ERP for pharmaceutical industry: records and validation

Business Central and Odoo can record lots, expiration dates and component consumption for a small US finished-drug or dietary-supplement plant. As of October 2026, Microsoft's Business Central pricing page and Odoo's pricing page do not describe 21 CFR Part 11, electronic signatures or GxP validation. Part 11 applies when required records are kept electronically in place of paper, or kept electronically in addition to paper and relied on, and when electronic records are submitted to FDA. The batch contents themselves come from 21 CFR 211 for finished drugs and 21 CFR 111 for dietary supplements. Your quality unit still validates each CGMP workflow for its intended use.

A manufacturing license is a separate line from that validation. Business Central Premium is USD 110 per user per month, paid yearly, and it is the license that includes manufacturing. Treat a nutraceutical plant and a finished-drug plant as different record problems. Buyers who search for an "ERP or SAP specifically for GMP env" are usually trying to separate those layers before they sign a software order.

Which rule set your batch record has to follow

Name the product before you name the software. A finished drug manufactured under US CGMP follows 21 CFR 210 and 211. A dietary supplement follows 21 CFR 111. A cosmetics line, a contract packer of non-regulated goods, or an R&D lab that does not release commercial batches is a third case. The screens for lots can look similar. The record an investigator asks to see does not.

21 CFR 211.188 requires a finished-drug batch production and control record to include an accurate reproduction of the master record, checked, dated and signed. It also requires dates, the identity of major equipment, the specific identity of each component batch, weights and measures, in-process and laboratory results, actual yield against theoretical yield, labeling controls, and the people who performed and checked each significant step.

21 CFR 111.260 is the dietary-supplement list. The batch record must include the batch or lot number, the equipment and lines used, the date and time of cleaning or a cross-reference to those records, and a unique identifier plus the weight of each component. It must show actual and theoretical yield, monitoring and test results, and the date and initials of each step on the master record, including weigh, verify, add and verify-addition. Packaging, label reconciliation, and quality-control review, approval or rejection, and release sit on the same record.

Those two lists are why a supplement brand cannot copy a drug manufacturer's batch template, and why a drug manufacturer cannot treat a supplement template as enough. If you make both, keep the master records and the release decision separate even when both products share a warehouse.

When Part 11 applies to the ERP

FDA's Part 11 scope and application guidance says Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under FDA records requirements, and to electronic records submitted to FDA. The underlying statute and regulations are the predicate rules. Part 11 remains in effect. The FDA page listing that guidance was current as of August 24, 2018.

The same guidance says FDA intends to interpret Part 11 narrowly. It applies when required records are kept electronically in place of paper, or kept electronically in addition to paper and relied on for regulated activities. If you print the batch record and rely on the signed paper, Part 11 generally does not attach to that record. Predicate rules still do. A printed packet that is missing equipment identity, component lot numbers or the second person's check fails 211 or 111 even when Part 11 never enters the conversation.

FDA also says it intends to exercise enforcement discretion on some Part 11 validation, audit-trail, copy and retention provisions. It still enforces access limits, authority checks, operational checks, training, signature accountability and the electronic-signature rules, plus every predicate rule. Discretion on one Part 11 provision is not a waiver of the batch record.

For a closed system, 21 CFR 11.10 requires validation of the system, the ability to generate accurate copies, and retrieval through the retention period. It requires limited access, secure computer-generated time-stamped audit trails that do not obscure prior information, and operational, authority and device checks. Personnel must be qualified. You need written policies that hold individuals accountable for signatures, and change control over system documentation.

If you do use electronic signatures, 21 CFR 11.50 says the signed record must show the printed name of the signer, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility or authorship. Those items must appear on any human-readable display or printout. Ask the vendor to show that block on your own master-record screen. A login, a status change or a work-instruction checkbox is a different object from that manifestation.

21 CFR 211.68 is the finished-drug computer rule, and it applies whether or not you are inside a Part 11 debate. Computers may be used if they are routinely checked under a written program. Changes to master and other records may be made only by authorized personnel. Input and output must be checked for accuracy. A backup file must be exact, complete and secure from alteration, erasure or loss. Where a calculation replaces a written record, validation data for that calculation must be retained.

What standard lot screens still leave off the batch record

Microsoft documents item tracking, tracing and production consumption. Odoo documents lots, a traceability report, expiration dates and bills of materials. Those features answer "which lot moved where." A batch production record also answers who did the step, on which equipment, against which master, with what yield, and who in quality released it.

