Product escapes and recall
Trace a contained S1/S2 NCR into an immutable affected-product population, obtain independent QA and Product Safety decisions, record external action evidence and close after the linked NCR/CAPA.
Screen orientation
product_escape:read is limited by site and clearance. Creation, revision and submission use product_escape:assess; scope approval, safety decision, coordination and closure use :approve, :decide, :coordinate and :close. The current scope author submits their own version. QA excludes its author/submitter; Product Safety also excludes its approver. Coordinators must differ from the scope author, scope approver and safety decider. Closure excludes the scope author/submitter and safety decider. Visible buttons do not override these named-user checks.
Six summary cards count scope review, safety decision, action tracking, verification, open products and open obligations. New escape opens the scope editor above the searchable register. Each case shows the current scope, affected units, dispositions, obligations and immutable history; stage-specific action forms open below the register.
Field reference
The entries below describe the current screen controls and read-only values. They do not relax server-side validation, site scope, classification handling or required independence in a governed decision.
| Field or value | Control | Required or shown when | How to use or read it | Result |
|---|---|---|---|---|
| Search register / Filter register by status / Sort register | Search and two selects | Optional view controls. | Search escape number, NCR number/title, site, status or severity. Select All states or a returned status; sort newest/oldest by creation time or Identity A–Z/Z–A by escape number. These filters do not change the summary totals. | Shows the matching subset of already authorized cases. |
| Contained S1/S2 NCR | Select | Required for creation; parent must be contained, not OPEN or CLOSED, with S1 or S2 severity. | Select the real NCR. Its site and classification govern the escape. Selection pre-fills trace context and risk/proposed action; review every default before submission. | Links the escape to its corrective-action prerequisite. |
| Scope title / Detected on / Trigger / Trigger reference | Text, date, select and text | Required; title at least 10 characters, reference at least 2; UI disallows future detection. | Identify the detection event using CUSTOMER_REPORT, IN_SERVICE_EVENT, DELIVERED_NONCONFORMANCE, INTERNAL_TRACE or AUTHORITY_REPORT and its exact reference. | Freezes the source event in the scope version. |
| Risk / Product-safety impact / Regulatory impact / Proposed action | Select, two checkboxes and select | Risk and proposed action required; checkboxes record actual impact. | Choose LOW/MEDIUM/HIGH/CRITICAL and MONITOR, NOTIFY, FIELD_INSPECTION, STOP_USE or RECALL. Safety, regulatory or CRITICAL cases cannot propose MONITOR. A partial scope cannot receive QA approval with MONITOR only. | Sets the response constraints without performing the proposed action. |
| Affected population definition | Multiline text | Required; at least 20 characters. | Describe the exact affected population and inclusion basis, distinguishing known units from unresolved exposure. | Retains the scope rationale beside the resolved product snapshot. |
| Trace item / Exact batch / Exact serial | Select and two text controls | Supply an exact item with one batch or serial, or a directly known product. | An item trace requires one identity, not both. Entering batch clears serial and vice versa. The item must match the parent NCR item when specified and remain within classification. | Runs the exact material genealogy trace; it is not a broad text search. |
| Trace completeness / Unresolved population | Select and conditional text | COMPLETE or PARTIAL required; unresolved text at least 20 characters only for PARTIAL. | COMPLETE requires at least one resolved product. PARTIAL records the remaining uncertainty. Changing completeness clears the unresolved text. | Makes incomplete trace coverage explicit to QA. |
| Additional directly known product (optional) / Manual inclusion rationale | Select and conditional text | One manual candidate is supported by this UI; rationale at least 10 characters when selected. | Choose a same-site product within the NCR classification. A revision restores the currently pinned manual product and rationale for deliberate review. | Adds the named product alongside exact genealogy results. |
| Scope and trace evidence / Replacement scope evidence | Controlled evidence select | Required for each initial or replacement scope. | Choose one CLEAN immutable version from an active same-site document within escape classification. Manage evidence leads to Documents; a typed reference alone is not a stored evidence version. | Pins the basis of the immutable population version. |
| Scope submission note | Multiline text | Required; at least 20 characters; current scope author only. | Explain why the current draft is ready for independent scope review. | Moves DRAFT to SCOPE_REVIEW. |
