Last updated:
Overview
Business Central handles traceability as standard through item tracking: serial numbers, lot numbers, package numbers, expiration dates and warranty dates, recorded on every inbound and outbound transaction. The Item Tracing page walks a lot forwards to the customers who received it, or backwards to the supplier who sent it. Quality inspections, including certificates of analysis, became standard in 2026. If you’re regulated, you can add electronic signatures, mass balance reporting and validation documentation through a compliance app.
So what does Business Central track out of the box?
More than most people expect. Item tracking is configured per item through an Item Tracking Code, and it isn’t an add-on. Once an item carries a tracking code, these fields turn up on your purchase receipts, sales shipments, production output, transfer orders and inventory journals:
- Serial No. — one number per physical unit. Use it where every unit has to be individually identifiable.
- Lot No. — one number per batch. It’s what most food, drink and life sciences manufacturers actually need.
- Package No. — a third level, handy where a pallet or case needs its own identity separate from the lot inside it.
- Expiration Date — with three separate controls on the Item Tracking Code: Use Expiration Dates, Require Expiration Date Entry, and Strict Expiration Posting, which forces the expiration date an item came in with to be respected when it goes out again.
- Warranty Date — driven by a Warranty Date Formula, with the option to make manual entry mandatory.
Two things are worth knowing before you configure any of it. Switch on Strict Expiration Posting and Business Central will stop a shipment that tries to send stock whose expiration date doesn’t match what you received. And once you’re using expiration dates, your warehouse picks can run on FEFO — first expired, first out — rather than bin sequence.
How does a trace actually work?
Tracing is done on the Item Tracing page. It walks the chain of posted transactions for a lot or serial number, in whichever direction you need. You pick a Trace Method:
- Usage → Origin. A customer sends back a faulty unit. You start at the sales shipment and expand backwards through production output, component consumption, and finally the purchase receipt that brought the defective lot into stock — along with the supplier who sent it.
- Origin → Usage. A supplier tells you a batch is contaminated. You start at that lot and expand forwards to every production order that consumed it and every customer who received the finished goods.
There’s a Show Components setting that controls whether the trace descends into components, and Trace Opposite – from Line flips the direction from any line without you retyping the filters. Between them, those two methods answer the only two questions a recall ever asks: where did this come from, and where has it gone?
Running a complete recall
Item Tracing works on posted entries — the transactions that actually happened, which is exactly what a recall investigation needs. Two practical points that we plan for on every implementation, and that separate a trace you can hand an auditor from one you can’t.
Check your open orders too. A lot sitting on an unposted sales order hasn’t left the building yet, so it won’t show up in a trace. That’s the shipment you most want to stop. Business Central’s Find entries search — available from almost any page with Ctrl+Alt+Q — searches by serial or lot number and surfaces those open records in seconds.
Get item application right at go-live. Item Tracing shows applied transactions, so clean item application and disciplined lot numbering are what make a trace give you the complete picture. Where the same lot number has arrived on more than one receipt, it’s worth confirming the trace resolves every branch.
Neither point is a shortcoming so much as a setup decision. Configure item tracking properly at implementation and Business Central will tell you, in minutes, which of your customers received a given lot and which supplier it came from. That’s precisely the work our consultants do on a traceability project, and it’s why our go-live plans always include a mock recall on real data.
Good news: quality inspections are now built in
This one changed recently, and a lot of the advice you’ll find online hasn’t caught up. Quality Management reached general availability with Business Central 2026 release wave 1 as a Microsoft-published extension. It installs automatically on new environments, and you can add it to an existing one from the Extension Management page.
Out of the box, it will:
- Generate inspections automatically when you receive a purchase order, post production or assembly output, or process warehouse movements.
- Create inspections manually for reactive checks, or on a schedule via the job queue.
- Apply inspection templates with defined measurements and pass/fail criteria.
- Block a non-compliant lot automatically, so nobody can pick it or ship it.
- Handle what comes next: move the stock to a quarantine bin, write it off with a negative adjustment, transfer it elsewhere, or raise a purchase return to the supplier.
