How Small Medical Device Companies Manage Lot Traceability Without Enterprise ERP

Small medical device companies do not need SAP, Oracle, or a six-figure ERP project just to answer basic lot traceability questions.

They do need something more disciplined than “check the spreadsheet and ask whoever packed the order.”

For a small Class I, II, or III medical device manufacturer, lot traceability has to answer two questions fast:

1. Backward trace: Given this finished good lot, which raw material lots, component lots, suppliers, and work orders were involved?
2. Forward trace: Given this raw material or component lot, which finished good lots were made, and which customers, orders, shipments, and invoices received them?

That is not automatically an enterprise ERP problem. It is a record control problem, a workflow problem, and eventually a system design problem.

The right system is the smallest system that can reliably answer the regulated questions.

What the FDA actually cares about

The FDA does not inspect for a specific ERP brand. It inspects whether your quality system and records can prove what happened.

Since February 2, 2026, FDA’s revised Part 820 has operated as the Quality Management System Regulation, or QMSR. QMSR incorporates ISO 13485:2016 by reference and ties medical device quality system requirements to related rules around UDI, traceability, complaint reporting, and advisory notices. U.S. Food and Drug Administration

Under current 21 CFR Part 820, manufacturers must document a quality management system, assign UDI under Part 830, document traceability procedures under Part 821 where applicable, report qualifying complaints under Part 803, and handle advisory notices under Part 806. eCFR

That sounds heavy, but the practical traceability question is still straightforward:

Can you prove which lots went into the device, where the finished devices went, and what changed in the record over time?

If the answer is yes, you may not need enterprise ERP.

If the answer is “we think so, but one person has to reconcile three spreadsheets, a packing list folder, and QuickBooks,” you have a risk.

The minimum lot traceability flow

A workable lot traceability process should follow the product from receipt to shipment.

At a minimum, you need records for:

• Raw material or component receipt
• Supplier lot number
• Your internal lot number
• Incoming inspection or release status
• Work order issue
• Quantity consumed by lot
• Finished good lot created
• Final inspection or release
• UDI, label, or packaging record where applicable
• Shipment line
• Customer, order, ship date, quantity, tracking number, and invoice

The weak point is usually not the lot number itself. Most companies can assign a lot number. The weak point is the relationship between records.

A finished good lot sitting in inventory is useful. A finished good lot tied to a work order is better. A finished good lot tied to the raw material lots used, the shipment lines it went out on, the customer orders it fulfilled, and the invoice records behind those shipments is the actual recall-ready system.

That is the difference between “we have lot numbers” and “we have lot traceability.”

Option 1: Controlled spreadsheets and paper travelers

For a very small device company, spreadsheets and paper travelers can work for a while.

This is most realistic when volume is low, the BOM is simple, one person owns the data, and the company has strong document control habits. A spreadsheet can record incoming lots, work order usage, finished good lots, and shipments. A paper traveler can carry the build record through production.

But the controls matter.

There should be one controlled template, not five versions floating around. Formula changes should be reviewed. Completed records should not be casually overwritten. Lot numbers should be generated consistently. Shipment history should be tied back to actual orders, not just copied into a notes field.

This is where small companies get into trouble. Spreadsheets feel simple because everyone knows how to open them. They are risky because everyone knows how to change them.

If electronic records are used for regulated records, Part 11 controls may apply. Closed systems need controls for authenticity, integrity, record retrieval, authorized access, and secure time-stamped audit trails where prior information is not obscured. eCFR

That does not mean every spreadsheet is banned. It means the more your spreadsheet drives production or quality decisions, the more disciplined your validation, access control, backup, and change control need to be.

Option 2: A simple database or low-code system

The next step up is usually a database.

This can be a low-code tool, a lightweight inventory system, or a custom internal database. The benefit is that records become linked objects instead of loose rows.

A good database lets you connect:

Raw material lot → work order → finished good lot → shipment line → customer order

That structure is much harder to maintain in a spreadsheet once multiple people are receiving, issuing, building, shipping, and investigating complaints at the same time.

A database also makes forward and backward tracing faster. You can start with a suspect supplier lot and ask, “Which work orders used this?” Then, “Which finished good lots came out of those work orders?” Then, “Which customers received those finished goods?”

The risk is that a custom database can become its own problem. If only one person understands it, if fields change without control, or if nobody tests backups, the system may look better than a spreadsheet while carrying many of the same risks.

Option 3: eQMS plus lightweight manufacturing software

Some small medical device companies split the problem across systems.

They use eQMS for document control, training, complaints, CAPA, and change control. Then they use lightweight inventory or manufacturing software for purchasing, work orders, inventory, and shipments.

