An unannounced inspection usually begins with a phone call you didn't expect — or no call at all. At eight in the morning, the inspection team is standing at your cold storage dock. There is no "we'll be there next week," no three-day window to patch up your records overnight. That is the whole point of a fly-inspection: no warning, straight to the floor, pulling records, walking the site, and questioning staff in parallel.
Quality heads at pharma distributors describe a peculiar dread around these visits: the system feels sound during internal audits, yet something might still surface when inspectors arrive. The dread has an empirical basis. In the inspection bulletins that drug regulators publish, temperature and humidity monitoring and record-keeping show up among the most cited deficiencies year after year. The reason is not that companies don't care about temperature — it's that keeping records is far harder than keeping things cold. Temperature control is an equipment problem. Record-keeping is a systems problem. You can buy equipment; a system has to be built out of daily actions.
Consider what happened at a distributor in an eastern Chinese provincial capital in the summer of 2024. Tens of billions of yuan in annual distribution volume, a cold storage footprint north of ten thousand square meters, hardware that ranked at the top locally. The inspection team skipped the expensive refrigeration units and went straight for three months of automated temperature and humidity logs. The data showed gaps — more than ten days with missing nighttime readings. The company's explanation: "a system upgrade." The inspectors' follow-up questions: where are the manual monitoring records covering the upgrade window, and where is the deviation assessment for those gaps? There were no answers. The company received deficiency findings and a mandated remediation: a manual backup logging procedure alongside the automated system, excursion alarms pushed by text message directly to the quality head, and every data gap to be treated as a deviation with a formal assessment. The fix cost several hundred thousand yuan. But the quality head later said the money wasn't the expensive part — it was the special audit a key client launched right after the inspection, which nearly cost the company that client's distribution contract.
The logic of the fly-inspection is visible in that case: inspectors don't care how expensive your equipment is. They care whether your record chain has breaks. Missing temperature records, in inspection language, translate to "you cannot say what these drugs went through during that period." What you cannot say, you cannot control.
A readiness checklist: five modules, held to standard every day
A useful readiness checklist earns its value not on inspection day — there is little you can do on inspection day. Its value is in running to that standard daily, so the inspection is merely a sampling exercise. I break it into five modules.
Module one: continuity of temperature and humidity records. Are probe calibration certificates current? Does the sensor layout map match the qualification report? Is every alarm record signed off with a documented response? The classic failure is the unanswered alarm: the system sounds off, the night-shift worker silences it and goes back to rest, and the log shows a clean record with no trace of handling. Inspectors cross-check alarm logs against response records. Ten alarms with zero responses looks worse than having no alarm system at all.
Module two: dual-person, dual-lock control. Are cold storage and reefer keys and passwords genuinely managed under a two-person, two-lock regime, or does the same name keep appearing on both the key log and the inventory ledger? This module tests internal control, not temperature — but it is a favorite inspection entry point, because weak dual control usually signals discounted execution across the whole quality system.
Module three: qualification status of cold chain equipment. Are qualification reports for the cold rooms, reefer trucks, and insulated containers current, and did the qualification cover worst-case conditions — say, the hottest days of summer? Many companies file a qualification report and leave it for years while swapping refrigeration units and rearranging racking without requalification. When inspectors read the report, the real question is: how do you prove this is still the same facility that was qualified back then?
Module four: the excursion deviation workflow — the heart of this article, covered in detail below. A workflow that survives inspection needs at least four moves: detect, isolate, assess, and correct-and-prevent. Miss one, and the record chain breaks.
Module five: the traceability chain across records. The SOP, the records, and the training files must corroborate each other. The SOP says isolate within two hours of an excursion; the record shows isolation three hours later; the training sign-in sheet shows the operator never attended deviation-handling training. Cross-check three points and the system's weak spots light up. Veteran inspectors never read a single record in isolation — they read how records interlock.
Why excursion-handling records are the must-check item
The reasoning works on three levels.
Level one: excursions are inevitable. Power outages, refrigeration failures, frequent door openings, extreme heat — every cold chain has a failure probability. Regulators understand this better than anyone, which is why the underlying logic of GSP was never "no problems allowed" but "when problems occur, do you detect them, handle them, and prevent recurrence?" A company claiming "zero excursions in three years" doesn't read as a model student to an inspector — it reads as suspicious. Either the sensors are placed where nothing ever happens, the alarm thresholds are set too wide, or the records aren't real. One of the three must be true.
Level two: deviation records are the honesty test. Temperature curves can look beautiful, but fabricating a coherent deviation record is expensive: the timeline has to hold together, the people have to match, the assessment basis has to actually exist. When inspectors read deviation records, they're reading the company's quality culture. A company willing to write down its excursions and work through the assessment properly earns the inspector's trust instead.
