Kayem Foods' recall of about 1.58 million pounds of ready-to-eat meat and poultry started with a customer complaint. FSIS says a retail customer reported warm product at delivery on October 1, and the company's investigation found a warehouse cooler that had temperature deviations. Any plant that holds product cold should know two numbers: how long a warm cooler would go unnoticed, and how long a complaint takes to become a hold.

What the notices say

FSIS names the trigger. Kayem's release names a cause.

FSIS, October 17. The FSIS recall notice says Kayem Foods Inc., a Chelsea, Massachusetts establishment, is recalling approximately 1,584,361 pounds of ready-to-eat meat and poultry "because they may have experienced temperature abuse during storage." It's a Class I recall. The products were produced from about March 31 to October 7, 2026, carry establishment numbers M/P 7839, P 20935A and M 9520, and went to retail and foodservice locations nationwide and in Hong Kong.

The notice is specific about how the problem surfaced: "The problem was discovered after the firm received a retail customer complaint regarding warm product temperatures at point of delivery on October 1, 2026." The establishment then determined that it had stored various products "in a warehouse cooler that experienced temperature deviations." FSIS reports no confirmed illnesses.

Kayem, October 16. The company's release says the products were "stored and shipped between June 7, 2026, and October 14, 2026." It attributes the recall to "a cooling system malfunction at one of the company's warehouses that resulted in storage temperature deviations." CEO Matt Monkiewicz says the company has "learned from and corrected the issue." Kayem's product list runs from Fenway Franks and other hot dogs to bacon, Al Fresco chicken sausage, turkey breast, ham and liverwurst.

What they leave out

Neither source says how warm the cooler got, for how long, or what the cooler's own monitoring showed.

There are no temperatures and no duration. FSIS doesn't name a pathogen or any other hazard. The cause stops at "a cooling system malfunction." Nothing says whether the cooler had a continuous logger or an alarm, who reviewed either one, or when product went on hold. The complaint came October 1. Kayem's storage and shipping range runs to October 14. The notices don't say when the affected product stopped moving.

The two date ranges measure different things. FSIS gives production dates. Kayem gives storage and shipping dates. Neither source explains how the two relate.

Why a complaint can get there first

A temperature record only protects product if someone sees the bad reading before that product ships. Three things stretch that gap.

Review lag. A log reviewed at the end of the week tells you about last week. FDA's rule for a facility that only stores unexposed packaged food, 21 CFR 117.206, sets the review of monitoring and corrective action records "within 7 working days after the records are created," or longer with a written justification from the preventive controls qualified individual. The recalled Kayem products carry the USDA mark of inspection, so this FDA section is here as an example of review timing. The timing problem carries to any plant. If product leaves a cooler faster than anyone reads that cooler's log, the review can date a failure but can't stop the shipment.

Alarms that don't reach anyone. The same section lets a storage facility keep "affirmative records demonstrating temperature is controlled or exception records demonstrating loss of temperature control." An exception record is only as good as the alarm behind it. A dead backup battery, a probe mounted next to the evaporator coil, a high limit that pages nobody, or a call list with the number of someone who left in the spring all produce the same record: nothing.

Air isn't product. The Kayem complaint was about product temperature at delivery. A wall probe reads air, and air comes back down fast once the door closes. A pallet that warmed through takes far longer. The room can log in range while the product on the pallet is still warm.

The check to run this week

Measure how long a warm cooler would go unnoticed in your plant and how long a complaint takes to become a hold. Write both numbers down.

1. Pull 90 days of cooler logs and who reviewed them. For every cooler, freezer and holding room that touches finished product, pull the last 90 days of temperature records. Next to each day, write who reviewed it and the date they signed. Look for gaps, flat lines (a stuck probe reads the same number for days), out-of-range readings with no corrective action attached, and reviews signed in one batch at month end. Then put the review lag next to how long product sits in that room before it ships.

2. Force a test alarm. Pick an off-shift hour and trip the alarm with a real reading: warm the probe until it crosses the high limit. Time three gaps: trip to first notification, notification to a person acknowledging it, acknowledgment to someone standing at the cooler. Confirm the call list has current numbers, that a missed call escalates to the next person, and that the system alarms on power loss and probe failure as well as high temperature. Write down every step that depended on one person.

3. Time complaint-to-hold on your last three complaints. For each one, write down when the complaint came in, when QA saw it, when the affected lots were identified, and when they went on hold. Use the timestamps in your complaint records, not memory. For any temperature complaint, check whether someone pulled the storage log for that lot. Then follow each complaint to its corrective action with the one-finding trace test.

4. Ask your third-party warehouse for the same. If anyone else holds your product cold, ask in writing for 90 days of temperature records for the rooms your product sits in, their alarm escalation list, their last alarm test and its result, and how fast they'll tell you about a deviation that touches your lots. A facility solely engaged in storing unexposed packaged refrigerated food that needs time/temperature control already has to monitor, keep records and review them under 117.206, so for that kind of warehouse the data should exist. Put the notification time in the storage agreement and file it with the warehouse's approval record.

FAQ

What caused the Kayem recall? FSIS says the products "may have experienced temperature abuse during storage" in a warehouse cooler that had temperature deviations. Kayem's release names "a cooling system malfunction at one of the company's warehouses." Neither gives temperatures, a duration or a deeper root cause.

What dates does the Kayem recall cover? FSIS lists products produced from about March 31 to October 7, 2026. Kayem says the products were stored and shipped between June 7 and October 14, 2026. Kayem's product list gives brands, UPCs and best-before date ranges.

What is a Class I recall? FSIS defines it as "a health hazard situation where there is a reasonable probability that the use of the product will cause serious, adverse health consequences or death." It's the most serious of FSIS's three recall classes.

What does FDA require of a warehouse that stores refrigerated packaged food? Under 21 CFR 117.206, a facility solely engaged in storing unexposed packaged food that holds refrigerated packaged food needing time/temperature control for safety has to set temperature controls, monitor them, take appropriate corrective action if a loss of temperature control may impact the food's safety, calibrate its temperature monitoring and recording devices or check them for accuracy, and review monitoring and corrective action records within 7 working days, or a longer timeframe with a written justification.

