Validating Sensor and IoT Data Feeds in GMP Facilities

When the GMP Record Comes From a Sensor

For most of the history of GMP, a monitoring record was something a person wrote down. An operator read a pressure gauge and entered the value on a log sheet. A warehouse technician checked a thermometer twice a day. A reviewer could see the handwriting, the time, and the signature, and could judge whether the entry looked right. The weaknesses of that model are well known, and FDA warning letters still describe them. In a 2023 letter, FDA noted that a sterile ophthalmic manufacturer recorded differential pressures by reading photohelic gauges whose upper and lower limits could be accessed and adjusted, and that the recording frequency was not adequate to detect pressure reversals that could affect the filling line.¹

Continuous electronic monitoring solves the frequency problem. A networked pressure transmitter can report every few seconds, and a particle counter can sample the Grade A zone for the whole of a filling run. But it moves the trust problem somewhere less visible. When a sensor writes the record, nobody sees the handwriting. The reviewer sees a clean trend line on a dashboard and has no direct way to know whether the sensor was in calibration, whether the clock that stamped the reading was correct, whether ten minutes of data were lost during a network outage and filled in by interpolation, or whether an alarm was raised and cleared by someone who should not have been able to clear it.

The Regulatory Baseline Has Not Moved

The core U.S. requirements are short and old. Under 21 CFR 211.42(c)(10)(iv), aseptic processing areas must include, as appropriate, a system for monitoring environmental conditions.² Under 21 CFR 211.68, automatic, mechanical, and electronic equipment used in manufacturing, processing, packing, or holding “shall be routinely calibrated, inspected, or checked according to a written program designed to assure proper performance,” and written records of those checks must be kept.³ The same section requires that input to and output from computer systems be checked for accuracy, with the degree and frequency of checking based on the complexity and reliability of the system, and that backup data be exact, complete, and secure from alteration, inadvertent erasure, or loss.³ For finished product storage, 21 CFR 211.142 requires written warehousing procedures that include storage under appropriate conditions of temperature, humidity, and light so that identity, strength, quality, and purity are not affected.⁴

In Europe, EU GMP Annex 11 has asked since 2011 that computerized systems exchanging data electronically with other systems include appropriate built-in checks for the correct and secure entry and processing of data.⁵ Annex 1, revised in 2022, is much more specific about continuous monitoring in sterile manufacturing, as later sections show.⁶

None of these texts mention the Internet of Things. They do not need to. A wireless temperature probe is “electronic equipment” under 211.68 whether it reports over a cable, a wireless mesh, or a cellular modem. The question for a quality leader is not whether IoT devices are in scope. They are. The question is what it takes to show that the data they produce can support a GMP decision, and that is the core of IoT data validation GMP inspectors expect to see.

Why Validation of the Software Alone Falls Short

Many organizations validate the monitoring application: they run installation, operational, and performance qualification (IQ, OQ, PQ) on the EMS software and server, test the audit trail and user roles, and consider the job done. That work is necessary. It is not sufficient, because most of the ways a sensor feed goes wrong happen outside the application. A probe drifts. A gateway loses power and its clock resets to a default date. A wireless link drops for forty minutes behind a new steel rack. A data logger in a transport container is started in one time zone and read in another. A firmware update changes how a device reports an error. The application may record all of this faithfully and still present a number that does not mean what the reviewer thinks it means.

That is why this article organizes the controls around the path a measurement travels rather than around the software.

The Six-Link Measurement Chain

Every sensor reading that becomes a GMP record passes through a chain of links. Each link can change the value, the time, or the meaning of the reading. Each link needs its own control, and the validation evidence should show that the chain works end to end, including when individual links fail.

The chain framing does two useful things. First, it shows who owns what. Links 1 and 2 are often owned by engineering or metrology. Link 3 is owned by the network or operational technology (OT) team. Link 4 may belong to IT or to the automation group that runs the historian. Links 5 and 6 belong to operations and quality. Gaps in control tend to appear at the handoffs between these groups, and a validation plan built on the chain makes those handoffs visible.

Second, it defines what a trustworthy reading looks like when it reaches the reviewer. We use a simple test: a reading is fit for a GMP decision only when five attributes travel with it.

