Chain of Custody

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated December 2025 • Traceability, Evidence Integrity & Controlled Transfers • Warehouse, QA, Lab, Security

Chain of custody is the documented, attributable record of who had control of a material, sample, product, or record, when they had it, where it was, and what happened to it at each handoff. It is the difference between “we think this is the right item” and “we can prove it is the right item.” In regulated manufacturing and testing, chain of custody protects the integrity of critical evidence: raw materials at goods receipt, samples in LIMS workflows, in-process and finished goods lots in the WMS, and inspection-ready records captured under data integrity expectations with an attributable audit trail (including Part 11/Annex 11 principles where applicable).

Chain of custody becomes critical when the consequences of uncertainty are high: recalls, customer disputes, regulatory inspections, contamination investigations, product diversion concerns, controlled substances, high-risk allergens, or any situation where the question is not just “what happened,” but “can you prove what happened.” A good chain-of-custody system reduces ambiguity by making handoffs explicit, by preventing informal transfers, and by preserving a continuous, tamper-evident story from origin through disposition.

“Traceability tells you where it came from. Chain of custody proves who controlled it at every step.”

1) What Chain of Custody Covers

Chain of custody applies anywhere custody matters: when something moves between people, locations, systems, or states. It can be used for inbound materials, in-process bulk, packaged goods, returns, samples, retained materials, high-risk ingredients, regulated chemicals, and documents that support release decisions. In its simplest form, chain of custody answers: Who had it? Where was it? When did it change hands? What condition was it in? What was the purpose of the transfer?

The “chain” must be continuous. If there is a gap—an unrecorded handoff, missing timestamp, unknown storage condition—then the evidence value degrades. In many regulated environments, the presence of gaps is more important than whether you can guess what likely happened. Chain of custody exists to eliminate guessing.

2) Chain of Custody vs Traceability vs Genealogy

These concepts are related but not identical:

• Traceability: the ability to link inputs to outputs across the supply chain and production flow (see end-to-end genealogy).
• Genealogy: the “family tree” of lots and transformations—what lot was consumed into what batch, what intermediate became what finished goods.
• Chain of custody: the custody and control history—who physically controlled the item/sample and under what conditions, including handoffs and storage control.

You can have good genealogy and still have weak chain of custody if transfers are informal. You can also have strong chain of custody for a sample even if the broader product genealogy is complex. The best systems treat these as complementary: genealogy explains relationships; chain of custody defends the integrity of those relationships.

3) Why Chain of Custody Exists (The Real Risk It Controls)

The risk chain of custody controls is not abstract. It is the risk of misidentification, tampering, contamination, substitution, or uncontrolled handling—especially when multiple people and locations are involved. If you can’t prove custody, you can’t rule out interference. That matters for:

• Lab samples: wrong sample, swapped sample, degraded sample, or undocumented storage conditions producing invalid results.
• High-risk materials: allergens, hazardous chemicals, controlled substances, or high-value ingredients vulnerable to diversion.
• Customer or regulatory disputes: proving what you shipped, what condition it was in, and whether handling conditions were controlled.
• Investigations: determining whether an anomaly could be explained by custody or condition issues rather than intrinsic product failure.

In plain terms: chain of custody prevents the organization from lying to itself under pressure. It forces reality into the record.

4) What a “Custody Event” Should Capture

A custody event is a single handoff or control change. The fields you capture should be consistent and sufficient to defend integrity. A practical minimum set includes:

• Unique identity: lot number, serial number, container ID, sample ID, or shipment ID.
• Event type: receive, transfer, issue, return, sample, seal, unseal, open, close, split, relabel, pack, ship, quarantine, release, dispose.
• Timestamp: the time the custody change occurred (not the time someone remembered to record it).
• From/To: person/role and location (bin, room, cage, lab bench, truck, line, freezer, quarantine zone).
• Condition: seal intact/broken, container integrity, temperature status, damage notes, contamination risk notes.
• Reason: why the transfer occurred (testing, staging, kitting, investigation, shipment, rework, disposal).
• Authorization: who approved the transfer when approvals are required (ties to roles & permissions and audit trails).

When custody is critical, “nice-to-have” fields become necessary. For example, if temperature is critical, temperature must be captured as a condition, not as an optional comment. If seals matter, seal ID or seal state must be recorded.

5) Physical Controls That Support Chain of Custody

Chain of custody is not only a record; it is a control system. Physical controls reduce the chance of custody gaps and make the recorded story credible:

• Seals and tamper evidence: seals on shipments, sample containers, and high-risk storage. Broken seals should automatically trigger a hold and investigation path.
• Controlled locations: cages, locked rooms, restricted bins for high-risk items and samples, with limited access roles.
• Clear labeling: container IDs and sample IDs that can be scanned and verified consistently.
• Segregation rules: allergen or chemical segregation to reduce cross-contact (see incompatible segregation and allergen control topics).
• Temperature control: defined storage (fridge, freezer, cold room) and acceptance rules for excursions.

Without physical controls, chain of custody becomes a story that could be false. Physical controls make the story defensible.

6) Chain of Custody in Warehouse and Production

In warehouse and production environments, chain of custody often shows up as enforced scanning and controlled movements. The organization must be able to demonstrate:

• Where the lot was stored: accurate bin history and movement trail (bin/zone topology).
• Who moved it: attributable user events linked to each transfer and pick.
• When it changed state: when it entered quarantine, when it was released, and when it was issued to a batch.
• How it was consumed: linkage to batch execution and the eBMR, including weigh/dispense steps and sign-offs.
• How returns were handled: returns to stock, partial containers, and re-labeled containers need documented custody to prevent mix-ups.

Chain of custody in production is also about preventing “ghost inventory.” If a transfer happens physically but not in the system, your custody chain breaks and your traceability claims degrade. That is why the best systems treat every move as a scan event, not a manual entry.

