The first decision is containment
A return to the intended temperature range does not close an excursion. Before deciding on product, prevent further exposure, identify potentially affected material and preserve evidence. Restoring the system, assessing the batch and understanding the cause are connected activities with different questions and responsibilities. Combining them into one decision can lead either to premature release or to rejection unsupported by the available data.
The procedure should cover storage and transport, including receipt, waiting periods and movement to alternative capacity. An alarm identifies a condition requiring assessment; it does not always demonstrate a product excursion. Equally, no alarm does not prove acceptable conditions when the sensor, power supply or communication was unavailable. Initial classification must retain both possibilities until evidence resolves them.
Regulatory context and limits of the references
[REQUIREMENT] EU GDP 2013/C 343/01 applies to relevant distribution activities, including management of transport deviations. [GUIDANCE] ICH Q10 provides a pharmaceutical quality-system model, while ICH Q9(R1) supports decisions proportionate to risk and uncertainty.
[GUIDANCE] Stability references such as ICH Q1A(R2), within their scope, do not provide a universal allowance for excursions. The consolidated ICH Q1 remains a Step 2b draft on the EMA source checked. Acceptability must follow authorised information and evidence applicable to the specific product.
Protect the product and the evidence
[GEP] Contact the designated responsible person, check system condition and decide whether material can remain safely in place. Transfer is not automatically the best option: moving into an unprepared location may add exposure or break traceability. Follow the approved contingency arrangement and record the decision, destination and actual timings. Confirm available capacity before moving inventory.
Identify and block potentially affected material through the quality system's defined status. Segregation may combine physical and electronic controls, but must prevent unauthorised use or dispatch. Initially broaden the scope where records are incomplete, then narrow it using a reviewable rationale. Include material that left the area during the uncertain period, rather than assessing only stock present when the alarm was noticed.
Preserve original data, settings, notifications, relevant audit trails, door records, deliveries, maintenance and power information. Photograph observable conditions before changing the scene where practical. Urgent repair may be appropriate, but recording the initial state supports reconstruction of the failure. Avoid resets that erase events without considering their effect on the investigation.
Reconstruct one consistent timeline
[GEP] Distinguish actual onset, first abnormal reading, first alarm, receipt, intervention and return to conditions. These timestamps rarely coincide. Align sources for time zone, daylight saving, transmission delay and clock offsets. A late message may describe an earlier event; its arrival time must not be assumed to mark the beginning of exposure.
The timeline should separate known facts, inferences and unknowns. If a segment is missing, establish a plausible interval from the last valid evidence, the next available evidence and physical conditions. Do not simply join two readings with a straight line and describe the interpolation as measured temperature. Keep the uncertainty visible throughout the assessment and in the final decision.
Check the instrument's identity, location, range, calibration, file integrity and possible movement. An out-of-tolerance probe requires evaluation of its error; it does not automatically invalidate every measurement. An isolated peak can also be real. Compare independent sensors and operational records before attributing it to interference, instrument failure or handling.
Define the affected material population
[QRM] Build a list by product, batch, quantity, position, packaging and status. Associate each item with its residence period and movements. A final inventory snapshot can omit dispatched material or include items arriving after the event. Where several zones exist, use temperature-mapping evidence without assuming that every position behaved identically.
Separate air, package-surface and product temperatures. A logger in a vehicle does not automatically describe every package; a logger inside one shipper may not represent other pallets. Shipping qualification can help interpret the relationship, provided actual load, packaging and conditions remain within the demonstrated envelope. A thermal model must not conceal a material difference from that envelope.
Investigate previous events affecting the same material. Returning to nominal conditions does not reset its thermal history. Consider cumulative exposure, event sequence and relevant freeze-thaw cycles. If the history is unavailable, record that limitation rather than declaring the batch history clean because no documents were supplied. The absence of a record is different from evidence that no event occurred.
