Documents are fast. Records with dates on them aren't.

Most gap-closure plans treat Edition 10 as a documentation project. Read the code, list what's missing, write it, train on it, done. That works for every clause that asks you to have a program. It doesn't work for the clauses that ask you to show the program running.

An auditor reading your food safety culture plan is reading a document. An auditor asking whether your culture score moved is reading two measurements taken months apart. You can produce the first one in an afternoon. The second one you either started earlier or you didn't.

What actually needs a running start

Four areas need elapsed time, not effort. If you haven't started them, starting them is this month's work.

Food safety culture measurement

One survey is a data point. A trend needs a second survey months later, with real intervention in between. That interval is the part you can't compress: if you have one survey from last spring and nothing since, no amount of December effort produces the second measurement.

What auditors look for behind the number is its own subject, covered in what auditors want to see behind your food safety culture score and how to build a food safety culture plan that actually passes an audit. For planning purposes, only the interval matters.

Environmental monitoring trends

Your EM program probably already runs. The question is whether anyone reads it as a series. Trending means you can show your baseline, where you exceeded it, and what the data did after you responded. A stack of individual results isn't a trend.

If you have twelve months of results and no graphs, the trending itself is quick. If you have twelve months of gaps because sampling slipped during a busy quarter, that history is what the auditor sees, and you can't re-swab last March. The program-level expectations are in environmental monitoring under SQF Edition 10.

Internal audits and the corrective actions that came out of them

Corrective and preventive action (2.5.3) is a Core Clause in Edition 10, which changes the scoring math: a minor finding against it deducts two points instead of one, a major deducts seven instead of five. And a corrective action isn't finished when it's written. It's finished when it's verified.

That's a chain: audit, findings, actions, verification. An annual internal audit schedule gives you one cycle. If findings from February are still open in December, you walk in with an open loop and no history of closing them. The planning question is arithmetic: how many complete cycles will exist by your audit date.

Change management

Change management (2.3.5) is retrospective by nature. It asks what changed and what you did about it. You changed a supplier in March, a sanitizer concentration in May, a line speed in June. Each of those should have triggered a look at whether your hazard analysis still holds. If it did, there's a record. If it didn't, there's nothing honest to write in December.

Personnel changes count too, which trips people up. You can only start following the process now, which gets you six months of real records instead of twelve.

Work backward from your audit date

Start with your actual recertification date, not January 2. SQFI's rule: audits before January 2, 2027 run on Edition 9, and anything on or after runs on Edition 10. So the January date is when Edition 10 audits become possible, not when yours happens. Pull your certificate and find the real one. (SQFI has noted the date could still move with the GFSI benchmarking process. A date that moves later only ever helps you.)

Take a site recertifying in March 2027:

• Culture: two survey points six months apart means the first survey goes out by September 2026. That's weeks away.

• EM: twelve months of trended data means the series started in March 2026. Graph what you have and find the gaps.

• Internal audit: one full cycle means auditing by October 2026, closing the corrective actions by January, and documenting verification in February, before the auditor arrives.

• Change management: a log started this month shows seven months of records on audit day. Started in December, it shows three.

Now run the same subtraction with your date. Any start date already in the past is the real gap, and you close it by starting immediately, not by working harder in the fourth quarter. A short real series beats a long invented one, and an auditor can tell the difference.

The part that's genuinely fast

Most of the list is still ordinary writing. Procedures, policy updates, org charts, scope statements, training materials, updated forms: someone who knows the site can produce all of that in a concentrated few weeks. If your gap list is mostly documents, you're in better shape than you think.

The mistake is treating the whole list as that kind of work. Sort your gaps into two piles on day one: things you can write, and things that have to accumulate. Pile two sets your real deadline, and it's almost always smaller and more urgent than pile one. For the clause-by-clause view of what moved in this edition, I wrote SQF Edition 10: what changed and how to prepare when the code was released.

What to do this month

Three things, in order.

Find your real audit date, not the January one. Everything else keys off it.

Sort the gap list into write-it and accumulate-it. Anything with a trend, a cycle, a follow-up measurement, or a closed loop goes in the accumulate pile.

Start the accumulate pile this week. If the culture survey has never gone out, send it. If EM results have never been graphed, graph what you have. If audit findings sit open, close them and record the verification. If changes happen without a reassessment step, start logging them today. Rough is fine, as long as the dates are real.

This is also the practical argument for keeping culture measurements, EM results, audit findings, corrective actions, and change records in one system instead of five. Not because software creates history, but because on audit day the chain has to come out in minutes, and chains that span a shared drive, an email thread, and someone's laptop usually don't.

If you want to see how that looks in practice, book a call and I'll walk you through it. If you'd rather work through the transition with help, our SQF Edition 10 services cover the gap assessment itself. Either way, do the backward-count this week. It takes an hour and it changes what you do in September.

For years, the broker in the middle of your supply chain was a blind spot. You qualified the manufacturer. You qualified the grower. The trading company that connected you to them sat outside your audit scope, because there was nothing to audit. That changed on July 6.

What the SQF Agents & Brokers Code covers

The code certifies the controls a non-handling trade business runs in its systems and on paper. SQFI lists the requirement areas as supplier approval, traceability, complaints management, documentation controls, and risk-based decision-making.

None of that involves a production line, because these businesses don't have one. An agent or broker's product is the transaction: matching a buyer to a supplier, moving the paperwork, and standing behind the claim that the goods are what the documents say. The code audits whether that business can actually trace a lot back to its source, whether it approved the supplier it sold you, and whether it has a real process when a complaint or a recall lands.

Who needs it, and who doesn't

The code applies to agents, brokers, traders, merchants, importers, and exporters. Virtual operations are fully eligible, so a broker running the entire business from a laptop can certify. SQFI is explicit that physical footprint is not a barrier.

What it does not cover is anyone who touches the product. Receiving, storage, and physical handling fall under separate SQF codes. If a company warehouses your goods or repacks them, the Agents & Brokers Code is the wrong standard. The line is simple: if they hold inventory, they need a different code. If they only hold the deal, this is the one.

Why this matters for your supplier qualification

Here is the operator problem it solves. When you buy an ingredient through a broker, your supplier-approval program has a gap. You can qualify the producer if you can see them. But the broker who sourced the lot, consolidated it, or relabeled the documents has been effectively invisible, and in a trace-back, that middle link is where the chain breaks.

Retailers already know this. SQFI notes that major retailers including Aldi require their agents and brokers to hold recognized third-party certification. The demand is not new. The SQF certificate is just a new way to meet it.

So the move is straightforward. If a supplier in your program is a broker or trading company, you can now require the Agents & Brokers certificate as part of qualification, the same way you require an SQF or BRCGS certificate from a manufacturer.

One caution, because it is the difference between a real control and a checkbox. The certificate verifies the broker's own systems: their traceability, their supplier approval, their complaint handling. It does not certify the food itself, and it does not replace qualifying the actual producer. A broker with a clean certificate can still sell you a lot from a manufacturer you never approved. Use the certificate to close the middle-link gap, not to skip the producer.

The FSMA 204 angle

There is a regulatory reason this code arrived now. The FDA Food Traceability Rule (FSMA 204) requires every company in the supply chain for a listed food to capture and pass Key Data Elements at each Critical Tracking Event. Brokers, importers, and traders are a link in that chain, and they are frequently the link that cannot produce a clean record, because they never had a food safety system built to.

A certification that audits a broker's traceability is the trade layer catching up to the rule the rest of your suppliers already live under. If you handle a 204 food, the intermediary's traceability is not optional, and now there is a standard that tests it.

How the audit works

The audit is annual, announced, and short. SQFI sets a minimum of half a day, with the certification body deciding the final length based on the size and complexity of the business. Audits run 100 percent remotely, which is what keeps the cost down. There are no unannounced audits unless a company specifically requests one. Annual registration is $650.

Agents & Brokers Code vs the Food Safety Services Code

These are two different SQFI codes for two different kinds of non-manufacturer, and they are easy to confuse. We covered the Food Safety Services Code when it went to public comment. The Services Code targets the vendors who perform work at your site: sanitation crews, pest control, calibration, maintenance. The Agents & Brokers Code targets the companies that trade your product without ever being at your site or touching it.

Both exist for the same reason. The SQF system is extending certification to the businesses around a certified site that used to sit outside anyone's audit.

What to do this quarter

Pull your approved-supplier list and flag every entry that is a broker, trader, or importer rather than a manufacturer or grower. Those are the ones the certificate is built for.

Then add the Agents & Brokers certificate to your qualification requirements for that group, with a date. Ask each broker whether they plan to certify and when. Certification is new, so most will not have it yet, and that is fine. The point is to put the requirement in writing now, so the ones who never intend to certify surface before your next audit, not during a recall.

And keep the producer qualification separate. The broker certificate is a new control on the middle of the chain. It is not a shortcut around the two ends.

Frequently asked questions

What is the SQF Agents & Brokers Code?

It is an SQFI certification standard, Edition 9, published July 6, 2026, for businesses that buy, sell, or broker food and general merchandise without physically handling it. It certifies their supplier approval, traceability, complaints management, and documentation controls.

Who needs SQF Agents & Brokers certification?

Agents, brokers, traders, merchants, importers, and exporters, including fully virtual operations. Companies that receive, store, or physically handle product are excluded and fall under other SQF codes.

Is the SQF Agents & Brokers Code GFSI recognized?

Not yet. SQFI expects formal GFSI benchmarking in 2027. Until then it is a valid SQF certification, but not a GFSI-benchmarked one.

How much does SQF Agents & Brokers certification cost?

Annual registration is $650. The audit is announced, runs a minimum of half a day, and is conducted 100 percent remotely, so audit fees are lower than an onsite standard.

Does a broker's certificate replace qualifying the manufacturer?

No. It verifies the broker's own systems and traceability. You still have to qualify the actual producer of the ingredient. Use the certificate to close the intermediary gap, not to skip the source.

The bottom line

The businesses in the middle of your supply chain just became auditable. That is the whole story: a link that used to sit outside every audit now has a certificate you can require and check.

If you run supplier approval on spreadsheets, adding a new certificate requirement and tracking who holds it is the kind of thing that quietly falls apart between audits. Beacon keeps supplier qualification, certificate expiry, and traceability in one place. If your broker records live in an inbox, see how it works.

What actually happened

A cyclosporiasis outbreak sickened more than 1,600 people across five states, by laboratory-confirmed count, before anyone named a product. CDC and state health departments linked the illnesses through interviews. About 90 percent of the people they talked to had eaten iceberg lettuce at the same restaurant chain. FDA's traceback pointed to iceberg lettuce grown on a single farm in Mexico and supplied through Taylor Farms. FDA said the implicated farm represents less than one percent of the U.S. iceberg supply.

FDA then reported a positive cyclospora result on the lettuce itself. Taylor Farms recalled shredded iceberg and salad sold through Walmart and foodservice.

The next day, FDA pulled the result back. Its lab experts re-reviewed the sample and concluded the finding "does not represent true amplification" and should be treated as a false positive. Cyclospora is hard to detect, and the molecular test that flagged the sample could not be confirmed.

The recall did not get reversed. The outbreak investigation still pointed at the same lettuce, with more than 90 hospitalizations and thousands of additional suspected illnesses under review across dozens of states.

The test was never the case

The evidence that implicated the lettuce was the outbreak investigation, not the sample. Patient interviews and traceback did the work. The positive result arrived late and left early, and the conclusion didn't move when it disappeared.

This is the part operators get backwards. A single positive feels like proof, so a single negative feels like a clearance. Neither is true. A lot can test negative and still be the vehicle, because contamination is rarely uniform and a sample plan catches a fraction of a fraction. A lot can throw a positive that a second method can't confirm, the way this one did.

Your incoming COA works the same way. A negative result on a sampling plan you didn't design and can't see is not the same thing as a clean lot.

Where the 2 a.m. decision goes wrong

Most recall decisions get made under time pressure with incomplete data, and most facilities improvise them. Someone forwards a positive from a customer, a third-party lab, or a regulator, and the room argues about whether to pull product while the clock runs. That argument should have happened months earlier, on paper. We've written before about the first 24 hours after a supplier causes a recall, and the pattern is always the same: the facilities that move cleanly already decided how they'd move.

Write the decision rule before you need it. What triggers a hold. What triggers a market recall. What a single presumptive or molecular positive means versus a confirmed one. Who has the authority to pull the trigger at midnight without waiting for a callback. If those answers live in someone's head, they change every time the pressure changes.

Taylor Farms moved fast on a regulator's positive during an active outbreak. That was the right call, and the later retraction doesn't make it wrong. Fast was correct because the epidemiology already existed. The mistake would have been waiting for a confirmatory test that, as it turned out, would have pointed the wrong way.

What to check this week

Pull your recall plan and find the sentence that tells you what to do with a single unconfirmed positive. Most plans don't have it.

Then run this drill. A customer emails you a molecular positive on a lot you shipped three weeks ago. Their retest is pending. Walk it through. Do you notify? Do you hold your remaining inventory? Do you initiate a recall now or wait for confirmation? Who signs off? Time the decision. If it takes more than an hour, or the answer depends on who's in the room, your plan has a gap a real event will find.

