Shipper qualification and lane qualification prove a packaging and route combination works under the conditions someone thought to test. A route risk assessment is the step that decides which conditions are worth testing in the first place, and it catches the failure modes that never show up in a chamber: a customs hold that runs long, a cross dock with no refrigeration, a driver who takes the wrong lane on a detour day. This is a failure mode style assessment (severity, occurrence, detection) adapted for cold chain distribution hazards, one accepted method under ICH Q9(R1); a simpler hazard ranking is equally valid if your quality risk management procedure specifies it. Replace every <<FILL: ...>> placeholder, run the assessment with a cross functional team before the lane is qualified, and let the output drive what the shipper and lane protocols actually challenge. A filled specimen follows. Verify each cited requirement against the current source before you rely on it.
Why this assessment exists (regulatory basis)
EU GDP Guidelines (2013/C 343/01), Chapter 9, expects transport routes and processes to be qualified against the real risks a shipment faces, not against a convenient assumption. ICH Q9(R1) supplies the method and warns specifically against subjective, undocumented scoring. WHO TRS 992, Annex 5, builds shipper and lane qualification on a documented risk basis rather than a one size fits all test. A route assessment done before qualification tells you where to put sensors, how many trial shipments to run, and which season is actually the worst case for this specific lane, instead of defaulting to a generic profile that may not represent the product’s real exposure.
Document control header
| Field | Entry |
|---|---|
| Assessment title | Cold Chain Distribution Route Risk Assessment, <<FILL: lane / product>> |
| Document number | <<FILL: RA-ID>> |
| Version / date | <<FILL>> |
| Feeds | <<FILL: shipper qualification protocol ID, lane qualification protocol ID>> |
| QRM method | Distribution route FMEA (severity x occurrence x detection) |
| Team (cross functional) | <<FILL: Cold chain / Logistics SME, QA, Stability, Validation, 3PL representative>> |
1. Scope
This assessment covers the failure modes that could take <<FILL: product / product family>> out of its labeled storage range on the lane <<FILL: origin to destination, mode>>, from <<FILL: point product leaves controlled storage>> to <<FILL: point product enters controlled storage at destination>>. It covers thermal, handling, data, and documentation failure modes. It does not replace the shipper thermal qualification or the lane transit qualification; it decides what those protocols need to test. Out of scope: <<FILL>>.
2. Scoring scales
State the scales explicitly so scoring is reproducible across scorers. Adjust the anchors to your quality risk management procedure.
Severity (S), impact if the failure mode reaches the product:
| Score | Meaning |
|---|---|
| 1 | Negligible: within the stability budget with wide margin, no dosing or supply impact |
| 2 | Minor: consumes stability budget but stays within it, requires disposition review |
| 3 | Serious: could exceed the stability budget or approach a freeze threshold for a freeze sensitive product |
| 4 | Critical: irreversible degradation or freeze event likely, patient supply or safety impact |
Occurrence (O), likelihood the failure mode happens on a given shipment before controls:
| Score | Meaning |
|---|---|
| 1 | Remote: no history on this lane, unlikely by design |
| 2 | Low: occasional, seen rarely in lane history |
| 3 | Moderate: plausible, seen periodically (seasonal customs load, known congestion point) |
| 4 | High: recurring, seen on a meaningful share of shipments |
Detection (D), chance the failure mode is caught before it affects the disposition decision (higher score means worse detection):
| Score | Meaning |
|---|---|
| 1 | Almost certain (real time logger with alert, active monitoring) |
| 2 | Likely (logger downloaded promptly at receipt, short feedback loop) |
| 3 | Unlikely (logger downloaded late, indirect evidence only) |
| 4 | Very unlikely (no logger coverage for this leg, or data can be lost or edited) |
Risk Priority Number (RPN) equals S multiplied by O multiplied by D. Define the action threshold: <<FILL: e.g. RPN 24 or higher, or any S4 with O of 3 or higher, requires additional control>>. Do not let the arithmetic override judgment: any credible severity 4 failure mode gets a control regardless of a low RPN, and a freeze sensitive product gets a stated no freeze control independent of score.
3. Route hazard assessment table
| # | Failure mode | Leg / location | S | O | D | RPN pre | Existing control | Additional mitigation | S | O | D | RPN post | Residual risk / owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Include, at minimum, one row for each of these route hazard categories, dropping any that are genuinely not credible for this lane and stating why:
- Coolant exhausted or conditioned incorrectly before dispatch.
- Winter freeze of a freeze sensitive product from over conditioned coolant.
- Customs, screening, or documentation hold exceeding the shipper’s qualified duration.
- Unrefrigerated dwell at a cross dock or transfer hub.
- Tarmac or ramp exposure during an air leg delay.
- Shipper damage, crush, or puncture in handling.
