# Chain of Custody

## What is it?

The chain of custody is a complete traceability record per test object: it
records **who** had custody of the test object when, **where** it physically
was, and **why** that changed (received, handed over, relocated, returned,
disposed of). For accredited labs (ISO/IEC 17025), such traceability is often
mandatory; for everyone else, it answers the everyday question "where is test
object X right now?".

Additionally, every test object in the chain gets a **scannable short code**
(e.g., `TO-7K3P9M`). You can print this code as a barcode/QR label, stick it
on the test object, and scan it at the station to jump straight to the
correct detail page.

## How to use it

- **Recording an event:** On a test object's detail page, in the *Chain of
  Custody* section, click *Record event*. Choose the type (e.g., "Handed
  over"), enter **holder** (who) and **location** (where) — both required —
  and optionally a note. The first recorded event automatically assigns the
  scannable code.
- **Picking a holder:** The "Holder (who)" field suggests matching members of
  your organization as you type; click a suggestion to use it. Free text is
  also allowed (e.g. "External lab" or "Courier DHL") when custody lies
  outside the app. It defaults to your own name — handy for the common case
  of taking custody yourself.
- **Chain sequencing:** The first event on a test object is always
  "Received" — it must be taken into custody somewhere before it can be
  handed over, relocated, returned, or disposed of. Once the most recent
  event is "Returned" or "Disposed", the chain is considered closed: the
  *Record event* button disappears and a hint explains why. To continue
  anyway (e.g. after an accidental disposal), delete that closing event (see
  below) and record a new one.
- **Photo for an event:** When recording, you can optionally attach a photo
  (e.g. the test object's condition at handover, a signature). Up to three
  photos per event. Photos appear as thumbnails right in the chain — click
  one to see it enlarged.
- **Current state:** At the top of the section you always see the current
  holder and location — derived from the most recent event. Below that, the
  full chain runs chronologically.
- **Code / label:** The short code is shown in the section. Click it to see
  it enlarged as a QR code — handy for scanning it straight off the screen
  with your phone, or click *Print* to print it as a label (the print view
  hides the rest of the page). If a test object doesn't have a code yet,
  assign one via *Assign code*.
- **Deleting an event:** A delete icon appears next to an event when **you**
  recorded it — e.g., to fix a typo right after recording. Admins and owners
  can additionally delete events recorded by other members, e.g. to clean up
  a colleague's mistake. Every other role can only delete their own events.
  The deletion itself remains traceable in the audit log, even though the
  event disappears from the chain.
- **Scanning:** Test objects → *Scan test object*. Scan the label (a barcode
  scanner behaves like a keyboard) or type the code — you land directly on the
  detail page. On a phone or tablet without a connected scanner, tap *Scan
  with camera* to open your device's camera and point it at the QR label —
  the code is read automatically and you're taken straight to the detail
  page. This button only appears when the browser supports camera access.

## Common issues

- **"The current holder is wrong."** The current state is always the
  **most recent** event (by event time). If an event was recorded with the
  wrong timestamp, record a correcting follow-up event or delete the faulty
  event if you recorded it yourself (see above) — the chain is otherwise
  deliberately append-only and is never overwritten.
- **"I can't record a new event."** Either you lack permission (see below),
  or the chain is closed: the most recent entry is "Returned" or "Disposed".
  If that was a mistake, delete that last entry and record a new one.
- **"Only 'Received' can be picked for the first event."** That's by design:
  the chain always starts with taking custody of the test object.
- **"I can't delete an event."** You can only delete events you recorded
  yourself, not ones recorded by other members. Admins and owners can also
  delete other members' events.
- **"Scanning doesn't find the test object."** The code doesn't belong to any
  test object in this organization, or it was typed incorrectly. The code
  consists of `TO-` plus six characters, excluding the easily confused
  `0/1/I/L/O/U`. Check the label or search for the test object via the list.
- **"A test object has no code."** A code is created automatically on the
  first custody event. You can also generate one in advance via *Assign
  code*.
- **"The camera scanner doesn't start / asks for permission."** Your browser
  needs permission to use the camera; allow it when prompted, or check your
  browser's site settings if you dismissed the prompt earlier. If your device
  has no camera, or the browser doesn't support camera access, the *Scan with
  camera* button won't appear at all — use the manual input field instead.
- **"Who can record events?"** Any member can read; recording requires the
  *Member* role or above. Viewers see the chain but can't change it.
- **"Can a colleague see someone else's code?"** No. Codes and events are
  bound to the organization; tenant isolation applies here too at the
  database level.

---

Source: https://www.testlabiq.com/en/help/chain-of-custody