Do the same for the inverse. A lot you were worried about comes back negative. Does that close the file, or do you still hold on the epidemiology? If negative auto-closes, you've built the same single-result trap in reverse.

A recall program isn't the plan document. It's whether the decision is already made when the positive lands. Beacon keeps the recall decision tree, the traceability records, and the hold authority in one place, so the call at midnight follows the rule you wrote at noon. If your recall plan still lives in a binder, see how it works.

What actually happened

Two premium organic formula brands, made by different companies, were linked to infant botulism within seven months of each other.

Nara Organics recalled all lots on June 13, 2026, after three infants in California, Pennsylvania, and Washington got sick, with onset in April and May. ByHeart recalled all its formula on November 11, 2025, in an outbreak that grew to 48 infants across 17 states.

The two brands share two upstream suppliers: Organic West Milk for the organic whole milk, and Dairy Farmers of America for the spray-dried powder. FDA has said plainly that it does not yet have enough evidence to call that shared milk the source. So I won't either. "Shared a supplier" is not "caused the outbreak," and the difference matters.

Here is the part that should stop you. During the ByHeart investigation, Organic West Milk gave FDA a customer list. That list did not show its milk reaching the makers of Nara Organics. FDA only learned about the connection during the current investigation, when the supplier said the earlier list had been incomplete.

The obvious diagnosis is the wrong one

The easy read is "foreign plant, bad inspection, infant formula problem, not mine." FDA did inspect two foreign manufacturing plants before the outbreak and found deficiencies. That part is real. But it isn't the operator lesson, because you don't run your supplier's inspections and you can't see them.

The lesson is the blind spot. A second brand using your exact upstream supplier had an outbreak. That is about the strongest early warning a supplier relationship can produce. And it never reached the other brand, because the only map of who buys from whom lived with the supplier, and that map was wrong.

Why one-up, one-down doesn't catch this

Traceability is built one up, one down. You record where a lot came from and where it went next. FSMA 204 sharpens that with lot codes and key data elements, but it doesn't change the shape. You see your direct supplier and your direct customer.

Shared-supplier risk lives two nodes away, sideways. The brand that buys the same milk powder you do is not your supplier and not your customer. It's a sibling you never see. One-up, one-down was built to trace a contaminated lot forward and backward through the chain after something goes wrong. It was not built to tell you that a company you've never heard of buys the same input you do and just recalled product over it.

So the signal exists. The path to deliver it to you does not. Unless you build one.

What to actually do

You can't fix a supplier's customer list. You can change what your own supplier program assumes.

1. Map your shared and single-source inputs. For every critical ingredient, ask who else buys from this supplier. You usually won't get a complete answer. Ask anyway, and write down what you learn. The exercise alone tells you where you are exposed.

2. Put a notification clause in the contract. Your supplier agreement should require the supplier to tell you, fast, about any recall, outbreak, illness, or regulatory action tied to a lot, line, or process that also feeds you. Make the clock a number. "Within 24 hours," not "promptly." When a supplier recall lands, the first 24 hours decide how bad it gets.

3. Pull public history into supplier approval. FDA publishes warning letters, import alerts, inspection classifications, and recall history. A COA tells you about one shipment. That record tells you about the supplier. Check it at approval and at every re-approval, not only after something breaks.

4. Watch your siblings. When a brand in your category recalls product, the first question is not "glad that wasn't us." It's "do we share any of their suppliers?" Answering it takes a current supplier list and five minutes. Most teams never ask.

5. Rehearse the pull. If a shared input gets named tomorrow, how fast can you list every finished lot that used it and reach every customer holding it? If the honest answer is "a few days," you have a recall problem stacked on top of a supplier problem.

The takeaway

You can't audit a supplier you don't know you share.

The contamination source in these two outbreaks may never get pinned down. The operator lesson doesn't depend on it. The warning that should have traveled from one brand to the other got stuck inside a supplier's incomplete customer list. The fix isn't another round of finished-product testing. It's a contract clause and a habit: know who shares your suppliers, and make those suppliers tell you the moment something moves.

This is the same gap that turns one bad lot into a supplier-of-supplier recall cascade. The contaminant changes. The blind spot doesn't.

Supplier records, COAs, and the enforcement history behind them belong in one place you can search the minute a sibling brand recalls, not scattered across an inbox and a binder. That's why supplier management and traceability live in the same system in Beacon.

If you want to see how that holds up against a real recall drill, book a demo.

Sources:

• Outbreak Investigation of Infant Botulism: Powdered Infant Formula (June 2026), FDA

• Nara Organics Recalls All Lots of Nara Infant Formula, FDA recall notice

• FDA knew of deficiencies at foreign plants that produced infant formula, Food Safety News

What actually happened

A shrimp-containing soup got packed into the minestrone cup. Minestrone is a vegetable soup. The product is sold as vegetarian, and the cup says so on the lid and the front.

The recall covered 4,496 units across 17 states and Washington, D.C., plus online orders through Whole Foods and Amazon. It's Class I because crustacean shellfish is one of the nine major allergens and a shrimp reaction can be life-threatening.

The part that should bother you: the mismatch turned up during an in-store inspection that found a single cup with the wrong product in it. Not at fill. Not at release. At the store.

This is a different failure than the label getting it wrong

Most undeclared-allergen recalls are label problems. The formula changed and the label didn't. The "Contains" statement missed an ingredient. The wrong label printed on the line. I've written about the label-to-product mismatch and the formulation change that outran the label before.

This one is the opposite. The label is right. It accurately describes a vegetarian minestrone. The contents are wrong. A whole different soup went into the package.

That's a product-identity failure. A line-clearance and changeover problem, not a labeling or cross-contact problem. Cross-contact is a trace amount from a shared surface. This was a full serving of the wrong soup. The fix lives on the production line, not in the label-approval workflow.

The Vegetarian claim is an allergen control, not marketing

A vegetarian or free-from claim is a control point. Treat it like one.

People with a shellfish allergy use that claim to screen. A shopper avoiding shrimp sees "Vegetarian Minestrone" and assumes no shellfish. That assumption is the whole reason a wrong-product mix-up became Class I instead of a quality complaint. The claim raised the stakes.

So the claim has to be backed by a controlled line, not just a correct recipe card. If you run an allergen-bearing SKU and a free-from SKU through the same filler, the claim is only as good as your changeover.

Where the control should have been

The question isn't how shrimp got into one company's soup. It's what stands between fill and ship in your plant.

Walk one changeover. Pick any allergen-bearing product that shares a line, a filler, or a packaging station with a free-from product. Then answer two questions.

What physically prevents product A from ending up in product B's labeled package? Documented, verified line clearance, or an operator who's supposed to remember.

What at the end would catch it if it happened anyway? A finished-goods check that the contents match the label, or just a check that the label printed correctly.

If your honest answer to the second one is "a customer would notice," your last line of defense is a store shelf. That's exactly what happened here.

The drill

Run a changeover audit on your highest-risk pair: the allergen-bearing SKU and the free-from SKU that sit closest together on the floor.

Document the line-clearance steps and make the verification a signature, not a habit. Add one finished-goods check that confirms the product in the package is the product on the label. By recipe, by appearance, by net weight, by whatever actually tells the two apart. Pull that sample at the start of every run after a changeover, not once a shift.

None of this is exotic. It's the difference between catching a wrong-product fill at your line and reading about it in a Class I recall notice.

Make the verification live on the line

This is the kind of control that's invisible on paper and obvious in software. The changeover record, the allergen matrix, and the label claim usually live in three different places, so nobody can see that a free-from cup just ran on a line that handled shellfish an hour earlier.

Beacon keeps them connected. The allergen rules and the changeover verification sit on the line, where the check has to happen, instead of waiting for a store inspection to find the one cup that's wrong.

If you want to see how that works, book a call.

What actually happened

Clover Hill Dairy of Mechanicsville, Maryland recalled all of its requeson after the FDA and CDC tied it to a Listeria outbreak. Nine people infected with the outbreak strain across Maryland, New York, and Virginia. Eight hospitalized. One death in Maryland. The state suspended Clover Hill's operating license.

Two details matter more than the headline. The sick people's samples were collected over a span running from March 6, 2023 to May 10, 2026, and CDC says the isolates are closely related genetically. And an unopened 18-pound tub of the requeson tested positive for the same strain. The cheese in the cooler matched the people in the hospital.

A second company, Nelson & Isa Lacteos in Bay Shore, New York, recalled requeson the same week. They didn't make it. They bought Clover Hill's 18-pound tubs and repacked the cheese into one-pound containers under their own name. Same product, second label, second recall. If you repack or private-label someone else's bulk, their contamination becomes your recall, and the lot identity has to survive the repack or you can't pull it cleanly.

The obvious read, and why it's wrong

The easy diagnosis: a small cheese maker had a contamination event, found it, recalled it, done. Clean up and move on.

The three-year span breaks that read. Transient contamination shows up as a cluster over weeks. A thread of genetically matched cases running from 2023 into 2026 is the signature of a strain that has been living somewhere in the process, not a one-time slip. The strain was circulating for years before anyone connected nine dots across three states.

A strain that persists like that survives routine cleaning. You don't catch it by cleaning harder. You catch it by proving it's the same strain showing up again, until you've cornered where it lives.

Resident or transient is a sequencing question

A positive tells you Listeria was on that surface the day you swabbed. It doesn't tell you whether it's the same Listeria you found last quarter. That distinction is the whole game, and most environmental monitoring programs never make it.

Here's the cycle that hides a resident strain. You get a positive in Zone 2. You clean. You re-swab. It comes back negative. You close the corrective action. Next quarter, another positive, same general area. You clean, re-swab, close it again. Every positive gets treated as a fresh event. The paperwork looks healthy: positives found, investigated, resolved.

Whole genome sequencing is what tells you those two positives are one organism. Match this month's isolate to last quarter's and you haven't found two transients. You've found a resident living in a floor drain, a hollow conveyor roller, a cracked weld, or a worn gasket, seeding your line on a schedule. The surface keeps coming back clean because you keep cleaning the surface. The source never moves.

None of this is specific to cheese. Any ready-to-eat operation with zones carries the same exposure: deli, bakery, prepared foods, smoked fish, dairy. The same post-lethality pattern hit an RTE pork outbreak earlier this year, where the cook step was fine and the contamination came from zone contact after the kill step.

The drill

Pull every environmental Listeria positive from the last eighteen months. For each one, you did one of two things: you sequenced it, or you cleared it and moved on. If it's all detect-and-clear, that's your gap. A presence/absence result can't separate a resident from a transient.

Three changes fix it.

Bank your isolates. When an environmental sample comes back positive, have the lab keep the isolate instead of just reporting the result. You can't sequence what you threw away.

Sequence on the second hit. When you get a second positive in the same area within a season, send both for WGS. If they match, stop treating it as a sanitation problem. A resident strain calls for teardown: dismantle the equipment, find the harborage, not another pass with the same chemical.

Trend the site, not the swab. A positive means more when you see it against that exact location's own history. Edition 10's environmental monitoring expectations are already pushing programs toward this kind of trend analysis. The facilities that find residents are the ones watching sites over time, not filing each swab on its own.

What it comes down to

The facilities that catch a resident strain aren't the ones that swab the most. They're the ones that ask whether this positive and that positive are the same strain. Most never ask. They swab, they clear, they close.

Go look at your last year of EM positives. If you cleared them one at a time, you don't actually know what's living in your plant. A strain matched across three years is what that looks like when it finally surfaces, and by then it's nine people and a suspended license.

Beacon logs environmental monitoring results as a trended series per site, so a positive shows up against its own history instead of as a one-off you close and forget. If you want to see how that works on your own program, book a demo.

What actually failed

The label never changed when the recipe did.

FSIS found the dumplings were formulated with peanut oil, with peanut nowhere on the finished label. The establishment determined that a formulation change led to the mislabeling. So the formula moved, the allergen profile moved with it, and the label stayed where it was. (FSIS recall notice.)

Here's the part worth sitting with. FSIS inspection personnel caught it during a routine allergen verification task. Not the company's own review. The check that should fire on any recipe change, a fresh look at allergens and the label, didn't fire inside the plant. It fired when a federal inspector checked the formula against the label.

This isn't the label-to-product mismatch from April's two-recall day, where the artwork was correct and the wrong product landed in the bag. Here the recipe changed and the artwork never did. Different failure, same place it shows up: the label.

The allergen re-check has no owner

In most plants, nobody owns the re-check, and that's the gap.

Someone changes an ingredient. A cost-driven oil swap, a new supplier, a reformulation to hit a texture. The change moves through R&D or procurement and into production. The label sits in a folder as artwork that already got approved once. The allergen assessment sits in a binder from the last audit. Nothing connects "the formula changed" to "re-run the allergen assessment, update the ingredient list, update the Contains statement."