The rest of this article works through the controls that keep each attribute intact, starting with calibration.

Calibration: Proving the Number Means What It Says

Calibration is the oldest control in this list and the one most often treated as a separate world from data integrity. It should not be. A reading from a probe that has drifted outside its tolerance is an inaccurate record, whatever the audit trail says. WHO’s technical supplement on checking temperature devices puts it directly: proven accuracy is required because “inaccurate readings can lead to a false sense of security” and put temperature-sensitive products at risk.⁷

Traceability Is a Chain, Not a Certificate

Calibration evidence is only as good as the reference it was compared against. NIST adopts the international vocabulary definition of metrological traceability: the “property of a measurement result whereby the result can be related to a reference through a documented unbroken chain of calibrations, each contributing to the measurement uncertainty.”⁸ Two points in NIST’s policy matter for GMP sensor programs. First, supporting a traceability claim is the responsibility of whoever provides the result, and judging whether the claim holds is the responsibility of the user. Second, NIST states that traceability alone does not guarantee fitness for purpose, because that depends on whether the measurement uncertainty is small enough for the intended use.⁸

In practice, this means a vendor calibration certificate is the start of the review, not the end. The quality unit should confirm that the certificate covers the range the device will be used in, that the reference standard used was itself calibrated and of higher accuracy than the device, and that the stated uncertainty is compatible with the limits the device is monitoring. WHO gives a concrete example: a reference thermometer with a rated accuracy of plus or minus 0.2 °C should be used to check a device rated at plus or minus 0.3 °C.⁷ A probe monitoring a 2 to 8 °C cold room with an alert at 7.5 °C needs an uncertainty well inside that half-degree margin, or alarms will be both late and early for reasons that have nothing to do with the room.

Calibration Events That Are Easy to Miss

Most calibration programs handle the scheduled interval well. The failures tend to come from unscheduled events. WHO lists circumstances in which a temperature device needs calibration or recalibration beyond its normal certificate, including when the battery is replaced, when the device was used or treated beyond its data sheet limits (for example, excessive temperature or shock), when its measurements are suspect, or when the certificate has been lost.⁷ For single-use transport loggers, WHO notes that the manufacturer’s calibration certificate should cover the entire temperature range the device is designed for, and that these devices cannot be recalibrated. Multiple-use devices should be calibrated against a certified, traceable reference standard once a year unless otherwise justified, and the calibration should cover the full range of intended use.¹⁰

Each of these events has a data consequence. When a probe fails its as-found check, the question is not only “fix the probe” but “which records did this probe write since its last good calibration, and what decisions relied on them?” A sensor program that cannot answer that question quickly will struggle in an inspection. The answer depends on attributes 2 and 3 above: the record must identify which physical device produced each reading, and the calibration history must be linked to that identity.

Calibrating Without Breaking the Record

WHO’s guidance on monitoring systems for fixed storage areas recommends an annual calibration plan designed so that it can be carried out without major disruption to the monitoring process.⁹ This sounds obvious, but it has design implications. If a monitoring point goes dark for a week while its only probe is at a calibration lab, the facility has a week-long gap in a GMP record. The practical options are rotating spares with controlled swaps, in-situ calibration where the metrology team brings the reference to the probe, or redundant probes at critical points. Whichever you choose, the calibration period itself should show up in the record as a known, explained state rather than as missing data.

Timestamps and Clocks: When Did It Happen?

ALCOA+ asks that records be contemporaneous. For sensor data, that principle depends on a clock nobody looks at. Every reading carries a time, and every investigation that involves a sensor feed depends on lining up times across systems: when the pressure dropped, when the door opened, when the fill started, when the alarm was acknowledged. If the clocks disagree, the sequence of events cannot be reconstructed with confidence.