Run the alarm test first, on the shift with the fewest people in the building. If you want to see how Beacon ties a complaint to the lots it names, book a call.

What the three notices say

Each notice concerns an allergen the label did not declare.

Saint Francis Apizza, Cincinnati. The company announced the recall on October 1 and FDA posted it on October 3. Four frozen pizzas: Pepperoni, Plain Cheese, Supreme, and Mushroom and Onion. The title calls it a recall "for Missing Sub Ingredients on the Label for Soy Which Includes Soybean Oil and Soy Lecithin, an Allergen." The body says the pizzas were misbranded "due to the soy allergen not being declared on the label."

Oliva LLC, Bethlehem, Connecticut. Announced and posted October 9. About 250 units of Riad's Oliva to Go Baba Ghanouj, Spicy Baba Ghanouj and Hummus, sold in Litchfield County, Connecticut and around Great Barrington, Massachusetts. The notice says "the recall was initiated after an inspection revealed that sesame was not declared on the product ingredient declaration." It doesn't say what the ingredient declaration did list.

Pan Pepin, Bayamón, Puerto Rico. Announced October 13, posted October 14. Seven lots of Para Bien Al Grano in a 24 oz box, distributed throughout Puerto Rico, recalled for undeclared sesame. The notice gives no cause. The company says it will "strengthen our labeling and allergen verification procedures."

Oliva and Saint Francis both report no illnesses. Pan Pepin's notice doesn't say either way.

Another came on October 22. WinCo Foods of Boise, Idaho recalled its WinCo Foods brand Hoagie Rolls (16 oz, best-by dates September 10 through November 3, 2026, sold in its stores in California, Idaho, Montana, Nevada, Oregon, Utah and Washington). The notice says the recall began after "the manufacturer, United States Bakery, discovered the packaging did not declare sesame flour in the ingredient list and allergen statement." No illnesses have been reported. Here the sesame wasn't hidden inside another ingredient: sesame flour was an ingredient, and the package didn't list it. Step 3 of the check below, carrying each allergen to the label, catches that case too: the row for sesame flour has nothing in its last column.

Hummus and baba ghanouj are about the last products where you'd expect sesame to go undeclared. It happened anyway, and an inspection caught it.

Sesame has to be on the label even inside another ingredient

Sesame has to appear on the label by name, including when it reaches the product inside another ingredient.

The FASTER Act made sesame the ninth major food allergen. It was signed April 23, 2021, and the requirements took effect January 1, 2023. FDA's FASTER Act page says packaged foods "must also declare sesame as an allergen if they have an ingredient made from sesame." FDA's consumer guidance says it expects sesame to be "specifically listed as sesame on the label if it's part of another ingredient," and names natural flavor and spice mix as examples.

An ingredient's own name only covers the declaration when it already names the allergen's food source. FDA's example is buttermilk. I run an SQF-certified tahini facility in Michigan. Tahini is sesame paste (FDA's import alerts file it under "Sesame Seed Paste (e.g., Tahina)"), and the word tahini doesn't say sesame to a shopper who doesn't already know it.

FDA's FASTER Act page shows the fix with a tahini ingredient list of its own: "Tahini paste (sesame, canola oil), water, garlic, lemon juice, parsley, salt." The sesame sits in parentheses inside the tahini line. A "Contains sesame" statement next to the ingredient list does the same job.

The pizza notice names two soy ingredients and leaves the rest open

You can't tell from the Saint Francis notice which soy ingredient triggered the declaration, and a label reviewer can't tell from the ingredient names either.

Soy lecithin comes from soy, and FDA's own example of the parenthetical form is "lecithin (soy)."

Soybean oil depends on processing. Under the FD&C Act, highly refined oils derived from a major allergen are exempt from the allergen declaration (FDA's allergen labeling guidance, Q D.9). When the oil is an ingredient, its source still goes in the ingredient list. An oil that isn't highly refined stays under the allergen rules. The peanut oil recall article from June walks through it.

The notice doesn't say whether the soybean oil was refined, which part of the pizza carried either ingredient, or which one drove the recall. All four varieties were recalled, Plain Cheese included. Those are composition questions, and only the supplier's spec answers them.

Why reading names misses it

A label review that works from the formula sees one line per ingredient, and the allergen sits one level below that line.

A formula says tahini, dough, pepperoni, seasoning blend. Each of those has its own ingredient list, and that list lives in the supplier's spec, usually in a different folder from the label artwork. If nobody opens the spec during label review, whatever is inside the ingredient never reaches the label.

The rules already expect the deeper read. Under 21 CFR 101.4(b)(2), an ingredient that itself contains two or more ingredients and has an established common or usual name is declared with "a parenthetical listing of all ingredients contained therein," or by listing each of its components in the finished food's ingredient statement. FDA's guidance applies the same logic to seasoning mixes: the sub-ingredients go on the finished label by their common names, and a major allergen in the mix gets declared even when it's only an incidental additive in the finished food.

A sub-ingredient miss needs no changeover error, like the two-recall day in April, and no recipe change. It can sit on a label from the first run.

The check to run this week

Trace every multi-component ingredient from the supplier's full composition down to the finished-product label, and put a signature on the trace.

1. List the ingredients that hide something. Go formula by formula. Mark every ingredient with its own ingredient list: sauces, bases, seasonings and spice blends, flour blends, doughs, cheeses, cured meats, flavors. Mark every ingredient whose name doesn't say its source, like tahini.

2. Get the full composition in writing. For each one, get the supplier's current specification with every sub-ingredient listed, plus an allergen statement that answers yes or no for each of the nine major allergens and says whether any allergen-derived oil is highly refined. The supplier's QA signs and dates it. If a blend is proprietary, the allergen statement still covers all nine. File it with the supplier's approval record.

While the tahini supplier's file is open, check FDA's import alerts too. FDA added AL MALAZ COMPANY FOR TRADE AND IND, of Cairo, Egypt, to Import Alert 99-19 on September 21, 2026, with tahini listed, and the alert names more than a dozen firms under its sesame seed paste codes. That one's a Salmonella alert, not an allergen alert, but it belongs in the same supplier file.

