The first three questions of almost any inspection of manufacturing automation are: what systems do you have, who owns them, and how do you know they work. This register answers all three on one page, organized by the ISA-95 level each system sits at (device, control, supervisory, execution, enterprise, and the historian archive), so the layered integrity risk is visible rather than buried in an alphabetical list. It is the article’s “practical first deliverable” made ready to fill. Replace every <<FILL: ...>> placeholder, keep the register under document control, and review it on a defined cadence. Field definitions, a filled specimen, and use notes follow. Verify each cited regulation against the current source before you rely on it.
Why this register exists (regulatory basis)
You cannot remediate, validate, or defend what you have not inventoried. 21 CFR 211.68 requires that automated equipment used in manufacturing be validated and controlled; EU GMP Annex 11 expects an up-to-date inventory of GMP computerized systems with their validation status and GxP relevance. Organizing the inventory by ISA-95 level makes the integrity profile of each layer explicit: the execution layer owns the batch record, the device layer often has no audit trail at all, and the risk sits differently at each. This register is the map that tells you where to spend remediation effort first.
Field definitions
| Field | Format | Required | Note |
|---|---|---|---|
| ISA-95 level | L0-L4 or Archive | Yes | Device (L0/L1), Control (L1), Supervisory (L2), Execution (L3), Enterprise (L4), Archive |
| System name / ID | Text | Yes | The real name used on the floor |
| Function | Text | Yes | What it does in one line |
| Primary GxP record owned | Text | Yes | The record this system is the source of truth for |
| System owner | Role / name | Yes | Accountable person by function |
| GxP criticality | High / Medium / Low / non-GxP | Yes | From the data criticality assessment |
| Validation status | Validated / In progress / Legacy-not-revalidated / N/A | Yes | Current qualified state |
| Audit trail capability | Full / Partial / None + compensating | Yes | Drives the DI remediation priority |
| Individual accounts | Yes / Shared / Mixed | Yes | Attribution status |
| Time source | NTP / Local / N/A | Yes | Clock synchronization |
| Interfaces to | System list | Yes | Where its data flows; feed the data-flow map |
| Remediation decision | Remediate / Replace / Compensate / None | Yes | For any open gap |
Register
| ISA-95 level | System name / ID | Function | Primary GxP record | Owner | Criticality | Validation status | Audit trail | Individual accounts | Time source | Interfaces to | Remediation decision |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Enterprise (L4) | <<FILL>> | Material genealogy, lot disposition | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Execution (L3) | <<FILL>> | MES / EBR | The official batch record | <<FILL>> | High | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Supervisory (L2) | <<FILL>> | SCADA / HMI | Operator actions, alarms, trends | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Control (L1) | <<FILL>> | DCS | Setpoints, recipe parameters | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Device (L0/L1) | <<FILL>> | PLC / equipment controller | Equipment control logic, setpoints | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Archive | <<FILL>> | Historian | Long-term time-series process data | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Add a row per real system; a plant typically has several at each level.
Instructions for use
- Populate one row per real system, not per system type. A site with four fill lines has four MES instances or four line configurations to name.
- Set criticality from the data criticality assessment, driven by how the record feeds a quality decision or a regulatory submission, not by the size of the system.
- Where audit trail capability is “None + compensating” or accounts are “Shared”, the remediation decision field must not be blank; every open gap carries a documented Remediate/Replace/Compensate decision with an owner.
- Use the interfaces column to build the data-flow map for each critical value, so reconciliation across systems is traceable.
- Review the register on a defined cadence and after any system is added, retired, upgraded, or re-classified.
Acceptance criteria
- Every GxP-relevant automation system on the floor appears, placed at its correct ISA-95 level.
- Each row has an owner by function and a current validation status.
- Every open integrity gap (partial/no audit trail, shared accounts, unsynced clock) has a documented remediation decision.
- Criticality is justified against data criticality, and an inspector can pick any high-criticality system and find its owner, validation record, and controls.
- The register is version-controlled and its review date is current.
Filled specimen
An illustrative extract for a sterile fill line. Names and states are examples.
| ISA-95 level | System | Function | GxP record | Owner | Criticality | Validation | Audit trail | Accounts | Time | Remediation |
|---|---|---|---|---|---|---|---|---|---|---|
| Execution (L3) | MES-FILL01 | EBR execution, fill line 1 | Batch record | Mfg Systems Lead | High | Validated | Full | Individual | NTP | None (compliant) |
| Supervisory (L2) | SCADA-FILL01 | HMI, alarms, trends | Operator actions, alarms | Automation Eng | High | Validated | Partial (no access-event log) | Mixed (shift login on night HMI) | NTP | Remediate: enable access log Q3, retire shared login |
| Device (L0/L1) | PLC-AUTOCLAVE-3 | Sterilizer cycle control | Cycle setpoints | Automation Eng | High | Legacy-not-revalidated | None | N/A | Local | Compensate: key-switch access, external config baseline, supervisory recording; replace at 2027 upgrade |
| Archive | HIST-SITE | Historian | Process time series | Plant IT | Medium | Validated | Insert-only, bulk-edit locked | Individual | NTP | None (compliant) |
Reading this extract, an inspector immediately sees where the risk concentrates: a partial SCADA audit trail with a night-shift shared login (remediation dated), and a legacy autoclave PLC with no audit trail held under named compensating controls with a replacement date. That is exactly the risk-based picture the register is meant to surface, rather than a flat list that hides which system is the problem.
Common inspection findings this register prevents
- No current inventory of floor automation systems, so scope of validation and remediation is unknown.
- A GxP system missing from the inventory or mis-flagged as non-GxP, so its changes route around the change-control gate.
- Integrity gaps with no owner and no decision, discovered by the inspector rather than the site.
- Criticality assigned by system size rather than by the record’s impact on a quality decision.
- A historian left off the inventory entirely because it “looks like infrastructure.”
How to adapt this register
- Replace the example rows with your real systems, one row each, at their true ISA-95 level.
- Align the criticality column to your data criticality and gap-assessment methodology.
- Make the remediation-decision column mandatory for any row with an open gap, and tie each decision to a change control or plan.
- Link the interfaces column into your data-flow maps for critical values.
- Confirm the referenced regulations against their current published versions before issue.