A hold and release program is the control that keeps product from shipping until someone with authority confirms it is safe and correct. Product is held after production or receipt, tested and reviewed against its specification, then given a disposition: release, rework, or destroy. Nothing leaves on assumption.
The failure this program prevents is simple and expensive: a pallet ships before its lab results come back, the results come back bad, and now you are running a recall instead of a rework. A hold and release program, also called positive release, makes shipment a decision, not a default. This post covers positive release, how you physically segregate held stock, the three disposition outcomes, and how to run the program without it becoming a paperwork jam.
What is a hold and release program?
A hold and release program is a documented system that places finished or incoming product on hold, checks it against defined release criteria, and records a formal disposition before the product can move. It converts "innocent until proven guilty" shipping into "on hold until proven good." The held status is real: the stock is tagged, segregated, and locked in your inventory system so it cannot be picked, staged, or loaded by mistake.
The program sits inside your food safety and quality system as a verification and control step. It is where the results of your HACCP monitoring, lab testing, and paperwork review actually gate the product. A critical control point reading that drifted, a positive pathogen result, a missing allergen check, or an unsigned batch record all become reasons the product stays put. Under a preventive-controls plan, corrective-action and product-disposition duties (21 CFR 117.150) assume you can find and hold the affected product, which is exactly what this program gives you.
What is positive release and how is it different from default release?
Positive release means product ships only after a positive confirmation that every release criterion is met, someone checks the box and signs. Default release is the opposite: product flows out unless someone actively stops it. The difference is who has to act. Under positive release, silence means the product stays. Under default release, silence means it goes.
Positive release matters most where the result you need arrives after production ends. Micro results for a pathogen or indicator organism can take one to five days. A finished-product specification check, a net-weight verification, or an allergen-label reconciliation might be same-shift, but the micro is not. If the product can be shipped and consumed before those results land, a positive release hold is the only thing standing between a bad lot and a customer.
How do you physically hold and segregate product?
A hold has to be real in three places at once: on the pallet, in the racking, and in the system. If it lives in only one of them, someone shipping in a hurry will miss it.
- Hold tags. A bright, standard tag on every held pallet or container, showing the lot, the reason for hold, the date, and who placed it. Many plants use a dedicated color so a held pallet is obvious from across the warehouse.
- Physical segregation. A marked quarantine area, cage, or floor-taped zone that held stock moves to. Where you cannot move it, rope it off. The goal is that no one loads a held pallet without walking past an obvious barrier.
- System status lock. A hold flag in your ERP or inventory system that removes the lot from available-to-pick. This is the strongest control, because it stops the pick before a forklift ever moves. Tags fall off; a system lock does not.
The three layers back each other up. A tag catches the human, the quarantine area catches the tag that fell off, and the system lock catches everything by refusing to let the lot be allocated. Positive release is only as strong as the weakest of the three, so a mature program keeps all three and reconciles them.
What are the disposition options?
Every held lot ends in one of three dispositions, decided by a qualified person against the specification and the food safety plan. The choice depends on whether the defect affects safety, whether it can be corrected, and what the correction costs.
| Disposition | When it applies | What happens next |
|---|---|---|
| Release | All release criteria met: specs in range, results acceptable, records complete and signed | Hold flag cleared, product returned to available stock, release recorded with signature and date |
| Rework | Defect is correctable and does not compromise safety: re-screen, re-pack, re-label, blend within limits | Product reprocessed under a written procedure, then re-inspected or re-tested and re-held until it passes |
| Destroy / divert | Safety compromised or defect not correctable: confirmed pathogen, undeclared allergen, foreign material risk | Product destroyed or diverted to non-food use under record; never released to the original market |
Two rules keep dispositions honest. First, the person deciding must be qualified and independent of the pressure to ship, usually quality, not production or sales. Second, rework is not a loophole. You cannot rework your way past a safety hazard; a lot with a confirmed pathogen or an undeclared allergen goes to destroy or divert, not back through the line. Rework is for correctable quality defects, and every reworked lot goes back on hold until it passes on its own.
How do you run a hold and release program?
Build the program as a repeatable loop so a lot cannot slip out between steps. Run it in this order:
- Define release criteria up front. For each product, write what "good" means: specification limits, required test results, and the records that must be complete and signed. If it is not written, it cannot be checked consistently.
- Place the hold automatically. Every finished lot and every incoming shipment starts held by default, system flag on, tag applied, moved to quarantine. Nothing is available to ship until it is released.
- Run the checks. Pull and test samples, verify net weight and labeling, reconcile allergens, and review the batch record for completeness and signatures.
- Compare to criteria. A qualified reviewer compares every result and record against the written release criteria, not from memory.
- Decide the disposition. Release, rework, or destroy, decided by an authorized person independent of shipping pressure, and recorded with reason, signature, and date.
- Clear or route. On release, clear the system flag and return the lot to stock. On rework, process under procedure and put it back on hold. On destroy, document the destruction.
- Reconcile the held inventory. Review the held list on a set cadence so nothing sits forgotten, and so a physical hold always matches a system flag.
The last step is the one people skip and the one that saves you. A held pallet that no one revisits is either aging out its shelf life or, worse, quietly getting shipped when the tag falls off and no one remembers why it was there.
What do the numbers say about shipping before release?
The cost of not holding shows up in the national recall data, and the pattern is consistent year over year.
- Undeclared allergens and pathogenic contamination are consistently the leading reasons for U.S. food recalls, per FDA's public Recalls, Market Withdrawals & Safety Alerts record, both are failures a finished-product hold is designed to catch before shipment.
- Preventive-controls rules require that when a deviation or unanticipated problem occurs, the affected product be evaluated for safety and prevented from entering commerce, under 21 CFR 117.150 corrective actions, you cannot evaluate and prevent what you have already shipped.
- A written recall plan able to identify and retrieve affected product is required for foods with a hazard requiring a preventive control, under 21 CFR 117.139; positive release is the upstream version of that same identify-and-retrieve capability.
Read together, the rules assume you can find, hold, and evaluate a specific lot on demand. A hold and release program is how you build that capability into normal operations instead of discovering you lack it during a recall.
How does hold and release connect to recalls and traceability?
Hold and release is the near end of the same spine that a recall sits at the far end of. If you can hold a lot before it ships, you have already proven you can identify it, locate it, and stop it, which is the entire mechanical ask of a recall. A plant with a clean positive-release program and clean supplier and lot traceability can convert most "we think there is a problem" moments into a hold instead of a recall.
It also depends on the same discipline as your incoming controls. A shipment that fails incoming material inspection gets held on the receiving side using the same tags, quarantine, and system flags you use for finished goods. The mechanics are identical; only the timing differs. And the moment a hold turns into confirmed bad product that already shipped, you are into your recall plan, so the two programs are written to hand off to each other cleanly.
How do you keep the records straight?
A hold and release program generates a running ledger: what is held, why, what the results were, who decided, and when it cleared. On clipboards and spreadsheets that ledger drifts out of sync fast, a tag says hold, the system says available, and the two disagree at the worst possible moment. The risk is not that you lack a control; it is that your three layers stop agreeing.
Holding release status in one connected system removes the disagreement. When the lot's flag, its test results, its batch record, and its disposition live in the same record, shipping cannot pick a held pallet and a released pallet is provably released. Harmony's connected data model ties test results and record review to the lot's release state, so positive release is enforced by the system rather than by whoever happens to be paying attention. Layer that on your base GMP program and hold becomes a lock, not a sticky note.