This is a ready-to-use self-assessment for whether a trading partner’s DSCSA program is genuinely operating at the enhanced drug distribution security standard, not just documented as if it were. Run it across the whole program, not one shipment, and re-run it on a defined cycle and after any material change (new trading partner, new platform, EPCIS version change). Replace every <<FILL: ...>> placeholder and record Pass, Gap, or N/A with evidence. A filled specimen follows. This content is educational and general; confirm the current enforcement posture for your trading-partner type before relying on any date in this document.
Document control header
| Field | Entry |
|---|---|
| Document title | DSCSA Enhanced Drug Distribution Security Enforcement Readiness Self-Assessment |
| Document number | <<FILL: CHK-ID, e.g. CHK-SC-021>> |
| Version | <<FILL: version>> |
| Effective date | <<FILL: effective date>> |
| Document owner | <<FILL: role, e.g. Head of Trade Compliance>> |
| Trading-partner type assessed | <<FILL: manufacturer / repackager / wholesale distributor / dispenser / 3PL>> |
| Applicable exemption status | <<FILL: e.g. not exempt, in full enhanced-phase exchange; or small dispenser under the exemption through the current published end date>> |
How to use this checklist
- Confirm your trading-partner type’s current enforcement posture against the latest FDA guidance before scoring section 1; the exemption end dates have moved more than once and this document does not substitute for checking the live source.
- Score every applicable line Pass, Gap, or N/A with evidence. A “Pass” without an evidence reference does not count.
- Log every Gap with a risk rating and an owner. A single open high-risk gap means the program does not pass.
- Re-run on the cycle in the header and after any material change.
1. Enforcement posture and scope
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| E1 | Trading-partner type and enforcement status confirmed current | The applicable enhanced-phase date or exemption status for this partner type is confirmed against the current FDA guidance, not carried over from a prior assessment | Dated confirmation note or guidance excerpt | <<FILL>> |
| E2 | Product scope determined | In-scope and excluded products (section 581/582 exclusions) are documented per NDC where the determination is not obvious | Product-scope determination record | <<FILL>> |
| E3 | Small-dispenser exemption applicability documented (if relevant) | If claiming the small-dispenser exemption, the full-time-employee count basis is documented and dated | Eligibility record | N/A or <<FILL>> |
2. Package-level transaction data
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| P1 | Transaction Information is package-level | TI carries the product identifier (serial numbers), not just lot-level data | Sample TI record | <<FILL>> |
| P2 | Transaction Statement current | TS content matches the current statutory elements | Sample TS record | <<FILL>> |
| P3 | Exchange is electronic and interoperable | No manual or paper T3 workaround remains in the standard flow | Process description; sample connection list | <<FILL>> |
3. EPCIS and technical exchange
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| X1 | EPCIS message integrity confirmed | Generated EPCIS validates against the GS1 US application standard schema for every active connection | Validation report per connection | <<FILL>> |
| X2 | EPCIS/CBV version documented per connection | Every trading-partner connection has a documented, agreed EPCIS/CBV version and transport | Connection inventory | <<FILL>> |
| X3 | New-connection qualification process exists and is used | New trading partners are onboarded through a documented qualification process before first commercial shipment | Reference to onboarding checklist; sample completed instance | <<FILL>> |
| X4 | Aggregation accuracy verified | Aggregation challenge testing shows correct parent-child inflation with no orphan or cross-mapped serials | Challenge test results | <<FILL>> |
4. Verification and returns
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| V1 | VRS operational for saleable returns | Every saleable return has a recorded verification result before re-shelving; no re-shelving on pending or no-response | Returns verification log sample | <<FILL>> |
| V2 | VRS operational for suspect product | Verification runs as part of every suspect-product investigation | Investigation records sample | <<FILL>> |
| V3 | Responder unavailability handled | A defined timeout and fallback quarantine procedure exists and was exercised (or tested) at least once in the review period | Incident record or test record | <<FILL>> |
5. Suspect and illegitimate product
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| S1 | Suspect/illegitimate product SOP current and approved | SOP exists, is current, and reflects the correct notification path | SOP document control record | <<FILL>> |
| S2 | Program has been exercised | At least one real event or a documented mock/tabletop exercise has run in the review period | Investigation record or exercise record | <<FILL>> |
| S3 | Form FDA 3911 timeliness demonstrated | Where an illegitimate-product event occurred, the notification timestamp is within 24 hours of the determination | Investigation record with timestamps | N/A or <<FILL>> |
| S4 | Data exceptions triaged separately from suspect-product events | A documented triage process and log distinguish routine data exceptions from suspect-product triggers | Exception log reference | <<FILL>> |
6. Trading partners and authorization
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| T1 | Authorized-trading-partner register current | Every active trading partner has current license/registration evidence and a re-verification date | Register export | <<FILL>> |
| T2 | 3PL/repackager data-ownership agreements documented | Where a 3PL or repackager is involved, the contract states scanning, event-generation, and T3/TS ownership | Contract clause reference | <<FILL>> |
7. System validation and records
| # | Check | Pass criterion | Evidence | Result |
|---|---|---|---|---|
| R1 | Serialization system validated | The L2/L4 serialization and EPCIS platform is validated under a risk-based CSV/CSA approach, with change control over master data and EPCIS mapping | Validation summary reference | <<FILL>> |
| R2 | Serial reconciliation performed per batch | Reconciliation reports (commissioned vs printed vs rejected vs shipped) show zero unexplained discrepancies, or discrepancies are dispositioned | Sample reconciliation reports | <<FILL>> |
| R3 | Records retained and retrievable | Transaction and serialization records are retained for the required period and a retrieval test has been performed | Retention schedule; retrieval test record | <<FILL>> |
Gap summary
| Gap ref | Check # | Description | Risk (H/M/L) | Owner | Remediation / due date | Status |
|---|---|---|---|---|---|---|
<<FILL: G1>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Overall result
| Field | Entry |
|---|---|
| Lines assessed | <<FILL: count>> |
| Pass | <<FILL: count>> |
| Gap (open) | <<FILL: count>> |
| N/A | <<FILL: count>> |
| Highest open risk | <<FILL: H / M / L>> |
| Program verdict | Ready / Conditional (gaps with plan) / Not ready |
| Assessor (name, signature, date) | <<FILL>> |
| QA / Trade Compliance approval (name, signature, date) | <<FILL>> |
References
DSCSA, section 582 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360eee-1). FDA guidance and current exemption notices for enhanced drug distribution security (confirm the live posture and dates for your trading-partner type; these have changed more than once). GS1 US DSCSA implementation guideline (EPCIS/CBV application standard). Partnership for DSCSA Governance (PDG), Interoperability Blueprint.
