The Questions a GDP Auditor Asks That Your Temperature Log Can't Answer

There is a moment in a GDP audit that I think about a lot. The temperature logs are on the table. Every trace is flat, every shipment is closed out, every file is where it should be. And then the auditor stops flipping pages and asks a question that isn't about temperature at all.

Back in April I wrote about what GDP compliance means for shippers in broad terms. This post is narrower. It's about five specific questions that show up in audit rooms, in one form or another, that a temperature log cannot answer no matter how complete it is. Each one probes the same gap: the distance between "we log temperature" and "we control the shipment."

If you ship on dry ice, that gap is wider than it looks, because dry ice has a property that makes temperature logging uniquely misleading. The payload holds near -100°F to -116°F for as long as any solid CO₂ remains, no matter how little is left. The log looks identical whether the box has thirty pounds of margin or thirty minutes. Keep that in mind as you read. It sits underneath every question that follows.

Five questions from the audit room

None of these are exotic. They come straight from the expectations in the EU GDP guidelines (2013/C 343/01) and USP <1079>: continuous protection, the ability to act on deviations, qualified processes, complete records. What makes them uncomfortable isn't the regulation. It's that the standard toolkit was never built to answer them.

1. "How do you know the product was protected between delivery and receipt into storage?"

The proof of delivery says 10:14 AM. The receipt into the freezer says 3:40 PM. The auditor wants to know about the five and a half hours in between.

The standard answer is that the logger was still recording, and it was. But recording is not protection, and for a dry ice shipment the trace from those hours proves less than it appears to. The box sat on a dock, probably warm, definitely unattended, spending margin at whatever rate that dock imposed. The temperature inside stayed flat because that's what dry ice shipments do until the moment they don't. A flat line across a dwell period documents that the product had not yet failed. It says nothing about how close it came.

This dwell gap is where a large share of dry ice losses actually happen: after the carrier has performed and before receiving has started, in the seam where nobody's SOP clearly applies. An auditor who asks this question is not fishing. They know it's the seam.

What would satisfy the question: a record of remaining thermal margin at the handoff, not just temperature through it. If you can show the box crossed the dock with 14 pounds of dry ice and entered the freezer with 12, the dwell period is characterized, not merely survived. Named custody for the gap helps. Evidence of margin closes it.

2. "What was your capability to intervene mid-transit?"

This one produces the longest silences. GDP guidelines expect you to act on deviations, not just record them, and sooner or later an auditor asks what acting looked like while the shipment was moving.

For a passive logger, the honest answer is: none. The device measured faithfully and told no one. You learn what happened when somebody plugs it in after delivery, which means every option you might have had (re-icing at a hub, diverting to a closer site, calling the consignee to prioritize receipt) expired before you knew you needed it.

Real-time trackers improve the answer, but less than the brochure implies. An alert that fires when temperature breaks is an alert that fires after the dry ice is already gone. And an alert with no escalation path behind it, no named recipient, no decision rule, no documented action, is barely better than the USB stick. Auditors have started asking to see the escalation SOP and an example of it being used. A folder of unread alert emails is a finding waiting to be written.

What would satisfy the question: an alert tied to a leading indicator (time until the dry ice runs out, not temperature after it has), an escalation path with names and thresholds, and at least one documented case where the alert fired, someone acted, and the product arrived cold. Intervention capability is a system property. You either built it or you didn't, and the audit room is a bad place to find out which.

3. "How do you verify your pack-out was adequate for this lane, this season, this container?"

Most shippers answer with the lane qualification: we tested this shipper on this route, it held for the qualified duration, we ship inside that window. It's a reasonable answer, and it ages badly.

Lane qualifications are snapshots. The one done in February does not govern August. The route that was qualified through one hub now connects through another. And the container in front of the auditor is not the container that was tested. The FAA's 2024 sublimation study (DOT/FAA/TC-24/24) measured average sublimation rates of 0.53 to 0.71 percent per hour across the container types it tested when fresh, and found that rates increase as containers are reused. Insulation chips, panels warp, seals loosen. The spec-sheet rate belongs to a new box. The one on its ninth trip runs hotter, and nothing on the outside tells you which one you grabbed.

