}

GDP in pharma transport: the deviation becomes a CAPA case, not a note

By
Bodo Buschick
•
6 min
GDP in pharma transport: the deviation becomes a CAPA case, not a note

GDP turns a temperature excursion in pharma transport into a deviation. Not just a number in the logger. A CAPA case. With a deadline. With an owner. With a chain from root cause to action to proof that the action worked. The distance between the number and the CAPA case is the real work. In most forwarders that run pharma transport, that distance is not closed.

My thesis: under GDP, the measurement is not the problem. The loggers work. The problem is the path from the number to the deviation. Today that path runs through the driver's report. Through dispatch's memory. Through a week in which the CAPA case sits before anyone writes it down.

What GDP actually requires in pharma transport

The EU guideline 2013/C 343/01 covers transport in Chapter 9. Wholesale distributors must protect medicinal products against breakage, adulteration and theft. And keep the temperature within the approved range. For the whole transport. That needs validated systems. Thermal packaging, temperature-controlled containers, refrigerated vehicles. Monitoring equipment is calibrated at least once a year. Refrigerated vehicles are mapped. Under realistic conditions. Including seasonal ones. Every delivery route carries a risk assessment. If an excursion happens, it has to be reported to the distributor and the recipient. There has to be a procedure that investigates and handles the excursion.

Chapter 1 of the guideline, Quality Management, goes further. Every deviation from an established procedure gets documented. A decision follows. What corrects the deviation? What prevents it from happening again? Corrective and Preventive Actions. CAPA. The principles of quality risk management belong inside this process, not only in the manual.

Both chapters together add up to the obligation. A temperature excursion does not just need a report. It needs a root cause. And a checked action. With proof that the action worked.

Where the deviation report is born today: late, from memory

The driver notices the delay first. Traffic. A closed dock. A wait at the border. He writes a sentence in his report. Sometimes. The data logger records the temperature curve. For the vehicle. With no link to the shipment, no link to the reason for the delay. The time window in the TMS only shows that arrival was late. No cause. The handover proof shows who signed when. Again with no link to the other two.

Three sources. None of them knows the case as a whole. It takes a complaint before anyone joins them. Then quality pulls the curve for the whole day. Searches for the section. Asks dispatch what happened that day. Writes the deviation report three weeks later. It reads like it.

That is exactly where GDP audits get hard. Not the temperature curve itself. The gap between the incident and the report. An auditor asks for the timestamp of the report. Not only the timestamp of the measurement.

How a deviation record builds itself

Three sources already run digitally at most forwarders with pharma transport. Telematics and data loggers for temperature and position. Time window and status data in the TMS for arrival, delay, unplanned stop. Handover proof, whether as a PDF, a photo or an app signature. The deviation record is born when these three sources meet one rule.

First, a classification rule. If temperature stays outside the corridor longer than a set time, that is an excursion. If a delay lasts longer than the agreed time window, that is a case too. An unplanned stop with a door opening counts as well. Every rule carries a threshold. The threshold comes from quality, not from code.

Second, a status per case. New. Under investigation. Root cause documented. Action defined. Effectiveness checked. Closed. Every status change carries a timestamp. That makes the deadline from the guideline visible, not just claimed.

Third, the CAPA chain itself inside the record. Not a separate Word document filed somewhere. A record linked to the case. Root cause, action, effectiveness check, each with its own date and its own owner. Anyone reviewing the case weeks later sees the whole chain in one place. Not three emails and a folder.

Fourth, and this is where the automation stops: the sign-off. The case goes to the Responsible Person. She decides whether the root cause holds. Whether the action is enough. Whether the case can close. The record hands her everything she needs in one place. It decides none of it itself.

What changes for dispatch, quality and the customer audit

For dispatch, the first step changes the most. A delay is no longer noted only in someone's head. It becomes a case automatically once it crosses the threshold. The dispatcher does not have to report it. He gets a question back instead, if the cause is still missing.

For quality, the order changes. Instead of collecting every case at the end of the month, quality sees it on the day it happens. The root cause analysis starts while the trip is still traceable. Not three weeks later, when nobody remembers.

For the customer audit, the picture changes the most. The customer asks for the number of deviations last quarter. And the handling time. Both sit ready as an export. No search through old driver reports. No case that only gets written once someone asks.

Where this breaks

Three honest limits.

Not every root cause sits in a system. A traffic jam can be derived from position data. A broken cooling unit on the vehicle, mostly too. A loading error. A wrong instruction from the shipper. A misunderstanding at the receiving dock. None of that sits in any telematics feed. The automation delivers the timeline and the readings. A human still has to establish and enter the actual cause.

Not every threshold is obvious. Some products tolerate a short excursion, others none at all for a single minute. The classification rule is a professional decision, not a technical one. It has to be set and reviewed regularly by the Responsible Person or quality management. Not chosen by the system itself.

A deviation record is not a substitute for CAPA. It collects the cases, orders them, keeps the deadline visible. The decision whether an action actually worked stays with the Responsible Person. She is personally liable for it, regardless of any commercial pressure. That is exactly why no case may close itself. The automation prepares the case. It does not decide it.

For context: forwarders in food transport need a temperature proof per shipment. The matching process is in the post on the HACCP cold chain in refrigerated transport. That post is about the shipment proof itself. This one is about what happens to a deviation afterward.

Tools

A classification rule per product or product group, with a threshold set by quality. A deviation record built from telematics, time window and handover proof, with a timestamp on every status change. A CAPA chain inside the same record, not in a separate document. A mandatory stop before every closure, where the Responsible Person signs off. An export for the audit, instead of a search before the audit.

How many days sit between a temperature excursion and the finished deviation report at your company? Send me the number. If the answer is uncomfortable, I will show you in a process check what the deviation record would look like for your three sources.