Mock recall: how to run a traceability drill
A mock recall is a practice drill. Pick one lot, trace it back to its ingredient lots and forward to every customer, time it, log the gaps and fix them. A small team can do it in an afternoon. FSMA 204 does not require mock recalls, but a drill tests the records it does require.
This guide covers what the law does and does not require, how to run the drill step by step, what to write down, and a simple record you can copy.
Is a mock recall required by law?
Not by FSMA 204. The Food Traceability Rule asks for records and a 24-hour response, and Subpart S of 21 CFR Part 1 does not mention mock recalls or drills. Other rules, FDA guidance and your own customers fill in the rest:
| Source | What it says about mock recalls |
|---|---|
| FSMA 204 (21 CFR Part 1, Subpart S) | Not mentioned. |
| Preventive controls rule, 21 CFR 117.139 | Requires a written recall plan for food with a hazard requiring a preventive control. Does not mention mock recalls. |
| FDA’s voluntary recall guidance (nonbinding) | Says a firm that expects complex recalls may want to consider mock recalls to verify its readiness. |
| Audit schemes benchmarked by GFSI, such as SQF, BRCGS and FSSC 22000 | Commonly expect traceability and recall tests. Check your audit scheme. |
| Your customers | May ask you to take part in one. Check your supplier agreements. |
The recall plan rule applies to facilities subject to the preventive controls requirements, and only for food with a hazard that needs a preventive control. Some facilities are exempt from that part of the rule, including qualified facilities such as very small businesses (21 CFR 117.5(a)).
Audit scheme details differ by scheme and edition, so read the standard you are certified to. SQF’s Edition 9 food manufacturing code, for example, requires the withdrawal and recall system to be reviewed, tested and verified at least annually, covering one step back and one step forward, and requires records of the tests (2.6.3.2 and 2.6.3.3). SQF Edition 10 is on the way, and SQF says audits to it will not start before January 2, 2027.
What goes in a recall plan?
A recall plan is the written procedure for a real recall. Where 117.139 applies, the plan must describe the steps, and who is responsible for each, to do these things as appropriate to the facility:
- Directly notify the direct consignees of the food, including how to return or dispose of it
- Notify the public about the hazard when appropriate to protect public health
- Conduct effectiveness checks to verify the recall is carried out
- Dispose of recalled food appropriately, for example by reprocessing, diverting or destroying it
FDA’s guidance on initiating voluntary recalls says plans should be specific to the firm or facility, so treat any template as a starting point. FDA’s industry recall page also offers model press releases for common food recall hazards.
How is a mock recall different from a traceability drill?
People use the terms loosely, and audit schemes may define them their own way. In this guide, a traceability drill tests only the trace: where did this lot come from, and where did it go? A full mock recall adds the response: drafting the customer notices, checking that customers acted, and accounting for the product.
Start with the traceability drill. It is the part that depends on your records, and it is the part FSMA 204 puts a clock on.
How do you run a mock recall in an afternoon?
The times below are suggestions, not rules. Adjust them to your size.
- Set the scenario (15 minutes). Pick a lot from a few weeks ago, ideally a food on the Food Traceability List or your most complicated product. Write one sentence for the trigger, such as “Supplier A reports a possible problem with an ingredient lot.” Name who runs the trace and who keeps time.
- Start the clock. One person searches. A second person logs the time, the source of each record, and every point where someone guessed or asked a coworker.
- Trace one up. Find the receiving records for the ingredient lots: supplier, supplier lot code, date and quantity. FSMA 204 receiving records are in 21 CFR 1.1345. The older one-step-back rule is 21 CFR 1.337, which covers many food businesses but not farms or restaurants.
- Trace through production. Find every finished lot that used the suspect ingredient lot. If you transform listed foods, 1.1350 expects the new lot code to be linked to the incoming lots.
- Trace one down. Find every shipment of those finished lots: customer, date, quantity and lot code. See 21 CFR 1.1340 and the older one-step-forward rule, 21 CFR 1.345.
- Reconcile the quantities. Compare what you received, used, shipped and still hold, and explain any difference. This is good practice, not an FSMA 204 requirement.
- Draft the outputs. Write the list of customers to notify and a sample notice. Put the lot’s records into a sortable spreadsheet, as in the 24-hour spreadsheet guide.
- Stop the clock and debrief (30 minutes). Compare the result with the target you set. Assign each gap an owner and a due date.
Label every message as a drill. Do not send a mock notice to a real customer without telling them it is practice.
FSMA 204 gives you 24 hours, or a time FDA agrees to, for a real request. If one lot takes more than a couple of hours to trace, a request covering many lots will be hard to meet. Scale up before you feel comfortable.
What should the record of the exercise show?
