Learn / Regulated wedge

Cold chain fails at the handover, not the sensor

The whole market sells you a better thermometer. More sensors, tighter tolerances, real-time alarms to a phone. All useful, none of it wrong. But walk the excursions back to where they actually started and you rarely land on a failed sensor. You land on a person, at a handover, making a call the process did not resolve. That is the seam the monitoring stack cannot cover, because it is above the sensor, not inside it.

Credit where it is due: modern cold chain monitoring is good. ELPRO, Sensitech, and Controlant make accurate, well-validated loggers and platforms that tell you exactly what the temperature did and when. If the question is what happened to this pallet between 02:14 and 04:40, the sensor answers it precisely. That is real value and it is not the thing this piece is arguing with.

The argument is about a quieter truth. A more precise thermometer measures the failure better. It does not remove the place the failure starts. And in a Good Distribution Practice cold chain, that place is almost always a human handover between the sensors: the tarmac transfer, the reefer release, the shift change, the airport-to-warehouse handoff. The data logger is faithfully recording an excursion that a process decision, made or missed at a handover, already set in motion.

The seams where cold chain actually breaks

Excursions and the findings that follow them cluster in a small number of unglamorous places, and none of them is the sensor:

  • The tarmac transfer. A temperature-controlled pallet comes off the aircraft and sits on hot asphalt waiting for a dolly, or waits in a staging area that is not the cold room. The logger dutifully records the climb. The decision that mattered was how long it was acceptable to wait, and who owned starting the clock.
  • The reefer release. Someone has to decide whether a refrigerated unit is fit to load: was it pre-cooled, is the set point right, is the door seal sound. That is a judgment at a handover. Get it wrong and the sensor inside will document a slow excursion the whole way.
  • The shift change. An excursion alarm or a pending corrective action is live when one team hands to the next. If the process does not force the handoff of that open item, it falls in the gap, and the next shift inherits an excursion nobody is acting on.
  • The airport-to-warehouse handoff. Custody moves between parties, and with it the responsibility for the temperature. When ownership blurs at that boundary, so does accountability for the decision, and the audit trail goes quiet exactly where it needs to be loud.

Notice the shape. Every one of these is a decision by a person at the boundary between two monitored legs. The sensor covers each leg. Nobody covers the seam.

The reframe: the industry has spent a decade making the thermometer better and left the handover exactly as it was, living in a fourteen-page SOP and someone's memory. So the sensor gets more precise while the failure point stays untouched. You do not have a measurement problem at the tarmac transfer or the reefer release. You have an ungoverned decision. Buying a tighter sensor for an ungoverned handover is buying a sharper picture of the same excursion.

Why the monitoring stack cannot close this

It is structural, not a knock on the vendors. A sensor detects and documents; it does not decide, route, or govern. When an alarm fires at 2am, the logger cannot tell you who owns the response, cannot resolve the pallet to the right corrective step for this lane, and cannot confirm the reefer pre-cool actually happened before loading. Those are process decisions, and they sit above the monitoring layer. The stack proves the temperature. It cannot prove the procedure around the temperature was current, owned, followed, and traceable, which is the thing a GDP inspector actually traces.

This is the same seam that turns a caught excursion into a scramble. The logger did its job; then the question becomes now what, and the answer lives nowhere governed. That whole decision path is the subject of your logger caught the excursion, now what, and it is why a clean monitoring report and a bad audit outcome can coexist on the same shipment.

The layer that is missing

Between the sensor and the vault sits an empty layer: the living, governed process that owns the handovers and decisions. Monitoring vendors sell the sensor. QMS vendors sell the document store. Neither owns the process that says for this shipment, on this lane, here is the exact handover sequence, here is who owns the reefer release, here is what happens if the tarmac wait exceeds the limit, and here is the trail proving it was done. That is the layer that governs the seams, and it is the one the market left out. The broader version of this gap is in GDP inspection readiness: readiness is a property of the process at the handover, not of the sensor on the pallet.

Where FLOW fits

FLOW is that missing process layer above the monitoring stack. Your cold chain handling lives as one master process that resolves to the exact steps for this shipment and lane, including the handovers: the tarmac transfer clock, the reefer release check, the shift-change handoff of open excursions, the custody boundary. Each carries an owner, a version, sign-off, and an audit trail of who did what, so the decision at the seam is governed and evidenced instead of improvised. It keeps your ELPRO, Sensitech, or Controlant monitoring exactly where it is and owns the process between and above the sensors. It is also readable by the AI agents you will eventually point at exception handling. The category argument is in the process system of record, and the process graveyard audit takes ten minutes and will show you which handovers on your critical lanes are ungoverned right now.

Common questions

Where does the cold chain actually break?

Far more often at the human handovers and decisions between the sensors than at the sensors themselves. The unglamorous failure points are the tarmac transfer where a pallet waits on hot asphalt, the reefer release where someone decides whether a unit is fit to load, the shift change where a pending action does not get passed on, and the airport-to-warehouse handoff where custody and responsibility blur. Modern data loggers are accurate. The excursion usually happens in the gap between them, where a person had to make a call and the process did not resolve it clearly.

Do better temperature sensors prevent excursions?

They detect and document excursions extremely well, which matters, but detection is not prevention. Vendors like ELPRO, Sensitech, and Controlant make accurate, well-validated monitoring that tells you precisely what happened and when. What a sensor cannot do is decide who acts on an alarm at 2am, route the pallet to the right corrective step, or make sure the reefer pre-cool actually happened before loading. Those are process decisions at handovers. A more precise thermometer measures the failure better; it does not remove the handover where the failure starts.

What is GDP cold chain process management?

It is the layer above the monitoring stack that governs the human decisions and handovers in a Good Distribution Practice cold chain: who owns each transfer, what the exact steps are for this shipment and lane, how an excursion is escalated and dispositioned, and how all of it is evidenced. Monitoring proves the temperature. Process management proves the procedure around the temperature was current, owned, followed, and traceable. Under GDP, an inspector traces the second thing, not just the first.

Why do cold chain audits find handover problems?

Because the handover is where the written process goes quiet and a person has to improvise. The SOP describes steady-state transport well, but the tarmac transfer under a cut-off, the ambiguous reefer release, and the pending action at shift change are exactly the moments the flat document does not resolve. An auditor tracing a real excursion lands on those seams and finds inconsistent calls, missing trails, or unclear ownership. The finding is rarely that the sensor was wrong. It is that the process at the handover was not governed.

Govern the handover, not just the temperature.

Bring one cold chain lane to a 30-minute pilot session. Leave with the handovers living in FLOW: owned, routed by scenario, and traceable when the excursion happens at the seam.

Book a pilot →