- Print a Certificate of Analysis, a Non-Conformance report or a General Purpose Inspection report — all three ship with Word layouts as standard.
That last point deserves a moment, because certificates of analysis used to be the classic reason a regulated manufacturer bought a quality add-on. They’re now part of standard Business Central.
Inspections are per lot, not per receipt. If a goods-in receipt contains two lots, you get two inspections, each tied to its own lot number and quantity. That’s the behaviour you want for traceability, and it’s the behaviour your auditor expects.
So if someone once told you that you needed a third-party quality module, it’s worth revisiting that assumption. Some businesses still will — we’ll come to where the line falls — but the baseline has moved a long way.
Audit trails and electronic signatures
For regulated businesses, tracing the product is only half the job. You also have to trace the record: who changed what, when, and who approved it.
Business Central handles the audit trail side natively. The Change Log records every insert, modify and delete on the tables and fields you nominate, capturing the old value, the new value, the user and a timestamp. Field monitoring sits alongside it, emailing an alert when a sensitive field changes — lighter than the change log, and Microsoft’s recommendation when you only need to watch a handful of fields. Business Central also emits admin-level create, update and delete events to Microsoft Purview’s unified audit log. And approval workflows give you a recorded chain of who approved what.
What Part 11 asks for
21 CFR Part 11 is the FDA’s rule on electronic records and electronic signatures. It applies if you supply the US market under FDA predicate rules — which catches a good number of UK life sciences, medical device and contract manufacturing businesses who assume it doesn’t apply to them. Broadly, it asks for:
- Secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions creating, modifying or deleting records — and that do not obscure previously recorded information.
- Signature manifestation: every signed record has to show the signer’s printed name, the date and time, and the meaning of the signature — reviewed, approved, released.
- Signature-to-record linking, so a signature cannot be excised, copied or transferred to another record.
- At least two distinct identification components for non-biometric signatures, typically a user ID and a password.
Business Central’s change log delivers that audit trail requirement as standard. The three signature requirements come from a compliance app on top. We implement Yaveon 365 Compliance for this: it adds electronic signatures built around 21 CFR Part 11 and EU GMP, an extended audit trail, and the validation documentation that turns a working system into an auditable one. The EU and UK equivalent framework is EU GMP Annex 11, which sets similar expectations for computerised systems.
One point worth being precise about, because vendors are routinely loose with it: no software is “21 CFR Part 11 compliant” on its own. The FDA doesn’t certify software. Compliance is a property of your organisation, your validated system and your procedures. What good software does is support the requirements and give you the documentation to evidence it.
What’s included, and what you can add
Standard Business Central covers more of this than most people expect, and the list grew again this year. Where you need to go further, the additions are well-trodden. This is what our scoping conversations actually decide.
| Requirement | Standard Business Central |
|---|---|
| Lot and serial number tracking | Native |
| Package / pallet numbers | Native |
| Expiration dates and FEFO picking | Native |
| Forward and backward lot tracing | Native (Item Tracing) |
| Merging or reclassifying lots | Native (Item Reclassification Journal) |
| Quality inspections, pass/fail criteria, lot blocking | Native since 2026 wave 1 |
| Quarantine bins and non-compliance handling | Native since 2026 wave 1 |
| Certificates of analysis and non-conformance reports | Native since 2026 wave 1 |
| Audit trail of data changes (who, what, when) | Native (Change Log, field monitoring) |
| Electronic signatures to 21 CFR Part 11 | Add a compliance app |
| GAMP 5 validation documentation | Add a compliance app |
| Handheld warehouse scanning app | Add an app |
| Mass balance / quantity reconciliation reports | Add an app, or Power BI |
| Supplier scorecards and vendor ratings | Add an app |
Who needs this, and what your sector has to prove
Traceability isn’t only a food problem. Microsoft’s own documentation puts it bluntly: monitoring an item’s transaction flow is a legal requirement in medical and chemical supply. What differs between sectors isn’t the mechanism — it’s the same item tracking engine underneath — but what a regulator or an auditor will ask you to produce.
