When HSA audits a Singapore importer or wholesaler for Good Distribution Practice (GDP), its auditors look closely at the records the computer system produces. The reference is HSA's Guidance Notes on Good Distribution Practice (GUIDE-MQA-013, December 2023). This checklist maps each relevant clause to what your warehouse or ERP system should be able to show.
Why does software matter in an HSA GDP audit?
HSA licenses therapeutic product importers and wholesalers under the Health Products Act. It checks a company's GDP compliance as part of licensing. The guide allows electronic records in place of paper, but only under the conditions in section 5.9.
In practice, an auditor will ask you to show a batch trace, a stock balance, a temperature record or a change history on screen. If your system cannot produce it, you have a finding.
HSA audits the company, not the software. No system is "HSA certified". The question is whether your system, and the procedures around it, produce records that meet the guide.
What does GUIDE-MQA-013 require of electronic records?
Section 5.9 sets six conditions:
- There are detailed written procedures for the system in use.
- The accuracy of the records is checked.
- Only authorised persons can enter or modify data.
- There is a record of changes and deletions, meaning an audit trail.
- Access is restricted by password or other means.
- Data, including the audit trail, stays readily available throughout the retention period and is protected by back-up to separate media.
The guide's own self-assessment checklist sums this up as "Computerized record: restricted access, audit trail and back-up". For deeper expectations on data integrity, many auditors also refer to the PIC/S data integrity guidance.
What should the system prove, clause by clause?
| GDP clause | What the guide expects | What your system should show |
|---|---|---|
| 5.6 Distribution records | Product, date, invoice or delivery order number, purchaser or supplier name and address, batch, expiry, quantity and stock balance | A per-batch ledger with a running balance, linked to every receipt and delivery document |
| 5.5 Contemporaneous records | Records made when the action is taken; alterations must leave the original readable | Entries time-stamped by user; edits keep the old value; no silent overwrites |
| 5.9 Computerised records | Restricted access, audit trail of changes and deletions, back-up | Role-based access, an audit log you can filter by record and user, and tested backups kept off the main server |
| 3.3 Labelling | Cartons labelled with at least product name, batch and expiry | Batch and expiry required at goods receipt; labels printed from the system |
| 3.4 Quarantine | Damaged or suspect goods quarantined physically or with an equivalent electronic system, and not sold | A quarantine status that blocks sales and transfers until an authorised person releases it |
| 3.5 Stock reconciliation | Periodic reconciliation of quantity, condition and expiry; discrepancies investigated | Cycle-count sheets per batch and location, with a variance report and approval |
| 3.6 Expiry | No receipt or supply of expired or near-expiry products | Minimum-remaining-shelf-life rules at receipt and at dispatch |
| 3.7 FEFO | Stock rotation by first expiry, first out, checked regularly; justified deviations only | Pick lists that suggest the earliest expiry, with overrides logged along with a reason |
| 7 Recall | Written recall plan, a designated person, customers informed, final reconciliation report | A batch-to-customer trace in minutes, exported as a spreadsheet, and a reconciliation of delivered against recovered |
| 8 Returns | Returns kept apart from saleable stock until a qualified person decides | A returns status separate from saleable stock, and a disposition record signed off by the Responsible Person or delegate |
| 10 Self-inspection | Recorded self-inspections with corrective and preventive actions (CAPA) | Reports that support the inspection, such as an expiry report, a quarantine ageing report and an audit trail extract |
What does HSA expect for cold-chain storage?
Annex 1 of the guide covers cold-chain products. Its main points for storage and records are:
- Mapping: map cold rooms under representative conditions to decide where probes go, and map again after significant changes.
- Continuous monitoring: monitor and record cold room and refrigerator temperatures continuously, using probes calibrated periodically for the operating range.
- Alarms: fit an alarm system with alert and action limits, and test it periodically.
- Backup power: keep storage temperature and monitoring running during a power failure, and test generators periodically.
- Excursions: have written procedures for handling temperature excursions during receipt, storage and delivery.
- Transport: map and monitor refrigerated vehicles if they are the main means of temperature control. This is not needed when a qualified insulated container is used.
For general storage, section 2.7 asks for devices that monitor storage conditions continuously and record readings such as daily maximum and minimum temperature and humidity. The readings must be reviewed regularly. Section 2.8 requires calibration traceable to national or international standards.
Your software does not have to be the data logger. It should, however, link a zone's temperature history to the batches stored there, so you can judge an excursion batch by batch.
What will an auditor ask you to demonstrate?
- "Show me every customer who received batch X, with quantities." Time how long this takes.
- "Show me the stock balance of batch X, and reconcile it to the shelf."
- "Who changed this invoice or this stock adjustment, and what was the original value?"
- "How do you stop a quarantined or recalled batch from being picked?"
- "Show me last month's temperature records for the cold room, and what happened at the last excursion."
- "When did you last restore from a backup, and where is the backup kept?"
- "Who has rights to approve stock adjustments or release quarantine?"
Rehearse these with your Responsible Person before the audit. HSA sets out the Responsible Person's duties in GUIDE-MQA-028 (November 2024).
What gaps do spreadsheets and basic accounting tools leave?
- No audit trail: a spreadsheet cell can be overwritten without leaving a record.
- No blocking: accounting packages often track quantity but not batch status, so quarantined stock can still be invoiced.
- No trace: batch numbers typed as free text cannot be traced reliably across documents.
- No expiry control: nothing stops a near-expiry batch from shipping.
How Asli Pharma ERP helps
Asli Pharma ERP captures batch and expiry at goods receipt, and GS1 DataMatrix scanning can fill both in. It also provides:
- FEFO picking
- A quarantine status that only an authorised QC release can clear
- Cold-chain zones with a temperature log
- Batch recall with a full customer trace, customer notice letters and a close-out report
- Approvals for sensitive actions
- An audit trail of who changed what
Asli Pharma ERP supports GDP record-keeping, but it cannot make a company compliant. HSA assesses your procedures and people as well as your records. Singapore GST F5 and InvoiceNow are on our roadmap.
Frequently asked questions
Does HSA certify warehouse or ERP software?
No. HSA licenses and audits the company, and checks the company's GDP compliance before issuing an importer's or wholesaler's licence. Software can support GDP record-keeping, but no system makes a company HSA compliant on its own.
What does GUIDE-MQA-013 say about computerised records?
Section 5.9 allows records to be kept by an electronic system if detailed procedures exist, record accuracy is checked, and only authorised persons can enter or modify data. There must be an audit trail of changes and deletions, access restricted by password or similar, and back-up to separate media. The data, including the audit trail, must remain available throughout the retention period.
What must a distribution record contain?
Section 5.6 lists product name, transaction date, invoice or delivery order number, name and address of purchaser or supplier, batch number, expiry date, quantity received or sold, and stock balance.
Is temperature mapping required for a cold room?
Annex 1 of the guide states that cold rooms used for cold-chain products should be temperature-mapped under representative conditions to find the right probe locations, and re-mapped after significant changes. Temperatures must be monitored and recorded continuously, with calibrated probes and a tested alarm system.
Can quarantine be managed electronically?
Yes. Section 3.4 allows damaged or suspect products to be quarantined either physically or with an equivalent electronic system, and they must not be sold or supplied. Quarantined, rejected, returned and recalled stock should be accessible only to authorised personnel.