A procedure describes the day things go normally: who measures, how often, where it is written. An emergency plan describes the moment operation stops and answers one question: what happens now, who does it, where do the goods go. When a unit stops, power fails, a vehicle or door is damaged, an accident occurs or an unexpected delay is observed, the plan shows the safe first move, who decides and what evidence governs the load.
Separate the onset time. The alarm time, the discovery time and the time the product left its accepted band can all differ. Record the last acceptable and the first unacceptable reading and do not guess the moment between them. For example, hypothetical readings of acceptable at 10:10 and unacceptable at 10:40 do not show that the excursion began at 10:10; a known power-loss time likewise does not mean product temperature crossed its limit then.
First move and ownership. The safe first move is not to relocate the load at once: keep doors closed unless needed, preserve the current reading, record the alarm and event time, and call the responsible person. If the primary owner cannot be reached the backup owner takes over; names, roles, contact route and decision authority are kept current. Load identity, product and lot, case or pallet count, current temperature and its time, logger identity, unit status, location and access risk go into the same incident record. If there is no measurement, write unknown; an estimate is not used as a measurement.
| Event and observed time | Safe first move | Checks and decision owner before backup/transfer | Record evidence |
|---|---|---|---|
| Unit stopped; onset known or unknown | Keep the door shut; record alarm and last good reading | Product/lot, current reading, backup capacity and power option; shift owner | Incident ID, timeline, logger and decision |
| Power failure | Avoid unnecessary opening; check a safe power option | Connection, capacity, safety and expected duration; maintenance or warehouse owner | Power state, test result and readings |
| Vehicle or transport failure | Protect the load; report location and access risk | Backup vehicle/container, equipment, capacity, hygiene and transfer time; logistics owner | Location, load list, transfer approval and deviation |
| Door left open or delivery delay | Secure closure; record opening and dwell time | Product condition, current reading, redirection and decision owner; field owner | Opening/dwell record, measurement and decision |
Backup space and power
The weakest clause is usually the backup space: the plan says the goods go to another cold area and stops there. Before moving, check that area's real free capacity, the pallet size it accepts, its current temperature, monitoring device, access, hygiene conditions, transfer time and staff; a neighbouring business or the nearest cold site is not automatically suitable. A volume independent of electricity works in an outage only if it was prepared beforehand. For plates, look for the condition GEBHARDT specifies for its own plates: the filling must be completely frozen, and the freezing temperature must be at least 5 °C below the melting point. Having plates in storage does not mean they are ready.
List the power options separately too: mains, a backup generator, an external supply that suits the vehicle or unit, a prepared cold source. Connection, capacity, fuel and safety are tried during an incident or a drill.
The decision about the product
In food, corrective action means two separate jobs: restoring control of the process and deciding what happens to the affected product (expert evaluation, reprocessing, another use or destruction). FAO's monitoring guide covers planned measurement and records, and its corrective-action guide explains why both decisions are needed. Bringing the temperature back into range does not release the product.
Drills
A drill does not need to cut power to a loaded, running unit and put product at risk. Start at a table with the contact chain, incident form, last known good time, the backup space's capacity and access, power options and decision owners; then use empty equipment or a safe simulation to try the transfer route, logger placement and record flow. A drill often turns up an out-of-date phone number, a key held by one person, or plates that are not in the freezer. After every drill and incident the plan is reviewed against the measurement gap, transfer time, capacity and communication problems, and review frequency follows risk, change and past incidents rather than a fixed annual interval.
Prepare the incident record with the fields in the cold-chain excursion report; the load list, measurement file, alarm and photos, backup checks and decision owner are linked under one incident number. The measurement and records guide separates the questions each record can answer.