Obligations come in three shapes, and businesses routinely conflate them. Statutory duties apply whether or not anyone certifies you. Certification standards go further than the law does. Contractual requirements come from your customers, and they are often the strictest of the three.
| Sector | What drives traceability | What you have to be able to show |
|---|---|---|
| Food & beverage | Statutory: Article 18 of Regulation 178/2002, retained in GB law, enforced by the FSA. Plus BRCGS certification. | Your immediate supplier and your immediate customer for every product — “one step back, one step forward” — on demand. |
| Life sciences | GMP for manufacture and GDP for distribution, regulated by the MHRA. EU GMP Annex 11 for computerised systems. FDA 21 CFR Part 11 if you supply the US. | Batch records and lot-level control from goods-in through to release, the ability to recall, and — where Part 11 or Annex 11 bite — a validated system with audit trails and electronic signatures. |
| Medical devices & technology | Certification: ISO 13485 clause 7.5.9, alongside UK MDR. FDA 21 CFR Part 11 for US-market records. | A documented traceability procedure. For implantable devices, clause 7.5.9.2 also wants records of the components, materials and work-environment conditions you used. |
| Chemicals | Statutory: UK REACH, Article 36, enforced by the HSE. | Information kept for at least ten years after you last manufactured, imported, supplied or used a substance — handed to the authority without delay on request. |
| Manufacturing & engineering | Contractual: customer requirements, certificates of conformity, material certificates. | Which material batch went into the part you shipped, tied to the certificate you issued. |
| Distribution & wholesale | Inherited from whatever you distribute — food law, GDP, REACH. | The chain either side of you, unbroken, even though you changed nothing about the product. |
Where the legal minimum stops
Food is the clearest illustration, because both obligations sit side by side. Article 18 asks only for one step back and one step forward, and Business Central’s item tracking clears that comfortably — as long as your lot numbers get captured at goods-in rather than written on a clipboard.
BRCGS goes a good deal further. It expects a full forward and backward trace including a mass balance reconciliation of what you received against what you used, wasted, reworked and shipped, tested at least once a year. The widely applied benchmark is that a trace should be achievable within four hours.
That gap is where projects go wrong, and it is not unique to food. Business Central will tell you which customers received a lot in minutes, in any sector. Reconciling the quantities — proving the 400kg you received equals what you shipped, scrapped and still hold — is the part that needs Power BI reporting or a specialist module. A chemicals business proving REACH compliance and a device manufacturer evidencing ISO 13485 hit the same wall in the same place.
So here’s the practical consequence: the item tracking setup is broadly the same across all six sectors above. The reporting layer on top of it is what your regulator or your customer actually reads, and it’s the part most implementations under-scope.
Where Yaveon fits
Yaveon 365 extends Business Central for regulated process manufacturers — pharmaceuticals, biotechnology, chemicals, food and beverage, cosmetics and medical devices. We’re a Yaveon partner, and we implement it where a regulated business needs to go beyond standard Business Central. It’s worth being specific about where that is, because the line moved a long way this year.
Standard Quality Management now covers inspections, pass/fail criteria, lot blocking and certificates of analysis, so the case for an add-on isn’t about inspecting goods at all any more. It’s narrower, and if you’re regulated, it’s decisive:
- Electronic signatures and an extended audit trail, built around the requirements of 21 CFR Part 11 and EU GMP — signature manifestation, signature-to-record linking, and the two-component identification the change log alone will not give you.
- Validation documentation. Yaveon develops and documents to GAMP 5 and ships a compliance kit of templates. In a GMP audit, the documentation proving your system was validated is as much the deliverable as the system itself.
- Process manufacturing depth — recipe and batch handling that a discrete-manufacturing ERP does not model well.
Here’s the honest summary. If you make food in a non-certified facility, standard Business Central plus Power BI will very likely do everything you need. If you’re GMP-regulated, supply the US market under FDA predicate rules, or need a validated system with electronic signatures, the compliance app is what gets you there — and the validation effort belongs in your budget alongside the licence.