3. Carry each allergen to the label. For each finished product, write one row per allergen: finished product, ingredient, sub-ingredient, allergen, and where the label declares it (by the ingredient's own name like sesame flour, in parentheses after the ingredient, or in the Contains statement). A row with an empty last column is an undeclared allergen. Someone other than the person who wrote the formula does the review, and the QA manager signs it.

4. Re-run it on a trigger. Re-check a product's trace whenever a supplier changes, a supplier sends a revised spec, the formula changes, or the label artwork changes. Re-confirm every supplier spec on a fixed date at least once a year. Receiving belongs in this too. A substitute tahini or a backup dough supplier brings a different spec, and the trace only holds for the item it was built on.

FAQ

Does "tahini" on an ingredient list declare sesame? Put the word sesame on the label. An ingredient's name counts as the declaration only when it already includes the allergen's food source, like buttermilk. FDA's own example writes "Tahini paste (sesame, canola oil)."

Does soybean oil need a soy allergen declaration? Not when it's highly refined. Highly refined oils are exempt from the major food allergen definition, though when soybean oil is an ingredient, it still appears in the ingredient list by name. Oil that isn't highly refined stays under the allergen rules, so get the refining status in the supplier's spec.

When did sesame become a major food allergen? The FASTER Act, signed April 23, 2021, made sesame the ninth major food allergen. Its labeling requirements took effect January 1, 2023.

Pull the trace for your hummus first, or whatever your plant makes where the allergen seems too obvious to check. If every row has a last column, you're done. If you want to see how Beacon runs an allergen label review, book a call.

A person earns a training certificate by finishing a course. Where a food safety rule applies, regulators require a written plan and a trained or qualified person behind it. A facility earns a scheme certificate when a certification body audits it against a scheme.

What is HACCP certification?

There is no single HACCP certification. When a customer or an auditor asks for it, your first job is to find out which of the three they mean.

HACCP training certificates

A HACCP training certificate says one person completed a course. The International HACCP Alliance accredits HACCP training programs for meat, poultry and other food products. People who finish an accredited program receive a certificate of completion carrying the Alliance seal.

FDA's preventive controls rule has its own standardized course, developed by the FDA-funded Food Safety Preventive Controls Alliance, and participants receive a certificate of completion. Either way, the certificate belongs to the person who took the course, so it leaves with them if they change jobs.

What USDA requires

What regulators require is a plan, built the way the HACCP plan explainer shows, and a trained person behind it. In a USDA meat or poultry plant, whoever develops or reassesses the HACCP plan must have completed a course on the seven principles, including a segment on writing a plan and on reviewing records.

The rule, 9 CFR 417.7, sets the course content and doesn't mention a certificate. When FSIS verifies a plant's system, its activities include reviewing the HACCP plan and the CCP records (9 CFR 417.8).

What FDA requires: HACCP plans and PCQIs

FDA's seafood and juice rules also require a written HACCP plan whenever the processor's hazard analysis finds a hazard reasonably likely to occur, each with its own trained person. Facilities subject to the preventive controls rule, 21 CFR part 117, must write a food safety plan instead, prepared or overseen by a preventive controls qualified individual, a PCQI. The exemptions from that rule are listed in 21 CFR 117.5.

Under these FDA rules, the trained person needs training equivalent to a standardized curriculum FDA recognizes as adequate, or job experience that qualifies them (21 CFR 123.10, 120.13 and 117.180). The job-experience route is an FDA route only, and the USDA rule above has no equivalent.

Is HACCP certification required?

For the facility, no. Where a rule applies, regulators require the plan and a trained or qualified person. When a customer or an auditor asks for a certificate, ask which one they mean.

Facility certification: SQF, BRCGS, IFS, FSSC 22000

Facilities get certified to audited schemes such as SQF, BRCGS, IFS and FSSC 22000. All four are recognised by the Global Food Safety Initiative, GFSI, whose benchmarking requirements expect each recognised programme to cover HACCP or a HACCP-based system.

The requirement for one of these certificates comes from a buyer, not from USDA or FDA. A certification body audits the site and issues the certificate: SQF, for example, licenses certification bodies to conduct SQF audits and issue SQF certificates.

Codex HACCP audits and GMP audits

GFSI's list of recognised programmes has no standalone audit against the Codex HACCP guidelines and no standalone GMP audit. If a customer asks for a certificate from either kind of audit, treat it as a separate request. Ask which standard the audit has to follow.

A check to run this week

List every certificate a customer, a buyer or an auditor asked your plant for this year. Next to each one, write which kind it is: a person's training certificate, the plan with its trained person, a GFSI scheme certificate, or a certificate from another audit, such as a Codex HACCP or GMP audit.

Then pull the training record for whoever developed or last reassessed your HACCP plan. In a USDA plant, that record should show a course on the seven principles that covered writing a plan and reviewing records. Under FDA's seafood, juice and preventive controls rules, it should show recognized training or the job experience that qualifies the person. If that person has left, the plan's next reassessment needs someone whose own record meets the rule.

FAQ

Is HACCP certification required by law?

Not for the facility, though where a rule applies, USDA and FDA require a written plan and a trained or qualified person behind it. The plan is either a HACCP plan or a food safety plan under the preventive controls rule. A facility certificate comes from a buyer's requirement, such as a GFSI scheme audit.

What is the difference between a HACCP certificate and HACCP certification?

A HACCP certificate is usually a training certificate: it shows one person completed a course, and it belongs to that person. Facility certification comes from an audit of the site against a scheme such as SQF, BRCGS, IFS or FSSC 22000, and a certification body issues it.

See how Beacon keeps training records and audit evidence together

I built Beacon so your HACCP plans, the training records behind them and your audit packets sit in one place, ready for the next customer who asks for a certificate. Watch the demo.

