Summary
In short
- Set the boundary to the last known good point, not to the batch that triggered the hold. That is nearly always further back than it feels.
- Physical control matters more than a system status. Product flagged as held in a system and sitting in a normal location will be picked.
- Release requires named authority and evidence, and the person who authorises release should not be the person under pressure to ship.
- Concessions are decisions to accept product that does not meet specification. They need customer agreement where the specification is the customer's, and they should be rare and trended.
- Track hold ageing. Product held indefinitely because nobody will decide is a decision to write it off slowly, made by inaction.
- Where the affected boundary cannot be established, that is a traceability finding as well as a quality one.
What it is
What it is
What is a hold and release record?
The record placing product under control so it cannot be used or despatched, defining the boundary of what is affected, documenting the investigation and the disposition decision, and evidencing the authorised release.
How is the boundary determined?
By running back to the last point at which the condition was demonstrably good: the last passed check, the last verified calibration, the last confirmed clean. That is usually further back than the immediate batch, and drawing it at the batch in front of you is the most common way product escapes.
When to use it
When to use it, and when not to
This controls product pending a decision. The investigation and the corrective action sit alongside.
Use it for
- Product suspected or confirmed as not meeting requirements
- Product affected by a process deviation, equipment failure, or failed check
- Material affected by a supplier notification or a customer complaint
- Product pending test results where release cannot proceed without them
- Any situation where the affected boundary needs defining before disposition
Not for
- Root cause analysis, which investigates why rather than controls what
- The corrective action record, tracking actions to prevent recurrence
- Customer complaint handling, which may trigger a hold
- The recall process, which applies once product has left your control
- Rework instructions, which follow a disposition decision
Standards
What it is built against
Control of nonconforming output is a core requirement across quality and food safety standards.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 9001 cl.8.7.1 | Nonconforming outputs identified and controlled to prevent unintended use or delivery | What is held |
| ISO 9001 cl.8.7.2 | Documented information on the nonconformity, actions taken, concessions and the authority deciding | Release |
| 21 CFR 117.150 | Corrective actions including evaluating product for safety and preventing affected food entering commerce | Disposition |
| ISO 22000 cl.8.9.4 | Withdrawal and recall, and handling of potentially unsafe products | Disposition |
| BRCGS Issue 9 cl.3.8 | Control of nonconforming product with identification, quarantine and disposition | What is held |
| 21 CFR 211.87 | Retesting of approved components subject to deterioration (pharmaceutical parallel) | Investigation |
| IATF 16949 cl.8.7.1.1 | Customer authorisation for concession before further processing | Release |
| ISO 9001 cl.10.2 | Corrective action following nonconformity, including determining causes | Related records |
What it does not cover
- Root cause analysis, investigating why rather than controlling what.
- The corrective action record, tracking prevention of recurrence.
- Complaint handling, which may trigger a hold.
- The recall process, applying once product has left your control.
- Rework instructions, following a disposition decision.
Filling it in
Filling it in well
Define the boundary properly, control the product physically, and name who released it.
Not the current batch, but back to the last occasion the condition was demonstrated acceptable. For a failed detector check that is the last passed check; for an out-of-tolerance instrument it is the last confirmed calibration; for a cleaning failure it is the last validated changeover. Record the reasoning as well as the boundary.
A status flag prevents transactions and does not prevent a person picking a pallet from a normal location. Physical segregation, or at minimum unambiguous marking and a location that signals held, is what stops product moving. Systems fail open when someone is in a hurry and the pallet is where it always is.
The person deciding product is acceptable should not be the person accountable for shipping it on time. The conflict is real, it operates strongest when the hold is expensive, and separating the roles costs nothing beyond deciding to.
Product held for months because nobody wants to write it off is being written off slowly by inaction, while occupying space and creating the risk that someone eventually releases it to clear the area. Ageing the hold list and requiring a decision at defined intervals turns a drift into a choice.
