Data integrity is whether a temperature record can be trusted to show what actually happened, rather than what someone typed in afterward. A record with full integrity was captured directly off a sensor at the time the reading occurred, cannot be altered without leaving a trace, and can be tied back to the specific device, person, and moment that produced it. A record failing any part of that chain is not automatically wrong, but it is not provably right either, and in a regulated cold chain those are treated the same way.
The concept applies to every record a cold chain generates: a shipment's temperature data logger file, a warehouse's continuous real time monitoring feed, a manual spot check written on a clipboard, and every correction anyone makes to any of them afterward.
ALCOA applied to temperature records
ALCOA is the standard shorthand for what a trustworthy record needs: attributable to a specific person or device, legible, contemporaneous with the event it describes, original rather than a copy or transcription, and accurate. Applied to a temperature reading, attributable means the sensor ID is captured alongside the value, contemporaneous means the reading was logged automatically at the moment it occurred rather than written down later from memory, and original means the raw sensor output, not a summarized or rounded version of it, is what gets kept. A record that satisfies all five is treated as reliable evidence; a record missing even one, most often contemporaneous, is treated as unverified regardless of how plausible the numbers look. Complete and enduring are sometimes added as a sixth and seventh check: complete meaning every reading in a sequence is present with no gaps quietly deleted, and enduring meaning the record survives in a durable format rather than one that degrades or becomes unreadable before its retention period ends.
Audit trails
An audit trail is the record of every change made to a record after it was first captured: who made the change, when, what the value was before and after, and why. A system with a real audit trail does not delete or overwrite the original reading when someone corrects it; it keeps the original, timestamps the correction, and shows both. That layered history is what lets an inspector tell the difference between a legitimate correction, fixing a sensor ID that was logged wrong, and a change made to hide an excursion that would otherwise have failed the shipment.
Access and edit rights
Uncontrolled edit access is the single most common way integrity breaks down. A system where any user can open a temperature file and change a value, with no audit trail behind the change, cannot prove any given reading is the original one, even if nobody actually altered anything, because there is no way to show that. Proper access control separates who can view a record from who can edit one, and further separates edit rights from approval rights, so a single person cannot both alter a reading and sign off on the corrected version without a second person reviewing the change.
Paper and spreadsheets don't hold up
A paper temperature chart, filled in by hand at fixed intervals, fails contemporaneous and original the moment a reading is written down from memory ten minutes after the check was actually due, which happens constantly and is nearly impossible to detect from the paper alone. It also has no audit trail: a crossed out and rewritten number on a chart could be an honest correction or a cover up, and paper cannot tell an inspector which. An unsecured spreadsheet carries the same problem in digital form. Anyone with edit access can change a cell with no record that a change happened, no timestamp on the edit, and no way to recover the original value once it is overwritten. Both formats can be completely honest in practice and still fail an inspection, because data integrity is judged on what the system can prove, not on what actually happened.
Retention and backup copies
A trustworthy record has to survive as long as the product it describes might still be under review, which for a pharmaceutical shipment can mean years after delivery. Retention policy sets how long raw sensor files, audit trails, and corrected versions all stay accessible together, not just the summary report generated at the time. A backup that stores only the final reading and drops the underlying audit trail has quietly destroyed the evidence that made the record trustworthy in the first place, even though the number itself is untouched.
Migrating data to a new monitoring platform carries the same risk. A file format change that preserves the temperature values but loses the timestamps, device IDs, or edit history behind them has broken integrity just as completely as an unauthorized edit would, and an inspector treats the two failures the same way.
Enforcement in practice
Regulators including the FDA and the MHRA inspect data integrity directly, treating a broken audit trail or unrestricted edit access as a finding regardless of whether the underlying temperatures were actually fine. Quality assurance teams, not IT departments, usually own the policy for who gets edit rights on a monitoring system, because the question is a compliance one, not a technical one: the system needs to be technically capable of restricting access, and someone needs to have actually decided who the access goes to. A finding against data integrity tends to cost a company more than a finding against a single temperature excursion, because an excursion is a bounded, one time problem while a broken audit trail throws every other record from the same system into doubt, retroactively.