Fable
The two ledgers in the pharmacy: one tracks how prescriptions were written, the other tracks how medicines were dispensed
The old-brand pharmacy passed to the fourth generation, and the shopkeeper established two general ledgers. One was called the prescription ledger, recording where each prescription came from, which doctor revised it, which herb was reduced by three qian, and why. From the source medical text to the medicine packet on the counter, every change could be traced to a corresponding line. The other was called the daily ledger, recording the actual events in the shop each day—who wrote the prescription, who filled it, what time the decoction was boiled, and how long before the patient returned for a follow-up. The two ledgers were kept in the same cabinet, but the people who looked at them were never the same.
The county office investigated twice. The first time, because the patient vomited continuously after taking the medicine, the inspector checked the daily ledger to find the pharmacist on duty that day, the dispensing time, and the packet number, then checked the purchase records for the same batch of herbs, and found that the batch of ginger had gotten damp and lost its potency. The problem lay in the daily ledger—operational records can trace quality incidents in actual practice.
The second inspection was because someone reported that the prescription did not conform to the compatibility standards of the Compendium of Materia Medica. The inspector went through the prescription ledger to see whether that cold-natured herb had a corresponding warm-natured herb to balance it, which edition of which medical text it was cited from, and which doctor had changed the compatibility at what time. The prescription ledger explained the design rationale—every step of reasoning and decision from theory to practice.
The messiest case was when two problems stacked together. The patient had an allergy, and the county office required the pharmacy to prove both that the prescription was reasonable and that the operation was error-free. The pharmacist first checked the prescription ledger and said the prescription was orthodox. The inspector replied that the prescription being fine did not mean the pharmacist had not measured the dose wrong. The pharmacist then checked the date ledger to prove the operation record was complete. The inspector said the operation being fine did not mean the prescription itself was safe. Each ledger governed only one dimension.
The old shopkeeper explained the rules at the gathering: the prescription ledger answers "why it was prescribed this way," tracing the source of the requirement, the basis for changes, the reasons for the design. The daily ledger answers "what actually happened," recording the time of operations, the person executing them, the system's responses, the state of the results. The pharmacy's safety depends on both ledgers being openable and both being reconcilable.
Later there was a batch replacement of medicinal materials—the licorice origin was changed. The formula ledger recorded: the original formula came from the third edition of the medical canon, the basis for replacing the licorice was row seven of the medicinal property comparison table, and the chief physician had signed approval. The daily ledger simultaneously recorded: the time the new licorice entered the warehouse, the batch numbers of the first medicinal packets used, and the follow-up records after patients took the packets showed no abnormalities. A cross-reference number was pasted between the two ledgers, a string of digits appearing in the same entry in both the formula ledger and the daily ledger.
The old shopkeeper's apprentice wrote in his notes: if an audit only looks at the day ledger, it sees operations but forgets design; if it only looks at the recipe ledger, it sees design but forgets implementation. Security does not require choosing which book is more important; it requires that both books can be opened to the page with the same serial number.