Write it so a stranger, such as an auditor, could follow it:
- Date, scenario, and the product and lot chosen
- Who took part and what each person did
- Start and end times, and how long each piece took
- What you found, and the document type and number each record came from
- The quantity reconciliation, with any difference explained
- Every gap: what you had to guess, search for or ask about
- Corrective actions, each with an owner and a due date
- The date of the retest, and a sign-off
What does a simple drill record look like?
Paste these tables into a spreadsheet. All values below are made up, so replace them with your own.
Drill summary
| Field | Example entry (made up) |
|---|---|
| Drill date | 2026-09-30 |
| Scenario | Supplier A reports a possible problem with basil lot A-2291 |
| Product traced | Fresh basil, 4 oz clamshell, lot 26245-BAS-01 |
| Team | Person 1 runs the trace, Person 2 pulls records, Person 3 keeps time |
| Start and end | 1:00 pm to 3:10 pm |
| Total time | 130 minutes |
| Your target | 120 minutes |
| Result | Target missed, gaps below |
Trace log
| Step | Record to find | Where found | Minutes | Gap? | Fix, owner, due date |
|---|---|---|---|---|---|
| 1. Receiving | Supplier lot, date, quantity | Invoice 4417 and receiving log | 12 | Lot code only on the case label | Add lot to receiving log, Person 2, Oct 15 |
| 2. Production | Finished lots that used lot A-2291 | Batch sheet B-310 | 25 | Batch sheet lists the ingredient but not its lot | Add a lot field, Person 1, Oct 20 |
| 3. Shipping | Customers who got lot 26245-BAS-01 | Bills of lading and email | 48 | Two shipments found only in email | Save all bills of lading in one folder, Person 3, Oct 17 |
| 4. Reconcile | Received, used, shipped, on hand | Inventory sheet | 20 | 3 cases unexplained | Start a waste log, Person 2, Oct 22 |
| 5. Outputs | Customer list, sample notice, spreadsheet | Shared drive | 25 | None | None |
How does a mock recall connect to FSMA 204’s 24-hour requirement?
Under 21 CFR 1.1455, you must make your required records available to FDA within 24 hours of a request, or within a reasonable time FDA agrees to. When FDA needs the information to address an outbreak, a recall or another public health threat, it can specify foods and date ranges or lot codes, and it can ask for the information as an electronic sortable spreadsheet. Some smaller businesses may send another form.
Each drill step maps to a record FSMA 204 expects:
- Trace one up uses receiving records (1.1345).
- Trace through production uses transformation records (1.1350).
- Trace one down uses shipping records (1.1340).
- The spreadsheet in step 7 is a rehearsal for the one FDA can request (1.1455(c)(3)).
FDA ran its own version between March and April 2026. In voluntary tabletop exercises with 15 companies, firms were asked to find records for one product over a date range and provide a sortable spreadsheet within 24 hours. FDA reported that most firms responded within 24 hours and that coordination across the supply chain mattered more than any particular technology. So bring a supplier and a customer into your next drill.
On timing, the original compliance date was January 20, 2026. FDA has proposed moving it to July 20, 2028 (not yet final), and Congress’s FY2026 appropriations law directed FDA not to enforce the rule before then, which FDA says it intends to follow. Check FDA’s Food Traceability Rule page for the current date. The FSMA 204 compliance checklist covers the full set of steps.
Frequently asked questions
Is a mock recall required by law?
FSMA 204 does not require one. The preventive controls rule requires a written recall plan (21 CFR 117.139) for food with a hazard requiring a preventive control, but it does not mention mock recalls. Audit schemes and customers may require them, so check your audit scheme and supplier agreements.
How often should I run a mock recall?
No federal food rule we reviewed sets a schedule. Audit schemes may: SQF Edition 9, for example, asks for a test at least annually. Check your audit scheme and your customer agreements. It also makes sense to rerun the drill after big changes, such as a new supplier, product or record system.
Do I need a recall plan template?
If 117.139 applies to you, you need a plan that fits your facility and names who is responsible for each step. A template is a fine starting point, but FDA’s guidance says plans should be specific to the firm or facility.
Can I drill a food that is not on the Food Traceability List?
Yes. The drill works for any product. FSMA 204 records apply only to listed foods, but your own lot codes and the older one-step-back and one-step-forward records still make a trace faster.
Where Lotcrumb fits
Lotcrumb is being built to link incoming lots to the batches and shipments they ended up in, so a drill like this becomes a search and an export instead of an afternoon in inboxes. Join the waitlist for early access.
This guide is general information, not regulatory advice. Recall obligations depend on your facility and products, so confirm yours with FDA guidance, your audit scheme or a food safety professional.