Use this gap list in every demo. If the presenter cannot show the row on your products, it is still open scope.

• Checked copy of the master (Finished drug (211.188): Required, dated and signed · Dietary supplement (111.260): Date and initials of each master step · What to demand in a demo: Print or display the master version used for that batch)
• Component identity and quantity (Finished drug (211.188): Specific identity of each component batch, weights and measures · Dietary supplement (111.260): Unique identifier and weight of each component · What to demand in a demo: Component lot posted on the consumption line for that batch)
• Equipment (Finished drug (211.188): Major equipment and lines · Dietary supplement (111.260): Equipment, lines, and cleaning date or cross-reference · What to demand in a demo: Equipment ID stored on the batch, not in a side spreadsheet)
• Yield (Finished drug (211.188): Actual yield versus theoretical · Dietary supplement (111.260): Actual and theoretical yield · What to demand in a demo: Both numbers on the closed record)
• Second person (Finished drug (211.188): People who performed and checked each significant step · Dietary supplement (111.260): Weigh, verify, add, verify-addition · What to demand in a demo: Two distinct users, two timestamps)
• Labels (Finished drug (211.188): Labeling controls · Dietary supplement (111.260): Packaging and label reconciliation · What to demand in a demo: Specimen or count tied to the batch)
• Quality decision (Finished drug (211.188): In-process and lab results in the record · Dietary supplement (111.260): QC review, approval or rejection, and release · What to demand in a demo: Release by the quality unit, with the record frozen)

A vendor page aimed at this search says "Generic ERP systems lack the specialized functionality to manage the complexities of pharmaceutical manufacturing." The accurate version is narrower. Standard ERP lot tracking covers identity and movement. It does not, by itself, reproduce the master, capture equipment and yield, or record a second-person check and a quality release. That missing block is configuration, a controlled form, or a separate batch-record tool, and then it is validation.

ERP for food and beverage traceability is a useful parallel for lot genealogy: one lot in, many lots out, and a recall path an operations lead can run. Food traceability is not drug CGMP. Do not treat a food recall report as a 211.188 batch record.

How Business Central handles lots, expiry and production

Business Central item tracking supports serial, lot and package numbers on inbound and outbound documents, with expiration date and warranty date fields. Lot and serial numbers can be required, assigned from a number series or typed. Posted item-tracking entries sit on item ledger entries. A lot can be blocked from transactions. For a regulated component, require the lot on the item, and block lots that quality has not released.

Item Tracing walks a serial or lot number from usage back to origin, or from origin out to where it was used. You can include only item-tracked components, or all components. Microsoft documents two limits you should test with your own history. Only applied transactions are shown. If the same lot was received on multiple transactions, the page may not show all of them. Find Entries lists posted and open records for a serial or lot number and does not show the transaction sequence. Run both pages during vendor selection on a lot that was received twice and consumed on two production orders. If a receipt is missing, your recall file is incomplete.

FEFO picking needs warehouse handling, lot or package tracking, an expiration date on the posted inventory, and Pick According to FEFO turned on for the location. If Strict Expiration Posting is on, expired lots are left out of the pick. A specific lot or serial number already on the source document is honored before FEFO. Leave Strict Expiration Posting off and expired lots are not left out of the FEFO pick. Confirm on your own location whether an expired lot can still be shipped. Put the specific lot on the production order when the master record names it, or FEFO can pick a different released lot than the one quality intended.

Production orders record material consumption and output through journals, or through automatic forward or backward flushing. A finished production order can be reopened once to correct missing consumption or wrong item tracking. There is no dedicated by-product feature. By-products are posted as negative consumption. Business Central manufacturing covers bills of materials, flushing methods and production-order status in more detail. For a CGMP batch, prefer consumption that names the lot a person issued, and treat a reopen as a deviation with its own reason, not as a quiet edit. Forward or backward flush can post a lot the operator never touched if inventory is wrong. That is the finding waiting in an automatic flush.

Premium is the license that includes manufacturing. Essentials is finance, sales and operations and does not include manufacturing. Confirm the user mix before you assume every person on the floor needs Premium.

