MHRA-compliant wholesale ERP with zero gaps on first internal audit

The challenge

A licensed pharmaceutical wholesale business in London was managing stock, batch records, and GDP documentation entirely on spreadsheets and paper.

A UK wholesale dealer’s licence is not a certificate you frame. It is a continuing obligation to demonstrate, on demand, that every medicine you have handled moved through a controlled and documented chain. This client could demonstrate that. It took three weeks and two people.

Every recall scenario, quarantine process, and supplier deviation had to be reconstructed manually from multiple documents. The Responsible Person carries personal accountability for this, which is what changes the character of the requirement: it is not a departmental process, it is a named individual’s liability.

The business was growing, MHRA inspections were increasing, and the manual processes could not scale without introducing serious regulatory exposure.

Why generic ERP would not have solved it

A general-purpose ERP tracks stock: quantities, locations, values. It was built to answer how much do we have and what is it worth. GDP asks a different question: what happened to this specific unit, and can you prove it.

Those are not the same data model. Batch traceability can be bolted onto a generic system, and the bolt-on is where the failure modes live: temperature records filed separately and reconciled by hand, expiry as a reportable field rather than a picking constraint, and, most commonly, an audit trail that someone with admin rights can amend.

What we deployed

PharmFlow, configured for UK GDP wholesale requirements, with every module aligned to MHRA guidelines.

• Full MHRA-compliant stock records
• GDP documentation with immutable audit trail
• Customer and supplier ledger system
• Real-time batch and expiry tracking
• Quarantine and returns handling
• Supplier qualification records
• Multi-location warehouse management
• 35+ reports with PDF and Excel export
• Full data migration from existing records

The compliance requirements are not features in this system. They are constraints on what records can exist. A movement cannot be written without an authorising user. A batch cannot be dispatched past expiry. Historical records cannot be amended, only superseded, with both versions retained. Quarantine, recall, and credit hold are distinct states with different release authorities rather than one generic hold flag.

The result

MHRA-compliant deployment in 45 days, with full GDP audit trail coverage from day one and zero compliance gaps identified on the first internal audit.

The practical change is that audit preparation is no longer a project. An inspection asks a question, someone runs a query, and the answer is on screen. The three weeks and two people went back to their actual jobs.