Signing the deviation, not the dashboard: cold-chain and serialization exception disposition
Happy-path serialisation is solved. Product moves, identifiers match, data flows. Trading-partner trust does not break on the happy path. It breaks on the exception — the excursion, the mismatch, the short shipment — where a human decides something and the decision travels downstream as a green tick.
Who accepted the temperature excursion?
Somebody dispositioned it, and downstream trading partners inherit that decision without any evidence behind it. A shipment logs an excursion or arrives with a serialization mismatch, a person decides it is acceptable, and the record is a status change in one company's system.
- Exception disposition is an operational workflow inside a platform. Downstream partners receive the outcome, not the reasoning or the authority behind it.
- The excursion profile — the actual time-temperature curve — is what a stability assessment is made against, and it is rarely what travels with the disposition.
- A portable disposition receipt lets a receiving partner verify who dispositioned, against what profile, on what stability basis, without platform access.
Part of Pharma and GxP identity
The moment the data model stops helping
Track-and-trace systems are excellent at the question where has this product been. They are structurally weak at who decided it was still good.
Consider a cold-chain shipment that spent 47 minutes at 9.2°C against a 2–8°C label claim. Someone with the right qualification compares that excursion against the product's stability data, concludes the mean kinetic temperature remains within the validated range, and dispositions the shipment as acceptable. That is a competent scientific judgement.
What the receiving wholesaler sees is a status field. Accepted. The excursion profile, the stability basis and the identity of the person who made the call are all upstream, inside a system the wholesaler does not have.
Why the profile matters more than the flag
A single alarm event is not a stability assessment. The same nominal excursion can be trivial or disqualifying depending on duration, cumulative exposure across the shipment's history, and the specific product. Two shipments can log identical maximum temperatures and warrant opposite dispositions.
This is why passing the flag without the profile loses the information that made the decision defensible. A downstream party that later discovers a quality problem has a status field and no way to evaluate the reasoning behind it.
| What travels today | What the decision was actually based on |
|---|---|
| Status: accepted | Full time-temperature series for the shipment |
| Excursion count | Cumulative excursion history across prior legs |
| Max temperature | Mean kinetic temperature calculation |
| Free-text comment, sometimes | Product-specific stability data and its validated range |
The Exception Disposition Receipt
Bind the disposition to its basis, and make the whole object portable.
{
"type": "manav-stmt/1",
"action": "disposition_shipment_exception",
"render": [
"Shipment: [id] Product: [name] [lot]",
"Exception: temperature excursion — [n] events",
"Profile hash: [hash of full time-temperature series]",
"MKT: [value] °C vs validated [range]",
"Stability basis: [protocol ref, version]",
"Disposition: accepted for distribution"
],
"actor": "[qualified person / designated role, credential]"
}The profile hash is the important mechanism. The full series does not need to travel — it can stay in the logger platform — but the hash means a downstream party who later obtains the series can confirm it is the one the disposition was made against. That closes the retrospective-substitution question entirely.
Applying the same structure to serialisation exceptions
Serialisation mismatches follow identical logic. A pack arrives whose identifier does not reconcile against the expected set. Someone investigates and dispositions: repackaging error, data transmission fault, or suspect product requiring quarantine.
Under enhanced drug distribution security obligations, that disposition has regulatory weight. It also travels as a status. The same receipt structure applies, with the exception profile replaced by the reconciliation detail.
Who signs
This is the question that generates the most internal debate, and it is worth resolving deliberately rather than by default to whoever is on shift.
- Temperature excursions against a pre-approved stability matrix: a trained designated role, under a delegation with an explicit scope.
- Excursions outside the pre-approved matrix: a Qualified Person or equivalent, without delegation.
- Serialisation mismatches suggesting suspect product: the role designated under your suspect-product procedure, and the delegation should make that unambiguous.
Expressing the first case as a scoped delegation with explicit bounds means an out-of-scope disposition cannot produce a valid receipt. The escalation your procedure already requires becomes enforced rather than remembered.
The measurable benefit
Write-off from unreconstructible disposition history is a real and quantifiable cost. When a downstream quality question arises and the disposition basis cannot be reproduced, the conservative action is destruction, and the conservative action is taken because the evidence is absent rather than because the product is bad.
Count how many units you wrote off in the last two years where the technical reason was inability to reconstruct a decision. For most distributors that number is not zero, and it is the number that funds this work.
What a partner downstream can see
| Party | Sees the excursion? | Sees the disposition reasoning? |
|---|---|---|
| Originating site | Yes | Yes — internally |
| Distributor | Sometimes | No |
| Dispensing pharmacy | Rarely | No |
| Patient-facing party | No | No |
The chain transmits product and transmits almost none of the quality decision-making behind it. Each party trusts the previous one, which is workable and leaves no artefact when a question arises years later.
Objections and honest limits
“Serialisation already provides traceability.” Of the unit's movement. It does not carry the quality dispositions made about that unit along the way, which is a different data set.
“Dispositions are made under a validated procedure.” They are, and procedure quality is demonstrable. What is not demonstrable is that a specific disposition applied that procedure to that excursion.
Making dispositions portable
- Render the excursion data at disposition. Duration, magnitude, the stability basis relied on.
- Sign that rendering. Not a status transition.
- Attach the receipt to the unit's record. So it travels with the product.
- Make it verifiable by a downstream partner. Without contacting the originator.
Terms used here
- Temperature excursion
- A deviation outside the labelled storage range, requiring a disposition decision.
- Disposition
- The decision on whether affected product remains acceptable for use.
- Serialization
- Unit-level identification enabling traceability of movement — distinct from quality decisions.
Frequently asked questions
Does the full temperature series have to travel with the shipment? No. The receipt carries a hash of the series. The series itself stays wherever it lives, and can be verified against the hash whenever it is produced.
Is this a DSCSA requirement? No. Enhanced drug distribution security obligations govern data exchange and verification of product identifiers. Exception disposition evidence is not prescribed, which is why it has not been built.
Who can be delegated disposition authority? That is determined by your quality system and applicable national rules. The mechanism makes the boundary enforceable; it does not set it.
What about shipments with multiple excursion events across legs? The receipt should reference the cumulative history, not only the current leg. Cumulative exposure is precisely the information that gets lost when only a flag travels.
Doesn't serialisation already give traceability? Of movement. It does not carry the quality dispositions made about a unit, which is a separate data set.
Who is most affected by the gap? Downstream parties, who inherit a decision they cannot see, and ultimately the patient-facing party.
What should the signature cover? The excursion data and the stability basis relied on — not merely that a disposition was made.
Where this fits in Manav
Manav binds the signer to the exact record being certified, on a credential under their sole control, and produces a receipt an inspector or a partner can verify without access to the originating system.
Sources and further reading
- FDA — Drug Supply Chain Security Act
- EU Guidelines on Good Distribution Practice of medicinal products for human use — temperature control and excursion handling.
- EudraLex Volume 4 — EU GMP guidelines