What review by exception means
Review by exception (RBE), also called exception-based review, is a way of reviewing batch records in which the reviewer looks only at the entries a validated system has flagged as exceptions, instead of reading every entry. ISPE’s definition, as cited in PharmTech, describes it as an approach where “manufacturing and quality data are screened to present or report only critical process exceptions.”
The idea is simple. If an electronic system has already checked every weight against its limit, enforced every step sequence and captured every signature, then reading those entries again adds little. The reviewer’s time is better spent on the places where something did not go as planned.
The scale of the change can be large. A 2023 EY article on electronic batch records describes RBE as able to “reduce a 150-page batch record review to a three-page exception report.” That is a consultancy illustration, not a benchmark, but it explains why interest is growing.
Is review by exception acceptable to regulators?
No FDA regulation or guidance mentions review by exception by name. What the rules require is a complete review. Section 211.192 says the quality control unit must review and approve “all drug product production and control records” before release. RBE is acceptable only when you can show that reviewing the exceptions gives the same assurance as reviewing everything.
That proof comes from three places:
- Validation of the system. Under 21 CFR 11.10(a), the system must be validated for “accuracy, reliability, consistent intended performance.” For RBE, that validation must show that every condition the reviewer would care about is actually captured as an exception.
- Enforcement in the system. Section 11.10(f) calls for “operational system checks to enforce permitted sequencing of steps and events.” The more the system enforces, the less the reviewer needs to check.
- A written procedure. The review SOP must define what an exception is, who reviews it, and what the reviewer still checks in full.
EU regulators are moving in the same direction for audit trails. The draft revised Annex 11 (public consultation July to October 2025) says in section 12.7 that “reviewing all entries in an audit trail record may not be effective,” and calls for targeted, risk-based review focused on changes that may indicate GMP violations. Section 12.5 says “the use of tools to help conduct audit trail reviews is encouraged.” This is not a general endorsement of RBE for batch records, but it is the clearest regulatory statement so far that full manual review is not always the best review.
The prerequisites for RBE
RBE is the last step of a digital batch record program, not the first. Industry sources describe a staged path:
| Stage | What the system does | Is RBE possible? |
|---|---|---|
| Paper | Nothing; humans record everything | No |
| Paper on glass | Electronic form; few checks | No; errors can still be entered silently |
| Electronic batch record with limits | Checks values against limits, forces deviation entry | Partly; some sections can be exception-reviewed |
| Integrated EBR / MES | Pulls data from equipment, enforces sequence, captures alarms and events | Yes, once validated |
PharmTech’s overview of RBE describes this progression: start with paper on glass, then add the logic for “equipment, material, and skills management” that enforces compliance, and only then move to exception reporting.
Before claiming RBE, confirm these are in place:
- Limits for every critical value are configured, not just displayed
- Equipment status, calibration and cleaning status are checked by the system before use
- Material identity and expiry are checked by scanning, not by typing
- Operator training status is checked before a step can be signed
- Data from scales, sensors and controllers flows in directly
- Audit trail events on critical data are captured and reportable
What counts as an exception
The exception list is the heart of RBE. If something is missing from it, nobody will see it. A typical list includes:
Process exceptions
- Values outside limits (alarm, alert or action limits)
- Deviations raised during the batch
- Steps executed out of sequence or skipped with justification
- Hold times exceeded
Manual intervention exceptions
- Manual entries where automatic capture was expected
- Overrides of system checks
- Comments entered by operators
- Late entries or entries made after the step
Data integrity exceptions
- Changes to critical data after entry (audit trail events)
- Signature corrections or re-signing
- Failed logins or permission overrides during the batch
Material and equipment exceptions
- Substituted materials or lots
- Equipment used out of calibration or cleaning validity (if the system allows it with override)
Each exception needs a severity and an owner. An operator comment may need only acknowledgment; an override of a critical limit needs a deviation number.
How to justify RBE in validation
Inspectors will ask how you know the exception report is complete. A defensible justification has four parts.
Risk assessment. For each section of the batch record, list what could go wrong and whether the system prevents it, detects it as an exception, or neither. Anything in the “neither” column stays under full manual review.
Challenge testing. Deliberately create each exception type in validation (an out-of-limit weight, a skipped step, a data change) and show it appears on the exception report. FDA’s final guidance on Computer Software Assurance (September 2025) supports focusing testing on high-risk functions; exception capture is one.
Parallel review. For a defined number of batches, run full review and RBE side by side and compare findings. Any finding the full review caught that RBE missed means the exception list is incomplete.
Ongoing verification. Periodically pull a sample of batches for full review to confirm the exception logic still holds after system changes.
Common RBE mistakes
- Claiming RBE on paper on glass. If the system does not enforce limits, there are no reliable exceptions to review.
- Leaving audit trails out. FDA’s data integrity Q&A says the records the quality unit reviews include audit trails. An RBE that ignores data changes is incomplete.
- No full-review fallback. Sections the system does not control (for example, manual visual checks) still need full review, and the SOP must say so.
- Exception lists frozen at go-live. New equipment, new steps or system updates add new failure modes. The list must be under change control.
- Reviewers who acknowledge without reading. If 300 low-severity comments appear on every batch, reviewers stop reading them. Tune severity so the report stays meaningful.
Review by exception readiness checklist
- The batch record is fully electronic for the sections covered by RBE
- Limits, sequence and material checks are enforced by the system
- A written exception list exists, with severity and owner for each type
- Audit trail events on critical data are included as exceptions
- Every exception type was challenge-tested in validation
- A parallel review compared RBE with full review
- Sections not covered by RBE are named in the SOP and fully reviewed
- The exception list is under change control
- Periodic full reviews confirm the logic still works
Test your exception logic with AskDona
The weak point of RBE is the exception you did not define. AskDona reads completed batch records, deviation logs and audit trail exports and flags issues across the whole record, not only the flagged items. Compare its findings with your exception report to find gaps before an inspector does. Run a sample batch record assessment on a batch you already reviewed by exception. AskDona shows the evidence; your quality unit decides.
FAQ
What is review by exception? A batch record review method where a validated system flags exceptions and the reviewer examines those, instead of reading every entry.
Is review by exception the same as exception-based review? Yes. The terms are used interchangeably, along with “batch review by exception” (BRBE).
Does FDA accept review by exception? FDA requires a complete quality unit review under 211.192 but does not prescribe how. RBE is acceptable when validation shows the exception report captures everything a full review would.
Can review by exception be used with paper records? No. RBE depends on a system that enforces limits and captures exceptions automatically.
Do audit trails need to be part of RBE? Yes. Changes to critical data are exceptions in their own right, and FDA treats audit trails as part of the record the quality unit reviews.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| PharmTech, Review by Exception: Connecting the Dots | Trade journal article (2019) | ISPE definition; staged path to RBE |
| EY, How electronic batch records can improve pharma manufacturing | Consultancy article | Review reduction illustration |
| 21 CFR Part 211 Subpart J (eCFR) | US regulation | 211.192 review requirement |
| 21 CFR Part 11 (eCFR) | US regulation | 11.10(a) validation, 11.10(f) sequencing checks |
| Draft revised Annex 11 (2025 consultation) | EU draft guideline | Sections 12.5 and 12.7 |
| EC consultation page | EU consultation page | Consultation dates |
| FDA, Data Integrity and Compliance With Drug CGMP: Q&A | FDA guidance | Audit trails in quality unit review |
| RQA, FDA issues final guidance on Computer Software Assurance | Professional association news | CSA final guidance date |