Who Signs a Batch Release, and What Each Signature Means

At the bottom of a certificate of analysis there is a signature. Buyers treat it as the seal at the end of the document, the point where the numbers become official. It is more useful to treat it as the last link in a chain, because the chain has three links and only one of them is a release decision.

Understanding which link you are holding changes what the document can support if a batch is later questioned.

Three functions, three assertions

Function	What it asserts	What it does not assert
Production	The batch was made according to the batch record, and deviations are recorded	That the material meets specification
Quality control	The tests were performed and the results are as reported	That the results are acceptable, or that the record is complete
Release	The batch record, the results and the deviations together justify release	That no future problem exists, only that none is known

A certificate signed only by the analyst attests to the middle row. That is a legitimate document for a laboratory report. It is a thin basis for a commercial release, because it says nothing about whether the batch record was reviewed or whether a deviation was closed.

What the release signature is actually certifying

Not that the tests passed. That the batch may be used. Those differ in the cases that matter: a batch that met specification but was produced during a validated-state lapse, or one that met specification with a deviation that was assessed as having no impact, or one that met specification against a specification that has since been revised.

Each of those is a release decision, and each requires a judgement that no analytical result can make on its own. That is why the release function exists separately from the laboratory, and why an organisation that merges the two has saved a signature and lost a control.

Personal accountability is not a formality

In the European framework the qualified person's attestation is personal and legally framed. It is not a departmental approval that can be absorbed by a committee. That structure exists because the decision to release a batch is the point at which all the evidence either adds up or does not, and somebody has to be accountable for having looked.

Where a customer's market requires that attestation, a supplier who cannot name the person and their basis of authority has a gap that no amount of analytical data fills.

Electronic signatures

An electronic signature is acceptable where it is attributable, linked to the record it signs and protected from copying. Three conditions, all necessary. An image of a signature inserted into a PDF satisfies none of them, because it can be moved from one document to another without leaving a trace.

The test is behavioural rather than technical: can the signature appear on a document its signatory never saw? If the answer is yes, the signature is decoration. The data integrity note sets out the other attributes that make an electronic record usable as a record.

Reading the chain from a certificate

Look for three things. The name and role of the signatory. Whether the signature is described as approval of results or release of the batch. And whether the document references the batch record or a deviation, however briefly.

A certificate that says "released by" with a name and a date is telling you more than one that says "authorised signature" over a line. The first names a person and a decision; the second names a form field.

The internal consistency check covers the numbers on the same document. The signature covers the decision about them, and the two checks are independent: a certificate can be arithmetically perfect and still not have been released.

Delegation and absence

Release authority is delegated in writing, with a defined scope and a defined period, and the delegation is recorded. A signature from a person who was on leave and whose name appears because the document system defaulted to them is not a release, it is a data integrity finding waiting for an inspector.

The practical test a buyer can apply: ask who would sign if the named person were unavailable for a month. An organisation with an answer has a system. An organisation without one has a habit that happens to work while nothing goes wrong.

Why this matters before the first shipment

Because the release chain is the mechanism through which every other control becomes effective. A validated method, a qualified instrument, a compliant batch record and a closed deviation all converge at one signature. If that signature is not a real decision, the controls upstream are documentation rather than assurance.

It is also the first thing that becomes visible when a supplier changes ownership or restructures. The analytical capability survives a reorganisation more easily than the release authority does, and a certificate issued during that transition is worth reading twice.

Where this leaves a supply-chain partner

We name the release function on the certificate, distinguish it from the testing function, and can state the basis of authority when asked. Where a customer's market requires a qualified person attestation, we say plainly whether that attestation is available for the batch in question rather than substituting a general statement of compliance.

That distinction is uncomfortable in a quotation and useful in an audit, and the complaint and CAPA process is where it pays for itself, because a closed complaint always turns on who had authority to decide what.

Release across a contract chain

When more than one organisation sits between the material and the customer, the release chain acquires more links and each link has to be identifiable. The site that produced the batch releases it against its own specification. The party that holds the batch and ships it confirms identity, storage and transport conditions. The customer receives a certificate from one of them and has to know which.

The failure mode is well known and rarely discussed. A certificate issued by a party that did not produce the batch may carry a signature that attests to the tests having been performed somewhere, by somebody, at some point. That is not a release decision about a batch; it is a statement about a document. The distinction becomes visible only when a result is disputed and the chain has to be walked backwards.

What makes a chain auditable is that each link names its own basis: which specification, which batch record, which deviations were considered, and who decided. Four facts per link, and the chain is reconstructible. Without them, the customer has a document with a signature and no path.

When the chain is unclear

Three symptoms are worth treating as findings rather than nuisances. A certificate whose product name differs slightly from the purchase order. A batch number that appears in two different formats on the same document set. And a signatory whose role is described only as "authorised".

None of these is necessarily an error, and each of them is a place where a chain can break without anybody noticing. The first two are detectable by comparison, which is why the internal consistency check exists. The third requires a question.

The regulatory framing is public. The EudraLex volume 4 text sets the European expectations for release and for the qualified person's attestation, the ICH Q7 guidance describes the corresponding responsibilities for active substances, and the EDQM publishes the certification framework that applies where a certificate of suitability is involved. A supplier operating in more than one of those frameworks should be able to say which one applies to a given batch.

A single question maps the chain: who released this batch, under which specification, and what deviations were considered? The answer either names a person, a document and a decision, or it describes a process that nobody is holding.

Release dates, shipping dates and what sits between them

A batch is released before it ships, and the two dates are not the same. On a well-run certificate the release date precedes the shipping date, and the transport documents reference a batch that had already been released. When the order reverses, the material moved before anyone decided it could.

The reversal is occasionally legitimate: a sample shipment for evaluation, released under a separate procedure. As a pattern it is a finding, because it means the release step is being applied to documents rather than to material, and the customer's incoming records will show batches that were in transit before their release date.

The second date worth checking is the one on the supporting documents. A safety data sheet carries its own revision date, and a certificate carries the date the tests were completed. Where the certificate is dated months after the tests, the question is what happened in between, and the answer is usually a review backlog rather than anything sinister. Still, the interval is a property of the system, and an inspector will read it as one.

Three dates, read together, describe a supplier's discipline more reliably than any single one of them: release, test completion, shipping. Ask for all three on the next batch and see whether the answer comes without a pause.

Frequently asked questions

Does the signature on a COA mean the batch is released?

Not necessarily. A certificate may be signed by the analyst who ran the tests, by the laboratory manager who reviewed them, or by the person authorised to release. Those are three different assertions, and only the last one is a release decision.

What is the difference between QC and QA here?

Quality control performs the testing and states what the results were. Quality assurance confirms that the batch record is complete, that deviations were assessed, that the specification was met and that the disposition is justified. QC supplies the numbers; QA supplies the judgement.

What does a qualified person actually confirm?

In the European framework, that the batch was produced and controlled in accordance with the marketing authorisation, the good manufacturing practice requirements and the specification. It is a personal legal attestation rather than a managerial approval, which is why it cannot be delegated casually.

Can an electronic signature replace a handwritten one?

Yes, where the system ensures that the signature is attributable to one individual, cannot be copied to another record and is linked to the signed content. An image of a signature pasted into a document meets none of those conditions.

Why do some certificates carry two signatures and others one?

Because the number reflects the internal organisation rather than the reliability of the batch. A single signature from a person authorised to release, backed by a reviewed batch record, is stronger than two signatures that attest only to testing.

What should a buyer ask when the signature is illegible?

Ask for the name, the role and the basis of authority, in writing. A certificate whose signatory cannot be identified is a document without an author, and that matters the day a result is disputed.