| Decision / Independent scope decision / Scope decision evidence | Select, multiline text and controlled evidence select | APPROVE or REJECT, note at least 20 characters and CLEAN same-site evidence required. | Independent QA reviews the population and uncertainty. Rejection preserves this version; use Revise for a replacement. | Approval moves to DECISION_PENDING; rejection returns the case to DRAFT. |
| Outcome / Effective on / Product Safety rationale | Select, date and multiline text | Required for safety decision; rationale at least 20 characters. | Choose MONITOR, NOTIFY, FIELD_INSPECTION, STOP_USE or RECALL. Safety/regulatory/CRITICAL exposure cannot use MONITOR. RECALL must include at least one RECALL product disposition. | Records the independent safety decision, not recall execution. |
| Product / Disposition / Due date / Disposition rationale | Read-only product and repeated select, date and text | Exactly one disposition for every approved affected product; rationale at least 10 characters. | For each serial choose EXCLUDE, MONITOR, FIELD_INSPECTION, STOP_USE, RETURN or RECALL and its accountability date. The prebuilt rows represent the approved scope and are not an editable population. | Creates one tracked product action per approved unit. |
| Obligation / Recipient reference / Due date / Requirement basis | Repeatable select, text, date and text | Active decisions require an obligation; recipient at least 2 characters and basis at least 10. | Choose CUSTOMER_NOTIFICATION, AUTHORITY_REPORT, INTERNAL_PROGRAMME, SUPPLIER_NOTIFICATION or FIELD_ACTION. Regulatory impact requires AUTHORITY_REPORT. This UI starts with one obligation and supports adding more, but provides no remove button. | Tracks who must account for external work; no notification is sent. |
| Product Safety decision evidence | Controlled evidence select | Required with the safety decision. | Select one CLEAN same-site version within escape classification covering the rationale, dispositions and obligations. | Pins the decision basis before ACTION_TRACKING. |
| Outcome / External action / acknowledgement reference / Completion evidence summary | Select, text and multiline text | Required per open product action or obligation; reference at least 2 characters, summary at least 20. | Product evidence uses COMPLETED or EXCLUDED; obligation evidence uses EVIDENCE_RECORDED or WAIVED. Cite work actually performed externally and justify any exclusion or waiver. Final entries cannot be updated through this screen. | Finalizes only the selected accountability entry. |
| Externally performed action evidence | Controlled evidence select | Required for each coordination action. | Select CLEAN same-site evidence of the actual action or justified exception. An external reference is recorded evidence, not a messaging or custody command. | All finalized products and obligations move the case to VERIFICATION. |
| Closure summary / Affected-product accountability result / Residual risk | Two multiline text controls and select | Required at VERIFICATION; both texts at least 20 characters; risk ACCEPTABLE or MONITOR. | Reconcile every affected product and obligation. The linked NCR/CAPA must already be CLOSED; this screen cannot close it for you. | Records the final independent accountability conclusion. |
| Independent closure evidence | Controlled evidence select | Required with closure. | Select CLEAN same-site closure evidence after the linked NCR/CAPA and every tracked entry are final. | Closes the escape while retaining scope and decision history. |
Actions and effects
When to use: A scoped assessor starts from a contained open S1/S2 NCR.
What it does: Creates DRAFT and resolves the population without moving, releasing or recalling material.
When to use: The author submits; independent QA approves or rejects.
What it does: Only a rejected current scope can be replaced. Approved scopes lead to a separate Product Safety decision.
When to use: An independent decider accounts for every approved product and required obligation.
What it does: Moves to ACTION_TRACKING; it does not execute dispositions or send notices.
When to use: An independent coordinator acts on an OPEN entry.
What it does: Retains external evidence and finalizes that entry; when all are final the case enters VERIFICATION.
When to use: An eligible independent closer acts after all accountability and parent NCR prerequisites pass.
What it does: Sets CLOSED without changing stock, products or the linked NCR.
Lists and states
- Case cards show escape/NCR/site/severity, current scope version/status, risk, trace completeness and proposed or decided action. Affected-unit rows combine the immutable product snapshot and genealogy path with the current product status; a current status badge is not recall execution evidence.
- Decision cards show the named decider, product dispositions and external obligations. OPEN entries expose evidence actions; final entries do not. Immutable scope history appears when more than one version exists.
Authority boundary
Product-escape governance sends no customer or authority message and never blocks, moves, releases, returns or recalls stock. It does not change product status or a baseline. A recorded RECALL decision is accountability, not executed recall; closure requires the linked NCR/CAPA to be CLOSED independently.