GMP Cold Storage: Mapping, Monitoring, Excursion Checklist

Most cold storage findings I see do not come from a freezer that failed. They come from a freezer that failed and nobody could show what happened to the product inside it. The unit drifted to 9.4°C over a weekend, an alarm went to a phone nobody was holding, and on Monday the team had a graph, a guess, and no written procedure for deciding what to do next.

This guide walks through what GMP expects for cold storage: how to map a space, how to monitor it, and how to handle an excursion so your disposition decision survives an inspector's questions. It is written for drug, biologic, dietary supplement, and food operations, and I flag where the rules differ. If you want the broader warehouse picture first, my article on GMP warehouse storage and distribution requirements covers receiving, quarantine, and segregation.

What do GMP regulations actually require for cold storage?

There is no single U.S. regulation titled "cold storage." The requirement is spread across several parts, and each one says roughly the same thing: store material under conditions that protect it, and be able to prove you did.

Notice what is missing: none of these hand you a mapping duration, a sensor count, or an alarm delay. Those numbers are yours to justify. In my view, that is where most programs go wrong, because they copy a number from a vendor template and cannot explain it when asked.

What temperature ranges define cold storage?

Start with the label. The storage statement on your approved labeling or specification is the controlling requirement, and USP <659> gives the standard definitions most firms use.

The ICH rows are long-term stability study conditions under ICH Q1A(R2), not storage definitions for commercial product; the storage definitions come from USP <659>.

Ultra-cold storage (-60°C to -80°C and colder) and cryogenic storage in liquid nitrogen are not defined in USP <659>. Your range comes from the product specification or the biologic license, so write it into the SOP in plain numbers.

One caution: if a product's label says "store at 2°C to 8°C," your operating range for the space is not automatically 2°C to 8°C. It should be narrower than the limit, because a unit that runs right at 8.0°C will cross the line on every defrost cycle.

How do you perform temperature mapping?

Temperature mapping shows you how temperature behaves across the whole space, over time, so you can find the hot spots, cold spots, and slow-recovery zones before product goes in. EU GDP guidance (2013/C 343/01, chapter 3) expects monitoring devices to be placed based on the mapping results, at the identified extremes.

Step-by-step mapping protocol

1. Write the protocol first. Define scope, the unit or room, the acceptance criteria (usually the label range), sensor count and placement rationale, study duration, load condition, and who approves the report. Quality approves before data collection starts.
2. Confirm the equipment is qualified. Installation and operational qualification of the chiller, compressor, defrost controls, and door seals should be complete. Mapping a unit with a failing door gasket tells you about the gasket.
3. Calibrate every mapping sensor before and after the study against a traceable reference. Calibration from an ISO/IEC 17025 accredited laboratory is the standard expectation, and a post-study check protects you if a sensor drifted mid-study.
4. Place sensors in a three-dimensional grid. Cover top, middle, and bottom levels, corners, the area near the door, near the evaporator and supply air, near the return, and the center of the largest product mass. In walk-in rooms and warehouses, the rule I use is simple: put sensors wherever you can imagine air behaving differently.
5. Place the control sensor and any existing monitoring probe inside the study so you can compare them with the mapped extremes.
6. Run under representative conditions. Mapping an empty room is useful as a baseline, but EU GDP guidance expects mapping under representative conditions, which means a loaded or worst-case load study should also be on your plan. Run the study long enough to capture compressor cycling, defrost, and normal door traffic. In my experience, many firms use seven days or more and repeat across seasons for ambient-influenced spaces. That is common practice, not a regulatory number, so document why your duration is sufficient.
7. Challenge the unit. Common challenges include a door-open test (defined duration, measured recovery time) and a power failure or compressor-off test (time to cross the limit with a full load). These two tests produce the numbers that feed your alarm delays and your emergency response plan.
8. Analyze and report. For each sensor, record minimum, maximum, mean, and time outside limits. Identify the hottest and coldest locations, and state where the permanent monitoring probes will go and why.
9. Define remapping triggers. At minimum: relocation, significant repair or modification of the refrigeration system, layout or racking changes, a change in load pattern, and a periodic interval set by risk assessment. EU GDP guidance (chapter 3) expects remapping based on risk or significant change; confirm the exact wording in the current text.

What do you do with an unacceptable result?

If any sensor exceeds the limits during normal operation, you have three honest options: fix the unit (rebalance airflow, repair seals, adjust setpoints), restrict the usable storage area and mark the bad zones as no-storage, or change the use of the space. What you cannot do is accept the report and move on. An approved mapping report with an unresolved failure is one of the first things an investigator will circle.

How should cold storage be monitored?

Mapping tells you where to look. Monitoring tells you, every hour of every day, whether the answer is still good.

