far you have to trace it. And that bar climbs with risk. So let's start at the bottom. ISO 9001, the general quality standard. Clause 8.5.2, identification is required, but real lot and serial traceability is conditional. The standard only asks for it when it's a requirement.
quote unquote. Translation, ISO nine thousand one by itself makes you label it, it doesn't make you trace it until a customer or a regulator says so. Now let's step up to aerospace. AS9100, which is gonna become IA ninety one hundred. Same clause number, eight point five point two, but amplified. Aerospace flips the default, traceability is on, and it goes further than anyone else. You have to trace the product back to the raw material batch that it came from.
And forward to the destination of everything made from that batch. Plus, it flows down to your sub-tier suppliers. In aerospace, the drill doesn't stop at your dock, it runs down to the heat lot of the metal and out to every tail number. Now, medical devices. ISO 1345, clause 7.5.9. Here, traceability is not optional at all. You have to document how far it goes and what records you keep.
And for implantable devices, you go even deeper still. Components, materials, even work environment conditions. On the FDA side of things, the old rule, 21 CFR, 820.65, tied a control number on every unit or lot to implant and life-sustaining devices alike. That section did not survive the transition that happened earlier this year. As of this year, the QMSR runs on ISO 1345 instead.
Because ISO 1345's deep traceability clause names only implants. The FDA had to write a new provision, 820.1D, to pull back the life-sustaining devices back under the same bar. Different clause number, same practical result. And then at the top, we've got pharmaceuticals, part 211, CGMP. There's no single traceability clause because the whole system is traceability. Every batch gets a record.
Every component with its supplier and its lot number. A reconciliation that ties any finished batch back to the exact material lots that went into it. Pharma assumes that a recall is coming and builds the trail in advance. Backward to the supplier, forward to the shelf. So that's the ladder. Conditional in ISO 9001, on by default in aerospace, mandatory and deep in medical, and total in pharma. We'll put the full breakdown on screen.
standard clause and how deep you have to go. But here's why it matters today. Every one of those requirements is just a promise on paper until you test it. The test is the where use drill. When people hear where use, they picture a bill of materials or an ERP search. Start with a part, ask where it went. And that's a fine start, but it's not the whole drill. Think of it like a less like a database lookup and more like contact tracing.
Your supplier lot is the index case. The drill is how you trace every exposure, what it touched, where it spread, who's affected, and how you contain it before it reaches anyone else. That's the line between basic and closed loop traceability. Basic traceability tells you which work order used a component. Closed loop traceability tells you what products were affected, which customers may be exposed, what supplier action is required, what has to change internally.
and how you're gonna verify that that's not gonna happen again. Connect the material, the process, and the decisions behind it, and you're not just finding records. You're managing risk at this point.
So let's build it. Five parts. Part one: start at the source. Identify the supplier, the part or material, the lot number, the purchase order number, the res the receiving record, and the cert that came in with it if it had one. Most traceability problems are born right here at receiving. The supplier dock in one folder, you have your inspection record in a whole other system, and inventory status is somewhere else. A strong system tells that whole story in one place.
Part two, contain it. Where is that material at right now? Raw inventory, quarantine, staged, work and process, finished goods, or is it already shipped? Before root cause, before disposition, before any customer decision, you stop the risk from moving. And the rule: a hold that only lives in a spreadsheet is not a true containment. If the floor cannot see that hold, the hold is not real. Part three, trace the product. Move into production history.
Which work orders used that lot? Which batches, assemblies, or serial numbers came out of those jobs? Any substitutions, any deviations, or any rework? This is where your product genealogy gets tested. Can you prove what went into what, when, and under what approval status? Part four, find the exposure. Are the affected products still under your control? What's still finished, what's in still in finished goods, what shipped, to which customers, and in what quantity? This is where good traceability pays for itself.
Go from everything we ship this quarter down to these two lots, these three customers, and this date range. And you've changed the whole situation. The goal isn't a blanket recall, it's precision. Part five: close the loop. You found the material, the product, the customers, now connect it back. Does this need a supplier corrective action request, or what we said call a SCAR? An internal nonconformance or KAPA? Does the supplier's risk rating change?
Should incoming inspection catch it next time? Does a spec need to be revised or do people need to be retrained? Because the output of the drill isn't a list of lots. It's a decision, it's a decision package. What happened, what's affected, what's contained, what actions are required, who owns it, when it's due, and how you're going to verify that it worked.
Make it real fast. A supplier calls lot B247, a stainless bracket you use in two product families, may have had an autotolerance cleaning process. You run the drill, source, you pulled a lot, the POs, the certs that came in with on let's say two different shipments. Contain the containment, some brackets are still in raw inventory, so they go on hold. The product itself.
B247 traced into four different work orders across both product families. Exposure. Two finished lots are still in your building, one shipped to a customer, and one is staged for manufacturing. So to close the loop, open up your supplier corrective action, revise the inspection, update the risk rating. You're no longer asking where that bracket went, you're asking what risk it created, what controls held, which controls failed, and what has to change.
So what do you get out of this? Run the drill and score five things. Because each one is a piece of information about your system. Time to exposures, how fast you can find the inventory, work orders, finished goods, and shipments tied to your lot. That's how long your clock runs in a real event. Completeness of evidence. Can you connect supplier docs, the inspection results, and disposition records? Or do you hit dead ends? That's whether you could defend the trace in an audit.
Containment readiness. Can you place material on hold visibly and fast? The quality system linkage is if you can connect that issue to actual nonconformances, kappas, supplier actions, supplier corrective actions, change control and training. And decision readiness. Could leadership make a competent call from what you've pulled together? And that last one is a whole point. The purpose of traceability isn't to collect records, it's to support a fast,
confident, defensible decision. And here's what usually decides all five. Are your systems connected? If supplier records live in one place, your inspections live in another, the inventory is in a completely separate ERP system, and Kappa's are you know tracked in a spreadsheet, the drill is gonna become a scavenger hunt. But when your QMS and ERP actually talk, that lot number becomes a single thread that you can pull. Receipt, inspection, work order, finished goods, shipment, customer,
And corrective action all hang off of the same record. And that's the idea of a platform like QT9. And it's where this season is headed. So here's your challenge. Pick one supplier, one recent lot, and then run a 30-minute where use drill against those five scores we talked about. If it took hours of digging through emails and shared drives, that's your signal. Eventually isn't a plan when supplier risk gets urgent. And remember the ladder that we started with.
Whatever your industry requires, again, conditional in 9001, deep in medical, total in pharma. The where use drill is how you prove you actually meet the requirements. It's not complete when you've just find the record. It's complete when your organization is safer because of what that record revealed. If this helped, please like, comment, and subscribe. And if you want a simple where use drill scorecard for your team to use, drop your email in the comments and I'll send it on over.
I'm your host, Christian Reyes, and this has been the compliance lab on the QT9 QCast. Until next time, keep improving and stay compliant.