Sources

• International HACCP Alliance, Accreditation Application for HACCP Training Programs (revised February 2001), section 1: https://www.haccpalliance.org/wp-content/uploads/2022/03/AccreditationApp.pdf

• FDA, FSMA Training: https://www.fda.gov/food/food-safety-modernization-act-fsma/fsma-training

• FDA, Food Safety Preventive Controls Alliance: https://www.fda.gov/food/food-safety-modernization-act-fsma/food-safety-preventive-controls-alliance

• 9 CFR 417.7, Training: https://www.law.cornell.edu/cfr/text/9/417.7

• 9 CFR 417.8, Agency verification: https://www.law.cornell.edu/cfr/text/9/417.8

• 21 CFR 123.6, Hazard analysis and HACCP plan (seafood): https://www.law.cornell.edu/cfr/text/21/123.6

• 21 CFR 123.10, Training (seafood): https://www.law.cornell.edu/cfr/text/21/123.10

• 21 CFR 120.8, HACCP plan (juice): https://www.law.cornell.edu/cfr/text/21/120.8

• 21 CFR 120.13, Training (juice): https://www.law.cornell.edu/cfr/text/21/120.13

• 21 CFR 117.5, Exemptions: https://www.law.cornell.edu/cfr/text/21/117.5

• 21 CFR 117.180, Preventive controls qualified individual: https://www.law.cornell.edu/cfr/text/21/117.180

• GFSI, recognised certification programme owners: https://mygfsi.com/how-to-implement/recognition/certification-programme-owners/

• GFSI Benchmarking Requirements Version 2024, Part II Implementation Handbook (Part III key elements): https://mygfsi.com/wp-content/uploads/2024/12/Benchmarking_Requirements_v2024_Implementation_Handbook_Part_II.pdf

• SQF Food Safety Code: Food Manufacturing: https://www.sqfi.com/the-sqf-code/choose-your-code/library-of-codes/food-manufacturing

• FSSC 22000 scheme page: https://www.fssc.com/fssc-22000/

What actually changed, and when

Four named food safety platforms have changed owner since October 2024 and one rebranded. Every line below is sourced to the acquirer's or the company's own announcement, linked in the table.

Trustwell is the compressed version of the whole pattern. ESHA Research and FoodLogiQ merged in October 2022 with investment from The Riverside Company, rebranded as Trustwell in February 2023, and passed to TPG's Rise Funds in January 2026. A plant that signed with FoodLogiQ in early 2022 has been through two changes of ownership and a new company name without ever switching software.

Ideagen adds a layer most buyers never look at. Hg took Ideagen private and Ideagen delisted from London's AIM market on July 8, 2022. Check the corporate parent as well as the vendor, because a product can sit inside a division that sits inside a sponsor-held company, and that's several layers between you and whoever sets the budget.

None of this is scandal. Consolidation is what happens to a software category once the buyers are real and the recurring revenue is provable. The consequences land on a renewal date, so find out who owns the product now before you sign the next term.

Who owns the roadmap now

After a close, ask who funds this product's roadmap, because it may no longer be the team that sold you the software.

Veralto said where TraceGains was going in its own announcement. It placed the product in the Product Quality & Innovation segment and called it complementary to Esko, Veralto's packaging and label design workflow business, and the FY2024 10-K puts TraceGains in that same segment. That's a coherent strategy. It also means releases get prioritized against packaging and label workflow demand, and your supplier document backlog competes with that.

Ask for a name. Who is the product manager for this product today, what shipped in the last two quarters, and what's committed for the next two. Get the answer in email, from someone who will still be there next year.

Pricing and per-user seats

Don't assume a price change waits for renewal. Check your current term, the renewal clause, and any cap on increases.

Acquirers buy recurring revenue. Veralto told the market TraceGains was on track for just over $30 million in sales in 2024, with more than 95% of it recurring. That figure is the asset, and growing it is the job of whoever runs the business now. Ask what that means for your line specifically.

Per-user seats are where this gets expensive for a plant. If you have 40 people on the floor who should be entering their own checks, a seat-based model charges you for doing the thing the software was bought to do, and the workaround is a shared login that destroys attribution on every record it touches. Ask for the renewal number in writing and multiply it out over three years before you compare anything.

Whether your product is becoming a module

Ask whether the product is still sold and supported on its own, and watch whether the parent still names it separately in its own marketing.

Ideagen's July 2025 announcement folded Safefood 360°, Authenticate, and its former Qadex supply chain product into a single food and beverage division. That's a reasonable way to sell to a large manufacturer that wants one contract. For a single-site plant that bought one of the three, it means the thing you bought is now a component of a suite built for somebody bigger.

The SafetyCulture rebrand to Mitti on August 11, 2026 is the mildest version and still not free. No ownership change was announced, but Mitti's own developer guidance says customer organizations move to the Mitti domains in stages into 2027, each on its own emailed window, and that sites restricting outbound traffic need the new domains on the allowlist before that window. Add the paperwork: every SOP, training deck, screenshot, and work instruction at your site that says SafetyCulture is now out of date, and document control says you have to fix them.

Where your records live and how you get them out

Run a real export now, while you're mid-term and nobody is in a hurry, and inspect what it actually contains.

Your vendor may well offer an export. What matters is what comes out of it. A CSV of CCP readings that drops the reviewer name, the electronic signature, the timestamp, and the attached photo gives you numbers in a grid with no evidentiary value. Pull a real month of data and open it. If the signatures don't survive, you have found your actual switching cost.

Dates are the other half. Trend evidence only counts if the timeline comes with it, which is why some SQF Edition 10 evidence can't be backfilled: a culture score moving over two surveys, an environmental monitoring series, a corrective action closed and verified months later. Migrate badly and your history arrives in the new system stamped with the import date, which reads to an auditor as a system with no history. Ask the vendor, in writing, whether the export preserves original record dates and signature metadata, and whether attachments come with it or as a separate dump you have to re-associate by hand.

Assignment, change of control, and data return

Read your own MSA rather than assuming. Four clauses decide what an acquisition can do to you.

The assignment clause, which sets whether the vendor can transfer the agreement without asking you. The change of control language, which in many contracts isn't there at all, so check rather than assume. The termination and data-return terms: how many days after termination your data stays available, in what format, and whether they'll certify deletion. And any cap on renewal price increases, which is the clause you most want and least often have.

Renewal is the one moment the vendor needs something from you, so that's when you ask for a data-return commitment with a number of days attached. Have your attorney read the clauses before you sign anything. This is contract mechanics, not legal advice.

How support changes

After a close, ask whether your named contact, your response commitment, and your included configuration help have changed.

The things worth checking by name are whether a named customer success manager has become a pooled queue, and whether configuration help that used to be included is now a professional services line item. Neither is unreasonable at a larger company. It's a problem when you bought partly on the strength of a person who answered the phone, and that was never written into the agreement.