Audit findings
Common audit findings
Hold findings concentrate on the boundary and on how the release happened.
| Finding | Clause | What fixes it |
|---|---|---|
| Boundary drawn at the current batch rather than the last known good point. | 21 CFR 117.150 | Run back to the last demonstrated good condition; that is what defines the affected population. |
| Product held in the system but not physically segregated. | ISO 9001 cl.8.7.1 | Physical control; a status flag does not stop a pallet being picked. |
| Release authorised by the person accountable for despatch. | ISO 9001 cl.8.7.2 | Separate the roles; the conflict peaks when the hold is expensive. |
| Concession granted without customer authorisation where the specification is theirs. | IATF 16949 cl.8.7.1.1 | Customer authorisation is required before further processing. |
| Holds ageing indefinitely with no forced decision point. | ISO 9001 cl.8.7.1 | Age the list; indefinite hold is a write-off decided by inaction. |
| Boundary reasoning not recorded, only the conclusion. | ISO 9001 cl.8.7.2 | Record why the boundary sits where it does; it will be examined. |
| Affected boundary could not be established from records. | BRCGS 3.9 | That is a traceability finding as well as a quality one. |
| Partial release of a held population without re-examining the boundary. | ISO 9001 cl.8.7.1 | Releasing part of a batch requires the same reasoning as holding it. |
| Concessions frequent and not trended. | ISO 9001 cl.10.2 | Repeated concession is a specification or capability finding, not a disposition one. |
| Held product in a normal storage location. | BRCGS 3.8 | Location should signal status; ambiguity is resolved in favour of shipping. |
Worked case
Case in point: the boundary that moved
A metal detector failed its check at the end of a four-hour run. The immediate decision was to hold the product made in the preceding hour, on the basis that the detector had been working earlier and the failure was probably recent.
The verification regime was hourly, and the last passed check had been three hours earlier because two intermediate checks had been missed during a changeover. The defensible boundary was therefore three hours of production, not one.
The distinction was not academic. Holding one hour meant releasing two hours of product that could not be shown to have passed through a functioning detector, and no amount of reasoning about when the failure probably began changes what could be demonstrated.
Definitions
Definitions and key terms
- Hold
- Control preventing product being used or despatched pending a disposition decision.
- Last known good point
- The most recent occasion the condition was demonstrated acceptable, which defines the affected boundary.
- Disposition
- The decision on held product: release, rework, downgrade, concession, return or destruction.
- Concession
- Acceptance of product not meeting specification, requiring customer authorisation where the specification is theirs.
- Physical segregation
- Locating held product so it cannot be picked in error, distinct from a system status flag.
- Release authority
- The named person empowered to release held product, separated from despatch accountability.
- Hold ageing
- Tracking how long product has been held, which converts drift into a decision.
- Extent of condition
- The population affected, determined by the boundary rather than by the batch that triggered the hold.
FAQ
Frequently asked questions
How far back should a hold extend?+
To the last point at which the relevant condition was demonstrably good: the last passed check, the last verified calibration, the last validated clean. Everything after that point is unknown. Reasoning about when the failure probably began is frequently correct and is not evidence, and the disposition has to rest on what can be shown.
Is a system hold sufficient?+
No. A status flag prevents transactions and does not prevent someone picking a pallet from its usual location when they are in a hurry. Physical segregation, or at minimum a location and marking that unambiguously signal held status, is what actually stops product moving. Ambiguity gets resolved in favour of shipping.
Who should authorise release?+
Someone with the authority to say no, and not the person accountable for shipping on time. The conflict is real and operates most strongly when the hold is large and the customer is waiting, which is precisely when the decision matters. Separating the roles requires nothing but a decision to do so.
What is the risk of an ageing hold?+
Two things. Product held for months is being written off slowly by nobody deciding, which is worse than deciding to write it off. And it occupies space and creates pressure, so eventually someone releases or disposes of it to clear the area, under conditions where the decision receives less scrutiny than it would have at the outset.
What if we cannot establish the boundary?+
Then you have a traceability finding as well as a quality one, and the boundary has to be drawn conservatively by definition. Being unable to determine what was affected is a more serious finding than the original nonconformity, because it means the same limitation will apply to every future event including a recall.
The agents
What the agents do with it
The record controls product pending a decision. What fails is a boundary drawn at the current batch and a hold that aged for a year.
Sets the boundary from the last passed check or verified condition, records the reasoning, and requires named release authority.
Applies physical segregation and location control so held product cannot be picked, rather than relying on a status flag.
Ages held product and forces a decision point, and trends concessions as a specification finding rather than a disposition.
Links equipment failures and calibration results to the affected production window, so the boundary is retrieved rather than reconstructed.
This template lives in KnowQuality — quality and food safety. HACCP, nonconformance, traceability, laboratory and customer complaints.
Sources
Sources
- ISO 9001:2015 clause 8.7, control of nonconforming outputs
- 21 CFR 117.150, corrective actions, FDA
- BRCGS Food Safety Issue 9 clause 3.8, control of nonconforming product
- IATF 16949:2016 clause 8.7.1.1, customer authorisation for concession
- ISO 22000:2018 clause 8.9, control of product and process nonconformities