How Odoo 19 handles lots, expiry and the bill of materials

Odoo 19 lot tracking is optional per product and must be turned on in Inventory settings. A receipt of a lot-tracked product cannot be validated until a lot is assigned. Delivery can pick an existing lot using FIFO, LIFO or FEFO. The traceability report on the lot lists stock moves. On an existing lot, the product and the on-hand quantity cannot be changed, but the lot number text itself can be edited. An editable lot number is a data-integrity problem: the identity on the receipt and the identity on the batch record can diverge after the fact. Restrict who can edit that field, and review changes to it.

Expiration dates require lot or serial tracking. A product can store days to expiration, best-before, removal and alert dates. Those values compute dates when goods are received or manufactured. Dates can also be typed or overwritten on the receipt. FEFO is a location or product-category removal strategy. It is not an automatic block on selling expired goods unless that strategy is set. A responsible user can be notified after the expiration date passes. Notification is not a hard stop. If your rule is that expired components cannot be weighed, the removal strategy and user rights have to enforce it, and someone has to test that an expired lot cannot be consumed.

An Odoo manufacturing bill of materials can require manual confirmation of component consumption, attach work-order instructions, and set flexible consumption to Blocked, Allowed, or Allowed with Warning. By-products are a separate feature that must be enabled. Work-order instructions use the Quality app and are procedure steps, not an electronic-signature control. For a batch record, Blocked or Allowed with Warning is the setting that matches a master formula. Allowed means a user can consume something other than the formula without a hard stop. Manual confirmation is what puts a person's action on the component line. The instruction text still does not show the signer's name, the time and the meaning required by 11.50.

Odoo manufacturing apps sit inside the subscription. Hosting and customization do not. The Custom plan is what Odoo requires for Odoo.sh, on-premise, Odoo Studio, multi-company and the external API. Odoo.sh hosting is extra. If your quality unit requires a controlled environment, backups you can restore, or a module that freezes a batch form, budget Custom and hosting beside the user fee. Implementation is not included in the subscription.

Audit trails, unique users and the settings that fail inspections

FDA's December 2018 data-integrity guidance defines data integrity as completeness, consistency and accuracy. Complete data should be attributable, legible, contemporaneous, original or a true copy, and accurate (ALCOA). An audit trail, in FDA's words, is a secure, computer-generated, time-stamped electronic record that reconstructs creation, modification or deletion.

The same guidance says each CGMP workflow on a computer, such as creating an electronic master production and control record, must be validated for its intended use. Qualifying the platform is not the same as proving that a given master record's steps and calculations are correct. The extent of validation should match the risk. If one system does both CGMP and non-CGMP work, you must assess the effect of the non-CGMP functions. A company that runs a commercial drug batch and a non-regulated sample in the same company database has that assessment to write.

Shared logins cannot identify a unique individual and do not conform to CGMP. Shared read-only accounts may be used to view data, not for attributable actions such as a second-person check. The system-administrator role should sit with people who are independent of the record content. Personnel who review the record under CGMP should review the audit trails that capture changes to that record. For production and control records, the quality unit must review and approve them, and that review includes the audit trails.

Business Central's change log records direct modifications only for tables and fields an administrator selects, and only after it is turned on. Microsoft warns that tracking all fields or ledger entries hurts performance and database size. The change log is turned off during a version upgrade and starts again when the upgrade finishes. New entries appear only after the user's session restarts. Administrators can delete log entries with a retention policy. Those are operational facts. They are not a statement that the change log is a Part 11 audit trail. If you rely on it, test the tables that hold lot numbers, consumption, output and status changes. Plan the upgrade window so a production day is not recorded only on paper because logging was off. Set retention longer than the record you must keep.

21 CFR 211.180 requires drug production, control and distribution records tied to a batch to be kept at least one year after the batch expiration date, or three years after distribution for certain OTC drugs that are exempt from expiration dating. Records must be readily available for inspection and may be originals or true copies. A retention policy that deletes change history inside that window leaves you with a batch record whose edits you cannot reconstruct. Set the log retention policy to the longer period that applies: at least one year after the latest batch expiration you must still hold, or three years after distribution for an OTC drug that is exempt from expiration dating.

Seven design choices show up again and again when a mid-market system is pointed at a regulated batch:

1. Shared logins on a weigh station or a supervisor account used by the whole shift.
2. Production users holding system-administrator rights, so the person who changes the record can also change the log.
3. Automatic forward or backward flush that posts component lots the operator did not issue.
4. Flexible consumption left on Allowed, so the formula is a suggestion.
5. Lot-number text left editable after receipt.
6. Reopening a finished production order to fix item tracking without a documented deviation.
7. A log retention policy that deletes history before one year past expiration.