Ask three things. Who is my named contact after this renewal, what response time is contractually committed rather than aspirational, and is setup or reconfiguration help still included in the subscription.

The eight questions to run before you sign

Run these eight questions on any vendor before you sign, acquired or not. Send them as one email and keep the reply.

1. Who owns this product's roadmap today, and what's the product manager's name?

2. What shipped in the last two quarters, and what's committed for the next two?

3. What is the renewal price, and is there a cap on future increases?

4. Is this product still sold and supported standalone, or only inside a suite?

5. Can I export all of my records myself, without a support ticket or a fee?

6. Does the export carry original dates, electronic signatures, reviewer names, and attachments?

7. What do the assignment, change of control, and data-return clauses say?

8. Who is my named support contact after renewal, and what response time is in the contract?

If the answers are good, renew and stop worrying about it. If four of the eight come back vague, start a parallel evaluation now rather than in the last month of your term.

When the bigger owner is the right answer

A larger parent is a real advantage for some plants, and it's worth saying plainly.

If you run six sites and need one contract, one invoice, and one security review, a company the size of Veralto or Ideagen is built for exactly that. Procurement teams that require SOC 2 and a completed security questionnaire before a signature should ask each vendor for both and see what comes back. Integration libraries track engineering headcount, so ask any vendor for its current connector list and check your ERP, LIMS, and warehouse system against it. And a company with a corporate parent is less likely to go dark on you, which is a real form of continuity.

If that's your profile, the right move after an acquisition is to renegotiate, not to leave.

Where SystemPath fits

SystemPath is built for 25-to-500-employee plants that want every shift on the system rather than a licensed few. I run an SQF-certified tahini facility in Michigan and I build Beacon, so weigh the rest accordingly. System Path LLC is founder-owned with no outside investor, the platform carries unlimited users so the floor enters its own records, and form records export on demand as CSV or per-record PDF, with the format deciding which signatures and attachments come along. The honest other side: we're small and we don't have SOC 2 yet. On integrations, ask us for the current connector list. The same eight questions apply to us, and question seven hardest, because a small vendor is its own kind of continuity risk. Ask us for the data-return terms the way you'd ask anyone else, and see our food safety software platform and document control before you decide.

FAQ

Does an acquisition void my software contract? Read your own agreement rather than assuming either way. Look at the assignment clause, the change of control language, the termination and data-return terms, and any cap on renewal increases. Don't assume an acquisition leaves the contract or the product unchanged until renewal.

How long after an acquisition do prices typically change? That depends entirely on your agreement, so check the current term, the renewal clause, and any cap on increases rather than assuming the change waits for renewal. Request the renewal quote 90 days before your term ends instead of 30.

What should I export before a vendor transition? Everything with a date on it: CCP and monitoring records, corrective actions with their closure and verification entries, supplier documents and certificates, environmental monitoring results, training records, and audit findings. Verify that signatures, timestamps, and attachments survive the export before you rely on it.

Is a private equity owner worse than a strategic acquirer? They optimize differently, not necessarily better or worse. A strategic buyer may fold the product into an existing suite, which is what Veralto's release describes in placing TraceGains alongside its Esko packaging software. A financial sponsor may hold for a period and sell again, which is what the Trustwell releases show between Riverside in 2022 and TPG's Rise Funds in January 2026. Ask the same questions of both.

My vendor rebranded but wasn't sold. Does that matter? More than you'd expect. SafetyCulture becoming Mitti in August 2026 was presented as a rebrand, and no ownership change was confirmed in the materials reviewed, but Mitti's developer guidance still has customer organizations moving to new domains in stages into 2027, with allowlist updates to make before your window. Every internal document naming the old product also goes out of date, and document control means someone has to update them.

When should I actually switch platforms? When the answers to questions one, two, and four come back vague, and the export in question six works. Confirmed record portability plus an uncertain roadmap is the case for moving. An uncertain roadmap with records you can't get out cleanly is a case for fixing the export problem first.

Run the eight questions on whatever you're renewing this quarter. Send them 90 days before your term ends, not in the last week, when the only answer you'll get is the renewal quote. If you want to see how a platform built for a single-site plant handles the records and the export side of it, book a call.

The inspector's form splits hands five ways

Five numbered items on the FDA model Food Establishment Inspection Report cover what your program files under handwashing. From the marking instructions in the 2022 Food Code, Annex 7, Guide 3-B:

• 8. Hands clean and properly washed

• 9. No bare hand contact with RTE foods or a pre-approved alternate properly followed

• 10. Adequate handwashing sinks, properly supplied and accessible

• 40. Personal cleanliness

• 46. Gloves used properly

Items 8, 9 and 10 sit together under "Control of Hands as a Vehicle of Contamination," inside items 1 through 29, the risk factor and public health intervention half of the form. Items 40 and 46 sit in the Good Retail Practices half, under "Prevention of Food Contamination," with a wiping-cloth item and a produce-washing item between them.

That split isn't cosmetic. The header field is labeled "Number of Risk Factor / Intervention Violations," and it counts only boxes marked OUT in items 1 through 29. The marking instructions say the Good Retail Practices "have been given less importance on the inspection form." For most of them the guide drops the risk factor IN, OUT, N.A. and N.O. differentiation. The inspector marks the item, documents each violation in "Observations and Corrective Actions," and records COS or R on items marked OUT. A fingernail finding and a glove-use finding are real citations that never touch that number.

Each item carries its own stack of code sections. Item 8 pulls in five: clean condition of hands and arms, the cleaning procedure (20 seconds, in a handwashing sink), when to wash, where to wash, and hand antiseptics. Item 10 pulls in eight, from sink numbers and placement to soap, hand drying, signage, and the requirement that the sink deliver water at a minimum of 85°F through a mixing valve or combination faucet. Item 10 for a blocked sink and item 10 for a cold-water-only sink are the same number against two problems with two different owners.

Gloves split as well. Item 46 reaches only §3-304.15(B)-(D), the slash-resistant and cloth glove limits. The single-use glove rule, one task and then discard, is §3-304.15(A), and the guide cites that one under item 15, "Food separated and protected."