So the honest answer to the auditor's question is usually: we verified a box like this, on a lane like this, in a season that may or may not resemble this one. That's a fleet answer to a shipment question.

What would satisfy it: measured consumption on the actual shipment, compared against the qualification assumption. If the qualification assumes this pack-out loses a quarter pound of dry ice an hour and the shipment's own data shows 0.4, you've caught a degraded container or an off-nominal lane while it's still a data point instead of a deviation. Requalification stops being a calendar exercise and becomes something every shipment quietly performs on itself.

4. "Show me the data between the last acceptable reading and the excursion."

When there has been an excursion, this is the question that decides the meeting, and with dry ice it has an answer nobody likes: the data between the last acceptable reading and the excursion looks perfect.

That's the thermal cliff. A dry ice payload holds near -100°F to -116°F for as long as any solid CO₂ remains, then warms fast once it's gone. There is no drift to point to, no gradual slope an investigator can walk backward to a root cause. The trace is compliant at 2:00 and failed at 5:00, and the thing that actually caused the failure, the dry ice mass running to zero, appears nowhere in the record.

This is why dry ice excursion investigations so often end at "undetermined" or a guessed root cause. The instrument recorded the symptom, and the symptom, by physics, arrives without warning. An auditor reviewing the CAPA sees an investigation built on a data set that could not have contained the answer, and writes accordingly. The corrective action that follows tends to be equally hollow: add more dry ice, retrain the packer, requalify the lane. All of it guessing at a cause the record never captured, which means nobody can say whether the fix addressed anything at all.

What would satisfy the question: the cause variable. A record of remaining dry ice mass over time turns the cliff into a slope. You can see the consumption rate change when the box sat on a hot ramp, see the hour when remaining margin fell below remaining transit time, and anchor the root cause in measurement instead of reconstruction. The excursion stops being a mystery with a timestamp and becomes a process with a history.

5. "How would you know this box, not boxes like it, was at risk?"

Every answer above has a fleet version and a shipment version, and this question forces the distinction into the open.

Qualification data, stability budgets, historical lane performance: all of it describes populations. Boxes like this one usually survive lanes like this one. That's useful for designing a pack-out. It's nearly useless for defending a specific shipment, because the shipment on the table was not an average. It was one box, with one fill weight, one reuse history, one particular sequence of docks and ramps. The patient at the end of the lane received that box, not the fleet.

The standard answer leans on the average and hopes the distribution is tight. The FAA data above suggests it isn't: reuse alone spreads container performance enough that the fleet mean stops predicting the individual box. And the auditor knows this, which is why the question is phrased the way it is. "Boxes like it" is an admission dressed up as an answer.

What would satisfy the question: per-shipment evidence. Not "our containers hold 96 hours" but "this shipment left with 38 pounds of dry ice, consumed it at 0.29 pounds per hour, and was received with 11 pounds of margin." That sentence ends audit questions in a way no fleet statistic can, because it isn't an inference. It's a measurement.

The record that ends the meeting

Run back through the five questions and notice what they have in common. None of them is answered by more temperature data. Higher-frequency logging, prettier dashboards, faster downloads: all of it sharpens the record of the symptom. The questions are about the cause.

For dry ice shipments, the cause has a name: remaining dry ice mass over time. Every question above collapses into it. Dwell risk is mass at the handoff. Intervention capability is a forecast of when mass reaches zero. Pack-out adequacy is measured consumption against assumption. The excursion timeline is the mass curve. Per-shipment evidence is this box's mass, not the fleet's average.

I don't think temperature logging is going away, and it shouldn't. It's the compliance record of what the product experienced. But the audit conversation is drifting, question by question, toward control, and control lives one layer down, in the physics the temperature trace can't see until it's too late. That's the layer we're instrumenting at CryoTrak: the quantity of dry ice actually left in the box, reported while the shipment is still moving and something can still be done about it.

The shippers, 3PLs, and freight forwarders who can produce that record don't argue with auditors. They answer the question, show the curve, and walk out of the room faster. That, more than any dashboard, is what the next few years of GDP scrutiny will reward.