At 4:40 on a Friday afternoon, a seasoning supplier phones the QA manager at a snack manufacturer. One lot of its blend tested positive for Salmonella. The manager knows the seasoning went into seven products over the past six days. The questions arrive immediately. Which finished lots contain it? How much sits in the warehouse? Which customers already received it?

The answers exist, but they live in three places: a paper batch sheet, an ERP system, and a shipping spreadsheet. By Sunday night, the team has a list it cannot fully trust. By Monday, a retailer is asking for lot codes, and the quality manager is still reconciling quantities.

This scenario is illustrative, but the pattern is familiar across food and beverage manufacturing. Plants invest heavily in preventing contamination, and they should. Yet the speed and accuracy of the response when prevention fails often decides how large a recall becomes. Recall readiness is a measurable capability, and most plants never measure it until a real event does.

This article explains how HACCP, ISO 22000, and FSMA fit together, then focuses on the three capabilities that determine recall performance: traceability, supplier verification, and mock recalls. It closes with measures that show whether the system works and lessons that carry over to other regulated industries.

The Three Layers: HACCP, ISO 22000, and FSMA

Food safety programs stack three layers, and confusing them causes real gaps. HACCP supplies the technical method. ISO 22000 supplies the management system around it. FSMA supplies the legal obligations in the United States.

HACCP: The Technical Method

The Codex Alimentarius General Principles of Food Hygiene define seven HACCP principles: conduct a hazard analysis, determine critical control points, establish critical limits, establish monitoring, establish corrective actions, establish verification, and keep documentation and records. The method rests on prerequisite programs such as sanitation, pest control, and allergen management, which control the general hygiene conditions around the process.

ISO 22000: The Management System

ISO 22000:2018 wraps HACCP in a management system built on the high-level structure shared with ISO 9001. It runs two plan-do-check-act cycles, one for the system as a whole and one inside operational planning and control. It also separates two kinds of control. Critical control points have critical limits, while operational prerequisite programs have action criteria. Plants that blur the distinction tend to over-classify, which dilutes attention, or under-classify, which leaves real hazards underdefended.

Many customers require certification to a scheme benchmarked by the Global Food Safety Initiative. FSSC 22000, for example, builds on ISO 22000 and adds sector-specific prerequisite program requirements, while SQF and BRCGS offer their own recognized frameworks.

FSMA: The Legal Layer

The Food Safety Modernization Act became law in January 2011 and shifted the FDA’s emphasis from responding to contamination toward preventing it. Its Preventive Controls for Human Food rule, 21 CFR Part 117, requires a written food safety plan that includes a hazard analysis, preventive controls, a supply-chain program, and a recall plan. It also requires monitoring, corrective actions, and verification, all overseen by a preventive controls qualified individual. Facilities must retain records for at least two years.

The stakes justify the effort. The CDC estimates that roughly 48 million Americans get sick from foodborne illness each year, with about 128,000 hospitalizations and 3,000 deaths.

Verification: Proving the Controls Work

Monitoring shows that a control ran. Verification shows that the control works. FSMA’s verification requirements include calibration of monitoring and verification instruments, product testing and environmental monitoring where appropriate, and review of monitoring and corrective action records, generally within seven working days. Environmental monitoring matters most for ready-to-eat foods exposed to the environment before packaging, where a pathogen in the plant can reach the product.

ISO 22000:2018 reaches the same point through its verification clause and its internal audit requirement in clause 9.2. A strong internal audit samples critical control point records and then walks to the line to confirm the record matches the work. A binder that is complete and a line that disagrees with it is the most common audit finding in food safety, and also the most expensive to discover after an outbreak.

Traceability: The Capability That Sets Recall Speed

Traceability links what went into a product to where the product went. ISO 22000:2018 clause 8.3 requires a system that identifies incoming material from immediate suppliers and the initial distribution route of finished product, with records retained for a defined period. It also expects the organization to verify and test the system’s effectiveness.

U.S. law adds its own layers. Since the Bioterrorism Act of 2002, FDA’s recordkeeping rule has required most food businesses to keep records of the immediate previous source and the immediate subsequent recipient of their food. That is the familiar one-step-back, one-step-forward standard.

FSMA Section 204 goes further for foods on the FDA’s Food Traceability List. The Food Traceability Rule, issued in November 2022, requires traceability lot codes and key data elements recorded at critical tracking events, such as shipping, receiving, and transformation. It also requires the company to provide records to FDA within 24 hours of a request, in an electronic sortable format. FDA has moved the compliance date to July 20, 2028, and the requirements themselves remain unchanged.