Handle apparently conflicting evidence systematically
If vehicle data, the receiving record and a logger inside packaging disagree, do not select the most favourable dataset. First identify what each channel measures and which material it represents. Outside air and an insulated box interior may differ without either instrument failing. The relationship must nevertheless be compatible with the qualified configuration and documented load.
Indirect records also have limits. A closed door contact establishes a contact state, not necessarily an intact seal. A running compressor does not prove the expected cooling capacity. Explain which inference each indirect record permits and which remains unsupported. Several consistent indicators can strengthen reconstruction without retrospectively creating missing measurements.
Where timing is uncertain, examine whether that uncertainty could change product disposition. If the conclusion remains unchanged for every plausible profile, the assessment may support a robust decision. If it depends on an unproven assumption, obtain further evidence or reach a decision consistent with that limitation. Record this sensitivity assessment and its reasoning, rather than leaving it only in investigation-team discussions. Reviewers should be able to distinguish a conservative bound from an estimate presented as fact.
Assess product impact
[QRM] A competent assessor compares the reconstructed profile with evidence applicable to the product and packaging. Consider formulation, concentration, container, batch age, remaining shelf life and sensitive quality attributes. Two products with the same labelled storage range may respond differently to an excursion. Different forms of the same active ingredient are not necessarily equivalent either.
Relevant evidence can include stability studies, transport data, specific excursion studies and a documented manufacturer or authorisation-holder assessment under defined responsibilities. A general statement from a logistics supplier does not replace product knowledge. Technical requests should include the profile, uncertainty, quantity and history, rather than asking only whether “a few hours outside refrigeration” is acceptable.
| Situation | Critical question | Decision to document |
|---|---|---|
| Complete profile and relevant data | Are conditions within the scientifically supported envelope? | Justified disposition by product and batch |
| Incomplete recording | What exposure cannot be excluded? | Additional evidence or continued hold |
| Possible freezing | Are this mechanism and packaging covered? | Specific assessment without averaging away the peak |
| Repeated events | Is the cumulative history supported? | Integrated assessment rather than isolated releases |
Do not automatically apply mean kinetic temperature to freezing, aggregation, physical transitions or biological systems. A summary value does not retain the complete profile. If a kinetic model is proposed, justify its mechanism, parameters and operating range. A calculated value does not, by itself, change the authorised storage conditions or establish that every relevant quality attribute remains acceptable.
Make a disposition decision without shortcuts
[GEP] The decision identifies material, reviewed data, assumptions, uncertainty, conclusion, any conditions and the authorised approver. It may require further information or result in rejection. A short event or high inventory value does not create an entitlement to release. Manage supply pressures without changing the scientific judgement or hiding the limitations of the evidence.
Analytical testing is useful only when the plan shows that attributes, sampling and methods address the identified risk. A passing result today may not exclude an effect on remaining shelf life. The FDA OOS guidance, May 2022, concerns out-of-specification laboratory results; it should not be treated as a universal procedure for every temperature alarm.
If material has already been distributed, promptly involve the responsible functions to assess communications, tracing and potential market actions under the applicable framework. This article does not prescribe universal notification obligations or deadlines. The outcome must match the authorisation holder's responsibilities, relevant licences and quality-system procedures.
Keep information requests tied to their context
When seeking external assessment, provide one version-controlled package with a chronology and specific questions. Include the complete profile, not only the maximum, and distinguish measured information from estimates. Ask whether the conclusion covers actual packaging, batch age and disclosed previous events. Clarify an answer addressing different conditions before relying on it; do not silently expand its scope.
Communications between warehouse, carrier, manufacturer and QA should retain consistent identifiers. Record who supplied each fact and when, keeping subsequent corrections. When a quantity is transferred or split, preserve its relationship with the batch and exposure segment. Material traceability and document traceability must progress together, including during urgent operational calls.
