Cold-chain record-keeping checklist: what to keep (and for how long)

The five facts start the file

Every cold-chain record exists to answer the same five questions about a moment when temperature was not where it was supposed to be. If the file can answer them, the charts and summaries are supporting evidence. If it cannot, the charts are context.

1. The band. The required range for that asset, registered once — +2 °C to +8 °C, −18 °C, whatever the product and plan say — and read from the record, not re-argued after the fact.
2. The start. The timestamp when the reading left the band. Not “that weekend”: a datetime the log can point to.
3. The duration. Minutes out of band, cumulative where events repeat. This is the number compared against product tolerances, customer agreements and stability data.
4. The worst value. The peak reached during the event, not the average. Severity separates a nuisance from a product-integrity question.
5. The recovery. When the reading returned to band, and what caused the event — door, defrost, compressor, power. The corrective action closes the loop.

Monitoring records

Monitoring is the planned observation that proves the limit held: who checks, how often, with what instrument, and what they record. Continuous logging does that better than a twice-daily manual tick — but a logger nobody reads is data, not monitoring. The review step is part of the record.

Under the US preventive-controls rule, records must contain the actual values and observations obtained during monitoring (21 CFR § 117.305(b)), be accurate, indelible and legible (§ 117.305(c)), be created concurrently with the activity documented (§ 117.305(d)), and include the date, time and the signature or initials of the person who performed the activity (§ 117.305(f)). A monthly average is none of those things.

For pharmaceutical distribution, WHO Good Distribution Practice (GDP) expects temperature-controlled storage and transport conditions to be monitored and recorded, and deviations investigated — the monitoring record is the evidence base for that assessment. The detailed expectations differ by market, so the record should be built to the strictest rule you operate under.

Calibration records

Every reading is only as good as the instrument behind it. Keep, per device: the identity (probe or logger serial, not “the fridge sensor”), the calibration date and method, the result, the reference the instrument was checked against, and the next due date. A calibration certificate that cannot be tied to a specific device does not rescue the readings it is supposed to validate.

In the US preventive-controls rule, calibrating process-monitoring and verification instruments is a verification activity (21 CFR § 117.165(a)(1)), and the facility must have written procedures for the method and frequency (§ 117.165(b)(1)). The record review has a clock on it too: monitoring and corrective-action records are reviewed within seven working days, or on a documented justification for a longer period (§ 117.165(a)(4)(i)).

Excursion and corrective-action records

An excursion record is the five facts plus what you did about them. For each event keep the asset and band, the start and end timestamps, minutes out of band, the worst value, the recovery, the assessment (how far, how long, cumulative exposure, and the stability data or product tolerance it was judged against), the disposition and the person accountable, the corrective action, and the verification that the fix worked.

The US preventive-controls rule is explicit that corrective actions must be documented in records (21 CFR § 117.150(d)). The corrective-action procedure has to identify the problem, act to reduce the chance of recurrence, evaluate affected food for safety and, where safety cannot be assured, keep it out of commerce (§ 117.150(a)(2)). “Recharged the unit” is a repair; the record also has to show the product decision.

HACCP's seventh principle is documentation and record keeping, and the Codex framework expects the records to be appropriate to the nature and size of the operation. The binding retention period is not set by Codex — it comes from the regulation that gives HACCP its legal force in your jurisdiction, or from the customer specification you signed. Check that source rather than copying a number from a template.

How long records must survive

There is no single cold-chain retention period. The record has to survive the strictest of three things: the applicable rule, your customer or insurance contract, and any legal hold. Retention is a floor, not a target.

• US food preventive controls. Records required by 21 CFR part 117 must be retained at the facility for at least two years after the date they were prepared (21 CFR § 117.315(a)(1)). Records that support the general adequacy of equipment or processes — validation studies, for example — must be kept at least two years after their use is discontinued (§ 117.315(b)). Offsite storage is allowed if records can be produced onsite within 24 hours of a request, except the food safety plan itself (§ 117.315(c)).
• HACCP. The plan defines which records exist and how often they are made. The retention period comes from the national rule that makes the HACCP system binding — in the US, 21 CFR part 117 for preventive-controls facilities; in the EU, the food hygiene rules built on HACCP principles, with the detail set by national authorities. Confirm the period that applies to your operation.
• Pharma (GDP). WHO GDP expects storage and transport conditions, and the investigation of deviations from them, to be recorded. The retention period comes from the national GDP rule or licence condition in your market — check it rather than assuming a single global number.
• F-gas records. Refrigerant records are a separate file with their own clocks: at least five years under EU Regulation (EU) 2024/573, and minimum three-year periods for the US leak-detection and refrigerant-management records. Our F-gas record-keeping guide sets out the detail.
• Contracts, insurers and customers. Frequently longer than any regulation — multi-year supply agreements and insurer conditions regularly run to five or seven years. Where two requirements collide, keep to the longer one.

Keep the underlying readings and the event-level record, not just the summary. A weekly “all clear” email cannot answer the five facts after the fact; the log can.

The one-page checklist

If the file is new, or an audit is coming, this is the working list:

• An asset register with the required band for every monitored unit or storage location, the unit of measure and the monitoring interval.
• The raw readings, retained as recorded — not only a daily minimum/maximum or a monthly summary.
• The monitoring review: who reviewed which period, when, and what happened to any gap in the trace.
• A calibration certificate for every instrument, tied to a device serial: date, method, result, reference used, next due date.
• An excursion register with the five facts for every event: band, start, duration, worst value, recovery.
• The corrective action for each event: what was done, who decided, what happened to the product, and the verification that the fix worked.
• The exposure assessment where one was made — how far, how long, cumulative exposure, and the stability data or product tolerance it was judged against.
• The HACCP plan or monitoring procedure that defines the band, the frequency and the corrective action, with a named owner.
• Refrigerant records for the equipment that serves the rooms — leak checks, repairs and recoveries — filed with the cold-chain record, not in a separate drawer.
• A retention schedule that maps every record type to the applicable rule, the customer contract and the insurer requirement, and applies the longest period.

How Cryovo fits

Cryovo turns the logger export into the monitoring and excursion record: registered band per asset, every out-of-band period with its start, duration, worst value and recovery, and the readings behind every number. The PDF is a deterministic audit-trail report you can hand over, and the CSV export is yours. The assessment and the product disposition stay with your people — that decision is not ours to make.

The sample report shows exactly what the record contains, and the 60-day design-partner pilot includes onboarding, your first CSV import and an audit-trail report built from your own readings.

General information, not legal or compliance advice for your operation; cite the published rule for your jurisdiction and product. Sources reviewed 4 November 2026: 21 CFR § 117.305, § 117.150, § 117.165, § 117.315; Codex Alimentarius, General Principles of Food Hygiene (CXC 1-1969), HACCP principles; WHO Good Distribution Practice guidelines.