This page explains what makes a temperature record trustworthy to an inspector: who made it, when, whether it has been changed, and whether you can still produce it years later. The one thing to remember is that where a system captures readings electronically, the MHRA treats the electronic data as the original record, so a filed printout is not enough on its own.
Why it matters
The record is the only proof you have
Nobody can go back and measure last March's fridge temperature. If a batch is questioned, a patient has a reaction, or an inspector asks how you know the cold chain held, the record is the whole of your answer. That is why inspectors treat a gap, an unsigned entry or an unexplained correction as seriously as a warm fridge: each one means the record can no longer be relied on.
The MHRA Inspectorate's data integrity blog for GDP gives everyday examples. Shared multi-user spreadsheets can make it impossible to show who made an entry, when, or whether it was overwritten. A wholesaler's proposal to report quality-critical events over WhatsApp was refused. An inspector could not trust ambient min/max records because the thermometer was uncalibrated and staff did not know how to use it. None of these involve bad intent; they involve records that cannot prove what they claim.
What the rules say
GDP, then the MHRA data integrity guidance
For wholesalers the legal duty comes from regulation 43 of the Human Medicines Regulations 2012, and the record-keeping detail from EU GDP. Chapter 4 says records are made at the time each operation is undertaken and kept for the period in national legislation, but at least five years. Section 3.3.1 says a computerised monitoring system must be validated or verified before use, its data protected against accidental or unauthorised change, checked for accessibility and backed up regularly to a separate, secure location.
EU GDP does not describe audit trails or what counts as the original. That detail is in the MHRA 'GXP' Data Integrity Guidance and Definitions (Revision 1, March 2018), which applies to GDP as well as GMP and uses ALCOA (it notes there is no difference in expectations from 'ALCOA+'). In the MHRA's own words (sections 3.10 and 6.1), data should be attributable to the person generating it, legible and permanent, contemporaneous, the original record (or a certified true copy) and accurate, and data governance should also keep it complete, consistent, enduring and available throughout its lifecycle. The MHRA describes it as a minimum expectation applied in proportion to risk, so a small site is not expected to check its data forensically, but it is expected to have assessed where its records could go wrong.
Raw data, printouts and audit trails
The MHRA defines raw data as the first capture of information. Where that capture is electronic and dynamic, 'paper copies cannot be considered as raw data', and keeping printed weekly reports in preference to the electronic data is not appropriate. You can keep only a static record if you can justify that it preserves the original, including metadata, audit trails and configuration settings, but the MHRA warns this is 'likely to be demanding in its administration'. Printouts remain useful for review and signing, as long as the electronic record is kept as the original.
A paper chart filled in by reading a display can itself be the original record. The MHRA asks for forms to be available where the work happens, so nobody jots readings on scrap paper and copies them later, and for transcriptions to be checked by a second person or a validated system. Scanning paper charts and destroying the originals is allowed if each scan is a verified true copy.
Where a system captures or stores raw data, the MHRA expects an audit trail showing who changed what, when and why, which users cannot switch off. It expects individual logins rather than one shared account, even if that means buying extra licences, and administrator rights held by as few people as possible. For a monitoring system, the entries that matter include alarm limit changes, sensor reassignments, acknowledgements and any edits to readings.
Hybrid, cloud-hosted and long-term records
Many sites run a hybrid: a logger plus a daily paper check. The MHRA accepts this if you document what makes up the whole data set and review and keep all of it, with extra review because hybrid systems are vulnerable to changes nobody can attribute. If your monitoring is cloud-hosted by a supplier, the MHRA says you remain responsible: you should know who owns the data, where it is physically held, and how you and the authorities get timely access to data, metadata and audit trails for the whole retention period, with that written into a technical agreement.