Level three: methodologically, deviation records are the highest-yield inspection entry point. A single deviation file compresses alarm response speed, training effectiveness, and whether the quality head actually does the job. Three deviation records give an inspector a working read on the maturity of the entire system. As the old hands say: read the deviations first, everything else second.
This leads to the counter-intuitive judgment at the center of this piece: the companies inspectors fear least are the ones with excursion records; the ones they fear most are the ones with none. The former shows a monitoring system that works and people who respond. The latter suggests a system that may not really be running at all. The strategic implication for inspection readiness is direct: don't spend your energy making records look perfect — spend it making sure every excursion gets a complete response. Perfect-looking records are a liability; complete handling is the asset.
A positive case: how an excursion record became a plus
In early 2025, a reefer truck operated by a North China pharma logistics firm suffered a refrigeration failure mid-route, and the cargo temperature alarm went off. The driver followed the SOP: pulled into the nearest service area, transferred the goods into backup insulated containers carried on the truck, and logged temperatures with a portable thermometer throughout. The post-incident review showed the cargo hold had briefly peaked just above 9°C for about half an hour, while the insulated containers held 2–8°C the entire time. The company opened a deviation investigation: quarantined the batch, pulled the product's stability data, asked the manufacturer for a quality impact assessment, and closed a deviation report within three days. The conclusion: the brief excursion stayed within the range supported by stability data, release with justification — and "backup insulated containers on every truck" went into the SOP with more frequent drills. Months later, during a fly-inspection, the team happened to pull exactly this deviation file and walked it line by line — alarm timeline, transfer log, assessment basis, corrective actions — and closed the visit with zero deficiencies. The quality head said it was the document the inspectors spent the longest on, and the one they rated highest.
A tiered response: what frontline staff should do when the alarm sounds
How you handle an excursion depends on its tier. Companies should build a three-tier response matrix, with thresholds set from their own qualification data (and always checked against the regulator's latest requirements):
| Tier | Example situation | Response | Documentation | Closure |
|---|---|---|---|---|
| Tier I — minor drift | Temperature nears the limit but stays within range | Heightened monitoring, note the cause | Note in the monitoring log | Same shift |
| Tier II — brief excursion | Out-of-range for a short period (each company sets its own cutoff, e.g., under 2 hours) | Quarantine affected goods, start quality impact assessment | Deviation report | Within 3 working days |
| Tier III — prolonged or repeated excursion | Long out-of-range period, or repeated alarms at the same sensor | Quarantine and suspend the affected area, full deviation investigation | Investigation report + CAPA | Escalated to the quality head per SOP |
The real value of tiering is that frontline staff know, the moment an alarm sounds, what tier this is and what to do — instead of calling for instructions and flipping through the SOP. Inspectors routinely ask operators on the floor: "the alarm goes off — what's your first step?" If the answer doesn't come, the prettiest SOP in the binder won't save you.
One more trade-off deserves a clear statement: more sensors are not always better. Some companies chase "full coverage" with dozens of probes in one cold room, generating so many alarms that the night shift slides from "check every one" to "selectively ignore" and finally to full alarm fatigue — where a genuine excursion drowns in false positives and nobody responds. The better design: concentrate sensors on critical points (near doors, at fan outlets, at validated worst-case spots), set alarm thresholds from qualification data, and prefer fewer points with fast response over many points with no response. Inspectors have zero tolerance for "ten alarms, zero responses."
The math: routine investment versus the cost of failure
| Item | Routine investment (order of magnitude) | Cost of getting it wrong |
|---|---|---|
| Automated monitoring + alarms + annual calibration | Tens of thousands of yuan per year | Deficiency findings for missing records, mandated remediation as a starting point |
| Backup power / backup refrigeration | Tens of thousands of yuan, one-off | One blackout excursion with no handling record can mean scrapping the whole batch — a single batch can be worth hundreds of thousands |
| Deviation-handling training and drills | Negligible internal training cost | Missing records, if read as a data integrity problem, can escalate to a critical deficiency |
| Manual backup logging procedure | Near-zero cost | Gaps during system outages equal "unknown drug history" — and "unknown" is indefensible |
The arithmetic points to a trend judgment: inspections are shifting from "checking the facility" to "checking the data." Electronic records, audit trails, data integrity — these terms appear in deficiency findings with growing frequency. Tomorrow's compliance competition won't be about who has the biggest cold room; it will be about who has the most complete data chain. The era of paper compliance is ending. The era of data compliance has arrived.
I'll close with an open question: if an inspection team walked into your cold storage at eight tomorrow morning and asked to trace three years of excursion-handling records, would your first instinct be to fetch the files — or to wonder whether the files have gaps? Your honest answer to that question is your true readiness level.
By Dr. Chen, Supply Chain Researcher
