A pallet of temperature-sensitive medicine sits on an airport apron for four hours in July. The logger later shows a peak of 9.4 degrees against a labelled range of 2 to 8. The product is very probably fine. Nobody can release it until someone reconstructs the excursion against the stability data, and that reconstruction takes three days because the logger file, the flight milestones and the packaging configuration live in three unconnected places.
Cold chain failures in pharmaceutical distribution are usually documentation failures first, and the gap sits between the transport record and the quality record. Specialist vendors including Wezom are frequently asked to build custom tms software around an existing transport platform rather than replace it, because the missing capability is not routing. It is the ability to answer, quickly and defensibly, what the product experienced and whether that matters.
The Clock That Runs Behind Every Shipment
Temperature-sensitive product carries a stability budget. Manufacturers establish, through stability studies, how much time at what temperatures a product can tolerate before quality is affected, and that data supports decisions about excursions. The budget is finite and cumulative across the product’s life, which means an excursion during transport consumes allowance that cannot be recovered later.
Mean kinetic temperature is the concept that makes this tractable. Rather than treating any moment above the range as equivalent, MKT weights exposure by both duration and temperature, reflecting that degradation accelerates non-linearly. A brief spike and a long mild deviation are different events, and the calculation distinguishes them.
For software, this has a specific consequence: the system needs the temperature profile, not a pass or fail flag. A logger reporting only whether limits were breached supports no assessment beyond quarantine. A system holding the full time-series, aligned to the shipment and to the phases of its journey, allows the quality team to calculate exposure and make a release decision on evidence.
The second consequence concerns where the decision authority sits. Transport operations cannot release product. A qualified person or designated quality function makes that call under the applicable regulatory framework, and the transport system’s job is to deliver them the complete record fast enough that the decision does not itself become the delay. Product sitting in quarantine occupies storage, ties up working capital and, for products with short remaining shelf life, can expire while waiting.
What Standard Transport Systems Do Not Model
General transport management systems model a shipment as freight moving between locations with a status. Pharmaceutical cold chain needs several objects that model does not contain.
The lane is the first. In Good Distribution Practice terms, a transport route is qualified: the combination of origin, destination, mode, carrier, packaging configuration and seasonal conditions has been assessed and documented as capable of maintaining the required conditions. A qualified lane has a validity period, supporting documentation and conditions attached. Shipping outside a qualified lane is a deviation in itself, and the system should know that before the booking rather than after the shipment.
The packaging configuration is the second. Passive shipping containers with phase change material have a defined duration under specified ambient profiles, and that duration depends on pre-conditioning, pack-out procedure and payload volume. Active containers have a battery runtime and require servicing between uses. Neither is a freight attribute in a conventional data model, and both determine whether a delay becomes an excursion.
The monitoring device is the third. Each shipment carries one or more loggers with serial numbers, calibration records and configuration, and the calibration status of the device is part of the evidence chain. A reading from a device with expired calibration is not usable evidence, which means device lifecycle tracking belongs inside the system rather than in a separate spreadsheet.
The fourth is the product itself, at a level of detail transport systems rarely carry. Batch or lot number, expiry date, storage condition class and the stability data relevant to excursion assessment all bear on what happens when something goes wrong. A shipment identified only by a description and a weight cannot support a quality decision.
Where these objects are absent, operations recreate them outside the system, which is exactly the situation that makes the three-day reconstruction necessary.
Deviation Handling Belongs in the Workflow
Most transport systems treat a temperature excursion as an alert. In a regulated environment it is the start of a process with defined steps, owners and timelines.
The sequence begins with detection, which is more useful in real time than after arrival. A shipment sitting on an apron at hour three of a container’s six-hour remaining runtime is an intervention opportunity; the same shipment discovered at hour nine is an investigation. Real-time monitoring devices with cellular or satellite connectivity make the first possible, at a cost per shipment that has to be justified against product value.
Detection leads to containment: the product is quarantined on arrival, physically and in the inventory system, so it cannot be dispatched while under assessment. Systems that raise an alert without placing an inventory hold depend on someone acting on an email, which fails at volume.
Assessment follows, combining the temperature profile, the product’s stability data and the excursion history of that batch. This is a quality decision and the system’s role is to assemble the evidence and record the outcome with its rationale and the identity of the person who made it.
Then comes root cause investigation and, where warranted, corrective and preventive action. The value of a well-structured system appears here, because patterns across shipments are visible only when excursions are recorded consistently. A recurring excursion on one lane during summer months, or on shipments handled by one ground agent, or with one packaging configuration, points at something fixable. Excursions recorded as free text in a shipment note produce no pattern at all.
The workflow also has to record what did not happen. A shipment that passed through a known risk point without excursion is evidence supporting lane qualification, and discarding that data leaves the qualification resting on the original study rather than on operational experience.
Validation Is the Part Nobody Budgets
Software used in decisions affecting product quality falls within the validated systems estate, and that changes both the cost and the rhythm of development. Teams arriving from general logistics work consistently underestimate this.
Computerized system validation under GAMP 5 principles applies a risk-based approach: the effort scales with the system’s impact on patient safety, product quality and data integrity. A transport system that only records where a truck is sits low on that scale. One that holds temperature evidence supporting release decisions does not.
The practical artefacts include user requirement specifications traceable to functional and design specifications, installation, operational and performance qualification, and a validation summary. Every requirement needs a test demonstrating it is met, and the traceability matrix connecting them is itself a deliverable.