Confirm the current version and effective dates of each reference before issue.
Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Filled specimen
The following shows part of a completed self-assessment for an illustrative wholesale distributor, so you can see the level of detail expected. Company, dates, and findings are illustrative.
Header:
| Field | Entry |
|---|---|
| Trading-partner type assessed | Wholesale distributor |
| Applicable exemption status | Not exempt; enhanced-phase exchange required since 27 Aug 2025 |
| Assessment date | 20 August 2026 |
Sample of completed lines:
| # | Check | Result | Evidence / note |
|---|---|---|---|
| E1 | Enforcement status confirmed current | Pass | Confirmed against FDA exemptions guidance, dated 18 Aug 2026; distributor segment not exempt |
| P1 | TI is package-level | Pass | Sample TI record TI-2026-08421 shows serial-level product identifiers |
| X2 | EPCIS/CBV version documented per connection | Gap | Connection inventory exists for 40 of 46 active trading partners; 6 legacy connections undocumented |
| X4 | Aggregation accuracy verified | Pass | Q2 2026 challenge test, 500 case samples, 100 percent correct inflation |
| V1 | VRS operational for saleable returns | Pass | Returns verification log sample shows recorded result on every entry, no re-shelving on pending |
| S4 | Data exceptions triaged separately | Pass | Exception log LOG-SC-027 in use since July 2026, monthly trend review evidenced |
| T2 | 3PL/repackager data-ownership agreements documented | Gap | 2 of 3 3PL contracts lack an explicit EPCIS event-ownership clause |
| R3 | Records retained and retrievable | Pass | Retrieval test performed 12 Aug 2026, records produced within 2 hours |
Gap summary:
| Gap ref | Check # | Description | Risk | Owner | Remediation / due date | Status |
|---|---|---|---|---|---|---|
| G1 | X2 | 6 legacy trading-partner connections have no documented EPCIS/CBV version | M | IT Serialization Lead | Complete connection inventory and confirm version with each partner; CAPA-2026-0211, due 30 Sep 2026 | Open |
| G2 | T2 | 2 of 3 3PL contracts lack an explicit data-ownership clause | H | Trade Compliance | Amend contracts with the event-ownership and T3 clause; legal review requested | Open |
Overall result: Conditional. One high-risk gap open (G2, contract amendment in progress) with a dispositioned plan and no evidence of an actual data-ownership failure to date. The program continues to operate under interim manual confirmation with the two affected 3PLs until the contracts are amended.
Common inspection findings this checklist prevents
- A program claims enhanced-phase readiness with no current, dated confirmation of the actual enforcement posture for its trading-partner type.
- EPCIS technical details (schema validation, version, aggregation accuracy) are asserted but never actually tested and evidenced.
- The suspect-product SOP exists but has never been exercised, real or tabletop, so no one has verified the 24-hour clock actually works under pressure.
- Every data exception is either escalated as suspect product or waved through, with no documented triage discipline.
- Trading-partner authorization records exist for some but not all active partners, with no complete register.
- 3PL and repackager contracts are silent on data ownership, discovered only when a real gap needs an accountable owner.
- Records retention is stated in policy but retrieval has never actually been tested.
How to adapt this checklist
- Set your document number, owner, and trading-partner type in the header, and confirm the current enforcement posture before scoring section 1.
- Add or remove lines based on which sections genuinely apply to your role (a dispenser will N/A several manufacturer-side lines; a 3PL will N/A most of section 2).
- Feed every open gap into your real CAPA or gap-remediation process, not just the table here.
- Set the re-run cycle to your risk profile, for example annually, plus after any material platform, partner, or EPCIS-version change.
- Confirm every regulation, guidance, and exemption date in the references against the current published source before issue; do not carry over a prior assessment’s dates.