When that connection depends on a person remembering, it breaks the first busy week. Allergen labeling is built on the Big 9, and peanut is one of the nine. A change that adds one of them is exactly the event your food safety plan is supposed to catch before product ships. FSIS makes the trigger explicit: you reassess the HACCP plan whenever a change could affect the hazard analysis, and the rule lists product formulation by name (9 CFR 417.4). FDA-regulated plants run the same logic under preventive-controls reanalysis (21 CFR 117.170). SQF says it again in change-management language. Every one of them assumes the re-check happens. None of them makes it happen.

"Exempt" peanut oil still has to be on the label

Highly refined peanut oil is exempt from the allergen declaration, not from the ingredient list.

This one trips up good operators. FALCPA leaves highly refined oils out of the major-allergen definition, so a fully refined peanut oil doesn't trigger a "Contains: Peanut" statement. People stop reading there and treat peanut oil as a free ingredient. It isn't. Even an exempt oil has to appear in the ingredient statement by its name. Leave "peanut oil" off the ingredients and you're misbranded no matter how refined it is. And if the oil isn't fully refined, you also owe the Contains statement.

Either way, adding peanut oil means changing the label. "We used the exempt kind" was never a defense for a label that never moved.

The drill

Pull your last ten formula changes and check whether each one triggered a documented allergen re-check.

Not the allergen matrix from your last audit. The last ten times someone changed an ingredient, a supplier, or a spec. For each one, find the record that says QA re-ran the allergen assessment and signed off on the label before product moved. If you can't produce it for even one change, you have the Synear gap, whether or not an inspector has found it yet.

The fix isn't more allergen training. People already know peanut is an allergen. The fix is a gate: no formula or supplier change closes until the allergen re-check and label review are done and recorded. The system refuses to advance without them, so the re-check stops being something a busy person has to remember.

That's what change management is for. In Beacon, a formulation or supplier change opens a change record that won't close until the allergen reassessment and the label review are attached. The software isn't the point. The point is that the most failure-prone step, remembering to look again, isn't left to memory.

FAQ

Does highly refined peanut oil have to be declared as an allergen?No. FALCPA excludes highly refined oils from the major-food-allergen definition, so refined peanut oil doesn't require a "Contains: Peanut" statement. It still has to appear in the ingredient list by name, so leaving it off the ingredient statement is misbranding even when the allergen declaration is exempt. If the oil isn't fully refined, the Contains statement is required too.

Why did FSIS handle a dumpling recall instead of FDA?The dumplings contain pork, which makes them a meat product under FSIS jurisdiction. FSIS enforces allergen labeling on meat and poultry and runs routine allergen verification tasks at the establishments it inspects. That verification task is how this recall started.

What changes should trigger an allergen reassessment?Any change that can move the allergen profile: a new ingredient, an ingredient or oil swap, a new supplier or a changed supplier spec, a reformulation, or a rework that brings another product's ingredients onto the line. FSIS HACCP reassessment (9 CFR 417.4) and FDA preventive-controls reanalysis both require you to look again when a change could affect the hazard analysis, and undeclared allergens are near the top of that list.

The allergens were never the problem

The peanut was real and the risk was real. But the failure sat upstream of the label. Someone changed the recipe and nothing in the plant made a person check the allergens again. That's a fixable gap, and it's a lot cheaper to fix before an inspector finds it than after a recall notice goes out with your name on it.

Pull your last ten changes this week. If you want to see how a change record forces the allergen re-check before anything ships, book a demo.

First Summit for me. Walked in fresh. The veterans of this conference may have stopped seeing the gap. I couldn't.

The AI workshop made the gap obvious

Cindy Jiang ran the opening AI workshop. It was the most informative session I sat in on all week.

The breakout discussion was more useful than the keynotes. The QA leads at my table were all using ChatGPT, Claude, or Gemini at work, with almost no prompting technique. A few had picked up the trick of having one model check another's output. Most hadn't. Citations, hallucinations, accuracy: every objection I heard is the same objection I heard from the same role two years ago.

Two things stuck.

Sean Leighton at Cargill said from the stage that the AI and software systems they're building have potentially prevented something like 42 food safety incidents. I don't know exactly how Cargill defines that and I doubt it's a public number. The directional point is right. AI applied against your own data finds things human review misses.

From a slide in the opening AI workshop. The case for AI run against real data at scale.

Lisa Shelley at NC State said the future is company-specific AI, not generic chatbots. I've been saying the same thing for two years. It's the entire reason I built Beacon the way I built it. Generic ChatGPT doesn't know your CCPs, your supplier list, your last three CAPA closures, or the equipment your second shift hates. A company-specific model that does is a different category of tool.

Another speaker in the AI workshop, same thesis. The company-specific AI argument came from more than just Shelley.

The gap: nobody in the room had a clean way to get there. The big companies were funding internal builds. Everybody else was prompting ChatGPT on a phone.

The harborage walk got uncomfortable fast

Sharon Birkett ran the pathogen-control workshop. The format was good: walk a notional plant, identify every spot a pathogen could hide, talk through mitigation.

I hadn't thought to look in half these places. Cable tray crevices. Drain housings. Gasket seams on equipment that hasn't been opened in five years. The underside of a conveyor support arm where condensation collects. Under every example was the same problem. A lot of harborage sites live on equipment that's older than the people running it.

That part didn't get answered.

Attendees raised the 20- to 30-year-old equipment problem. A speaker referenced an equipment-replacement budget. That works for the speaker's company. The 25-person family-owned operation in Michigan, Wisconsin, Iowa, or Texas can't run that play. If the slicer is running, the slicer stays. Nobody had an answer for the SMB version. Managing pathogen risk on equipment that predates your employment and has no service history.

This is a data problem before it's a capex problem. If you can't replace the equipment, you have to track every sanitation event against every harborage site you've identified. And you have to do it in a way the next QA Manager can pick up. Paper logs don't survive that. Spreadsheets don't survive an auditor asking "show me every clean of point 14 in the last 18 months" on the spot.

"Food safety economics" was a great session for big companies

The food safety economics workshop covered how to communicate cost-benefit of food safety to leadership. Good premise.

The math was solid. ROI calculators showing prevention of a recall saves seven or eight figures. Cost-of-prevention curves. Frameworks for justifying a sanitation overhaul to a CFO.

None of it fit a manufacturer doing $5M to $20M in revenue.

For a small operator, the financial math isn't "prevent a $10M recall." The financial math is "one bad event closes the business." There's no insurance product that makes a 30-person plant whole after a regulatory shutdown that lasts six months. The decision isn't an ROI calculator. The decision is whether you survive.

I'd like to see a session next year aimed at that math. What the prevention investment looks like when the alternative is bankruptcy. What a 1.5-person QA team buys with $50K. The rank-order of investments for a plant with no margin for error.

Nestlé's digital HACCP rollout was the cleanest case study of the week

David Clifford walked through Nestlé's global HACCP digitization. Pilot, lessons, global rollout, master data, training.

Clifford presenting Nestlé's modular digital HACCP approach.

Two things I took from it that apply at any scale.

One: clean, centralized master data is the prerequisite. If your equipment list, your CCP definitions, and your supplier records don't match across plants, digitizing your HACCP doesn't give you a global HACCP. It gives you a digital version of the chaos.

Two: digitization fails when you don't bring the floor along. The thread through every digital migration I've watched (and a few I've run) is the same. If the line lead doesn't trust the new system, they'll keep the paper backup, and you'll get exactly zero of the value you paid for.

One line from the talk stuck with me afterward.

Clifford mentioned, almost in passing, that two years into Nestlé's rollout with a large enterprise vendor, he still doesn't have role-based access permissions he can configure himself. He sounded frustrated. I would be too.

Read that twice. Nestlé. Two years. I'd guess millions in. Still no RBAC.

That's not a Nestlé problem. That's an enterprise food safety vendor problem. RBAC is week-one functionality. If you can't configure permissions yourself two years into a multi-million-dollar contract, the vendor's priorities are not yours.

The cost-center-to-value-creator session needed an SMB seat

A session on translating food safety into financial relevance for executives. Good content. Real point.

The implicit audience was the QA Director at a $500M company who reports to a VP of Operations and has to make a case to a CFO. The SMB version of this conversation is different. At a 30-person plant, the QA lead, the owner, and the CFO are usually three people who can be in the same room in five minutes. The silo to break isn't finance vs. quality. It's "QA is the person who writes the SOPs" vs. "QA is the person who tells me when a decision is going to cost us our customer."

The bridge the session described is real. The bridge for a small plant is shorter and louder.

The Town Hall heard the room

The 15th annual Town Hall sat senior regulators from AFDO, CDC, FDA, and USDA on one stage.

The audience pushed hard on one point. The regulatory agencies are too siloed and the system is too complicated to work through. A manufacturer in our space ends up dealing with FDA for one product line, USDA for another, state ag for another, and the rules read differently depending on which inspector walked in that morning. Several attendees floated the idea of a cross-agency team for food safety.

I don't know if a single agency is politically possible. I know the request from the room wasn't framed as an aspiration. It was framed as exhaustion. The people in the room run plants. They're spending real money translating between three regulators who don't coordinate. That's not a technology gap. It's the kind of problem a shared platform across agencies could absorb in a hurry. I doubt that gets built. I'd like to be wrong.

The Tech Tent talk that surprised me

Dr. Alex Athey at Zeroic presented ozone nanobubble technology. Eight years of validation, independent lab trials, plant trials on produce and proteins. The pitch is that ozone delivered via nanobubbles works as an antimicrobial without the chemical residue or the costs that killed previous ozone attempts.

I don't have the chemistry background to evaluate the science. The pitch and the data looked compelling. If you run a produce wash line, this is worth twenty minutes.

Food safety culture was the thread under every session

Every session ended back there. The AI panel did. The harborage walk did. The Town Hall did.

The version of food safety culture I heard on stage is the one I believe. It isn't a poster on a wall. It's the line operator on third shift who stops the line because something doesn't look right, and the owner who backs that decision the next morning. It's QA having authority that doesn't require a manager to sign off. It's leadership understanding what a CAPA actually costs to close, not just what it costs to open.

The SQF Edition 10 auditor interpretation came up several times. Auditors are walking the floor and asking line workers what they do and why. They aren't asking to see the checklist. They're asking the operator to explain the food safety reason behind the step they're doing. If the operator can't, the culture isn't real, no matter what the score is. We wrote more about what auditors actually look for behind a food safety culture score if that part of Edition 10 is on your list this year.

That's the right test. It's also the test paper-based and checklist-based compliance systems can't help you pass. You either build the culture or you don't.

What I took home

The summit was well-run. Good size, well-programmed, the right people in the rooms. I learned things I'll use.

What I kept noticing was who wasn't in the conversation. Every case study, every framework, every "here is how we built it" came from a company with the headcount and capex budget to build it. The small to mid-size manufacturer, which is most of the industry by plant count, was in the audience, not on the stage.

That gap is why I built Beacon. I needed a compliance platform that fit a small SQF-certified plant in Michigan, not a Cargill global rollout. Everything on the market either cost six figures and took six months to implement, or cost less and only did 80% of the job. I built the version for the scale this industry actually runs at.

If you run an SMB plant and want to talk through how Beacon could fit, book a call. Happy to walk you through it.

Three different mechanisms. Three different points on the line.

If you read this as a string of unrelated incidents, you go back to your daily work. If you read it as a prompt to audit your own physical-hazard control program, you find the gap before the recall traces back to you.

That distinction is the whole article.

Lactalis Canada: glass in creme brulee

Class II recall, initiated April 14, 2026.

The product: Specially SELECTED brand Vanilla Creme Brulee, 3.6 oz cups. Specially Selected is Aldi's US private-label premium line. Lactalis Canada is the firm of record on the recall.

Reason FDA published: "Product may contain foreign objects, specifically glass."

Distribution: NY, IN, FL, IL, VA, MD, and MI. Seven states.

What FDA did not publish: where the glass came from. That gap is important. Glass contamination in a chilled dessert plant typically comes from one of three sources. A cracked vessel during cream or sugar handling. A finished-glass container that fractured on the line. A maintenance work order that left glass debris in a zone the cleaning crew did not catch. Each of those root causes lives in a different SOP, so the corrective action is different.

If a plant cannot reconstruct which of the three it was within 24 hours, the recall scope expands because they cannot bracket the affected production cleanly.

For any plant running multiple private-label customers on shared equipment, the additional pressure is that every customer who shares that line is now asking the same question. The glass policy and the changeover protocol need to be documented in a way that holds up to seven different customer audits in the same week.

The Mochi Ice Cream Company: foreign object in frozen dessert

Class II recall, initiated April 20, 2026.

The product: My Mochi Strawberry flavored Non-Dairy Frozen Dessert, 7.5 oz containers, six pieces per package. UPC 0-70934-99645-8. Distributed to six retail consignees with locations nationwide.

Reason FDA published: "Foreign object found inside retail container."

That is the entire description. No identification of what the object was. No identification of where it entered the product.