Two adjacent items get mistaken for this group. Item 6 (proper eating, tasting, drinking, or tobacco products use) and item 7 (no discharge from eyes, nose, and mouth) are hygienic practice items, not hand items. They show up on the same report because §2-301.14(D) requires a handwash after coughing, sneezing, tissue use, tobacco use, eating, or drinking. Tasting is somewhere else again, under §3-301.12. Count them as triggers, not as hand hygiene citations.

Manufacturers get the same split with different numbers

Food manufacturers hit this taxonomy problem under a different citation scheme. 21 CFR 117.10(b) lists nine numbered methods for maintaining cleanliness in a single paragraph. Five of them are personnel-hygiene provisions covering the same ground:

• (b)(2) maintaining adequate personal cleanliness

• (b)(3) washing hands thoroughly "before starting work, after each absence from the work station, and at any other time when the hands may have become soiled or contaminated"

• (b)(4) removing unsecured jewelry and hand jewelry that can't be adequately sanitized

• (b)(5) maintaining gloves in an intact, clean, and sanitary condition

• (b)(8) confining eating food, chewing gum, drinking beverages, and using tobacco to areas other than where food may be exposed or where equipment or utensils are washed

Two observations on a Form 483, one against 117.10(b)(3) and one against 117.10(b)(5), are two problems: a wash-timing failure and a glove-condition failure. They get read as "personnel hygiene" and closed with a retraining roster.

Co-packers get a third version of it: several customer schemes, a state inspection, and a GFSI-benchmarked audit mapped against one program, each with its own terminology and numbering.

A 40-line report is not 40 problems

Raw granularity buries the action. The obvious lesson from the five-item split is "be more granular," and it's only half right.

Two failure modes show up, and they're opposites.

The first is collapse. The report has three hand findings, the QA manager reads the theme instead of the lines, opens one corrective action called "handwashing retraining," and closes it with a signed roster. The sink that couldn't reach 85°F is still cold. The cloth gloves are still touching RTE product. Both get cited again, and the sink comes back with the R box marked.

The second is explosion. A 40-line report becomes 40 corrective actions with their own owners and due dates, and by week three nobody can tell which of them share a cause. The log stops being something anyone reads.

The report gives you a list of line items. It does not give you the list of causes, and you need both to close it out.

The mapping step nobody writes down

Between the inspection report and your corrective action log there's a translation step, and in most facilities it lives in one person's head. Write it down: one row per cited item, mapping the inspector's line to the program element that owns it.

The mapping is where the ownership problem surfaces. On a plant program, all five hand items usually point at the same SOP and the same owner. On the inspector's form they belong to different functions:

Item 10 is a maintenance work order. Item 46 is a training and supply problem. Retraining the crew fixes neither, which is why the retraining corrective action keeps failing verification.

One mechanical rule for building it: use your last report's line items, not FDA item numbers. The Food Code is a model that jurisdictions may adopt and modify, so the wording on the report you actually received is the wording your crosswalk has to carry.

Open corrective actions per cited item, roll up per root cause

Open one corrective action per cited item, then group them by root cause. Doing it in the other order is what produces the repeat citation.

The reason is verification. The guide ties R to the same violation under a particular item number cited on the last report, so your closure evidence has to line up with each cited item and each violation under it.

The guide's own example is the cleanest version of this. Item 10 is marked out because the hand sink has no soap and no paper towels. The person in charge puts soap out and does not replace the towels, so COS is not marked, because "all violations under that item were not corrected." One item number, two violations, one of them closed.

Root cause grouping sits above the item log, not in place of it. Say three citations trace back to one cause: the only hand sink in the prep area runs cold because a mixing valve failed. You have one fix and still three item closures, each with its own evidence: the valve repair, the verification that the sink now delivers 85°F, and the observation record showing the crew washing there instead of at the prep sink. Group the rows by cause to decide what to fix, and keep the item log as the thing you close against.

Getting from an immediate correction to a real root cause is its own discipline, and it drives most repeat findings. We covered that depth problem in seven HACCP plan mistakes that lead to audit failures. This is the direction problem: item first, cause second.

Reconcile every cited line against its status before you call the report handled. An item can be open, corrected on site, or already closed, and an unexplained gap between cited lines and tracked items is worth chasing.

Build the crosswalk from your last report

Pull your most recent inspection report and build a one-page crosswalk. It works on a report from any authority.

One row per printed line item in the "Observations and Corrective Actions" section of the report, never per theme.

Four rules make it useful:

1. No merging. Two cited items never share a row, even when they share a cause. The root cause column is where they meet.

2. A blank program element is the finding. A cited item with nothing in column three means the inspector is measuring something your program doesn't track.

3. One accountable owner per row, by name. The same owner can legitimately hold several rows. Record why they hold each one.

4. Carry the repeats forward. Any item marked R gets flagged. R means the same violation under that item was cited on the last inspection, so find out whether the prior correction was incomplete, ineffective, or never made.

Build it on the last report and the gaps show up immediately. Do it again after the next inspection and you have a trend line on which program elements keep drawing citations, which gives an auditor a traceable record of what recurred.

Several of these items close on observed behavior rather than a document, so the training and competency side matters too, but the crosswalk comes first: it tells you what to train against.

Where the work actually goes

Most of the labor here is transcription: getting a scanned report into rows a corrective action system can track, and getting the facility items in front of maintenance instead of QA.

That transcription is what Beacon does with a regulatory inspection. The uploaded report gets extracted into coded violations, a person reviews and commits them, and only then do committed critical violations create CAPAs while non-critical ones create follow-up tasks. Owner assignment follows the facility's resolved responsibility settings.

Your program shouldn't make the inspector's item numbers its internal taxonomy. Use them as the crosswalk's traceability key and nothing more.

If you want to see how an inspection report turns into tracked corrective actions without the retyping, book a walkthrough.

What the recall record says

The recall covered two Functional Formularies products, and the reason recorded in the FDA enforcement record is a laboratory using the wrong vitamin A method. Nutricia North America, of White Plains, New York, initiated it voluntarily on May 26, 2026, covering LIQUID HOPE Organic Whole Foods Meal Replacement Peptide Formula Berry Medley and NOURISH Organic Whole Foods Meal Replacement Peptide Formula Berry Medley, both in 12 oz pouches.