Electronic records and signatures bring their own requirements, addressed by 21 CFR Part 11 in the United States and EU GMP Annex 11 in Europe. The relevant capabilities are concrete: a secure computer-generated audit trail recording who changed what and when, with the original value preserved and not obscured; user access controls tied to individual identities rather than shared accounts; electronic signatures linked to their records; and system-enforced sequencing where the process requires it.
Change control is where the operational rhythm shifts most. A change to validated functionality requires assessment, approval, testing and documentation before deployment. Continuous deployment of everything is not available. The architectural response is partitioning: keep the validated scope as narrow as the regulatory requirement allows, and separate non-impacting features such as dashboards and planning aids so they can be changed on a normal cycle. Teams that skip this partitioning end up validating the whole application, which makes every minor improvement expensive.
Data retention is the last piece. Records supporting distribution of a medicinal product must be retained for defined periods that outlive most software, which means archival strategy and the ability to render old records readable belong in the design rather than in a later conversation.
The Integration Surface Around the Transport Layer
A cold chain transport system sits between several systems that each hold part of the picture, and the integration work typically exceeds the application work.
Logger and device platforms are the first. Each monitoring vendor exposes data differently, through its own API, file export or portal, with its own data format, time representation and definition of an alarm. Operations using more than one device type, which is common when customers or lanes dictate the choice, need normalization into a single internal representation. That normalization must preserve the raw data alongside the normalized version, because the raw file is the evidence.
Time handling deserves specific attention here. Loggers record in their own time base, flights are scheduled in local time at each end, and warehouse events arrive in system time. Reconstructing what happened requires all of these normalized to a single reference with the original preserved, and offsets that seem trivial during design become the reason an excursion cannot be attributed to a specific handling stage.
The warehouse and ERP systems hold batch, expiry and inventory status, and the quarantine hold has to be effective in whichever system actually controls dispatch. An integration that records a hold only in the transport system leaves the product releasable from the warehouse.
Carrier and forwarder milestones matter more in air freight than in most domains, because the risk points are identifiable: tendered, accepted, loaded, departed, arrived, broken down, cleared, collected. Each transition is a place where product may sit outside controlled conditions. Where those milestones arrive electronically, the system can correlate temperature behaviour with handling stage. Where they do not, the temperature record shows a deviation with no attributable cause, and lane improvement becomes guesswork.
The quality management system is the final connection. Deviations, investigations and CAPA records live there, and a transport system that raises excursions without feeding them into the QMS creates parallel records that must be reconciled manually during an inspection.
Where the Boundary Between Bought and Built Should Fall
Nothing above argues for building an entire transport platform. Most of what a pharmaceutical distributor needs from transport software is undifferentiated: booking, rating, carrier communication, track and trace, freight settlement. Those functions exist in packaged form and building them consumes capital without producing capability.
What packaged products handle poorly is the intersection: the shipment record that also carries batch, lane qualification, packaging configuration, device assignment and temperature evidence, with a deviation workflow that satisfies a validated environment. That intersection is where a custom tms software layer earns its cost, and it is usually a layer rather than a replacement.
Several components are better bought than built even within that layer. Monitoring hardware and its data platform is a device business with calibration infrastructure behind it. Stability modelling and MKT calculation is well-defined mathematics, but the underlying stability data belongs to the manufacturer and the assessment authority sits with quality. Validation tooling and document management are available as products.
What remains to build is the connective structure: the data model holding the objects packaged systems lack, the workflow that moves a deviation from detection through to closure with the right approvals, the evidence assembly that produces a complete shipment dossier on demand, and the analytics that turn accumulated excursion data into lane and packaging decisions.
Sequencing this matters as much as scoping it. Evidence assembly comes first, because it delivers the three-day reconstruction as a same-hour retrieval without changing how anyone works. Deviation workflow follows, once the evidence is reliably available. Predictive and preventive capability, such as flagging a shipment whose remaining container runtime is falling below its remaining transit time, comes last, because it depends on both the data and the operational trust built by the earlier phases.
Questions to Put to a Vendor Before Anything Is Signed
Ask how they handle validation. A vendor without direct experience of GAMP 5, IQ/OQ/PQ documentation and change control in a regulated estate will discover the requirement mid-project, and the discovery reprices the engagement.
Ask what their audit trail design looks like. The answer should cover immutability, what is captured, how the original value is preserved and how the trail is reviewed, not just that logging exists.
Ask how they would model a lane qualification with a seasonal validity window and an attached packaging configuration. Vendors who have built for this domain answer in terms of objects and relationships. Vendors who have not answer in terms of custom fields.
Ask what happens when two logger vendors report the same excursion differently. Normalization strategy reveals whether they have integrated devices before.
Ask which parts of the system they would keep outside validated scope and why. A vendor who proposes validating everything is proposing a system nobody will be able to improve.
Ask how the deviation record reaches the quality management system, and who owns the reconciliation if the two disagree.
The distributors who get value from custom tms software in this space are not the ones who concluded that packaged transport platforms are inadequate. They are the ones who identified that the transport record and the quality record were separate artefacts, and built the narrow layer that joins them. The product on the apron in July was always going to be fine. What the system determines is whether that took three days to establish or forty minutes, and whether the next shipment through the same airport encounters the same four hours at all.