When the regulatory record is that thin, two things are usually true. The operator did not characterize the contamination before initiating the recall, which means the corrective action is generic and the same gap stays open. And the contaminant was not caught by a routine on-line control, because a metal-detector hit or an X-ray reject produces a known reject record with an investigation tag, not a thin one-line entry. When the public record reads this way, detection was usually after the fact and often through a consumer complaint, not at the line.

The audit question for your own facility is straightforward. When your line generates a foreign-object reject, the rejection-disposition record should identify what the object was, where it likely entered the stream, and whether the upstream control needs adjustment. If the record just says "foreign object," the line is pushing units aside without capturing what would let you stop it from happening again.

Straus Family Creamery: metal in organic ice cream

Recall announced May 16, 2026. Distribution began May 4.

The product: Straus Family Creamery Organic Super Premium Ice Cream across five flavors and six SKUs. Vanilla Bean pint. Strawberry in pint and quart. Cookie Dough pint. Dutch Chocolate quart. Mint Chip pint. Best-by dates December 23 to 30, 2026.

Distribution: 17 states. Arizona, California, Colorado, Connecticut, Florida, Georgia, Iowa, Illinois, Indiana, Maryland, New Jersey, Oregon, Pennsylvania, South Carolina, Texas, Washington, Wisconsin.

Reason in the recall notice: metal pieces. Source not disclosed.

The product mix tells you something. Three of the recalled flavors run through downstream inclusion injection (Cookie Dough chunks, Mint Chip chocolate chips, Strawberry fruit pieces). Vanilla Bean carries particulates blended into the base mix, not injected downstream. Dutch Chocolate is a base ice cream with no particulates at all. Both of the no-inclusion-injection flavors are on the recall anyway, which means the metal entered the product before the inclusion stage. The source is upstream of the inclusion feeder. That points to the mix tank, the homogenizer, the pump train, or the scrape blades inside the continuous freezer barrel.

Six SKUs on the same recall also says the contamination was not a single spike. Whatever shed metal was shedding across the duration of a base-run cycle, long enough to land in multiple consecutive flavor productions.

Three different controls, not one

If you treat all three of these as "foreign-material problems," you go to the metal detector and the X-ray as your answer. That misses two of the three.

A metal detector does not catch glass. Glass control is a separate program. A glass-and-brittle-plastic register that lists every glass surface in the facility. A routine inspection log for each surface. A no-glass-above-the-line rule for exposed product zones. A maintenance-work-order procedure that requires a glass check before the line restarts.

A metal detector does not catch a foreign object that is not metal. Plastic, bone, wood, and stone pass through every metal detector regardless of sensitivity. The control there is upstream. A sieve, a filter, a magnet on a powder line, a sift screen on a dry-ingredient hopper, sized to the smallest contaminant you can reasonably expect to enter that stream.

A metal detector does catch metal, but only if the detector is positioned where the metal actually enters the product and only if the sensitivity is set to catch the size of fragment the most likely source produces. A detector at finished-pack catches large fragments. It does not reliably catch small shavings from a slowly worn scrape blade, because detector sensitivity is calibrated for the finished-pack profile and small particles can fall below the threshold. A blade can shed below-threshold fragments for the length of a base-run cycle before anyone notices.

For each physical-hazard class, the control sits at a different point on the line. The plants in these three recalls had metal detectors. Two of the three failures were not metal-detector misses.

The drill that finds your gaps

Pull your physical-hazard control program. For each hazard class (glass and brittle plastic, metal, wood, hard plastic, foreign matter from raw materials), answer the following.

1. Is there a written control specific to that hazard, not just a reference to the metal detector?

2. Is the control positioned at the point on the line where that hazard is most likely to enter?

3. Is the rejection-disposition record specific enough to identify what was rejected and why?

4. When a hazard is caught, does the investigation route to the upstream source, or does it stop at "reject and continue"?

5. For glass specifically, is there a current glass-and-brittle-plastic register, and was it inspected this month?

If you cannot answer yes for all five on any one hazard class, that is the gap.

Then run the audit on your last 90 days of rejection records. If every reject says "foreign object" with no further detail, your line is generating data the way the My Mochi recall record reads. That data does not support root-cause analysis when a recall does happen.

What we built into Beacon

When we built Beacon's HACCP module, we made physical hazards a first-class hazard category alongside biological and chemical, each tied to the process step where it can enter the product. Every physical hazard you identify gets a risk score, a CCP if you assign one, a critical limit, and a monitoring record format. When a monitoring record comes in outside the limit, the system auto-creates a deviation that routes through immediate action, evaluation, and CAPA linkage. You cannot close the deviation without filling out what happened.

That does not replace your glass-and-brittle-plastic register or your metal detector log. It does mean the records that live inside the HACCP plan stay connected to the rest of your food safety system instead of sitting in a separate binder. When the supplier recall 24-hour clock starts, the records pull from one place.

Book a call and I'll show you how the workflow runs.

Where the Listeria came in

A positive in an unopened cooked RTE narrows to one of three sources.

The cook step didn't reach validated lethality on that lot. Process deviation, instrumentation drift, or load-pattern variation in the kettle.

The cook step worked, but post-cook handling reintroduced Listeria before the package was sealed. Zone 1 contact with a contaminated slicer, conveyor, scoop, or hand.

The cook step worked and post-cook handling was clean for that lot. But environmental Listeria had established a harborage somewhere in the plant, and it transferred to product during the production window.

Mechanism 1 is usually the rarest for a plant with a validated thermal process and live deviation reporting. Mechanism 2 and Mechanism 3 produce the same outcome on different timelines, and they trigger different CAPAs. Both happen in what FSIS calls the post-lethality processing environment.

9 CFR 430.4 in one paragraph

FSIS requires every RTE meat operator with a post-lethality exposed product to elect one of three Alternatives, in writing, in the HACCP plan.

• Alternative 1. A post-lethality treatment (a second kill step on packaged product) plus an antimicrobial agent or process that suppresses growth. FSIS verification testing frequency is lowest because the operator runs two controls.

• Alternative 2. One of those two. Either a treatment or a growth inhibitor. Paired with a sanitation program meeting a specified environmental monitoring frequency.

• Alternative 3. Sanitation program only. FSIS verification testing frequency is highest here, because nothing in the product itself is doing the work after lethality.

The election commits you to a verification rhythm, a recordkeeping obligation, and a specific response posture when an environmental or product positive surfaces. Reading the Alternative is step one of the audit.

A finished-product positive is a CAPA on the election

The investigation here isn't a CAPA about one lot. It's a CAPA on the Alternative election itself.

Two questions have to get answered.

First, did the controls in the elected Alternative actually run as designed during the production window for January 20, 2026? Documented verification, EM zone results, sanitation records, deviations.

Second, is the elected Alternative still the right one for the line and product mix as the plant operates today?

The second question is the one most plants don't ask. Plants elect an Alternative on day one and run with it for years. The line changes. The product mix changes. The personnel change. The Alternative doesn't. A finished-product positive is the forcing function that re-opens that election.

What the next 30 days look like at a plant in this situation

FSIS will write a Noncompliance Record. If the underlying cause isn't controlled, that escalates to a Notice of Intended Enforcement. Environmental sampling expands. A HACCP reassessment becomes mandatory under 9 CFR 417.4. The investigation outcome lands in the FSIS quarterly Listeria sampling tables months from now, after the case closes.

For every other RTE operator, the consequence shows up later. SQF, BRCGS, and FSSC 22000 surveillance auditors are going to ask whether your written 430.4 Alternative election is still consistent with what your line actually does. They'll ask what your last 90 days of environmental monitoring looks like, zone by zone, line by line, week by week. That's the same question that just got expensive at Crawford.

If your EM data lives in a PDF, your sanitation records live in a binder, and your Alternative election sits in a HACCP document last touched three years ago, the answer to "are these still aligned" is a project, not a query.

What I'd be doing this week

I run an FDA-side facility, not an FSIS-regulated plant. The 9 CFR 430 framework isn't my daily reality. But the underlying logic carries. A finished-product positive in a validated cooked RTE narrows the failure to a small number of zones, regardless of which agency writes the rule.

If I ran an RTE plant under 9 CFR 430, three things would go on the Monday board.

1. Pull the written 430.4 Alternative election out of the HACCP plan. Read it cold.

2. Pull the last 90 days of environmental Listeria results, by zone and line. Compare the verification frequency to what the elected Alternative actually commits you to.

3. Identify one person on shift who can re-explain the Alternative election to a third-shift sanitation crew in plain language. If that person doesn't exist, that's the gap.

That's three hours of work. Three hours that get expensive if you wait.

The reason I built Beacon is that the data needed for this kind of reassessment shouldn't be a project. If your EM zones, sanitation events, operations records, and production lots are connected, pulling a 90-day zone view in the same screen as the 430.4 Alternative election is a query. If they aren't, it's archaeology.

Book a demo. I'll show you what it looks like to read your last 90 days of EM data against the regulation you committed to in your HACCP plan, side by side.

Source: FSIS Public Health Alert, May 9, 2026

What you actually get when you ask vendors for records

The four service categories each fail the records request in their own specific way. I've pulled records in all four at the facility I run. Here's what comes back.

Sanitation

Ask your contracted sanitation crew for last shift's verification records and you'll get a service log: the time they arrived, the lines they cleaned, the chemicals they used. That's a service log. It isn't verification.

What counts as verification: the ATP swab result that confirmed the surface met spec. The visual inspection sign-off. The allergen verification swab tied to the changeover. Half the time those records live in the vendor's app, the other half on a clipboard nobody scanned. To pass an SQF Edition 10 audit, that verification evidence has to live somewhere your site can produce on demand.

Pest control

Your pest vendor will hand you device logs. Ask for the trend analysis at your stated cadence and the conversation gets quiet. A list of devices serviced is not a trend analysis. The trend analysis is your responsibility under Edition 10, and the auditor wants to see that someone at your site read the vendor data, found patterns, and acted on them.

This is where contracted relationships fall down hardest. The contract sounds like the vendor handles everything. Then the auditor asks who reviewed last quarter's trends and signed off. That ownership is exactly what falls through.

Testing and calibration

Calibration labs almost always send a certificate. Most certificates are missing the things SQF actually wants: the reference standard, the measurement uncertainty, the as-found condition. Without those, the certificate doesn't demonstrate metrological traceability under SQF or under ISO/IEC 17025.

Testing labs are the same story. A micro result with no method reference, no limit of detection, no chain of custody isn't documented evidence for your finished product testing program. It's a number on letterhead.

Equipment maintenance

Maintenance is the category where the work order and the actual equipment don't match. The vendor writes up the PM. You sign the work order. The auditor walks the line and finds the procedure doesn't reflect the food contact surface in front of them.

Lubricant compliance is the one I catch most. Contracted technician shows up, uses lube from his own truck that isn't on the approved chemical list, doesn't write the brand on the work order. Now you have a non-conformance that crosses prerequisite programs and the sanitation program, because allergen and chemical control verification depends on knowing every substance that touched a food contact surface.

What to do at your facility this week

Three questions. Run them this week. They're the same questions an SQF auditor will run at your next stage two:

1. Can your site produce, within an hour, the post-clean verification records for last shift's sanitation tied to the master sanitation schedule? If those records only live in the vendor's system, that's your gap.

2. Can your site produce the most recent trend analysis from your pest control program at your stated cadence, signed by the responsible person at your site? If the only trend documents come from the vendor, that's your gap.

3. Do your calibration and testing certificates include the reference standard, the measurement uncertainty, and the as-found condition? If your answer is "the vendor sends a certificate," check it against ISO/IEC 17025. If those elements are missing, that's your gap.

Three answers tell you where your contracts are weakest under SQF Edition 10 today.

A note on the SQF Food Safety Services Code

While we're on this topic: SQFI has a separate code in public comment through May 15, 2026. The SQF Food Safety Services Code is a draft framework that gives service providers, sanitation crews, pest control companies, calibration labs, equipment maintenance vendors, a path to be evaluated against SQFI expectations.

Two things to know.

First, the Services Code is targeted at the providers, not at your manufacturing site. It does not change what SQF Edition 10 requires of you. The four gaps above are yours to fix under Edition 10 today, regardless of where the Services Code lands. Edition 10 already requires you to manage contracted services through contracts, hazard analysis, prerequisite-program compliance, and a register of providers. None of that changes.

Second, operators are welcome to comment. The vendors who eventually pursue Services Code certification will have to meet the standard SQFI publishes, and SQFI is asking what that standard should look like. If you have a specific view on what a service-vendor certification should require, the comment window is the moment to say so. It's adjacent to your audit, not central to it, but useful if you want certified vendors to be a meaningful filter when you're evaluating who to contract.

How to submit public comment before May 15

Four steps:

1. Create or log into an SQFI account at sqfi.com.

2. Open the public comments section under "Comply with the Code."

3. Submit comments tied to specific provisions of the Services Code draft.

4. Cite operational examples where you can.

If you actually contract these services, your comments carry weight that an industry trade group's comments don't. Operator specificity is what the framework needs.

Frequently asked questions

What is the SQF Food Safety Services Code?

