Raw Farm's Tests Came Back Clean. The Outbreak Still Traces to Them.

FDA tested 19 samples of Raw Farm raw cheddar cheese during the current E. coli O157:H7 outbreak investigation. One sample came back positive. On its face, that's the finding that would close the case.

But the strain in that positive sample isn't the strain making people sick in this outbreak. Whole-genome sequencing showed the isolate matches a different 2025 outbreak that CDC previously investigated. The cheese that tested positive was never shipped to stores.

Meanwhile, the 2026 outbreak strain hasn't been recovered from any Raw Farm product. The case against the company is entirely epidemiologic.

Of eight sick people interviewed, all eight reported consuming raw dairy. Of the seven who could name a brand, all seven said Raw Farm.

In 2026, five sick people specifically reported eating Raw Farm raw cheddar. Over half the patients are children under five.

So here's the operator problem. The FDA's product sampling came back clean on this outbreak's strain, and the case is built on interviews with sick people and their caregivers. If your supplier approval leans on incoming lot testing, nothing in that protocol would have flagged Raw Farm.

The trap in "all our tests came back negative"

Lot-based pathogen testing is a verification activity. The sample sizes and sampling frequencies aren't built to find rare contamination events across a full production year.

A negative result on a pulled 25-gram sample tells you about that sample. It doesn't tell you the facility is controlled.

What you actually need to evaluate is whether the supplier has a process that prevents and detects contamination across the whole production environment. That's not something a certificate of analysis can tell you. It's what a supplier approval program is supposed to verify up-front and re-verify on a schedule.

This is where a lot of supplier approval programs stop short. Approval often boils down to:

• A completed self-assessment questionnaire

• A current GFSI or regulatory certificate

• A COA on the first few shipments

• An annual renewal

None of that would have flagged Raw Farm. Their paperwork looks like anyone else's. The patterns worth flagging sit in the back pages of the history: prior outbreaks, prior recall behavior, how the company handles enforcement requests.

What a real supplier approval program looks for

Here's what a buyer can verify in a few hours per supplier. Before the first shipment, and again annually. Each of these would have flagged Raw Farm.

Documented outbreak and recall history. Raw Farm has a public record of prior FDA-investigated outbreaks tied to the same raw cheddar product line. That includes an early-2024 E. coli O157:H7 outbreak with 11 illnesses, 5 hospitalizations, and 2 HUS cases. CDC's follow-up on the 2025 outbreak whose strain matches the 2026 FDA-positive sample is only getting underway as of mid-April 2026.

An outbreak lookup against the FDA outbreak investigation archive and CDC's published outbreaks takes about twenty minutes per supplier. If you find a pattern, either your risk team approves with documented additional controls, or the supplier doesn't make the cut.

Environmental monitoring evidence, not EM certificates. Ask for the supplier's last 12 months of environmental monitoring data by zone, site, and organism. Look at the zone map, the swab site count, the frequency, and the trend of positives and corrective actions.

A facility that finds periodic positives and documents harborage investigations and zone upgrades is running a real program. A facility that shows all negatives across 12 months is either doing insufficient swabbing or not reporting honestly. Both are red flags.

Auditors now expect real EM data under SQF Edition 10, and the same logic applies to your supplier reviews.

How they handled enforcement pressure. Any public FDA recommendation to recall, any warning letter, any import alert, any consent decree: pull the record and read how the company responded. Raw Farm publicly fought the recall recommendation for three weeks and called the FDA's "possible link" to their products "false."

That's a behavioral signal, independent of any single test result. That kind of posture doesn't stay contained to regulators. It shows up with buyers during an incident.

Their CAPA evidence for prior events. A supplier that had a 2024 E. coli outbreak and a 2026 E. coli outbreak two years later needs to show you what changed operationally between them. Specific CAPAs, with verification of effectiveness. Not a summary letter.

If their answer is "we implemented additional training," that isn't a CAPA. It's a bullet point.

If you already buy from a higher-risk supplier

Sometimes you're already locked in, or the alternative suppliers don't exist, or the ingredient is irreplaceable. That's a real situation, not a failure. The question becomes what additional controls you add:

• Tighter incoming lot testing with a meaningful sampling plan, not a token COA check

• Segregation of that supplier's lots with hold-and-test protocols before release

• More frequent on-site audits, especially unannounced ones if your agreement allows

• Clear written triggers that force a supplier review: FDA outbreak mention, new warning letter, new recall, new import alert

We've covered what happens in the 24 hours after a supplier-caused recall a few weeks ago. The short version: you want to reduce the odds of being in that window at all, and that starts up-front with the approval decision, not at 3 AM when FDA's on the phone.

What to do this week

If you buy ingredients, don't wait for your next requalification cycle. Especially if the supplier's product category is higher-risk by definition: raw dairy, RTE seafood, sprouted products, fresh produce, nut butters.

Pull the outbreak history on your top ten suppliers by volume today. It's public data, and it takes less than a day. Document what you find in your supplier management file so you're not redoing the lookup next year.

If something shows up (prior outbreak, prior recall, active warning letter), decide before you get pulled into someone else's 24-hour scramble.

See how this works in Beacon.