Source Time and Server Time Are Different Facts

Industrial protocols make a distinction that GMP programs should adopt. The OPC Unified Architecture (OPC UA) specification defines two timestamps for each data value. The source timestamp reflects the time applied to the value by the data source, should be generated as close as possible to the source, and never changes once assigned. The server timestamp reflects when the server received the value or knew it to be accurate.¹¹ The specification also states that a server passing a value on from another server must pass the source timestamp without changes.¹¹

For a GMP record, the source timestamp is the one that matters, because it describes when the condition existed. The server timestamp is useful diagnostic information: a large difference between the two tells you the reading was buffered or delayed in transit. A system that stores only the time a value arrived at the database will misplace every reading that was held in a device buffer during an outage, and it will do so without any visible error.

How Much Can a Clock Drift?

Clock drift is not theoretical. The Network Time Protocol version 4 specification (RFC 5905), which most plant networks use for time synchronization, uses a default frequency tolerance of 15 parts per million when estimating how much a clock’s error can grow between updates, and notes that this amounts to about 1.3 seconds per day.¹² Over a month without synchronization, a device clock at that tolerance could be off by more than half a minute. Battery-powered loggers and gateways that lose power can reset entirely. With synchronization in place, RFC 5905 describes precision in the range of tens of microseconds on fast local networks and tens of milliseconds at long polling intervals.¹² NIST notes for its own internet time service that the accuracy a user sees is usually determined largely by the stability and reciprocity of the network connection between the server and the user’s systems.¹³

For most GMP monitoring, sub-second accuracy is more than enough. The point is not precision for its own sake. It is having a defined, verified time source, knowing the tolerance you need for each use, and detecting when a device falls outside it.

Time Zones in the Audit Trail

The July 2025 consultation draft of the revised Annex 11 addresses this for audit trails. It proposes that an audit trail capture the date and time a change was made, “including the time zone if applicable,” and that audit trail data be recorded at the time of events rather than at the end of a process.¹⁴ The revised Annex 11 is still a draft and not yet in force, so treat this as a clear signal of inspector expectations rather than a current requirement. For sensor feeds that span sites or cross time zones in transit, recording the time basis explicitly avoids a class of investigation errors that are hard to untangle after the fact.

Gaps, Buffers, and Bad Values

Every sensor feed will have missing data at some point. Networks drop, batteries fail, servers restart, and probes are removed for calibration. The integrity question is not whether gaps happen but whether they are detected, explained, and handled honestly in the record.

What Research on Sensor Data Errors Shows

A systematic review of physical sensor data quality published in the Journal of Big Data screened 6,970 publications and examined 57 in detail. It found that the errors most often addressed were missing data and faults such as outliers, bias, and drift, and that faults also include noise, constant values, and stuck-at-zero readings.¹⁵ The review also found that missing values in the research literature were most often filled in by imputation, most commonly using association rule mining.¹⁵

That last finding marks a line GMP organizations must not cross in the record itself. Imputation can be a sensible technique for an analytics model or an engineering study. It has no place in the GMP record of what a sensor measured. If a value was not measured, the record must say so. Any estimated or interpolated values used for analysis should be stored separately, clearly labeled, and never presented in a report as if they were measurements.

Store and Forward: The First Defense

WHO’s guidance on monitoring systems for fixed storage areas sets a clear expectation for wireless networks: sensors should continuously collect and buffer data even during network outages and power cuts, and send the buffered data to the host server when the connection is re-established. Ideally, sensors should have built-in storage so they can also act as data loggers.⁹ The same guidance says wireless configurations should be tested to avoid dead zones and transmission problems in complex monitoring layouts.⁹

Store and forward works only if the chain preserves the original source timestamps (see the previous section) and if the buffer is large enough for the longest outage you plan for. Both should be tested during qualification. Pull the network connection for longer than your expected worst case, restore it, and confirm that every reading arrives with its original time, in order, without duplicates, and with the gap period clearly visible as recovered data rather than live data.

Silence Is Not the Same as Stability

Some devices report only when a value changes. This reduces network traffic, but it creates a specific hazard: silence can mean “nothing changed” or “the device stopped talking.” The OPC UA specification deals with this directly. It describes a server receiving values from an exception-based device and explains that, in the absence of errors, not receiving a value means the value has not changed. It also specifies that when a value cannot be read because of an error, the source timestamp is set to null, and when the status is bad, the value is to be ignored and set to null.¹¹

The lesson for GMP systems is to make the difference between “steady” and “silent” visible. That requires a heartbeat or communication-status check for each device, a quality flag stored with each value, and reports that show bad or uncertain periods distinctly. A monitoring point that shows a perfectly flat 5.0 °C for six hours might be a well-controlled cold room. It might also be a probe that failed with its last value frozen on screen. The review found that constant-value and stuck readings are recognized fault types in the research literature,¹⁵ and they are exactly the faults a person scanning a dashboard is least likely to catch.