This can work well.

The danger is interface drift. If the item master in the eQMS does not match the item master in inventory, or the lot number on the complaint record does not match the lot number in shipments, the system becomes fragile.

Hybrid stacks need clear ownership. One system should be the source of truth for item numbers. One system should be the source of truth for lot genealogy. One system should be the source of truth for customer shipment history.

When those boundaries are not written down, audit prep becomes a reconciliation exercise.

Option 4: A right-sized ERP instead of enterprise ERP

This is where PAX fits.

PAX was built inside a medical device manufacturing facility near Seattle because the team needed lot and expiration tracking, 10-year document retention, export documentation support, and GAAP accounting without the complexity of a large enterprise ERP.

On the PAX medical device page, the product is positioned for small Class I, II, and III medical device manufacturers with simple assemblies. It includes lot and expiration traceability, 10-year document retention, finished goods component traceability, quote-to-order conversion, shipping integrations, and work-order labor costing.

The important part is the trace path.

PAX supports bi-directional lot tracking. A finished good lot can be traced back to the work order and raw material or component lots that fed it. A raw material or component lot can be traced forward to the work orders that consumed it, the finished good lots those work orders produced, and the customer orders, shipments, and invoices those finished goods went out on.

In plain English:

If a customer calls about finished good lot FG-24091, PAX can show where that lot came from and where it shipped.

If a supplier notifies you that raw material lot RM-8831 may be affected, PAX can show which work orders used it, which finished good lots were created from those work orders, and which customers received those finished goods.

That is the practical recall question.

The order data matters more than people think

A lot trace report that stops at finished goods inventory is incomplete.

For medical device companies, the question is not only “what did we make?” It is “who received it?”

That means shipment-line data matters. Customer order data matters. Invoice linkage matters. Tracking numbers matter. Packing lists matter.

If a reportable correction or removal is initiated to reduce a risk to health, manufacturers generally must report the action within 10 working days. The report includes, among other details, device identification, lot or serial number, total number of devices manufactured or distributed, consignee information, and dates and quantities distributed. eCFR

That is why lot traceability should reach the customer order level.

A spreadsheet that says “FG lot 104 used RM lot A” is helpful. A system that says “FG lot 104 shipped to these 17 customers on these 23 shipment lines, under these order numbers and invoice numbers” is much more useful when the clock is running.

When spreadsheets are still enough

Spreadsheets may still be enough if your company is very small, your BOM is simple, shipment volume is low, and your quality system has strong record controls.

They are usually not enough when:

• More than one person edits traceability records
• You have multiple raw material lots feeding multiple work orders
• You ship partial orders
• You need fast customer impact reports
• You are handling recurring complaints or supplier issues
• You are preparing for regular audits
• You cannot run a mock recall quickly

In our experience, the breaking point usually comes when the company can still make product, but can no longer answer questions quickly.

That is when a lightweight ERP or structured manufacturing system becomes less expensive than the labor spent reconciling disconnected records.

Where PAX is not the right fit

PAX is built for small manufacturers with simple to moderate BOMs. That includes many medical device companies, especially teams that need lot traceability, work orders, inventory, accounting, CRM, and shipping in one system without enterprise ERP overhead.

It is not the right answer for every manufacturer.

If you need advanced demand planning, highly complex multi-site manufacturing, deep enterprise MRP, or serial-level genealogy inside a single work order, you should validate that workflow carefully before choosing PAX. For batch manufacturing where the work order is the batch boundary, PAX’s current lot genealogy model is a strong fit. For more granular intra-work-order genealogy, the requirement should be discussed during evaluation.

That is not a weakness to hide. It is the buying decision.

Small manufacturers should not buy enterprise ERP because they were scared into it. They also should not stay on spreadsheets after the traceability risk is obvious.

The right system is the smallest system that can reliably answer the regulated questions.

The practical takeaway

Lot traceability without enterprise ERP is possible.

But it has to be real traceability, not just lot numbers written down somewhere.

A small medical device company needs controlled records, backward and forward genealogy, shipment and customer linkage, audit trails, backup discipline, and a workflow that people can actually follow on a busy day.

For some teams, that can start with spreadsheets and paper travelers. For others, it means a database or eQMS hybrid. For small medical device manufacturers that want one system for inventory, work orders, shipping, accounting, CRM, and bi-directional lot tracking, PAX is built for that middle ground.

PAX will not be the right fit for every medical device manufacturer. But if you are under 50 employees, have simple to moderate BOMs, and need lot traceability without enterprise ERP complexity, reach out. We will tell you honestly whether PAX makes sense for you, or whether something else is a better fit.

Written by

Matthew Obey
May 1, 2026