Key obligations

• Map record repositories (digital and physical) and assign custodians.
• Define secure transfer methods for sharing confidential files with regulators.
• Rehearse record-access drills to prove you can deliver within the expected timeframe.
• Keep records for the retention period MoCRA specifies (at least 6 years in most cases).

Evidence regulators expect to see

• Record inventory showing location, owner, and access level.
• SOP describing how to deliver files securely (encrypted email, portal, on-site review).
• Drill log with dates, participants, and outcomes.
• Distribution datasets tying lots to customers for traceability.

Intake sections that populate this section

• Records Access
• Training & Docs
• Policies & References

Relevant SOP templates

• Records Access SOP

Risk of non-compliance

• FDA can escalate to warning letters or mandatory inspections when records are delayed.
• Retailer audits may fail if teams cannot retrieve documents during the visit.
• Internal investigations stall without a defined hand-off process.

Further reading

• 21 U.S.C. § 364f – Records
• FDA MoCRA Overview – Records Access