The final dossier should be understandable to someone who did not attend those calls. Explain decision steps and avoid reliance on unrecorded conversations. Assign ownership to outstanding information. Where a conditional decision is permitted within the process, its conditions must be verifiable; a vague promise to supply evidence later cannot substitute for the evidence needed to support the present decision.
Investigate beyond the first failed component
[GEP] Separate immediate cause, contributing factors and control weaknesses. “Door open” describes an event; it does not explain why it remained open, why the signal was not handled or why the process required an unplanned delay. “Human error” is insufficient without examining instructions, interface design, staffing and workload. These factors can change what a sustainable corrective action looks like.
Develop competing explanations and seek evidence that could disprove them: seals, blocked airflow, excess load, controller, power, logistics activity, sensor, network and response. Avoid selecting tests only to confirm the first explanation. If the cause is not demonstrated, label it probable or undetermined and select controls compatible with that uncertainty. Confidence should follow the evidence, not the closing deadline.
Assess the alarm and escalation chain separately from the thermal failure. Equipment can fail despite appropriate maintenance, while a delayed response may enlarge the event. These mechanisms need different actions and effectiveness criteria. Keep the deviation, maintenance order and technical change linked so that one record is not closed on a conclusion contradicted by another.
CAPA and effectiveness verification
[GUIDEGXP] Correction resolves the immediate problem; CAPA addresses a cause or systemic vulnerability. Replacing a seal may restore service. Changing wear checks, spare availability or door detection may reduce recurrence. Select actions according to the demonstrated mechanism, not a standard list. Where several barriers failed, determine whether actions are needed at more than one level.
Define owner, deadline, completion evidence and effectiveness criteria before closure. Simply counting “zero events” is weak if activity has fallen. Consider opportunities for failure, such as comparable accesses or shipments, and verify that the new control functions. Training is appropriate for an identified knowledge gap; it does not compensate for a poorly designed interface or an impossible operating instruction.
Return to service requires checks of affected functions, monitoring and updated instructions. System requalification should match the change and uncertainty. Technical closure may precede product disposition, or the reverse; records must show which decisions are complete and which remain open. A single status field should not conceal those distinct responsibilities.
Hypothetical case: defrost and delayed notification
In a hypothetical cold room, an event appears during defrost. Notification arrives after a network interruption. The team blocks batches potentially present during the period, preserves local records and reconstructs timing without assuming that message arrival marks the start of the temperature breach. Previously dispatched quantities are included in the initial scope review.
Comparison of channels shows a local abnormality near recently added pallets. Reconstruction separates airflow obstruction from communication delay. Product impact is assessed using relevant profiles and evidence. No batch is released merely because defrost is a normal system function. The important question is whether the observed exposure is supported for that product.
Actions change the layout and verify notification after connection loss. Effectiveness includes a functional test and observation of comparable operating conditions. QA closes product disposition, cause assessment and CAPA separately. This hypothetical example supplies no thresholds, durations or acceptance criteria transferable to another site.
Checklist, warning signs and conclusions
- Containment and material status are documented and verifiable.
- Scope includes movements, dispatched product and uncertain periods.
- Original data, clocks and configurations are preserved.
- Air, packaging and product are not treated as equivalent measurements.
- Scientific assessment and approval follow defined responsibilities.
- Cumulative history and remaining shelf life are considered where relevant.
- Cause, contributing factors and uncertainty are distinguished.
- CAPA, technical restoration and product disposition have traceable conclusions.
Warning signs include resetting before saving records, interpolation presented as measurement, automatic use of averages, verbal release, acceptance based only on absence of complaints and repeated training without addressing the cause. [GUIDEGXP] A sound investigation makes clear what happened, which products are involved and what evidence supports each decision.
Feed trends and learning into the Cold Chain & Controlled Temperature Systems lifecycle. References checked on 21 September 2026: EU GDP 2013/C 343/01, ICH Q9(R1), Q10 and Q1A(R2), with consolidated ICH Q1 explicitly retained as a draft. No excursion value or acceptable duration is universal.