Where Traceability Breaks

Paper records rarely fail in obvious ways. They fail at the joints between systems and steps. Watch for these weak points:

• Rework. Product reintroduced into a later batch carries the original lot into a new one, and records often skip the link.
• Bulk and shared containers. Silos, tanks, and hoppers blend multiple lots, so a single ingredient lot can reach many finished lots.
• Partial lots. An ingredient container used across shifts or days splits one lot across several batches without a clear record.
• Manual lot entry. Handwritten or retyped lot codes introduce transcription errors that surface only during a recall.
• Shipping records. Finished lots may map to customer orders only through pallets or cases, not through lot codes.

Design for the Trace

A practical traceability design connects four record sets: receiving records by ingredient lot, production records by batch, finished lot records, and shipping records by customer. Each link needs a unique identifier that carries across systems. Scan barcodes wherever possible instead of typing codes. Reconcile quantities at each step, so the system can show how many units of an ingredient entered, how many went into batches, and how much remains in stock. That reconciliation, often called mass balance, tells you whether your trace is complete or merely plausible.

What a Good Trace Looks Like

Run the trace in both directions. A forward trace starts with a suspect ingredient lot and ends with every finished lot and customer that received it. A backward trace starts with a complaint about a finished lot and ends with every ingredient lot, supplier, and production line involved. A mature system answers both from the same linked records. The query should return ingredient lot, batch number, finished lot, quantity produced, quantity shipped, customer, and quantity on hand, with each figure reconciling to the one before it. If the team must open three files to get that answer, the system depends on people to bridge the gaps, and under pressure people make mistakes.

Supplier Verification: Controlling Hazards You Do Not Operate

Ingredients carry hazards from upstream, and the best plant controls cannot fix a contaminated lot at receiving unless the plant tests for the right hazard. ISO 22000:2018 clause 7.1.6 requires control of externally provided processes, products, and services, with criteria for evaluation, selection, monitoring, and re-evaluation.

FSMA makes the expectation specific. When the facility’s hazard analysis identifies a hazard that a supplier controls, the supply-chain program must approve the supplier and verify its controls. Verification activities may include onsite audits, sampling and testing, and review of the supplier’s food safety records. When the hazard could cause serious adverse health consequences or death, and the supplier controls it, the rule generally calls for an onsite audit at least annually unless the facility documents an appropriate alternative. Importers face parallel duties under the Foreign Supplier Verification Programs rule.

Build a Risk-Tiered Program

Treat suppliers by risk, not by habit. Four factors help:

• Ingredient hazard. Raw agricultural inputs, spices, and allergens carry different exposure than packaging or inert materials.
• Control location. Decide whether the supplier or your own process controls the hazard, since that determines who verifies what.
• Supplier history. Rejected lots, audit findings, and complaint trends move a supplier up or down a tier.
• Certification status. A current GFSI-recognized certificate helps, but it does not replace your own verification of the specific hazard.

A certificate of analysis states what the supplier tested. Incoming sampling, periodic independent testing, and records review show whether those statements hold up. Document each supplier’s approval status, verification schedule, and test results in one place, and define what triggers a reassessment, such as a recall, a positive result, or a change in source. Write a duty to notify you of changes in source, process, or facility into each quality agreement, because a silent change at the supplier can invalidate the hazard analysis you built on the original source. Tie incoming results back to the supplier record so a pattern across lots is visible before it becomes an event.

Recall Plans and Mock Recalls

What the Rules Require

FSMA requires a written recall plan for any food with a hazard that needs a preventive control. The plan describes how to notify direct consignees, notify the public when appropriate, conduct effectiveness checks, and dispose of recalled food. ISO 22000:2018 clause 8.9.5 asks for personnel with authority to start a withdrawal or recall, documented notification to authorities, customers, and consumers, and secure handling of affected stock. It also asks organizations to verify recall effectiveness through techniques such as mock recalls, and to report the cause, extent, and outcome of actual recalls to top management.

Other rules shape the timeline. The Reportable Food Registry requires responsible parties to report within 24 hours when food presents a reasonable probability of serious adverse health consequences or death. The FDA also holds mandatory recall authority under FSMA when a company fails to recall voluntarily. FDA classifies the most serious recalls as Class I, meaning a reasonable probability that use or exposure will cause serious adverse health consequences or death.

Run Mock Recalls That Mean Something

Many plants run mock recalls that prove only that someone can prepare. A useful exercise tests the system under realistic conditions:

• Pick the scenario late. Choose the ingredient or finished lot without advance notice, and vary the starting point between an upstream ingredient issue and a downstream customer complaint.
• Start the clock at the trigger. Measure time from notification to a complete list of affected lots, quantities, locations, and customers.
• Reconcile quantities. Account for every unit produced, shipped, held, and consumed. A trace that accounts for 100 percent is a result, while 85 percent is a finding.
• Test off-hours. Run at least one exercise when the usual staff are unavailable, since real events rarely respect the schedule.
• Check communication. Confirm that contact lists for customers, regulators, and the recall team are current and that each person can act.
• Set criteria first. Write acceptance targets for time and accuracy before the exercise, and treat misses as corrective actions.

