Every result would trace back to its sample, method, analyst and lot, and every change would leave a record

Chain of custody is the unbroken record of who held a sample, where and in what condition, from receipt to disposal. ISO/IEC 17025:2017 asks a laboratory for a procedure covering transport, receipt, handling, storage, retention and disposal (7.4.1), and for unambiguous identification retained while the item is in its care, including sub-divisions (7.4.2). Part 111 asks a supplement manufacturer to identify each unique lot of components so it can be traced to the supplier, the date received, its status and the products it went into (21 CFR 111.155(d)(1)).

The steps are a proposed design. Roles follow Part 111: quality control personnel review and approve test results (111.110(c)) and make disposition decisions (111.87), and their review is documented with date and signature at the time of performance (111.140(b)(2)). With motion allowed the sample moves by itself; under reduced motion use the buttons.

FDA's 2018 Q&A defines metadata as the contextual information required to understand data, and an audit trail as a secure, computer-generated, time-stamped record that allows the course of events around a record to be reconstructed. A balance or pH-meter printout can be the original record; an FT-IR spectral file is dynamic and can be reprocessed, so a printout of it is not a true copy (question 10). Chromatographic data should be saved at each step or injection, aborted runs captured in the audit trail, and every reprocessed result kept (questions 12 and 14).

ISO/IEC 17025:2017 requires a LIMS to be validated for functionality, including its interfaces, before use (7.11.2), protected from unauthorized access, tampering and loss (7.11.3), and calculations and data transfers to be checked (7.11.6). A conformity statement needs a documented decision rule (7.8.6), and a corrected report is a new, identified report that references the original (7.8.8).

Under Part 111, a firm may rely on a supplier's certificate for components other than dietary ingredients only if it first qualifies the supplier by confirming the certificate's results, the certificate describes the methods, limits and actual results, and the qualification is documented, periodically re-confirmed and approved by quality control (21 CFR 111.75(a)(2)(ii)(A)–(E)). Each dietary-ingredient lot still needs at least one identity test (111.75(a)(1)(i)).

Part 11 sets the criteria under which FDA treats electronic records and signatures as trustworthy and equivalent to paper (11.1(a)). It applies to electronic records kept under any FDA records requirement (11.1(b)); Part 111 states that all electronic records must comply with it (111.605(c)). Records required only by Part 117 or by the food traceability rule are exempt (11.1(i), 117.305(g), 1.1455(e)).

In its 2003 guidance FDA said it would interpret Part 11 narrowly and would not enforce its validation, audit-trail, record-retention and record-copying requirements (11.10(a), (b), (c), (e) and (k)(2)) while it re-examined the rule, but that predicate-rule requirements still apply and that it would keep enforcing access limits, operational, authority and device checks, training, accountability policies, documentation controls and all electronic-signature requirements. The proposed system would implement every control regardless.

Electronic signatures must be unique to one person (11.100(a)), issued after identity verification (11.100(b)) and certified to FDA as legally binding (11.100(c)); non-biometric signatures use at least two components such as an ID code and password (11.200(a)(1)).

FDA defines data integrity as the completeness, consistency and accuracy of data, and says such data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA). The guidance is nonbinding and was written for drug CGMP (21 CFR 210, 211 and 212); it is used here because it defines the terms. PIC/S PI 041-1 adds four attributes (ALCOA+): complete, consistent, enduring and available, and lists chronological sequencing, date formats, units, rounding and significant digits as examples of consistency.

The right-hand column quotes or paraphrases rule text a supplement and ingredient laboratory would follow; it does not claim that any rule uses the word “ALCOA”.

Part 111 requires a unique identifier for each lot of components received or produced, traceable to the supplier, date received, status and the product made from it (111.155(d)(1)); a batch record listing the identifier and the weight or measure of each component used (111.260(d) and (e)); a lot number for each packaged and labeled lot from a finished batch (111.260(a), 111.415(f)); and records of product distribution (111.475(b)(2)). The figure joins those links. A backward trace answers which inputs, suppliers and tests stand behind a lot; a forward trace gives the scope of a recall.

The lots, suppliers and customers are invented to show the method; they describe no real product or company.

The rule (21 CFR Part 1, Subpart S) applies to persons who manufacture, process, pack or hold foods on FDA's Food Traceability List (1.1300). The list names “Herbs (fresh)”, with parsley, cilantro and basil as examples, and covers foods that contain a listed food only while it stays in the listed form, such as fresh (FDA, Food Traceability List page, current as of Jul 24, 2026). The list does not name dried herbs, botanical extracts or dietary supplements; whether a given input is covered must be checked against the list.

Covered firms keep a traceability plan (1.1315), assign traceability lot codes at initial packing, first land-based receiving and transformation (1.1320), keep the key data elements for each critical tracking event, provide records to FDA within 24 hours of a request, as an electronic sortable spreadsheet in an outbreak or recall unless a size exemption applies (1.1455(c)), and keep them for 2 years (1.1455(d)). The original compliance date was January 20, 2026. FDA proposed a 30-month extension (90 FR 38084), and Public Law 119-37, § 780 bars the use of funds to enforce the rule before July 20, 2028.

A cryptographic hash turns any record into a fixed-length digest; changing one character changes the digest. Linking each record's hash to the previous one (Haber and Stornetta, 1991) means that editing an early record breaks every later link unless all later records are recomputed, and recomputing changes the final hash. Sharing that final hash with a customer, or having it time-stamped by an independent authority (RFC 3161), makes a full rewrite detectable. NIST describes blockchains as tamper evident and tamper resistant rather than immutable (NIST IR 8202, 7.1) and notes that a ledger cannot tell whether input data reflect real-world events (7.3).

For a certificate of analysis, the hash would prove that the document a customer holds matches the one released; it would not prove the analysis was right. Correctness still depends on validated methods, qualified instruments, trained analysts, second-person review and the Part 11 controls above. Proposed use: hash certificates and shipment records at release, publish or share the digest, and treat any correction as a new, linked document (ISO/IEC 17025 7.8.8).