A Gap Handling Procedure That Holds Up

A defensible procedure for data gaps usually covers five steps:

1. Detect. The system raises a communication or data-loss alarm after a defined period without valid data, set based on how quickly the monitored condition could change.
2. Classify. Was the gap recovered from a buffer, covered by a redundant probe or a backup logger, or not recovered at all?
3. Assess impact. What product or process was exposed during the gap? Are there other data sources (adjacent sensors, door logs, HVAC status) that bound the risk?
4. Document. Record the gap, its cause, the assessment, and the outcome in the quality system, linked to the affected records. Do not edit the monitoring record to fill it.
5. Trend. Review gap frequency by device, location, and cause. Recurring gaps at one location point to a coverage or hardware problem that needs a fix, not repeated assessments.

Alarms That Lead to Action

An alarm is where a sensor feed turns into a human decision. It is also where regulators look closely, because alarm settings and responses are the point at which a monitoring program can be tuned, deliberately or by neglect, to produce fewer uncomfortable events.

What the Guidance Asks For

FDA’s guidance on aseptic processing recommends that pressure differentials between cleanrooms be monitored continuously throughout each shift and frequently recorded, and says that all alarms should be documented and deviations from established limits investigated.¹⁶ It describes a suitable facility monitoring system as one that will rapidly detect atypical changes that can compromise the facility environment, allowing conditions to be restored before action levels are reached.¹⁶

EU GMP Annex 1 goes further on alarm governance. Critical air pressure differences should be continuously monitored and recorded, with a warning system that instantly alerts operators to a failure. The warning signal should not be overridden without assessment, and where alarm delays are set, they should be assessed and justified within the contamination control strategy (CCS).⁶ For equipment, Annex 1 says monitoring requirements should be defined in the user requirements specification and confirmed during qualification, that process and equipment alarm events should be acknowledged and evaluated for trends, and that the frequency of alarm review should depend on criticality, with critical alarms reviewed immediately.⁶ For Grade A, it requires continuous particle monitoring with alarms triggered when alert levels are exceeded, and procedures defining the response.⁶

The draft revision of Annex 11 adds a full section on alarms. It proposes that alarm limits, delays, and early warnings be justified and set within validated specifications; that setting, changing, or deactivating alarms be limited to users with appropriate privileges under an approved procedure; that critical alarms be acknowledged only by authorized users with a comment explaining the acknowledgment; that all alarms and acknowledgments be logged automatically with date, time, user, and role, in a log that GMP users cannot deactivate or edit; and that alarm logs be reviewed periodically for timeliness, appropriate action, and trends.¹⁴ Again, this is a consultation draft, but it gives a clear picture of where inspection expectations are heading.

Where Alarm Programs Go Wrong

Three patterns come up repeatedly.

Delays and durations that swallow real events. A short delay before an alarm fires is reasonable when a door opening briefly disturbs pressure. The risk is a delay or duration rule long enough to hide a real excursion. In a 2020 warning letter, FDA found that a manufacturer’s non-viable particle action level had been exceeded in seven batches with no investigation of the high particle levels. Under the firm’s procedure, an investigation was not required unless an excursion lasted longer than a set duration; FDA redacted that duration in the published letter.¹⁷ The same letter described manual recording of differential pressures, excursions that included pressure reversals, and the lack of an integrated system for recording pressures and initiating deviations.¹⁷ Every delay and duration rule should be written down, justified with data, and tested.

Alarms that fire so often that people stop reading them. WHO’s guidance on storage monitoring addresses this plainly: monitors should not be placed where transient events such as door openings generate an abnormally high number of alarms, and if frequent out-of-range alarms from transient events cannot be resolved technically or operationally, those areas should not be used to store temperature-sensitive products.⁹ This is a useful principle beyond cold storage. If a monitoring point alarms constantly, the answer is to fix the process or the location, not to widen the limit until the alarms stop.