Getting the setup right before go-live
Across our implementations for UK manufacturers, distributors, food producers, life sciences and medical device businesses, the same four decisions determine whether traceability works on day one or turns into a two-year clean-up. They’re sector-agnostic, and in our experience they matter more than the software.
Lot or serial, decided per item
Serial numbers on a high-volume ingredient create thousands of entries nobody will ever query. Lot numbers on a piece of capital equipment lose the individual identity you needed. It’s an item-level decision, not a company-level one.
Decide your expiry rules before the first receipt
Turning on Strict Expiration Posting after two years of trading means reconciling every lot that entered inventory without a date. Switch it on at go-live, or accept that you never will.
Capture the lot at goods-in, not later
Traceability fails at the receipt, not at the recall. If someone keys a lot number in a day later from a delivery note, your trace is only ever as good as that transcription.
Test a recall before an auditor does
Run a mock trace on real data. Pick a lot, trace it both directions on the Item Tracing page, then check your open orders separately. If the result looks too clean, go looking for unapplied entries and lots received on more than one receipt.
FAQs
Does Business Central do lot traceability without an add-on?
Yes. Lot numbers, serial numbers, package numbers, expiration dates and warranty dates are all standard item tracking functionality, configured through an Item Tracking Code on the item. Forward and backward tracing on the Item Tracing page is standard too.
Does Business Central include quality inspections?
Yes. Quality Management reached general availability with Business Central 2026 release wave 1. It’s a Microsoft-published extension that installs automatically on new environments and can be added to existing ones from the Extension Management page. It generates inspections on goods receipt and production output, applies pass/fail criteria, blocks non-compliant lots automatically, and prints Certificate of Analysis and Non-Conformance reports.
Can Business Central produce a certificate of analysis?
Yes, since 2026 release wave 1. The Quality Management extension ships three printable reports — Certificate of Analysis, Non-Conformance and General Purpose Inspection — with Word layouts as the default. This used to be a common reason to buy a third-party quality module, and it isn’t any more.
How do I check open orders during a recall?
Item Tracing covers posted transactions. To catch a lot still sitting on an unposted sales order, use Business Central’s Find entries search (Ctrl+Alt+Q), which searches by serial or lot number across open records as well. Between the two, you can see where a lot has gone and stop where it’s about to go.
What makes a trace return the complete picture?
Clean item application and disciplined lot numbering. Item Tracing works on applied transactions, so where the same lot number has arrived on more than one receipt it’s worth confirming the trace resolves every branch. Get this right at implementation and a full forward and backward trace takes minutes. It’s one of the things we test during a go-live.
Does Business Central support 21 CFR Part 11 electronic signatures?
Business Central gives you the audit trail requirement as standard: the Change Log records who changed what and when, with old and new values. Electronic signatures — signature manifestation and signature-to-record linking — come from a compliance app such as Yaveon 365 Compliance, along with the validation documentation your auditor will ask for. Worth knowing that no software is Part 11 “compliant” on its own; the FDA doesn’t certify software, so compliance rests on your validated system and your procedures.
Is Business Central enough for BRCGS or ISO 13485?
For the trace itself, generally yes. The gap is quantity reconciliation. Standard Business Central does not produce a mass balance report — proving what you received equals what you used, wasted, reworked and shipped — so most certified sites add Power BI reporting or a specialist quality module on top. That applies equally to a BRCGS-certified food producer, an ISO 13485 device manufacturer and a chemicals business evidencing UK REACH.
Is traceability in Business Central only relevant to food?
No. Microsoft’s own documentation describes monitoring an item’s transaction flow as a legal requirement in medical and chemical supply. Life sciences businesses need it for GMP and GDP, medical device manufacturers for ISO 13485, chemicals businesses for UK REACH, and engineering firms for the certificates of conformity their customers demand. The item tracking mechanism is the same in each; what differs is the evidence you have to produce.
Ready to get traceability right?
Most traceability problems are configuration decisions made early and discovered late. If you’re scoping an implementation, or you already have Business Central and a trace takes longer than it should, talk to our team and we’ll look at your setup with you. We’re here to help you every step of the way.