The SQF Food Safety Services Code is a new framework SQFI is developing that sets risk-based expectations for service providers whose work directly affects food safety, including sanitation, pest control, testing, calibration, and equipment maintenance. It is in public comment through May 15, 2026. The Code targets service providers themselves, not certified manufacturing sites.

Does the SQF Food Safety Services Code change what manufacturing sites have to do?

No. The Services Code is targeted at service providers. SQF Edition 10 already requires certified manufacturing sites to manage contracted services through contracts, hazard analysis, prerequisite-program compliance, monitoring, and a register of providers. Those obligations are unchanged.

When does the SQF Food Safety Services Code take effect?

SQFI has not announced an implementation date as of May 2026. The current phase is public comment, which closes May 15, 2026.

How is the SQF Food Safety Services Code different from SQF Edition 10?

SQF Edition 10 is the current edition of the Food Safety Code for Food Manufacturing, published in March 2026. The Services Code is a separate framework targeting service providers rather than certified manufacturing sites. The two operate in parallel.

How do I submit a public comment on the SQF Food Safety Services Code?

The SQFI public comment system requires an SQFI account and accepts submissions through May 15, 2026. Submit through the public comments section of the SQFI website under "Comply with the Code."

What records do auditors expect from contracted sanitation services?

Under SQF Edition 10, certified sites must maintain verification evidence (such as ATP swab results, visual inspection sign-offs, and allergen verification swabs tied to changeovers) that ties contracted sanitation work to the master sanitation schedule. A vendor service log alone, listing time arrived and lines cleaned, does not by itself satisfy that requirement.

What is the difference between a vendor service log and verification?

A service log records that work was performed: time, lines, chemicals. Verification confirms the work met the cleanliness or performance specification: ATP swab, visual inspection, allergen swab. SQF auditors look for verification evidence, not service logs alone.

What this comes down to

If you already keep your own verification records, your own pest trend analyses, your own as-found calibration files, and your own environmental monitoring program records, you're in shape under SQF Edition 10 today.

If you've been letting vendors hold the documentation, the gap is real today, before any new framework. Your auditor will already find it.

The Services Code may eventually give you a way to prefer vendors who carry SQFI-certified status, the way Storage and Distribution Code certification works for warehousing partners. That's later. The contracts and the records sit with you right now.

If you want a structured walk-through of how your contracted services hold up under Edition 10, book a demo and we'll go through your sanitation, pest, calibration, and maintenance evidence trail.

The COA chain has a ceiling

Utz reported that the affected seasoning batches tested negative for Salmonella prior to use. Their direct supplier was a third-party seasoning supplier. That supplier had sourced dry milk powder from California Dairies. That's where the signal originated.

Utz's incoming testing reaches one tier up. The recall came from two tiers up. This is the supplier-of-supplier gap. Your QC catches what your direct supplier ships you. It does not catch what your direct supplier's supplier decides to recall.

Ghirardelli moved the same day. April 27, they recalled more than a dozen powdered beverage mixes that contained the affected milk powder, supplied to them through a third-party manufacturer. FSIS issued a public health alert the same week for meat and poultry products carrying FDA-regulated dairy ingredients from the recalled lots. FSIS says additional downstream products are expected to be identified as the agency works through its notifications.

What "potential Salmonella" actually means

California Dairies recalled out of caution. The public language is "concern of potential Salmonella contamination," not a confirmed positive in finished milk powder. That distinction matters. The signal could be environmental, an incoming raw-material flag, or a precautionary action driven by their own supplier.

You don't get to know. You get a notification from your direct supplier saying the milk powder lot is on the recall list. Whether your specific batch contained the contamination is not yours to answer. Your only response is to recall whatever finished product contains that lot of milk powder.

Why your incoming testing doesn't help

A Salmonella test on a 25-gram seasoning sample has a detection floor that depends on prevalence and homogeneity. If contamination is sparse and clumpy in a commodity-scale milk powder lot that's been blended into a seasoning with other ingredients, your incoming sample can hit clean while the lot still contains pathogens elsewhere.

Utz isn't recalling because they think their seasoning was contaminated. They're recalling because they can't prove it wasn't. Once California Dairies pulled the upstream lot, every brand that used it had to assume their finished product was implicated until proven otherwise. The proof requires testing volumes that no one downstream can practically run.

This is the same lesson Raw Farm's clean test results didn't get them out of. A negative test result is evidence about the sample. It's not evidence about the lot.

What this means for your supplier approval program

Your supplier approval matrix probably has columns for GFSI cert level, COA per shipment, allergen profile, audit recency. It almost certainly doesn't have a column for "list of upstream commodity suppliers."

For dry ingredients that are commodity-derived, dry dairy, dry egg, soy protein, gum systems, premixes, color blends, seasoning blends, that's the gap. You're approving the blender or distributor. You're not tracking who they buy raw material from. When the originator recalls, you find out at the same time as your direct supplier, sometimes after.

Three things to add this quarter:

1. Supplier questionnaire field for upstream commodity origin. For every dry ingredient that contains a commodity input (dairy, egg, nut, spice, dry protein), require your direct supplier to disclose their upstream supplier on each finished-good lot. This sits in your COA file alongside the certificate of analysis itself.

2. A standing "ingredient origin" record in each lot file. Same way you keep allergen statements and GFSI certificates, keep an upstream-supplier reference. The day a recall hits, you're not reverse-engineering who made the milk powder, you're pulling the file.

3. A standing recall-trace SOP that handles the two-tier case. Your existing recall plan probably assumes the trigger is your direct supplier. The 24-hour drill in our supplier recall stress test covers that. The two-tier case is different: your direct supplier is the messenger, not the cause, and the question of which lots of finished product to pull depends on which downstream blends contain the recalled originator material. Build the decision tree before the call comes.

What the cascade exposes

Three product categories pulled this week. The food safety reporting tracks it as three independent recalls because that's how FDA's recall system catalogues it. From an operator's seat, it's one event with three (and counting) implicated downstream operators. Dry milk powder from a major commodity supplier flows into hundreds of ingredient blends. The number of brands tied to this one upstream signal isn't done growing.

Your COA file is a record of one supplier's QC decisions. The recall didn't come from QC. It came from the originator deciding to be cautious. You don't get a vote, and right now you probably don't get visibility either.

If you're running supplier records out of spreadsheets and PDFs, the next cascade is going to hurt. Beacon keeps your supplier master, COAs, qualifications, and lot links connected, so a recall trace is a query, not an archaeology project. Book a call and I'll show you what changes when the data is connected. Or use the supplier management module overview as a starting point.

Foundation FSSC published Version 7 of the scheme on May 1, 2026. Most coverage is hitting the headline changes: GFSI 2024 alignment, sustainability, retail and wholesale categories. The bigger story is the ISO 22002:2025 PRP swap nobody's leading with. It rewrites the standards every QA team has been working off for years.

What V7 actually changes

V7 isn't a fresh start. It builds on V6 along five lines.

1. The ISO 22002:2025 series replaces the old ISO/TS 22002 family. This is the structural change. ISO 22002-100:2025 is the new common baseline covering hygiene, sanitation, pest control, allergen management, traceability, and food defense across sectors, with sector-specific parts layered on top.

2. GFSI Benchmarking Requirements v2024 alignment. Sharper expectations on governance, leadership accountability, food safety culture, food fraud, and food defense.

3. Sustainability tied to the UN SDGs. Food loss and waste, responsible sourcing, environmental impact. Already in V6. Stronger in V7.

4. A more defined structure for food chain categories. Retail and wholesale get a cleaner path through ISO 22002-7:2025.

5. Strengthened areas across the board. Allergen management, food safety and quality culture (one integrated program), equipment management, food loss and waste, and quality control.

None of those bullets is news if you've been watching FSSC. Strengthened doesn't mean rewritten. It means auditors will ask sharper questions about the same programs you already have. If your V6 program was thin in any of those areas, V7 will catch it.

The PRP swap is the actual work

The headline changes get the press releases. The PRP swap is what'll slow operators down.

Every prerequisite program in your facility (sanitation, pest control, allergen segregation, glass and brittle plastic, traceability, food defense) was built off ISO/TS 22002-x. ISO 22002:2025 replaces it. Your sector annex sits on top of the new 22002-100 baseline.

Your PRP manual needs a clause-by-clause crosswalk against the new structure. Not because most of your controls will change. Because the references your auditor pulls up will. If your PRP says "per ISO/TS 22002-1:2009, section 8.4," your auditor in 2027 will flag it. Even if the actual control hasn't moved.

That's the work. For a mid-size facility, that's weeks of QA time, not days.

What auditors will look for first

Auditors will hit three areas hardest in the first wave of V7 audits.

Food safety and quality culture. V6 brought it in as an integrated program. V7 strengthens the expectation. If your culture plan is a poster, an annual training module, and a survey, you'll get a non-conformance. Auditors want what you measured, what changed because of it, and where leadership is on the hook. The standard questions to expect are in What Auditors Want to See Behind Your Food Safety Culture Score.

Equipment management. V6 added explicit equipment management requirements. V7 sharpens them. Your equipment list, hygienic design records, change control when equipment is added or modified, and the link from equipment to your HACCP plan all need to hold up. "We have a PM schedule" isn't a program. The program is documented decisions about food-contact equipment, with an audit trail for every change.

Food loss and waste. Same pattern. V6 introduced the requirement. V7 raises the bar. Documented policy, measurable objectives, and a real link to operations. Not a sustainability paragraph in your quality manual.

What to do this week

If you're V6 certified and your transition audit isn't on the calendar, here's the Monday-morning version.

1. Download the official V6-to-V7 changes documents from fssc.com. Read once. Then read again with your PRP manual open next to you. The Foundation FSSC published two change summaries on May 1, 2026: one for the scheme, one for the annexes. Those are the primary source. Everything else is a recap.

2. Talk to your CB this week. Ask when they're slotting your transition audit. Most CBs will be capacity-constrained in the back half of the window. The first six months of the transition are the calm period. That ends fast.

3. Crosswalk your PRPs. Every reference to ISO/TS 22002-x in your manual needs to point to the new ISO 22002:2025 family. Sanitation, pest control, allergen, traceability, glass and brittle plastic, and food defense all touch this.

4. Stress-test your culture, equipment, and food-loss-and-waste programs. If any of those three would generate an awkward conversation with an auditor today, that's where V7 will land hardest. Fix what's fixable now, while there's no audit pressure. It's cheaper than fixing it during a transition audit.

5. Pick a transition lead. Not your QA Manager and ten other things. One person who owns the V7 readiness plan, with a date and a budget. If you ran a lead through the SQF Edition 10 transition, this is the same job on a parallel timeline.

Twelve months sounds like a lot. It's three quarter-end retros, two budget cycles, and one CB lead time. It isn't a lot.

That gap matters now in a way it did not five years ago. SQF Edition 10 requires your facility to maintain a documented food safety culture plan with measurable performance indicators and evidence of continuous improvement, and GFSI's Position Paper on a Culture of Food Safety, Version 2.0, released March 2026, calls for measurement through multiple indicators rather than a single survey score. Auditors are starting to look past the existence of a survey and ask how the survey was built, how the items were selected, and what the numbers actually represent.

If your facility is generating culture metrics from a vendor template that has no published validation evidence, the score itself may not be the problem. The methodology behind it is.

What the research examined

Wang, Mirosa, Hou, and Bremer at the University of Otago reviewed 31 peer-reviewed studies on food safety culture measurement published between 2010 and 2025. The studies collectively surveyed more than 7,860 respondents across roughly 2,023 companies, including approximately 325 managers. European studies dominated the sample with 15 entries, followed by Brazil with 6, the United States with 4, and four cross-national projects covering multiple regions.

The pace of research has accelerated in step with regulatory expectations. Between 2010 and 2020 the literature produced 15 studies, and sixteen more have appeared since 2021, an expansion that mirrors what GFSI member schemes including SQF and BRCGS have done over the same period. Food safety culture moved from a soft commentary topic to an auditable element of the management system, and the academic instruments that operators inherited were not built for that role.

The reviewers' primary question was whether the instruments being used in the field meet basic measurement standards. They examined two dimensions: how each questionnaire defined what it was measuring, and how the instrument was tested for reliability and validity. Their conclusion is not that the instruments are useless, but that the validation evidence behind most of them is thinner than the consumers of the data assume.

The validation gap, in numbers

Across the 31 studies, the reviewers cataloged 182 distinct dimensions or sub-dimensions of food safety culture, and after clustering those reduced to eight broad groupings. The underlying point is the fragmentation: different research teams call the same construct by different names, and call different constructs by the same name, so a "leadership" dimension in one instrument is not the same as a "leadership" dimension in another.

Five dimensions appeared with consistency across the literature: Resources (in 27 studies), Commitment (26), Leadership (25), Communication (25), and Risk concepts (24). If your facility's survey covers fewer than these five core constructs, the reviewers' analysis suggests the instrument is incomplete on its face.