The stated reason, verbatim: "Subpotent for Vitamin A. The firm discovered that the testing laboratory used the wrong method when testing for Vitamin A. The test results gave a higher concentration of vitamin A than what is actually in the product."

FDA classified both recalls Class II on July 13 and published them July 22. Class II covers a situation in which use of a violative product "may cause temporary or medically reversible adverse health consequences or where the probability of serious adverse health consequences is remote." Both were still listed as Ongoing in the openFDA enforcement data as of its September 2, 2026 update.

The quantities are not small. Liquid Hope: 1,363 cases of 12 pouches plus 16,298 cases of 24. Nourish: 2,050 cases of 12 plus 55,310 cases of 24. Shipped to 48 states and Washington DC, and also to Canada and Australia.

The sentence that matters in that reason is the second one: "The firm discovered." Nutricia found it themselves. Someone inside went looking at how the test was run rather than at what it returned.

The record stops there. It doesn't say whether a COA changed hands, what number was on it, or what Nutricia's vitamin A spec required. What it does say is that a wrong-method result overstated vitamin A and product shipped on that result, which means something accepted the number.

The method line is on the COA and not in the review

A COA review that compares the reported value to the spec limit cannot catch a method error, because the method line is not part of the comparison.

Open any COA. It gives you an analyte, a result, units, a spec range, and a pass or fail. Somewhere on the page, usually in smaller type toward the bottom, it gives you a method reference.

A QA tech reads the result, reads the spec, and stamps it. The method reference sits on the same sheet of paper and never enters the decision.

That method line carries four questions your review never asks:

• Applicability to the matrix. For vitamin A, the applicable method depends on the matrix, the intended use, and the concentration range.

• Validation at the concentration in question. AOAC 992.06 below carries a concentration bound in its own applicability statement.

• Agreement with the spec. The limit was written with some method in mind, and usually nobody recorded which one.

• Coverage by the lab's accreditation, for this analyte and this matrix.

A COA can be accurate to a wrong method and still be wrong about the product. The lab did its job and the chemistry ran to protocol. The number is a faithful report of what that method measures. It just isn't the number your spec is about.

This is the third distinct way a clean COA fails, and the three don't overlap. Two tiers up, the signal starts at a supplier you have no contract with and never appears on any COA you hold. At the sampling level, a negative result is evidence about the sample, not about the lot. Here the sample is right and the lot is right, and the measurement is answering a different question than the one you asked.

The same analyte, different methods, different numbers

Run one sample for one nutrient by two validated methods and you can get two different numbers. Both runs are correct. The gap is the methods.

Vitamin A is a useful illustration because AOAC INTERNATIONAL has several validated methods for it and their scopes are bound to matrix. The paper describing AOAC First Action 2011.15 puts it plainly: "Existing AOAC LC methods are suited for specific vitamin A analytical applications."

AOAC 992.06 is written for milk-based infant formulas containing more than 500 IU of vitamin A per reconstituted quart. Run it as written on specialty formulas and, per the single-laboratory validation published in the Journal of AOAC International, "vitamin A recoveries are low compared to results generated with alternate validated vitamin A methods." The correction was a reagent volume: double the potassium hydroxide in the saponification step.

Same nutrient, same product family, and a sample-prep detail moves the reported number.

The enforcement record doesn't name the method Nutricia's lab used, and there's no reason to guess at it. The direction of error there was high rather than low, so the 992.06 example above is an illustration and not the mechanism. Which method a lab picked matters far less than the fact that the choice moves the number at all.

FDA's own compliance framework for nutrient content builds the method in. 21 CFR 101.9(g)(2) says composites "shall be analyzed by appropriate methods as given in the 'Official Methods of Analysis of the AOAC International,' or, if no AOAC method is available or appropriate, by other reliable and appropriate analytical procedures." Appropriate is doing real work in that sentence.

The tolerance itself is method-aware. For naturally occurring nutrients, the same section says no regulatory action follows a shortfall smaller than "the variability generally recognized for the analytical method used in that food at the level involved." The agency writes the method into the number it will act on. Most supplier specs don't.

What "accredited" actually covers

ISO/IEC 17025 accreditation covers a list of specific methods a lab was assessed on, and nothing outside that list.

A2LA, one of the accreditation bodies, defines a scope of accreditation as "the list of specific tests, types of tests, calibrations, product certifications, etc. for which a Conformity Assessment Body (CAB) is found competent." Then it states the limit directly: "Capabilities that are not listed on the scope are not covered by the CAB's A2LA accreditation."

FDA says the same thing in regulation. Under the Laboratory Accreditation for Analyses of Foods rule, "scope of LAAF-accreditation refers to the methods of analysis for which the laboratory is LAAF-accredited" (21 CFR 1.1102). A lab has to show that "for each method, the laboratory is accredited by a recognized accreditation body to ISO/IEC 17025:2017(E)," and that it has passed a proficiency test within the last 12 months "for each method within the scope of LAAF-accreditation" (21 CFR 1.1138).

Per method. Not per lab.

A current accreditation doesn't make every test an accredited test. Check the scope for the method, the analyte, the matrix, and the range limits. For testing under the LAAF rule, the method used must be "within the laboratory's scope of LAAF-accreditation" (21 CFR 1.1151(a)), and a lab that wants to work outside its scope has to ask FDA in writing under 21 CFR 1.1151(e).

The accreditation logo in the COA header doesn't tell you which side of that line your test landed on. The scope does.

Whose lab it is doesn't change the mechanism

The enforcement record says only "the testing laboratory." It doesn't say in-house or contract, and the blind spot works the same either way.

Owning the lab gives you more access to the method, not more scrutiny of it. The result still arrives as a value on a report, and the person receiving it still compares that value to a limit.

For an accredited lab, obtain the current scope from the lab or its accreditation body. The scope, not the certificate alone, shows whether the method is covered. An internal lab that holds no accreditation has no scope to obtain, which leaves method selection checked only by whoever selected it.

Three columns to add to your COA review

Add three columns to whatever you already track COAs in, and the method stops being invisible.

Method. The method reference printed on the COA, copied into the record next to the result. If the COA doesn't print one, ask for it in writing and make every COA after that carry it.