- Wrong shipper class used for the lane (for example, a shorter duration configuration used on a longer route).
- Data logger failure, loss, or data gap during transit.
- Driver or courier deviation from the qualified route or an unplanned multi stop detour.
- Last mile multi stop delivery with repeated door openings not represented in the chamber profile.
- Receiving delay or storage in an unqualified area after arrival.
- Season transition (shoulder season) falling outside the profile qualified for that period.
- Loss of power or refrigeration at a 3PL cross dock or warehouse.
- Mislabeled storage condition or incorrect handoff instruction at a transfer point.
4. Mitigations and actions
| Action ID | Failure mode addressed | Action | Owner | Due | Status |
|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
5. Residual risk statement and acceptance
For each failure mode where risk remains after mitigation, state it plainly and record who accepted it and on what basis (lane qualification data, monitoring trend, contractual control at the 3PL). Unaccepted residual risk is an open action, not a closed assessment.
Residual risk summary: <<FILL>>. Accepted by: <<FILL: risk authority / Quality Head>>.
6. Acceptance criteria
- Every credible failure mode on the route hazard categories in section 3 is identified and scored with the defined scales, or its exclusion is justified.
- Scoring rationale is recorded, not just the numbers, addressing the Q9(R1) caution against subjective scoring.
- Each failure mode above the action threshold has a mitigation with an owner and a due date.
- Any severity 4 or freeze related failure mode carries a control regardless of the calculated RPN.
- The assessment output is reflected in the shipper qualification profile selection and the lane qualification trial design, not filed separately from them.
- The assessment was run by a cross functional team, is under change control, and carries a review trigger.
7. References
EU GDP Guidelines (2013/C 343/01), Chapter 9 (Transportation). WHO Technical Report Series 992, Annex 5 (Qualification of shipping containers and temperature mapping). ICH Q9(R1), Quality Risk Management. 21 CFR 211.142 and 211.150 (US warehousing and distribution procedures).
Confirm the current version and clause numbers of each reference before issue.
Filled specimen
An extract for a frozen cell therapy product shipped by air in a vapor phase dry shipper. Scores are illustrative and would be justified by the assessing team.
| # | Failure mode | Leg | S | O | D | RPN pre | Existing control | Mitigation | S | O | D | RPN post | Residual / owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Customs hold exceeds the dry shipper’s qualified vapor phase hold duration | International air leg, destination customs | 4 | 3 | 2 | 24 | Pre cleared documentation packet, 24 hour margin built into hold duration claim | Add a real time GPS and temperature logger with an alert to logistics and QA if dwell exceeds a defined threshold | 4 | 2 | 1 | 8 | Low; Cold chain / Logistics SME |
| 2 | Dry shipper tipped or mishandled during a hub transfer, risking liquid nitrogen loss | Hub cross dock transfer | 4 | 2 | 3 | 24 | Orientation labeling, tilt indicator on the shipper | Require the ground handler to sign a handling attestation at each handoff; escalate any tilt indicator trip to immediate QA review before further transit | 4 | 1 | 2 | 8 | Low; Supply chain / distribution operations |
| 3 | Real time logger battery depletes before arrival, leaving a data gap | Full transit | 3 | 2 | 3 | 18 | Pre shipment battery check | Set battery qualification margin at 1.5 times the worst case transit time; add a passive backup logger as a second record | 3 | 1 | 2 | 6 | Low; Validation engineer |
Reading row 1, the team judged customs dwell as the dominant hazard for this lane, moved detection from unlikely to likely by adding real time alerting, and stated the residual risk with an owner. That residual risk line, and the lane’s demonstrated worst case dwell, is what set the qualified transit margin in the lane qualification protocol for this route.
Common inspection findings this assessment prevents
- A shipper and lane qualified against a generic seasonal profile with no documented basis for why that profile represents the real route.
- A known recurring failure point (a specific customs hub, a specific cross dock) with no assessment and no mitigation, discovered only after an excursion.
- Risk scoring with no recorded rationale, which reads as arbitrary under the Q9(R1) subjectivity caution.
- A freeze sensitive product’s winter risk dismissed because the calculated RPN came out low.
- An assessment run by one function alone, missing the operational reality a logistics or 3PL representative would have raised.
How to adapt this assessment
- Set the scales to match your quality risk management procedure so a score of 3 means the same thing to every scorer.
- Walk the real route with the cold chain or logistics SME and enumerate the actual handoffs, dwell points, and modes, not a generic template list.
- Record the scoring rationale, not just the numbers, and let judgment override the RPN for any severity 4 or freeze related failure mode.
- Feed the output directly into the shipper qualification profile selection and the lane qualification trial design and season.
- Put the assessment under change control with a review trigger tied to lane, carrier, or season changes, and confirm the references before issue.