The validation picture is more concerning. Of the 31 studies in the review:

• 11 reported Cronbach's alpha, an internal consistency check

• 6 included expert review of items

• 5 conducted exploratory factor analysis

• 2 conducted confirmatory factor analysis

• 2 used principal components analysis

The most rigorous structural validation methods, confirmatory factor analysis and Rasch analysis, appeared either rarely or not at all across the entire sample. Twelve of the 31 studies developed new questionnaires, while the other 19 simply applied existing instruments to a new population, often without re-validating in the new context. The reviewers cite a 2024 finding from Nyarugwe and Jespersen directly: none of the assessment tools in the literature has been subjected to all of the validation checks the field considers standard, and that includes the most widely adopted instrument in the literature, De Boeck et al. (2015).

Why this matters under SQF Edition 10

SQF Code Edition 10 was released in March 2026 and formalizes food safety culture inside the management commitment element. Senior management is required to maintain a documented Food Safety Culture Plan that includes communication strategies, training programs, feedback loops, measurable performance indicators, and an evaluation system that demonstrates continuous improvement. The plan itself is not optional, and the indicators it requires are not decorative documentation.

Auditors are still calibrating how to evaluate the methodology behind culture measurement, but the practical question they now ask is consistent across audits. How did your facility choose its dimensions? What instrument did you use, and where did it come from? How did you decide that the score you reported is reliable enough to drive a corrective action?

A facility that hands the auditor a culture score without an answer to those three questions is in the same position as a facility that hands over an environmental monitoring trend chart with no swab plan behind it. The number is not the evidence. The methodology behind the number is the evidence.

GFSI's Position Paper on a Culture of Food Safety, Version 2.0, released in March 2026, pushes in the same direction. The paper calls for assessment through multiple indicators rather than a single metric and ties food safety culture to measurement, deliberate intervention, and continuous improvement of practice. The new framework drew on more than 180 academic and industry sources and replaces the original 2018 position paper that first established a common language for food safety culture across GFSI member schemes.

What an auditor looks for

The auditor's question is not whether your facility ran a survey. The question is whether the result your facility reported is defensible under examination. From the auditor's chair, a credible food safety culture measurement program shows the following five elements.

A stated theoretical framework. Your survey should be built on a defined model, whether that is the Yiannas framework, the Griffith et al. construct, the De Boeck instrument, or another published source. If the auditor asks where your dimensions came from and the answer is "the consultant who built it for us," the framework is undocumented and the program rests on assumptions the facility cannot defend.

Evidence the instrument was validated for the population using it. Validation is not a one-time event that travels with the instrument from one context to another. A questionnaire validated on European retail food service does not automatically apply to a Texas processing plant or a California co-packer, so if your facility adopted an existing tool, your records should show what was done to confirm the instrument fits the setting.

A sample design that reflects the plant population. A survey distributed only to office staff or only to leads is not measuring plant culture. The sample needs to cover production shifts, sanitation, receiving, warehouse, and maintenance, and the records should show the distribution by role and by shift.

Response rate and segmentation. A 30 percent response rate from a single shift tells you very little about your overall facility. Auditors expect to see the response rate disclosed, the results segmented by role and shift, and a written explanation when participation drops below a defensible threshold.

A closed-loop linkage between findings and corrective action. This is the element auditors weigh most heavily, because the linkage is the only thing that demonstrates the program produced an outcome rather than a record. The survey identified a weak signal on hand-washing compliance among third-shift sanitation workers. What did the facility do? What changed? When the next round measured, did the signal improve? If the answer to any of those is missing, the program is a survey, not a culture management system.

Common failures in practice

The patterns that surface most often during audits are not exotic, and they are correctable once the facility recognizes them.

The five-question quarterly survey. A short questionnaire run repeatedly with no analytical follow-through, where the numbers move quarter to quarter, no one investigates why, and the report goes into a binder. The auditor is not impressed by the cadence; the auditor wants to know what the data drove and what changed in the operation as a result.

The vendor template with no documentation. A culture survey purchased off the shelf, branded for the facility, and deployed without any record of the dimensions, the validation history, or the source. When the auditor asks for the supporting methodology, there is nothing to produce, and the conversation moves quickly toward a non-conformance.

Aggregate-only reporting. A facility-wide score of 4.2 out of 5 hides everything that matters, because culture variance lives at the shift, line, and department level, and a program that does not segment its results cannot find its weak points before the auditor finds them first.

Survey-only measurement. Questionnaires capture self-reported attitudes, but they do not capture observed behavior on the plant floor. A defensible program triangulates: the survey, the walk-through observation, and the employee interview should tell the same story, and when they do not, the discrepancy itself becomes the finding.

The missing plan-do-check-act linkage. The single most common failure across audits is the missing loop, where the facility ran the survey, recorded the score, and never returned to the same dimension to verify whether anything moved. Without a closing loop documented in the records, the survey functions as documentation theater rather than a management tool.

Building a defensible measurement program

The reviewers' practical recommendation, stated in academic terms, is to choose dimensions and items that suit the specific context being investigated. In operational terms, that translates to a small number of decisions, made deliberately and documented in the food safety culture plan itself.

Choose your framework before you choose your instrument. Decide which model your facility is using, whether that is Yiannas, Griffith, De Boeck, or another, and write down why your facility chose it. The framework drives the dimensions, and the dimensions drive the items.

Adopt a published instrument or document the gap honestly. If your facility is using a vendor tool, ask the vendor for the published validation evidence behind it, and if they cannot produce it, that is a finding waiting to happen at your next audit. The most-adopted tool in the academic literature is the De Boeck et al. (2015) instrument, with later refinements by Nyarugwe and others, and these instruments carry peer-reviewed validation history that your facility can reference in its own records.

Run validation checks that fit your scale. Most facilities will not conduct confirmatory factor analysis, and that is acceptable provided the program documents what was done in its place: pilot testing with a representative sample, expert review of items by the food safety team, internal consistency checks where the data permit, and an explicit acknowledgment of the limitations of the methodology used.

Triangulate with observation and interview. A culture program built on survey data alone is fragile, so pair the questionnaire with structured plant-floor observations on the same dimensions and short employee interviews with a representative sample. When the three sources agree, your facility has evidence; when they disagree, the discrepancy is the corrective action.

Close the loop, and document the closing. Every measurement round should produce a documented action that ties back to the next measurement, because the auditor is looking for movement in a specific dimension across two consecutive rounds, with the corrective action recorded between them. The score on its own is not enough.

What this means for your facility

The food safety culture programs that pass an Edition 10 audit are not the ones with the highest survey scores, but the ones where the documentation, the interviews, and the floor observations tell the same story, and where the methodology behind the measurement holds up to a careful question from the auditor.

If your facility is preparing for an Edition 10 transition audit and the culture measurement program rests on a survey instrument with no validation history, the gap is fixable now and will be more expensive to fix later. The first step is a written record of your framework, your instrument source, and the validation evidence you have or can obtain, and the second step is the triangulation: observation and interview alongside the questionnaire, on the same dimensions, on a defined cadence.

A practical starting point is the four-pillar plan structure covered in our food safety culture plan guide, with the methodology layer added on top. For facilities still mapping the broader Edition 10 changes, our Edition 10 preparation guide covers the structural shifts that affect documentation, monitoring, and verification across the standard.

Beacon's food safety platform builds the survey, the observation log, and the corrective action linkage into a single record so the methodology is defensible by design. For facilities preparing for an Edition 10 transition specifically, our SQF audit preparation service reviews the culture program against current auditor expectations and documents the validation gaps that need to close before the audit.

The 2026 review is not a reason to scrap your current program. It is a reason to document what your facility has, identify what is missing, and put the validation evidence in place before an auditor asks for it.

Different products, different states, different mechanisms. Same root cause. The label didn't match what was in the package.

That distinction matters. If you treat this as an allergen-control problem, you'll go look at your allergen matrix. The matrix is fine. The problem is upstream of the matrix, in the part of your system that should catch it when the label and the product disagree.

What happened at Ferris Coffee & Nut

The product: Frederik's by Meijer Vanilla Bourbon Trail Mix. 9-ounce black bag, lot 6069-1, expiration 12/10/26. Distributed in Michigan, Indiana, Ohio, Illinois, Wisconsin, and Kentucky.

What went wrong: chocolate-covered pretzel balls (which contain wheat and soy) were packaged in bags labeled for bourbon-flavored caramels (which don't). No illnesses reported. Production suspended.

If you've ever run a multi-SKU bagging line, you know this scenario. Two products move through the same packaging area on the same day. Both look similar. Both go into similar bags. The line clears one product, sets up for the next, and somewhere in the changeover the wrong product ends up in the right bag.

This is a packaging-changeover failure dressed up as an allergen failure. The pretzel formulation is fine. The caramel formulation is fine. The two SKUs collided during changeover, and nothing in the post-changeover process caught the swap before it shipped.

What happened at French Broad Chocolates

Different mechanism. The Bette's Bake Sale Bonbon Collection contains a Walnut Fudge bonbon. The product was the right product. The packaging was the right packaging. The failure was on the printed tasting guide that ships with each box, where the Walnut Fudge bonbon was incorrectly identified. A consumer relying on the guide to tell the bonbons apart could have eaten one with walnuts without knowing.

Distributed April 14 through April 20 from the company's Asheville retail stores and shipped online to 40 states plus Washington, DC.

The printed tasting guide is the kind of secondary document that sits in a separate print queue from the product label, often handled by a different vendor and rarely reviewed against the actual product manifest. That's exactly where this kind of error hides.

The shared root cause: label-to-product reconciliation

Both recalls came down to the same gap. At some point in the process, a person or system should have read what the label says, looked at what's in the package, and verified that the two match.

Neither company caught it.

Most facilities run a version of this check, but it's almost always informal. The line lead glances at the label as the first case comes off the changeover. The print operator pulls a sample from the run and eyeballs the copy. None of this is documented, and none of it is reconciled against an authoritative source like the spec sheet or the master allergen list.

When a regulator or a customer asks how you verified the label matched the product, most QA teams can't answer with a record.

The 24-hour reality of a supplier recall gets a lot of attention. The hours-zero reality of preventing one is what nobody writes about.

What changeover validation should actually look like

For a multi-SKU line like the one Ferris ran, the procedure has four parts.

1. Visual line clearance, documented. Not "the line lead checked." A signed clearance form that names the previous SKU, the next SKU, the time of clearance, and the person who cleared it. The form lives in the production batch record.

2. Allergen-aware changeover sequencing. If the previous product contained wheat and the next does not, the changeover protocol changes. Soy and wheat are major allergens under FALCPA. The protocol should specify what cleaning is required, what verification is required, and who signs off.

3. First-case label-to-product check. When the first case comes off the line after changeover, the line lead pulls a unit, reads the label out loud against the product, and signs the batch record. This is a manual reconciliation. It takes 60 seconds. It catches more mismatches than any other check on the line.

4. Packaging reconciliation at end of run. The case count produced should match the labeled units of the right SKU. If you produced 4,200 units of Product A but the system shows you only had 4,180 labels for Product A, you have a problem to find before the truck leaves.

Most facilities have parts of this. Few have all four written, signed, and audited.

What label-print reconciliation should look like

The French Broad failure is different. The product was right. The printed insert was wrong. That gap usually exists because labels and inserts are produced through separate workflows, often by different vendors, and rarely cross-checked against each other.

The fix is a master spec for each SKU that lists every printed surface and every printed component, with allergen content explicitly called out. Before any printed piece ships from the printer, a sign-off matches every printed surface against the spec.

This is mechanical. It doesn't require AI. It requires that one person owns the spec and one person owns the sign-off, and they can't be the same person.

The drill that finds these gaps

Pull the last 10 changeovers your facility did. For each, ask:

• Is there a signed line clearance form?

• Is there a first-case label-to-product check, signed?

• Is the case count reconciled against label inventory?

• For products with allergen changes between SKUs, is there a documented allergen-cleaning step?

If you can't answer yes for all four on at least 9 of the 10, your facility has Ferris's gap.

Then run the same drill on printed components. For the last 10 SKU print runs, is there a signed reconciliation between the printed copy and the master spec? If not, your facility has French Broad's gap.

Both gaps are easy to fix in advance. They get hard only after the recall.

What we built into Beacon

When we built Beacon's allergen and labeling workflow, we started with the failure modes from real recall investigations, not a matrix-on-a-PDF. Each SKU has an allergen profile that ties to the area changeover procedure and the label review. The label review compares what's declared on the label against what the product actually contains, and a discrepancy escalates to CAPA instead of getting initialed off in a binder.

The system makes the reconciliation steps mandatory and signed, instead of trusting that the line lead did them informally.

If your changeover and label reconciliation runs on paper, those signatures are sitting in 12 different binders nobody opens until the next audit. That's the part that breaks.

Book a call and I'll show you how the workflow runs.

It wasn't a sanitation failure. The Czech Republic Regional Public Prosecutor's Office in Brno reported that police separately seized two jars from a Brno store that matched the description in an email from an unknown perpetrator. A suspect emailed a description of the jars they had seeded, and police used the description to find them on the shelf.

That's extortion by rat poison. That's the scenario the US Intentional Adulteration rule was written to prevent.