Alarm settings that anyone can change. The 2023 warning letter describing adjustable gauge limits is an extreme case,¹ but the same risk exists in software when alarm configuration is open to a broad user group. WHO states that alarm limits should be set only by authorized users.⁹ Changes to limits, delays, and routing should go through change control and appear in the audit trail.

Pre-Alarms and Event Alarms

Two features of modern monitoring systems deserve more use than they get. WHO describes low and high alarm thresholds triggered before the temperature goes out of range, in addition to those triggered after, and event alarms for conditions such as mains power failure or a door left open.⁹ Pre-alarms give people time to act before product is affected. Event alarms, including communication loss and low battery, protect the feed itself. Both should be part of the requirements, not optional extras switched on after go-live.

Three Feed Types, Three Risk Profiles

Environmental monitoring, equipment sensors, and cold chain loggers share the chain described above, but the risks and the evidence regulators look for differ. A single validation template applied to all three tends to overtest some links and undertest others.

Environmental Monitoring

Continuous environmental monitoring in sterile manufacturing is where regulatory expectations are most specific. Annex 1 requires that Grade A be monitored continuously for particles of 0.5 µm and 5 µm and larger, with a sample flow rate of at least 28 liters (one cubic foot) per minute, so that all interventions, transient events, and any system deterioration are captured.⁶ It adds that the size of monitoring samples taken by automated systems will usually depend on the system’s sampling rate and need not match the volumes used for formal cleanroom classification, but that monitoring sample volumes should be justified.⁶ Those justifications belong in the validation package.

FDA’s aseptic guidance is careful to note, in its discussion of environmental monitoring results, that averaging of results can mask unacceptable localized conditions, and that each individual result should be evaluated against alert and action levels.¹⁶ The same principle applies to continuous feeds. A report that shows only hourly averages for a Grade A counter is not a faithful record of what the counter measured.

New sensing technologies raise their own validation questions. An ISPE white paper on bio-fluorescent particle counters (BFPCs), which count viable particles in real time, notes that these instruments report in auto-fluorescence units rather than colony-forming units and that the two are not equivalent. It says the main validation elements should rely on data and documentation from the vendor, in line with USP <1223> and Ph. Eur. 5.1.6, and describes a user performance qualification that includes an alarm handling concept and a parallel phase with traditional air sampling during implementation. It also says suppliers should provide data on common interferences that can trigger false positives, such as 70 percent isopropyl alcohol.¹⁸ The broader point applies to any new sensor type: understand what the device measures, what it confuses for a signal, and how its results relate to the method it replaces before relying on it for GMP decisions.

Equipment and Process Sensors

Equipment sensors often feed a data historian and, through it, electronic batch records or process trends used for continued process verification. The risk shifts from the alarm layer to the storage and reporting layers. Which value goes into the batch record when a parameter is sampled every second: the minimum, the maximum, the average over a step, or the value at a specific time? Each choice can be right, but it must be defined, justified, and verified during qualification. The 211.68 requirement that input and output be checked for accuracy applies here directly:³ a qualification test should compare values in the batch record against the raw source data for a sample of parameters and steps.

Compression settings deserve particular attention. Historians commonly store a new value only when it changes by more than a configured deadband, or when a maximum time has passed. A deadband set for storage efficiency can be wide enough to hide a short excursion that matters to product quality. Treat compression and deadband parameters for GMP-relevant tags as validated configuration under change control.

Cold Chain and Storage

For storage areas, WHO sets out a clear set of expectations for monitoring systems: audit trails, secured databases, standard operating procedures covering installation, use, backup, and decommissioning, qualification through IQ, OQ, and PQ, and defined user levels with clear access privileges.⁹ Monitoring points should be placed where mapping studies have found hot and cold spots.⁹

In transit, the data logger is the whole chain in one small box: sensor, clock, memory, and battery. WHO’s supplement on transport monitoring notes that monitoring devices can be used to decide whether to accept or reject a consignment, and to analyze weaknesses in the transport system after the fact. It says that downloaded time and temperature data should, in most instances, be kept for at least three years in a non-volatile format that allows retrieval.¹⁰ That retention point is easy to miss when single-use loggers are discarded at the receiving dock. The receipt procedure should confirm that the data have been downloaded, reviewed, and stored before the device is thrown away.