GFSI-recognized schemes such as SQF and BRCGS expect periodic mock recalls or traceability tests, and auditors tend to scrutinize both the results and the follow-up. Treat the exercise as a diagnostic, not a compliance chore.

Communicate Under Pressure

A trace tells the team what to say, but someone still has to say it. Assign roles in advance: a recall coordinator, a regulatory contact, a customer communications lead, and a decision-maker with authority to stop shipments. Keep templates for customer notices, regulator notifications, and holding statements ready to edit. During the mock recall, send a test notice and measure how long confirmation takes. A plant that traces product in two hours but needs two days to reach customers has solved only half the problem.

Where Food Safety Systems Break Down

Food safety systems that fail an audit or an outbreak investigation usually share a few weaknesses:

• The hazard analysis never gets reanalyzed. New ingredients, equipment, or suppliers enter production while the written plan stays frozen.
• Monitoring records get filled in after the fact. Operators sign critical control point logs in batches at the end of a shift, and the record no longer reflects the process.
• CCPs and OPRPs blur together. Teams apply critical limits where action criteria belong, or the reverse, so corrective action triggers become unclear.
• Certificates substitute for verification. The plant files the supplier’s certificate of analysis without ever testing against it.
• Environmental monitoring positives lack follow-up. A positive swab triggers a re-clean but no root cause, trend review, or corrective action.
• Allergen changeovers rely on memory. Changeover verification lacks documented checks, and label controls depend on one person’s attention.
• Training records trail the work. The person who signs monitoring records cannot show current training for that task.
• Recall contacts go stale. The contact list lists people who left the company or changed roles.

Every item on the list reflects a control that exists on paper but not in practice. Testing each one under pressure, through audits and mock recalls, exposes the difference.

Lessons for Other Regulated Industries

Recall readiness is not unique to food. Any manufacturer that ships lot-controlled product needs to find, notify, and retrieve quickly.

Medical device manufacturers meet the same logic in ISO 13485 clause 7.5.9, which requires traceability, and in clause 8.3.3, which covers actions on nonconforming product found after delivery, including advisory notices. In the United States, 21 CFR Part 806 governs reports of corrections and removals. Pharmaceutical manufacturers work under FDA’s recall regulations in 21 CFR Part 7 and the product tracing requirements of the Drug Supply Chain Security Act. Aerospace and automotive suppliers rely on forward tracing to identify every assembly that contains a suspect lot.

The shared lesson holds across all of them. A recall plan that no one has tested is a hypothesis, and a mass balance that closes is evidence.

Connecting Food Safety Data in One System

The weak points described above share a cause: records that live apart from one another. A HACCP plan in a binder, supplier files in email, training records in a separate platform, and lot data in an ERP system cannot support a two-hour trace.

The eLeaP food safety QMS page notes that FDA inspections under FSMA and third-party scheme audits routinely review training records, food safety plan currency, corrective action documentation, and the traceability between quality events and corrective actions. It describes specification deviations that link directly to HACCP and CAPA workflows, and training that supports PCQI qualification. The eLeaP piece on HACCP and ISO 22000 examines why a control that exists only on paper, never tested under pressure, gives the appearance of food safety without the substance.

For the broader software picture, the eLeaP quality system software guide covers one-up, one-back traceability and mock recall support for food manufacturers. It also reports a case example in which mock recall completion time fell from six hours to 45 minutes. The eLeaP overview of eQMS software explains how FSMA’s documentation duties under 21 CFR Parts 117 and 507 map to an electronic system.

Software cannot decide which hazards are real or set a defensible critical limit. It can connect the records, enforce workflows, and show an auditor or investigator the full chain in minutes.

Measuring Recall Readiness

Bring a short set of measures to management review:

• Mock recall time to complete trace. How long does the full list of lots, quantities, and customers take, and is that time falling?
• Mass balance accuracy. What percentage of product do you account for at each step?
• Notification time. How long until every affected customer receives notice?
• Supplier verification completion. What share of planned audits, tests, and records reviews finished on schedule?
• Corrective action closure. How many CCP deviations and environmental positives closed with a documented root cause?
• Training currency. Do monitors, auditors, and PCQIs hold current qualification for the tasks they perform?
• Hazard analysis currency. Has the food safety plan been reanalyzed after each relevant change and within the required cycle?

Review mock recall results next to actual complaint and deviation data. If the two tell different stories, trust the one that cost you something.

The Underlying Test

Every control in this article answers one question: if something goes wrong today, how fast and how accurately can the organization respond? The underlying test is practical. Pick a finished lot shipped last month. Within two hours, produce every ingredient lot that went into it, every other batch those ingredient lots touched, and every customer that received any of them. Then show that the quantities reconcile.

If the team can do that without heroics, the system works. If it cannot, the gap shows exactly where a real recall would slow down. Build the program so the trace holds at every step, and prevention and response become two sides of the same quality system.