When Your Supplier Causes a Recall, You Have 24 Hours

Nate's Fine Foods is a pasta ingredient supplier based in Roseville, California. Not a brand anyone asks for at the grocery store. Their name isn't on the package.

But in 2025, their pre-cooked pasta tested positive for Listeria monocytogenes during a multistate outbreak. Seven people died. Twenty-eight got sick across nineteen states. The products that killed them were packaged by FreshRealm and sold under Marketside at Walmart and Home Chef at Kroger. Related pasta products reached shoppers at Trader Joe's and Sprouts.

None of those downstream brands made the contaminated pasta. All of them had to recall.

If your facility buys ingredients or co-manufactures with a third party, that outbreak is your stress test. Because FSMA gives you 24 hours to produce records. And your customers will give you less.

The 24-Hour Clock Is Real

Two separate FDA deadlines apply the moment contamination is suspected.

Under 21 CFR 117.139, any facility producing a food with a hazard requiring a preventive control must maintain a written recall plan. That's the baseline. It's been federal law since FSMA's Preventive Controls for Human Food rule took effect.

Under FSMA 204, firms handling Food Traceability List products must provide Key Data Elements tied to Critical Tracking Events to FDA within 24 hours of a request. Forward trace, backward trace, lot-level detail. The enforcement date got pushed to July 2028, but the clock itself is not changing.

And under the Reportable Food Registry rule, if there's a reasonable probability that a food from your registered facility will cause serious adverse health consequences, you have 24 hours to notify FDA.

That's the legal clock. Customers move faster. A Walmart or Kroger buyer who hears "Listeria in your plant" isn't waiting 24 hours to cut POs and hold inventory.

Run the Scenario

It's Thursday at 3pm. Your co-packer calls. One of their CCPs failed last week. They ran product anyway and shipped it under your brand. FDA is on their way to both plants.

In the next 24 hours you need to:

• Freeze every affected lot in your warehouse and in transit

• Pull purchase records for every shipment of that ingredient going back six months

• Identify every finished product SKU that used those lots

• Build a customer distribution list: who got which lot, how much, when

• Notify retail buyers before they call you

• Draft the FDA notification

• Coordinate quality, ops, legal, and customer service

If your answer to any of that is "we'd need to pull it from spreadsheets" or "the QA manager has most of it in her email," you're going to miss the clock. The clock isn't the worst of it. A botched recall is how facilities end up on consent decrees.

Why Most Facilities Fail This Test

I've seen the paper systems. I've built the spreadsheets. I know what lot traceability looks like when it lives in three binders, a shared folder, and one person's head.

The common failure patterns:

Lot codes that don't cascade. Ingredient lot comes in, gets dumped into a batch, and the finished-product lot number doesn't reference the ingredient lot. You can't trace forward.

Customer shipment records in the sales system, ingredient records in the QA system. Two databases, no join. Nobody can answer "which customers got product made with lot X" in under a day.

Mock recalls that pass on a good day. QA runs a mock recall quarterly, assembles records in six hours, celebrates. But the mock is a known lot on a calm Tuesday. The real one will be a Sunday morning with the plant on weekend skeleton crew.

No documented decision tree for who calls FDA. When the call has to happen at 11pm, nobody wants to be the one to make it. So it doesn't happen until Monday.

What a 4-Hour Recall Actually Looks Like

The target isn't 24 hours. The target is four hours, because you need buffer.

A facility that can do this has three things in place.

First, every lot is linked bidirectionally in one system. Raw material lot in, finished goods lot out, customer shipment lot delivered. One query pulls the full trace. Not one spreadsheet and a phone call to accounting.

Second, the customer distribution list writes itself. When you pull a finished-goods lot, the system already knows which POs shipped what quantities to which DCs on which dates. Nobody builds that list during a recall.

Third, there's a written, tested procedure for the first four hours. Who freezes inventory. Who calls customers. Who drafts the FDA notification. Who owns the press statement. The procedure names people and backups by role. It does not require anyone to figure it out on the fly.

The Mock Recall Metrics That Matter

Most mock recall programs measure the wrong thing. They measure whether the mock was conducted, not whether the facility is ready.

Run the next one with these metrics:

• Time from trigger to complete forward trace. Target: under two hours. Full list of customers, POs, ship dates, quantities.

• Time from trigger to complete backward trace. Target: under two hours. Every ingredient lot, every supplier, every receiving date.

• Time from trigger to FDA notification draft. Target: under four hours.

• Records completeness. Every lot accounted for. No gaps. No "we'll have to check on that one."

• Do it on a weekend. Or at 2am. Or with the QA manager on PTO. The test that matters is the one that's harder than a real recall.

If you can't hit these numbers, you don't have a recall plan. You have a recall binder.

If You Use Co-Packers or Third-Party Suppliers

Your supplier's risk is your recall. Nate's didn't put its name on the package. Kroger and Walmart still recalled the product. FreshRealm still took the hit.

Before your next supplier audit, ask two questions. Can they trace a lot forward and backward in under four hours? And if their product causes a recall, will they communicate it to you before it hits the news?

If the answer is unclear, you're carrying their risk. Your supplier management program is where that gap gets closed or left open.

What to Do This Week

Pick a random finished-goods lot from the last 60 days. Have your QA team trace it forward and backward. Time it. Don't warn anyone in advance.

Whatever number you get, that's your real recall response time. If it's more than four hours, start fixing it before your supplier forces the issue.

If your traceability still lives in binders, spreadsheets, and people's heads, see what a connected system looks like. That's the difference between a recall you handle and one that handles you.