7) Chain of Custody in Laboratory Work

In labs, chain of custody is often the difference between valid and invalid data. A sample that is not controlled can produce a test result that is not defensible. Chain of custody in lab workflows typically includes:

• Collection event: who collected the sample, from what lot/batch, at what time, and under what conditions.
• Container identity: sample container ID and labeling verification to prevent swaps.
• Storage conditions: whether the sample was refrigerated/frozen, protected from light, or held under defined limits.
• Transfers: handoff to the lab, assignment to analysts, and controlled movement between benches or instruments.
• Testing event linkage: test methods, instrument runs, and review steps tied to the right sample in LIMS.
• Retention/disposal: how long the sample is retained and how it is disposed or archived, aligned to record retention expectations.

This is why chain of custody is inseparable from data integrity. If the sample identity is uncertain, the data is uncertain. If the custody chain has gaps, the results become vulnerable in audits and investigations.

8) Handling Exceptions: When the Chain Breaks

Chains break in real life: someone forgets to scan, a label falls off, a seal is broken, a temperature logger fails, a sample is left out, or a container is damaged. The program is judged by how it responds to these failures. A mature chain-of-custody program defines explicit exception rules:

• Immediate status control: place impacted material/sample on hold or quarantine until evaluated.
• Event documentation: record what happened, when, and who discovered it, with attribution.
• Impact assessment: determine whether integrity could be compromised and whether results remain valid.
• Escalation: route to deviation or nonconformance, and document disposition via MRB when needed.
• Corrective action: repeated breaks trigger training, process redesign, or CAPA.

Exceptions are not embarrassing. Uncontrolled exceptions are. The system must treat chain breaks as quality events, not as “fix it later” admin problems.

9) Designing Chain of Custody to Be Executable

The best chain-of-custody systems are designed to be easy. If custody events are burdensome, people will bypass them. Practical design principles:

• Make scanning the default: use barcodes/labels so identity is captured quickly and consistently (see barcode validation).
• Restrict manual overrides: allow exceptions only with documented reasons and approvals.
• Use controlled locations: bins and zones that enforce movement rules and reduce ambiguity.
• Keep event types standardized: a small set of well-defined event types is better than a long list no one uses correctly.
• Link custody to workflows: receiving, quarantine, sampling, testing, shipping, and disposal should naturally generate custody events.

Chain of custody should not feel like “extra work.” It should feel like “how work is done.”

10) Chain of Custody and Audits

Auditors rarely ask “do you have chain of custody.” They ask questions that chain of custody answers:

• Show me where this lot was stored and who moved it.
• Show me how this sample was collected, stored, and tested.
• Show me how you prevent unapproved material from being used.
• Show me how you know the released lot is the same lot that was tested.
• Show me the evidence trail for this investigation or complaint.

A strong chain-of-custody system answers these questions quickly because the events are already captured with attribution, time, and identity, backed by audit trails and controlled permissions. That speed is not just convenient; it is proof that the system is real.

11) How This Fits with V5 by SG Systems Global

V5 WMS. In the WMS, chain of custody is expressed as attributable movement and status events: goods receipt, directed put-away, lot transfers, quarantines/holds, picks, returns, and shipment staging. Because every movement is tied to a user, time, and location, the custody chain becomes naturally audit-ready and supports genealogy.

V5 QMS + Records. In V5 QMS, custody-related exceptions can be escalated into deviations, nonconformance, MRB, and CAPA with linked evidence and approvals. Document control and audit trails keep the custody story defensible, especially when custody events affect release decisions.

V5 MES + Execution. In execution workflows, custody becomes the “who did what when” history of material issue, dispense, and consumption events captured into the eBMR, strengthening the link between warehouse custody and batch evidence.

Bottom line: V5 turns chain of custody into a living operational control: movements and handoffs are captured by default, exceptions are governed, and the evidence chain remains inspection-ready end to end.

12) FAQ

Q1. Is chain of custody only for laboratories?
No. Labs use chain of custody heavily, but it also applies to warehouse movements, controlled storage, high-risk materials, returns, shipments, and any situation where custody integrity must be defensible.

Q2. What’s the difference between chain of custody and audit trail?
An audit trail records changes to data and actions in a system. Chain of custody records custody and control handoffs of physical items/samples (and associated records). They overlap when custody events are recorded digitally and must be attributable.

Q3. What should we do if a custody event is missed?
Document the gap as an exception, place impacted material/sample on hold or quarantine if needed, assess impact on integrity, and route into deviation/nonconformance if required. Repeated gaps should trigger CAPA and process redesign.

Q4. Do we need tamper-evident seals for chain of custody?
Not always, but seals are common where the consequence of interference is high (controlled substances, high-value ingredients, legal disputes, certain sample types). If seals are used, seal state should be captured as a custody condition.

Q5. How does chain of custody support recalls?
It strengthens recall evidence by proving where lots were, who controlled them, and whether handling conditions could have contributed to the issue. Combined with genealogy, it supports faster containment and a more defensible root-cause narrative.

Q6. What is the minimum viable chain of custody?
Unique identity, timestamped transfers, attributable person/role, controlled from/to location, and condition notes for critical constraints (seal/temperature/integrity). If those elements are consistently captured, the custody chain becomes defensible.

Related Reading
• Traceability & Linkage: End-to-End Genealogy | Upstream Traceability | Batch-to-Bin Traceability | Serialization
• Warehouse & Controls: WMS | Goods Receipt | Bin & Zone Topology | Directed Put-Away
• Lab & Evidence: LIMS | Tests & Analyses | Data Integrity | Audit Trail
• Exceptions & Disposition: Quarantine | Hold/Release | Nonconformance | MRB | CAPA