The US Inspector Doesn't Care That It Happened in Austria

HiPP is not sold at US retail. That doesn't matter to anyone running a US food facility right now.

The FDA started comprehensive Intentional Adulteration inspections in September 2024. Compliance deadlines under 21 CFR 121 have all passed. Very small businesses, averaging less than $10 million in annual food sales, are exempt from most of the rule's requirements. Everyone else is in scope. When a Consumer Safety Officer arrives at your facility today, they issue two Form 482s on the way in. One for food safety. One for food defense. Same officer, same day.

If you've never seen the second form before, that's a problem.

Food Safety Assumes Good Faith. Food Defense Doesn't.

A HACCP plan is built around hazards that could reasonably enter the process by accident. An IA plan is built around the opposite assumption: someone is trying to hurt your consumers or your company, and the food is the weapon.

The vulnerability questions are different. Food safety asks where contamination could enter. Food defense asks where a small amount of intentional contaminant, added by a person with a motive, could harm a lot of people downstream.

The rule requires five things, and a lot of IA plans were written once from a template and filed:

• A vulnerability assessment identifying actionable process steps

• Mitigation strategies for each one

• Monitoring procedures

• Corrective action procedures

• Verification and record-keeping

The plan has to be written. The mitigation strategies have to be observable on the floor. And the whole thing has to be reanalyzed at least every three years per 21 CFR 121.126. If you wrote yours in 2019 and haven't opened it since, you're already past the reanalysis trigger.

This is different from the supplier-caused recall scenario we covered earlier this month. That one assumes your supplier failed you by accident. Food defense assumes someone, inside or outside your facility, is trying to cause harm.

Four Things to Audit Before the CSO Arrives

1. When was your vulnerability assessment last reanalyzed?

Reanalysis is required every three years, minimum. It's also triggered by significant facility changes, new vulnerability information, failed mitigation strategies, or an FDA directive. If you added a product line last year, re-piped a bulk tank, switched to a new ingredient supplier with open totes, or moved a CIP station, the vulnerability profile changed. The plan should have changed with it.

Open the plan. Check the signature date. If it's more than three years old, your first corrective action is scheduling the reanalysis.

2. Can someone walk into your actionable process steps?

The rule focuses specifically on the steps where a small amount of contaminant could harm a lot of consumers. Bulk liquid receiving. Ingredient storage and mixing. Open conveyor lines before the kill step. Those are the places the rule expects mitigation strategies.

Walk each one. Not with the plan in hand. With the eye of someone trying to get in. Unlocked door to a mix tank. Unsecured dock during a break. Shared badge swipes at a shift change. A camera aimed at a blind spot.

The inspector will walk it with the plan in hand. The gap between what the plan says and what the floor looks like is the finding.

3. Who is your Food Defense Qualified Individual, and when did they last train?

The rule requires an FDQI. FSPCA runs four courses aligned to different parts of 21 CFR 121: plan preparation and reanalysis, vulnerability assessment with the Key Activity Types method, vulnerability assessment with the full method, and mitigation strategies.

If the person named on your plan retired, left the company, or got reassigned to another line, you don't have an FDQI. You have a paper trail. An inspector who asks to speak with your FDQI and gets told "she moved to quality" gets a finding.

4. Does the plan describe what actually happens, or what someone wrote?

"Tamper-evident packaging" on a plan means nothing if the floor uses unsealed totes between two process steps. "Access control" means nothing if the receiving dock door stays propped open for forklift traffic during summer shifts.

The plan is a contract with the inspector about what the facility does. The floor either honors it or it doesn't.

The Scenario Is Not Sophisticated

The person who seeded the Brno jars didn't need inside knowledge of the manufacturing process or an exotic contaminant. They bought rat poison at a hardware store and figured out how to get product onto a shelf. Then they emailed the description.

The same vector exists in every country where consumer products move through open supply chains. It's the reason the IA Rule exists. It's the reason FDA stood up a Food Defense Inspection Team with its own Form 482. And it's the reason an IA plan that sits in a binder between audits is a liability, not an asset.

If your IA plan hasn't been touched in three years, open it before an inspector does.

See how Beacon handles food defense alongside food safety. Documentation lives next to your food safety plan. Your FDQI lives next to your PCQI. Reanalysis triggers show up on the same calendar as the rest of your compliance work. Call me at (313) 484-4887.

If it becomes law, New York will be the first state in the country to require mandatory disclosure of self-designated "generally recognized as safe" (GRAS) ingredients. It will also ban three food additives from manufacture, distribution, and sale in New York: Red Dye 3, potassium bromate, and propylparaben.

For food manufacturers selling anything in New York, this is not a labeling question. It is a supplier approval and ingredient intake question, and the preparation work starts now.

What the Bill Actually Does

The Food Safety and Chemical Disclosure Act has two operative parts.

The first is a ban on three specific food additives: Red Dye 3 (FD&C Red No. 3), potassium bromate (a flour treatment agent with documented carcinogenic and thyroid concerns), and propylparaben (a preservative linked to reproductive harm). The ban applies to food "manufactured or sold in the state," which covers both in-state producers and any company shipping finished product into New York for retail.

The second is the GRAS disclosure provision. Under federal rules, a manufacturer can self-designate an ingredient as GRAS without ever notifying the FDA, using the company's own scientific basis for the safety conclusion. The ingredient may appear in the finished product under generic categories such as "natural flavor," "artificial flavor," or "spices," and neither the FDA nor the public has visibility into what it actually is. New York's bill changes that for any product sold in the state. Manufacturers will have to report each self-designated GRAS substance they decline to disclose to the FDA, along with the supporting safety data, to the New York Department of Agriculture. The Department will then publish that information in a public registry.

No other state has enacted a GRAS disclosure regime. California's 2023 Food Safety Act (AB 418) banned four additives including the three in New York's bill, but California stopped at bans. New York is the first state to require a company to show its work on the ingredients it self-cleared. Arkansas and West Virginia have passed additive bans of their own, some of which are under court challenge.

The Implementation Timeline

The bill becomes law upon gubernatorial signature. The additive ban takes effect immediately at that point. Retailers may continue selling existing inventory until the product's "best by" or expiration date, subject to a maximum sell-through period of three years from enactment.

The GRAS disclosure requirements, and the rest of the legislation, take effect one year after signature.

Two dates matter to operators. The first is whenever Governor Hochul signs, which triggers the additive ban. The second is one year after that signature, which is when the GRAS reporting obligation becomes active.

Note an important timing consideration on Red Dye 3 specifically. The FDA's federal revocation of Red Dye 3 authorization, which we covered in our earlier piece on the federal synthetic dye phase-out, carries a food compliance deadline of January 15, 2027. If New York's bill is signed in the spring or summer of 2026, the state-level ban arrives eight to twelve months ahead of the federal deadline. Facilities relying on the federal runway are now working against a shorter clock if any of their product reaches New York shelves.

What This Means for Your Ingredient Intake Program

For any manufacturer selling product in New York, three practical changes need to be underway before the signature happens, not after.

First, reformulation status on the three banned additives. Your bill of materials for every SKU that reaches New York retail needs a line of evidence that Red Dye 3, potassium bromate, and propylparaben are either not present or have been replaced. Private-label manufacturers and co-packers must apply this across every brand they produce. Common gap areas include legacy specialty SKUs, imported ingredients, and color blends sourced from suppliers that are not reformulated to current U.S. market standards.

Second, supplier disclosure for flavors, spices, and other ingredient categories. The GRAS disclosure obligation applies to the manufacturer, but the underlying information often lives with the supplier. A natural flavor compound purchased from a flavor house may contain GRAS substances the flavor house designated internally. Under the new law, you will be expected to either know what is in that flavor system or have documentation from the supplier certifying that no undisclosed GRAS substances are present. Send a disclosure attestation letter to every flavor, spice, color, and specialty ingredient supplier now, before the reporting deadline makes the request urgent for them as well.

Third, your supplier approval program needs a GRAS disclosure section. Most food safety management systems have supplier qualification documentation that covers certification, allergen status, and country of origin. Few cover GRAS status. Adding a specific question to your supplier questionnaire, and adding a clause to new supplier contracts, is the kind of change that is small in isolation and expensive to make after a regulatory trigger. The auditor version of this question is: when a reviewer opens your supplier file in eighteen months, can you show them the GRAS-related communication you initiated in 2026?

The Larger Pattern

New York is not an outlier. California's AB 418 banned four additives in 2023. California's AB 660 updates labeling rules for quality-indicator dates, taking effect July 1, 2026. FDA enforcement on the import side has escalated, as we documented in our piece on FSVP warning letters in 2026. Arkansas, West Virginia, and other states have passed additive bans or color restrictions, some of which are under court challenge. Federal and state regulators are moving at different speeds on the same underlying concerns, and state laws are now the leading edge.

For a manufacturer operating nationally, the compliance architecture cannot continue to assume federal deadlines set the pace. The pattern that CA AB 418, CA AB 660, the federal Red Dye 3 revocation, and now New York's Food Safety and Chemical Disclosure Act share is that each requires ingredient-level and label-level information that either already lives in your food safety management system or should. The ability to answer "does any product I sell in state X contain substance Y, and can I prove it?" is becoming a baseline capability.

What to Do Before the Governor Signs

Start with a three-question audit for every finished product SKU that reaches any state with recent additive or labeling legislation:

1. Is Red Dye 3, potassium bromate, or propylparaben present in this product or any of its ingredient inputs, as of the most recent specification?

2. Which ingredients appear under "natural flavor," "artificial flavor," "spices," or similar generic categories, and do we have GRAS disclosure documentation from the supplier for each?

3. Where does this product ship, and which of those jurisdictions have additive bans, labeling rules, or disclosure requirements that affect this SKU?

A facility that can answer these questions cleanly for every SKU is positioned for both the New York law and the next state bill. A facility that cannot is going to find out which one triggers the conversation first.

Next Steps

Governor Hochul's office has not publicly signaled a signing timeline. The bill could be signed within weeks. For manufacturers selling in New York, treating the transition as a reformulation project rather than a labeling project is the right frame. The labeling piece is downstream. The upstream work is in the bill of materials, the supplier files, and the attestations gathered before the disclosure deadline becomes a reporting deadline.

If ingredient specifications, supplier attestations, and finished-product formulation records currently sit across spreadsheets, email threads, and paper supplier files, this is the kind of regulatory event that makes the weakness visible. Food safety management systems that consolidate specification documents, supplier questionnaires, and bill of materials data reduce a law like this to a paperwork update rather than a reconstruction project.

See how Beacon organizes supplier files and specifications across jurisdictions.

But the strain in that positive sample isn't the strain making people sick in this outbreak. Whole-genome sequencing showed the isolate matches a different 2025 outbreak that CDC previously investigated. The cheese that tested positive was never shipped to stores.

Meanwhile, the 2026 outbreak strain hasn't been recovered from any Raw Farm product. The case against the company is entirely epidemiologic.

Of eight sick people interviewed, all eight reported consuming raw dairy. Of the seven who could name a brand, all seven said Raw Farm.

In 2026, five sick people specifically reported eating Raw Farm raw cheddar. Over half the patients are children under five.

So here's the operator problem. The FDA's product sampling came back clean on this outbreak's strain, and the case is built on interviews with sick people and their caregivers. If your supplier approval leans on incoming lot testing, nothing in that protocol would have flagged Raw Farm.

The trap in "all our tests came back negative"

Lot-based pathogen testing is a verification activity. The sample sizes and sampling frequencies aren't built to find rare contamination events across a full production year.

A negative result on a pulled 25-gram sample tells you about that sample. It doesn't tell you the facility is controlled.

What you actually need to evaluate is whether the supplier has a process that prevents and detects contamination across the whole production environment. That's not something a certificate of analysis can tell you. It's what a supplier approval program is supposed to verify up-front and re-verify on a schedule.

This is where a lot of supplier approval programs stop short. Approval often boils down to:

• A completed self-assessment questionnaire

• A current GFSI or regulatory certificate

• A COA on the first few shipments

• An annual renewal

None of that would have flagged Raw Farm. Their paperwork looks like anyone else's. The patterns worth flagging sit in the back pages of the history: prior outbreaks, prior recall behavior, how the company handles enforcement requests.

What a real supplier approval program looks for

Here's what a buyer can verify in a few hours per supplier. Before the first shipment, and again annually. Each of these would have flagged Raw Farm.

Documented outbreak and recall history. Raw Farm has a public record of prior FDA-investigated outbreaks tied to the same raw cheddar product line. That includes an early-2024 E. coli O157:H7 outbreak with 11 illnesses, 5 hospitalizations, and 2 HUS cases. CDC's follow-up on the 2025 outbreak whose strain matches the 2026 FDA-positive sample is only getting underway as of mid-April 2026.

An outbreak lookup against the FDA outbreak investigation archive and CDC's published outbreaks takes about twenty minutes per supplier. If you find a pattern, either your risk team approves with documented additional controls, or the supplier doesn't make the cut.