Monitoring system essentials

• Probe placement from the mapping report. Put at least one probe at the warmest location and one at the coldest (or the location that recovers slowest), plus the control sensor. A single probe in the middle of the room fails the logic of the mapping study.
• Continuous recording with a sampling interval you can defend. For most product, a few minutes between readings is typical; shorter intervals suit high-value biologics.
• Independent monitoring. The monitoring probe should not be the same sensor the refrigeration controller uses. If the controller sensor fails, the controller will report that everything is fine.
• Alarm system with escalation. Alerts by local horn alone are useless at 2 a.m. Use phone, text, or email with a documented escalation path and a record that someone acknowledged it.
• Backup power and data. The monitoring system should survive a power outage and buffer data until communication is restored.
• Calibration of probes at a defined interval (in my experience, commonly annual), with traceability to national standards. Set the interval from your drift history, not from habit.

Alarm limits versus action limits

Many firms use two tiers, and I think it is the cleanest design. An alert limit sits inside the label range and gives the team time to intervene. An action limit sits at the label boundary and triggers the excursion procedure. A time delay on the alarm filters out brief door-open spikes, and the delay should come from your door-open challenge test, not from guesswork.

These numbers are examples. Use the ones your own mapping data support.

Worked example (illustrative): Suppose your door-open challenge shows the warmest mapped location rises to 6.8°C after a 60-second opening and returns below 5°C within 8 minutes. The 7.5°C alert limit is never reached by a normal door event, so a 15-minute alert delay (about twice the recovery time) filters routine openings. If the reading is still above 7.5°C at 15 minutes, something other than a door is happening and the team has time to act before the 8.0°C action limit. If the power-failure test shows the loaded unit takes about 90 minutes to reach 8°C, the delay and escalation steps must fit well inside that window.

Data integrity for monitoring systems

If your monitoring is electronic, 21 CFR Part 11 applies to the records you rely on for GMP decisions. That means unique user logins, audit trails that capture changes to alarm limits and acknowledgments (11.10(e)), validated software, and controls so nobody can edit raw readings. FDA's December 2018 guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers, is the document I point clients to when they ask what investigators expect. Disabling an alarm or widening a limit without a change record is a data integrity finding, not just a storage finding.

If you are validating the software, treat it like any other GMP computerized system and apply a risk-based lifecycle approach, such as the one described in ISPE GAMP 5.

How do you handle a temperature excursion?

An excursion is any time product is exposed to conditions outside its labeled or specified storage range. The existence of an excursion is not the violation. Failing to detect it, failing to investigate it, or releasing product without a sound rationale is.

Excursion response, step by step

1. Secure the product. Move affected material to a quarantine status in your inventory system immediately, and physically segregate it if it can be done without causing more exposure. Under 21 CFR 211.142(a), quarantine before release is already a warehousing requirement, so the mechanism should exist.
2. Stabilize the equipment. Get the unit working or move product to a qualified backup unit. Document the transfer, time, and conditions in transit.
3. Notify Quality right away. Quality owns the decision under 21 CFR 211.22.
4. Establish the facts. Which unit, which sensors, start and end time, peak temperature, and duration outside range. Pull data from the monitoring system, and compare it with the control sensor and the hot and cold spots identified in your mapping report. As an illustrative example only, a reading of 9.1°C at the monitored probe could correspond to 10°C at the top shelf near the door, and the mapping report is how you would know.
5. Identify every affected lot and quantity, including material in nearby units that share a failed utility.
6. Evaluate the product impact. Use the best available evidence in this order of strength: manufacturer-supplied excursion data or stability data on the specific product, your own stability data, and then literature or scientific rationale. For room-temperature products, USP <659> allows excursions between 15°C and 30°C and permits the use of mean kinetic temperature (not exceeding 25°C) when assessing cumulative thermal effect. Mean kinetic temperature is a calculation with a defined purpose; do not apply it to a refrigerated biologic and call it a rationale. For refrigerated and frozen products, I am generally conservative: if there is no data supporting the exposure, contact the product owner or manufacturer before making a call. The related stability testing article covers how stability data gets generated and where it can support this kind of decision.
7. Make a documented disposition. Release, release with additional testing, return, or reject. Quality signs it. The rationale has to be written so someone who was not in the room can follow it a year later.
8. Investigate root cause under 21 CFR 211.192 and open a CAPA if the cause is systemic. A recurring Friday-evening failure that always involves the same door is a process problem, not bad luck.
9. Check downstream impact. If product from the unit was already shipped, evaluate whether a recall or field notification assessment is needed.
10. Trend. Excursions are data. Quarterly trending by unit, cause, and shift catches the problem before it becomes a pattern an inspector finds for you.