Each of these is a configuration decision. Write it into the design packet your quality unit approves, and test the opposite action on purpose: expired lot, wrong component, second user absent, log row deleted.

Who validates the workflows, and what that adds to the project

FDA's position is direct. The regulated firm validates each CGMP workflow for its intended use. A vendor's platform qualification, a partner's test script, or a successful go-live does not prove that your master record's steps and calculations are correct. The extent of that work should match the risk of the workflow. Creating and releasing an electronic master is a higher-risk workflow than reading an on-hand report.

Ownership splits in a way software contracts often blur. Your quality unit reviews and approves production and control records, including their audit trails, and your quality unit accepts the validation. A system administrator who is independent of the record content controls access and logging. An implementation partner can configure lots, consumption, permissions and reports, and can help write test steps. The partner does not release the batch, and the partner's completion of a phase is not an inspection result.

We implement Business Central and Odoo for companies in the 20 to 100 person range. On a regulated project we configure the workflows you specify, document the tests you ask to see, and leave the validation decision and batch release with your quality unit. We do not present ourselves as a pharma validator, and we do not treat go-live as evidence that an investigator will accept the record. If you need a computer-system validation lead, hire that role inside quality or as a specialist, and have them review the configuration before you freeze the master records.

There is no public validation price for Business Central or Odoo in the material vendors publish for these products. Budget it as its own workstream: inventory of CGMP workflows, risk ranking, test steps on your master records, account design, backup and restore, and the audit-trail review procedure. Odoo Success Packs, described below, are hours of configuration. They are not a validation quote. Ask every bidder to price data migration, batch-record design and validation support as separate lines so a low license total cannot hide them.

What the licenses cost as of October 2026

Prices below are US list prices seen in October 2026. They move. Re-open the vendor page before you put a number in a budget. None of these figures includes validation, batch-record design, data migration or ongoing quality support.

• Business Central Essentials (Price: USD 80 per user per month, paid yearly · What the page says you get: Finance, sales and operations. Manufacturing is not included.)
• Business Central Premium (Price: USD 110 per user per month, paid yearly · What the page says you get: Everything in Essentials, plus service management and manufacturing.)
• Business Central Team Members (Price: USD 8 per user per month, paid yearly · What the page says you get: Limited read, approve and selected updates.)
• Odoo Light User (Price: USD 8.90 per user per month · What the page says you get: Manufacturing shop-floor use and inventory barcode operator. Sold through an advisor quote.)

Business Central licenses are bought through a CSP partner. The pricing page is the source for the three amounts above: Essentials, Premium and Team Members.

Odoo's US pricing page, with the Yearly toggle selected, prints more than one USD figure for each plan. Do not collapse them into one price. The pricing page shows Standard at USD 24.90 and USD 31.10 together, and also prints USD 31.10 and USD 38.90. It shows Custom at USD 49.00 and USD 61.10 together, and also prints USD 61.00 and USD 76.20. A footnote says the discount is valid for 12 months for the initial users ordered. Standard is Odoo Online and all apps. Custom is required for Odoo.sh, on-premise, Studio, multi-company and the external API. Hosting on Odoo.sh is extra. Companies under 50 employees usually buy Success Packs. Companies above 50 usually use a partner. Implementation is not in the subscription.

Assume 10 people need full manufacturing use and 15 people only approve or view. On Business Central that assumption is 10 Premium users and 15 Team Members: 10 times USD 110 is USD 1,100, and 15 times USD 8 is USD 120, so USD 1,220 per month and USD 14,640 per year in licenses. Essentials cannot replace Premium for those 10 if they run production orders.

Assume the same 10 full users on Odoo Custom, which is the plan required once you leave Odoo Online. At the lower printed figure of USD 49.00 the 10 users are USD 490 per month. At the higher printed figure of USD 76.20 they are USD 762 per month. Light users at USD 8.90, if the advisor quote matches the page, would add USD 133.50 per month for 15 people. Get the order form to state which printed figure applies, and add hosting if you use Odoo.sh.