Logger configuration errors are among the most common cold chain data problems: a logger started after the product was loaded, a clock set to the wrong zone, a recording interval too long to catch a brief excursion, or a device whose calibration certificate does not cover the temperature range of the lane. Each can be prevented by a configuration checklist at dispatch and a matching check at receipt.

A Validation Approach Built Around Failure Modes

Traditional qualification of monitoring systems tends to prove that the system works when everything is working: the sensor reads, the value appears on screen, the alarm fires when the limit is crossed. That is necessary evidence. The more valuable evidence shows what happens when things go wrong, because that is when the record matters most. We recommend building the operational qualification around the failure modes of each link in the chain.

Scope the Chain Before You Write Test Scripts

Start by drawing the actual measurement chain for each feed type: the device models, firmware versions, gateways, protocols, servers, historians, and reporting tools, along with who owns each one. Identify which readings are GMP-critical and what decisions they support. This is also where a risk-based approach, consistent with GAMP and FDA’s computer software assurance thinking, is most useful: a humidity point in a general warehouse and a Grade A particle counter do not need the same depth of testing. Draft Annex 11 frames alarm expectations around cases where a regulated user relies on the system to notify them of an event requiring action to protect product quality, patient safety, or data integrity.¹⁴ That reliance test is a good way to decide which points get the most rigorous treatment.

Test Each Link Where It Breaks

Interfaces Deserve Their Own Evidence

Sensor feeds rarely stay in one system. EMS data flows into a quality management system for deviation handling, historian data flows into MES or a data platform, and logger files are uploaded into a warehouse system. Annex 11 already expects built-in checks for data exchanged between systems.⁵ The draft revision proposes that routine transfer of critical data between systems be based, where possible, on validated interfaces rather than manual transcription.¹⁴ In practice, interface testing should confirm that values, units, timestamps, and quality flags survive the transfer unchanged, and that a failed or partial transfer is detected rather than lost without notice. Pay particular attention to quality flags: an interface that carries the value but not its status turns a known bad reading into an apparently good one downstream.

Keep It Validated After Go-Live

Sensor networks change constantly. Devices are added, replaced, and moved; firmware is updated; gateways are swapped; networks are reconfigured. Each change can affect a link in the chain. A sustainable program includes:

• Configuration baselines for devices, gateways, and historian tags, with firmware versions under change control.
• Periodic clock offset checks across all tiers, with results recorded.
• Periodic alarm review covering counts, response times, repeat alarms, and changes to limits, as Annex 1 and the Annex 11 draft both describe.⁶¹⁴
• Gap and fault trending by device and location, to catch failing hardware and coverage problems early.
• Periodic review of the chain diagram, confirming that what is installed still matches what was validated.

For organizations bringing large numbers of new wireless or IoT devices into a GMP area, it helps to qualify device types and firmware versions once, as a platform, and then qualify each installation against that baseline. This keeps the effort proportionate while preserving the evidence that each installed device behaves as the qualified type does.

Conclusion

Sensor and IoT feeds have made GMP monitoring far more complete than any paper log could be. They have also made it easier to trust a record without checking it. The requirements that apply are familiar: calibrate and check automated equipment, monitor environmental conditions, keep accurate and complete records, and investigate what goes wrong. What is new is how many links there are between the physical condition and the record, and how many of those links belong to teams that do not think of themselves as part of the quality system. Validating a sensor feed well means validating that whole chain, with particular attention to how it behaves when a probe drifts, a clock slips, a network drops, or an alarm is tuned to stay quiet.

Sakara Digital works with pharma and biotech organizations that are expanding continuous monitoring, connecting shop floor data to quality systems, and preparing those feeds for inspection. If you are planning a new monitoring system, reviewing an existing one after a finding, or trying to decide how much validation a growing sensor network needs, we are happy to have that conversation and offer an independent view on where to start.

For Further Reading