Excursion decision table

GMP cold storage checklist

Use this as an internal audit tool. Each line should have a document behind it.

Procedures and responsibilities

• Written warehousing SOP names storage conditions for each product class (211.142; 111.455 for supplements).
• Excursion SOP defines roles, timelines, and the Quality sign-off requirement.
• Emergency plan covers power loss, compressor failure, and after-hours response, with a tested call tree.

Qualification and mapping

• Equipment IQ/OQ complete and current.
• Mapping protocol approved before the study; report approved after.
• Sensor placement covers the warmest, coldest, and slowest-recovering zones.
• Door-open and power-failure challenges performed and recorded.
• Remapping triggers defined, and the last remap date is within your own stated interval.
• No-storage zones identified and physically marked.

Monitoring

• Permanent probes placed at mapped extremes.
• Monitoring probe independent of the control sensor.
• Alert and action limits documented with rationale; alarm delays justified by data.
• Alarm escalation tested and acknowledgment recorded.
• Probe calibration current, traceable, with as-found/as-left data.
• Electronic system validated, with audit trail enabled and access controlled.
• Backup power and data buffering verified.
• Daily min/max review documented; periodic trend review by Quality.

Excursions

• Every alarm event has a record, including those closed as no-impact.
• Affected lots quarantined before assessment begins.
• Product impact assessment cites specific data, not general comfort.
• Disposition signed by Quality.
• Root cause and CAPA documented where warranted (211.192).
• Excursions trended and reviewed.

What do inspectors commonly cite?

These are based on my own experience rather than a specific dataset; check the FDA Form 483 and warning letter databases for current examples to cite. The repeat findings I see are consistent: mapping done once at commissioning and never revisited after the racking changed, monitoring probes placed in the convenient spot rather than the mapped extreme, alarms acknowledged but with no investigation record, excursions closed with "product is stable" and no data attached, and software with shared logins. Each one maps back to the clauses above, and none of them requires new technology to fix. They require a procedure that people follow and a Quality unit that reads the graphs.

If you are preparing for an inspection and want a second set of eyes on your cold storage program, see my FDA inspection preparation page. I would rather help you find the gap in a mock review than have an investigator find it first.

Frequently asked questions

Does every excursion require a product impact assessment? Every alarm event needs a record. Brief spikes that recover within your validated recovery time can be closed as alarm events after confirming recovery. Anything outside the label range with product exposure needs a documented assessment by Quality.

Can I use mean kinetic temperature for refrigerated product? Not as a general rationale. Mean kinetic temperature is a tool for assessing cumulative thermal effect on room-temperature product. For refrigerated and frozen product, rely on product-specific data or the manufacturer.

How often should I remap? Set the interval by risk assessment and document it, and remap after relocation, significant repair or modification, layout or racking changes, or a change in load pattern.

Should the alarm probe be separate from the control sensor? Yes. If the controller sensor fails, the controller will report normal conditions. An independent probe is what lets you detect that.

Last updated: 2026-10-27

Frequently Asked Questions

Does 21 CFR Part 211 require temperature mapping of cold storage?

Part 211 does not use the word mapping. 21 CFR 211.142(b) requires storage under appropriate temperature conditions, and mapping is the accepted way to demonstrate that a space holds those conditions everywhere product sits. The EU GDP Guidelines (2013/C 343/01), section 3.2, explicitly call for an initial mapping exercise and repeat mapping based on risk or significant change, and FDA investigators commonly expect similar evidence.

How often should a cold storage unit be remapped?

No regulation sets a fixed interval. EU GDP section 3.2 says to repeat mapping according to a risk assessment or when significant modifications are made to the facility or temperature control equipment. Define your triggers in the SOP: relocation, major repair, layout or load changes, and a periodic interval you can justify from performance history and seasonal influence.

What is the difference between an alert limit and an action limit?

An alert limit sits inside the labeled storage range and warns the team before product is at risk. An action limit sits at the label boundary and triggers the formal excursion procedure, including quarantine and a Quality assessment. Alarm time delays should be based on door-open and recovery data from mapping, not arbitrary settings.

Can mean kinetic temperature be used to justify a cold storage excursion?

USP <659> allows mean kinetic temperature, not exceeding 25°C, to be used when evaluating excursions for controlled room temperature products. It is not a general tool for refrigerated or frozen biologics. For those products, rely on product-specific stability or manufacturer excursion data and involve Quality in the decision.

Who decides whether product can be released after an excursion?

The quality control unit. Under 21 CFR 211.22, Quality is responsible for approving or rejecting materials and products, and under 21 CFR 211.192 unexplained discrepancies must be investigated and documented. Warehouse staff can quarantine and gather facts, but disposition requires Quality sign-off with a written rationale.