Odoo publishes Success Packs for new customers at USD 493, USD 3,060, USD 5,950, USD 10,625 and USD 21,250, after a 15 percent new-customer discount on the first pack. Those packs are 4, 25, 50, 100 and 200 hours of a dedicated consultant. Returning-customer prices on the same page are USD 580, USD 3,600, USD 7,000, USD 12,500 and USD 25,000. Onsite travel sits outside those pack prices and is billed separately, according to the Odoo Success Packs page. A 50-hour pack can cover a tight configuration workshop. It does not cover computer-system validation of a drug master record. Price that work on its own line.

People comparing industry software often hear a stack like "JD Edwards and SAP for production BOMs. Windchill and other CAD tools for design BOMs. Trackwise for change control management, deviation/event management." Another accountant thread says "All the start ups start on Quickbooks but move to netsuite in after a year or two." They do not remove the batch-record and validation work above. A firm that sells a Microsoft add-on has described the gap in one sentence: "We are the layer in Microsoft ERP that makes it fit GMP requirements." Read that as a scope warning. The base license tracks lots and production. The GMP layer, whoever builds it, still has to be specified and validated by you.

How to choose a first phase

Decide in this order.

1. Classify every commercial product as finished drug, dietary supplement, or outside both rules. Write the batch-record contents from 211.188 or 111.260 next to that product.
2. Decide which of those records will exist only as signed paper, and which ones people will rely on inside the system. Part 11 follows the second group.
3. List the CGMP workflows a computer will perform: master approval, weigh and dispense, consumption, yield, label reconciliation, QC release. Each one needs validation matched to its risk.
4. Test genealogy on a lot received more than once. In Business Central, compare Item Tracing with Find Entries. In Odoo, read the traceability report and try to edit the lot number.
5. Fix the seven settings in the audit section before you train operators. Unique users, independent administrators, no silent flush, consumption locked to the formula, lot identity frozen, reopens treated as deviations, logs kept for the retention period.
6. Price Premium or Custom users, limited users, hosting, configuration hours and validation as separate lines. Our manufacturing ERP work is scoped in phases for plants in this size range, and an ERP implementation can start with inventory, lots and production while quality still releases on the paper record they trust.
7. Only then compare Business Central and Odoo on the demo evidence. Premium at USD 110 is the Business Central manufacturing seat. Odoo keeps manufacturing in the subscription and moves you to Custom when you need Odoo.sh, on-premise, Studio or the external API. Business Central for growing companies is the rollout path when the license and the production-order design are the fit. Choose the product whose demo showed your component lots, your yield and your second check, on your items.

Bring the fit-check answers and a sample master record to the call. We will mark what the base product already posts, what has to be configured, and what your quality unit still has to validate. That is the budget conversation worth having before a license order.

How Flectic can help

Flectic implements Dynamics 365 or Odoo for manufacturers of 20 to 100 people that need lot traceability on the same records as inventory and finance. Our ERP for manufacturers work starts with a pilot: one cell goes live with its operators first while the rest of the plant keeps producing. Flectic sends a written proposal with a fixed price for each phase before work starts. Book a free discovery call to scope a first phase with Flectic.

Sources

• Part 11, Electronic Records; Electronic Signatures: Scope and Application, FDA, October 2026
• 21 CFR 11.10 Controls for closed systems, Cornell LII, October 2026
• 21 CFR 11.50 Signature manifestations, Cornell LII, October 2026
• 21 CFR 211.188 Batch production and control records, Cornell LII, October 2026
• 21 CFR 211.68 Automatic, mechanical, and electronic equipment, Cornell LII, October 2026
• 21 CFR 211.180 General requirements (records), Cornell LII, October 2026
• 21 CFR 111.260 What must the batch record include?, Cornell LII, October 2026
• Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), FDA, October 2026
• Track items with serial, lot, and package numbers, Microsoft, October 2026
• Trace item-tracked items, Microsoft, October 2026
• Pick according to FEFO, Microsoft, October 2026
• About production orders, Microsoft, October 2026
• Auditing changes, Microsoft, October 2026
• Business Central pricing, Microsoft, October 2026
• Lots and serial numbers, Odoo, October 2026
• Expiration dates, Odoo, October 2026
• Bill of materials configuration, Odoo, October 2026
• Odoo pricing, Odoo, October 2026
• Odoo Success Packs, Odoo, October 2026
• ERP or SAP specifically for GMP env, Reddit, October 2026
• What are the Industry Standard softwares for Pharma and Medical Device Manufacturing?, Reddit, October 2026
• Life science / biotech / R&D accountants, Reddit, October 2026
• Pharmaceutical Manufacturing ERP Software, BatchMaster, October 2026