Environmental monitoring evidence, not EM certificates. Ask for the supplier's last 12 months of environmental monitoring data by zone, site, and organism. Look at the zone map, the swab site count, the frequency, and the trend of positives and corrective actions.

A facility that finds periodic positives and documents harborage investigations and zone upgrades is running a real program. A facility that shows all negatives across 12 months is either doing insufficient swabbing or not reporting honestly. Both are red flags.

Auditors now expect real EM data under SQF Edition 10, and the same logic applies to your supplier reviews.

How they handled enforcement pressure. Any public FDA recommendation to recall, any warning letter, any import alert, any consent decree: pull the record and read how the company responded. Raw Farm publicly fought the recall recommendation for three weeks and called the FDA's "possible link" to their products "false."

That's a behavioral signal, independent of any single test result. That kind of posture doesn't stay contained to regulators. It shows up with buyers during an incident.

Their CAPA evidence for prior events. A supplier that had a 2024 E. coli outbreak and a 2026 E. coli outbreak two years later needs to show you what changed operationally between them. Specific CAPAs, with verification of effectiveness. Not a summary letter.

If their answer is "we implemented additional training," that isn't a CAPA. It's a bullet point.

If you already buy from a higher-risk supplier

Sometimes you're already locked in, or the alternative suppliers don't exist, or the ingredient is irreplaceable. That's a real situation, not a failure. The question becomes what additional controls you add:

• Tighter incoming lot testing with a meaningful sampling plan, not a token COA check

• Segregation of that supplier's lots with hold-and-test protocols before release

• More frequent on-site audits, especially unannounced ones if your agreement allows

• Clear written triggers that force a supplier review: FDA outbreak mention, new warning letter, new recall, new import alert

We've covered what happens in the 24 hours after a supplier-caused recall a few weeks ago. The short version: you want to reduce the odds of being in that window at all, and that starts up-front with the approval decision, not at 3 AM when FDA's on the phone.

What to do this week

If you buy ingredients, don't wait for your next requalification cycle. Especially if the supplier's product category is higher-risk by definition: raw dairy, RTE seafood, sprouted products, fresh produce, nut butters.

Pull the outbreak history on your top ten suppliers by volume today. It's public data, and it takes less than a day. Document what you find in your supplier management file so you're not redoing the lookup next year.

If something shows up (prior outbreak, prior recall, active warning letter), decide before you get pulled into someone else's 24-hour scramble.

See how this works in Beacon.

Life Plus is not a one-off. FDA cited four importers in June 2025, another in November 2025, and multiple more in February 2026 ahead of the Life Plus letter. Enforcement is sustained, and Life Plus shows what happens when an inspector keeps coming back.

If you import any ingredient from a foreign supplier, even if customs paperwork says someone else is the "importer of record," you might be the company FDA expects to have a working FSVP. And if you don't, you're on the same path.

What FSVP Actually Requires

FSVP is a Food Safety Modernization Act rule, codified at 21 CFR Part 1 Subpart L under Section 805 of the FD&C Act. Every recent warning letter in this enforcement run cites the same section: 21 CFR 1.502(a).

In plain English, the rule requires US importers of food to do four things:

1. Analyze hazards in the food being imported

2. Evaluate and approve foreign suppliers based on those hazards

3. Conduct verification activities to confirm the supplier is controlling the hazards

4. Maintain records that prove you did all of the above

The verification activities can be audits, sampling and testing, record review, or something else risk-based. The key word is "verify." Trusting your supplier's own paperwork and shaking on it does not count.

USDA-regulated meat, poultry, and egg products are exempt at the time of import. Dietary supplement importers get modified requirements focused on CGMP compliance. Very small importers get modified requirements too. Everything else needs a full FSVP file.

The Importer Question Most Facilities Get Wrong

Here's the confusion that keeps showing up in FDA inspections. The FSVP importer is not the same thing as the Customs importer of record.

FDA defines the FSVP importer as the US owner or consignee of the food at the time of entry. Whoever owns the product or has agreed in writing to purchase it. That is almost always the manufacturer or buyer, not the customs broker, not the freight forwarder, and not the supplier's US sales arm unless the contracts say so.

If you buy imported cocoa powder for your bakery, you're probably the FSVP importer for that cocoa.

If you import spices from India to blend into your seasonings, you're probably the FSVP importer for those spices.

If your foreign supplier has a US sales entity and that entity is the importer on paper, verify in writing. The purchase agreement matters. Without it, FDA will look at who actually owns the food at entry, and the answer is usually you.

There's one escape hatch worth knowing. Manufacturers subject to the Preventive Controls rule who implement PC for the hazards in the imported food, or who comply with the PC supply-chain program, are deemed in compliance with most FSVP requirements for those foods. That's a real exemption, but only if your PC supply-chain program actually covers the imported ingredients in question. Double-check that yours does.

What Import Alert 99-41 Does to Your Business

FDA has a specific enforcement tool for FSVP failures that doesn't get nearly enough attention. Import Alert 99-41, published in August 2019, is called Detention Without Physical Examination for non-compliant FSVP importers.

Here's what it actually means. When FDA places your company on the Red List of this alert, every future shipment you bring into the United States is detained at the port. No physical exam. No chance to show it's safe. It just sits until you prove you're back in compliance.

Most FDA import alerts target foreign suppliers. This one targets you, the US importer. It's a different beast. The only way off is to petition the FDA Compliance Officer who placed you on it, with documentation showing the FSVP violations have been fixed.

The petition doesn't have a published timeline. Practitioners report it can take months. During that time, your imports are not moving. Your production line goes without those ingredients, or you scramble to source domestically at a markup. A fine is a check. This is a shutdown.

The 24-hour stress test a supplier-driven recall puts on your operation has a cousin here. Except instead of 24 hours of frantic tracing, you're looking at weeks or months of ingredient shortages while you rebuild a program the inspector already told you was missing.

The Three Gaps That Keep Getting Cited

Looking across the recent FSVP warning letters (Life Plus in March 2026, Ocho Rios Atlanta in October 2025, the four named companies cited in June 2025), the same patterns keep appearing.

No FSVP at all. The plainest violation, and the one that keeps showing up. The company imports food, has no hazard analysis, no supplier approval records, no verification activities. In the Life Plus case, the company had an FSVP for only one supplier out of its full import list.

FSVP that isn't being followed. A hazard analysis was done once, three years ago, and never updated. Supplier approvals are on file but no one conducts verification activities on the schedule the program says they should. Records exist but they stop at 2023.

Response without documentation. FDA's warning letter to Ocho Rios Atlanta noted the company responded to the agency's observations, but the response did not include any supporting FSVP records. Saying you've fixed the problem is not the same as showing proof. FDA treats an undocumented response as non-responsive, and the clock keeps running.

What to Check This Week

If you import any food ingredient, walk through this sequence:

1. Identify who the FSVP importer is for every imported ingredient. Not the customs IOR. The FSVP importer under the rule. If the contract is ambiguous, assume it's you until a written agreement says otherwise.

2. Match each imported ingredient to either an FSVP file or a PC supply-chain program entry. If neither exists for a given ingredient, you have a gap.

3. Check the date on every hazard analysis and supplier approval. If it's more than two years old and the supplier, product, or process has changed, it's probably stale.

4. Verify that verification activities actually happened on the schedule your program requires. A scheduled annual audit that hasn't happened since 2024 is the same as no program.

5. Keep records that show you did the work. If an FDA inspector can't read your audit report, your audit report doesn't exist.

The FSVP warning letter clusters in 2025 and 2026 are not evidence FDA decided to change its approach this quarter. They're evidence that a rule that's been around since 2017 gets consistent enforcement, with a real operational consequence attached. The companies that get caught are the ones who assumed FSVP was a paperwork exercise.

If your supplier qualification program runs on email threads and PDFs scattered across a shared drive, the next FSVP inspection is going to find what Life Plus found out the hard way. See what a supplier program designed to survive an FDA inspection looks like.

But in 2025, their pre-cooked pasta tested positive for Listeria monocytogenes during a multistate outbreak. Seven people died. Twenty-eight got sick across nineteen states. The products that killed them were packaged by FreshRealm and sold under Marketside at Walmart and Home Chef at Kroger. Related pasta products reached shoppers at Trader Joe's and Sprouts.

None of those downstream brands made the contaminated pasta. All of them had to recall.

If your facility buys ingredients or co-manufactures with a third party, that outbreak is your stress test. Because FSMA gives you 24 hours to produce records. And your customers will give you less.

The 24-Hour Clock Is Real

Two separate FDA deadlines apply the moment contamination is suspected.

Under 21 CFR 117.139, any facility producing a food with a hazard requiring a preventive control must maintain a written recall plan. That's the baseline. It's been federal law since FSMA's Preventive Controls for Human Food rule took effect.

Under FSMA 204, firms handling Food Traceability List products must provide Key Data Elements tied to Critical Tracking Events to FDA within 24 hours of a request. Forward trace, backward trace, lot-level detail. The enforcement date got pushed to July 2028, but the clock itself is not changing.

And under the Reportable Food Registry rule, if there's a reasonable probability that a food from your registered facility will cause serious adverse health consequences, you have 24 hours to notify FDA.

That's the legal clock. Customers move faster. A Walmart or Kroger buyer who hears "Listeria in your plant" isn't waiting 24 hours to cut POs and hold inventory.

Run the Scenario

It's Thursday at 3pm. Your co-packer calls. One of their CCPs failed last week. They ran product anyway and shipped it under your brand. FDA is on their way to both plants.

In the next 24 hours you need to:

• Freeze every affected lot in your warehouse and in transit

• Pull purchase records for every shipment of that ingredient going back six months

• Identify every finished product SKU that used those lots

• Build a customer distribution list: who got which lot, how much, when

• Notify retail buyers before they call you

• Draft the FDA notification

• Coordinate quality, ops, legal, and customer service

If your answer to any of that is "we'd need to pull it from spreadsheets" or "the QA manager has most of it in her email," you're going to miss the clock. The clock isn't the worst of it. A botched recall is how facilities end up on consent decrees.

Why Most Facilities Fail This Test

I've seen the paper systems. I've built the spreadsheets. I know what lot traceability looks like when it lives in three binders, a shared folder, and one person's head.

The common failure patterns:

Lot codes that don't cascade. Ingredient lot comes in, gets dumped into a batch, and the finished-product lot number doesn't reference the ingredient lot. You can't trace forward.

Customer shipment records in the sales system, ingredient records in the QA system. Two databases, no join. Nobody can answer "which customers got product made with lot X" in under a day.

Mock recalls that pass on a good day. QA runs a mock recall quarterly, assembles records in six hours, celebrates. But the mock is a known lot on a calm Tuesday. The real one will be a Sunday morning with the plant on weekend skeleton crew.

No documented decision tree for who calls FDA. When the call has to happen at 11pm, nobody wants to be the one to make it. So it doesn't happen until Monday.

What a 4-Hour Recall Actually Looks Like

The target isn't 24 hours. The target is four hours, because you need buffer.

A facility that can do this has three things in place.

First, every lot is linked bidirectionally in one system. Raw material lot in, finished goods lot out, customer shipment lot delivered. One query pulls the full trace. Not one spreadsheet and a phone call to accounting.

Second, the customer distribution list writes itself. When you pull a finished-goods lot, the system already knows which POs shipped what quantities to which DCs on which dates. Nobody builds that list during a recall.

Third, there's a written, tested procedure for the first four hours. Who freezes inventory. Who calls customers. Who drafts the FDA notification. Who owns the press statement. The procedure names people and backups by role. It does not require anyone to figure it out on the fly.

The Mock Recall Metrics That Matter

Most mock recall programs measure the wrong thing. They measure whether the mock was conducted, not whether the facility is ready.

Run the next one with these metrics:

• Time from trigger to complete forward trace. Target: under two hours. Full list of customers, POs, ship dates, quantities.

• Time from trigger to complete backward trace. Target: under two hours. Every ingredient lot, every supplier, every receiving date.

• Time from trigger to FDA notification draft. Target: under four hours.

• Records completeness. Every lot accounted for. No gaps. No "we'll have to check on that one."

• Do it on a weekend. Or at 2am. Or with the QA manager on PTO. The test that matters is the one that's harder than a real recall.

If you can't hit these numbers, you don't have a recall plan. You have a recall binder.

If You Use Co-Packers or Third-Party Suppliers

Your supplier's risk is your recall. Nate's didn't put its name on the package. Kroger and Walmart still recalled the product. FreshRealm still took the hit.

Before your next supplier audit, ask two questions. Can they trace a lot forward and backward in under four hours? And if their product causes a recall, will they communicate it to you before it hits the news?

If the answer is unclear, you're carrying their risk. Your supplier management program is where that gap gets closed or left open.

What to Do This Week

Pick a random finished-goods lot from the last 60 days. Have your QA team trace it forward and backward. Time it. Don't warn anyone in advance.

Whatever number you get, that's your real recall response time. If it's more than four hours, start fixing it before your supplier forces the issue.

If your traceability still lives in binders, spreadsheets, and people's heads, see what a connected system looks like. That's the difference between a recall you handle and one that handles you.