A nightly backup is not an archive. The MHRA distinguishes backup (a copy for disaster recovery) from archive (protected long-term retention) and expects records to stay readable, with their metadata, after a system is retired. Retention periods come from your sector: at least five years under EU GDP and in SPS records guidance, at least one year plus the stock's full storage history under Green Book chapter 3, and at least ten years in original format for HTA-licensed tissue establishments. For GMP batch documentation, API and investigational product records, see EU GMP and the Orange Guide.
| Control | MHRA data integrity 2018 | EU GDP 2013 | Green Book ch 3 | SPS records 2026 |
|---|---|---|---|---|
| Sets a minimum retention period | · | ✓ | ✓ | ✓ |
| Records made at the time of the activity | ✓ | ✓ | · | · |
| Electronic data is the original, not the printout | ✓ | · | · | · |
| Audit trail and individual logins expected | ✓ | · | · | · |
| Regular, checked backups | ✓ | ✓ | · | · |
A tick means the source states it in the items in this library; a blank means it does not address it there.
What good looks like
A record an inspector can trust
Write down, once, which record is the original for each unit, and how the paper and electronic records link. Give everyone their own login. Make entries at the time and sign them. Use ink: that is our reading of the MHRA's expectation that data is "legible and permanent" (section 6.1) and of the pencil records cited as a major deficiency in the 2016 GDP deficiency data; record a missed reading as missed, with the reason, and never fill it in afterwards. Correct mistakes so the original stays visible.
Review the records on a set routine and document the review the way the MHRA asks: a positive statement of whether issues were found, the date and the reviewer's signature, with a risk-based look at the audit trail. If you rely on a courier's or 3PL's temperature summary, assess their data integrity controls first, because a summary hides the detail.
- Daily: entries made at the time, attributable to a named person.
- At each review: positive statement, date, signature, audit trail checked.
- Periodically, as your procedure sets: test that backups restore and archived data is still readable.
- At any change of system or supplier: an archiving plan agreed before switch-off.
Worked example
A spike at 03:10 that looks like a faulty sensor
This is an illustrative example. At the Tuesday review, a wholesaler's quality lead sees that one cold room sensor logged a single reading of 14 °C at 03:10, with readings either side at 5 °C. The other two sensors in the room show nothing unusual. It looks like a sensor fault, and the temptation is to delete the point.
The MHRA says data can only be excluded with documented, valid scientific justification that it does not represent what was measured, and the excluded value must be kept with the data set. So she raises a deviation instead. She checks the sensor and its calibration, looks at the audit trail for any configuration change around 03:10, and compares the other sensors. She records her conclusion against the reading, keeps the value visible, and the Responsible Person signs off the review with a positive statement that one issue was found and how it was closed.
Where it's unclear
Where the sources disagree
Retention periods differ between EU GDP, the Green Book, WHO and the HTA (how long to keep records). The MHRA accepts controlled hybrid systems, while the WHO data integrity guideline says replacing them should be a priority with a documented CAPA plan (hybrid records). CQC expects GP practices to keep a daily manual record even with a logger, and the MHRA treats the logger's stored data as the raw data (logger versus daily reading).
Wherever the sources differ, assess the risk and record your reasoning.
Inspection findings
What MHRA inspectors have found in temperature records
The MHRA GDP deficiency data for 2016 includes a Responsible Person who admitted adding fabricated readings to fill gaps in temperature records, records made in pencil, unsigned temperature records and unapproved corrections, all cited as major deficiencies. The same data shows cold chain deviations that were recorded but never put through CAPA.
Gaps found at a CQC inspection do not automatically mean stock was badly stored. PHE's Q&A on CQC inspection says not to dispose of vaccines on that basis alone, but to contact the screening and immunisation team and gather evidence such as stock turnover and the fridge's service history. The responsibility and inspection page covers who should be reviewing records, and monitoring and alarms covers the instruments that produce them.
In summary
The short version
- Decide and document which record is the original for each fridge, room or vehicle.
- Keep electronic monitoring data as the raw data; treat printouts as copies.
- Use individual logins, keep audit trails switched on and review them in proportion to risk.
- Make entries at the time, signed, and record missed readings as missed.
- Never delete a suspect reading; investigate it and record the conclusion against it.
- Know your retention period, and keep backups and a separate archive that stays readable.
- For cloud-hosted systems, get data access, location and exit terms in writing.