Lab scope, verified. The date you last obtained the lab's current scope of accreditation and confirmed that the method appears on it for your analyte and your matrix. Get the scope from the lab or its accreditation body, rather than relying on the certificate alone.

Last split sample. The date you last sent a duplicate of the same lot to a second lab and compared the results. Quarterly is a reasonable starting cadence on any analyte that carries a label claim or a spec you release product against.

The first two columns and the first round of scope requests are an afternoon of work. The split sample takes longer because of lab turnaround, but putting it on the calendar doesn't.

One more change costs nothing: put the method in the spec. A specification that reads "Vitamin A: 750 to 1,500 IU per serving" and stops there hands the method choice to whoever happens to run the test that day. A spec line that names the method makes a substitution visible on the COA instead of invisible in the lab.

Beacon reads each COA value against the spec and flags the miss, and a person decides the hold. That value comparison is the part software is good at. The method column is the part you add, because nothing can check a method the spec never named.

Nutricia's formulas shipped to 48 states, Canada and Australia on vitamin A numbers a wrong method produced. Whatever reviewed those numbers wasn't looking at the method.

If your COAs live in a shared drive and your supplier records live somewhere else, adding a method column is a retyping project before it's a program. Book a call and I'll show you what it looks like when the spec, the COA and the lot are one record.

The rule names a person, not an account

The FDA rule requires the signature or initials of the person performing the activity. SQF requires records to be confirmed by those undertaking monitoring activities.

21 CFR 117.305(f) lists what a record has to include: enough information to identify the plant, the date and when appropriate the time, "the signature or initials of the person performing the activity," and where appropriate the product identity and lot code. Paragraph (d) of the same section says records are created concurrently with the activity they document. Together those provisions require the record to be created concurrently and tied to the person who performed the activity.

SQF gets at it from a different angle. Element 2.2.3.2 requires that all records "shall be legible and confirmed by those undertaking monitoring activities that demonstrate inspections, analyses, and other essential activities that have been completed." The confirmation belongs to the person doing the monitoring, and an entry made under a shared account may not demonstrate it. Edition 9 is still the audited edition for audits before January 2, 2027. Edition 10 audits begin as early as that date, subject to SQFI's transition guidance and its surveillance-audit exception.

One scope note on which sanitation records this reaches. Sanitation under the CGMP subpart doesn't carry a records requirement on its own. Sanitation controls you've identified as preventive controls do: the monitoring, corrective action, and verification records required by 117.190 are subject to every part of subpart F, including 117.305(f). Pre-op verification and sanitation monitoring records are in scope. A daily housekeeping walk is in scope too when your food safety plan treats it as monitoring, corrective action, or verification.

An unattributable signature can't show who did the work

The record needs to connect a qualified person to the task and the time. Strip the person out and you're left with a task and a time.

21 CFR Part 11 is worth reading here even though it doesn't bind you. Electronic records kept to satisfy Part 117 are exempt from Part 11 unless they're also required under some other statute or regulation. It's still a useful reference point for electronic signature controls.

Section 11.50 says a signed electronic record carries the printed name of the signer, the date and time the signature was executed, and the meaning of the signature. Section 11.100(a) says each electronic signature "shall be unique to one individual and shall not be reused by, or reassigned to, anyone else." If a shared shift login is doing the work of an electronic signature, it meets neither half of that sentence. The exemption doesn't change what the record has to show.

How one tablet ends up carrying a whole crew

Shared logins are what's left after four practical problems land on the same device. The details below are a composite, not any real site.

Gloves. Wet nitrile on a capacitive screen is unreliable, and an operator who has to strip a glove to log in will do it twice before deciding somebody else can enter it.

One device per line. If the tablet is mounted at the packaging end and six people work the line, the login belongs to whoever mounted it, usually the lead.

Password fatigue. A twelve-character password with a symbol, typed on a screen keyboard, dozens of times a shift, is an unworkable design. Crews solve it by typing it once at start of shift and leaving the session open.

The QA tech signing for the crew. This one looks like diligence. The tech walks the line, sees the work is done, and enters it because she's the one with the account and the training on the form. Her name goes on all of it.

Put those together and you get the failure. A sanitation crew cleans the floor drains overnight. The work is recorded against the supervisor's account, because his is the login open on the mounted tablet. Weeks later an FDA investigator pulls the drain cleaning records during an environmental swabbing follow-up, points at three nights, and asks who performed them. The supervisor's name is on all three. He worked one of them.

What an auditor does with a signature nobody can place

An auditor may treat the task as unverified and may go on to review related records. The code sets the confirmation and qualification requirements, not the sampling response.

The reason is a requirement most people read past. SQF element 11.2.5.7 says pre-operational inspections "shall be conducted by qualified personnel." Qualified is a claim you back with a training record. The signature on the inspection is the only thing connecting that task to that training file. Cut the link and it gets much harder to demonstrate that a qualified person completed the inspection for that date.

That's a harder problem than a dirty drain. A dirty drain is one corrective action. A records practice that can't attribute entries puts every record it touched in question, and moves the conversation from your sanitation to your record system.

It costs you the investigation too. A pathogen hit on a drain swab starts with what happened on that drain and who was standing there. If the answer is "the supervisor account," the investigation has nowhere to go, and neither does retraining.

Paper has the same hole. Turnover is what opens it.

21 CFR 117.305(f)(3) permits a signature or initials from the person performing the activity, which is why sanitation logs use a small initials box.

Initials only work if something maps them to a person. Plants that do this well keep a signature and initials register: printed name, initials, the specimen signature, employment dates, and the tasks that person is qualified for. Plants that don't end up with "JM" on a stack of logs and a QA manager who left in March, the only one who knew there were two JMs on second shift.

The clock runs longer than people expect. 117.315(a)(1) requires records be retained at the plant for at least two years after they were prepared, and SQF ties retention to customer, legal, and regulatory requirements, at minimum the product shelf life. For a shelf-stable product that can run well past two years. Two years is long enough that "we'll just ask him" stops being a plan.

Digital systems inherit the same obligation. A deactivated user still has to resolve to the person behind the signature or initials on every record they ever signed. Where Part 11 applies, 11.50 also wants the printed name, the execution date and time, and the meaning of the signature. Reassigning a departed employee's PIN or badge number to a new hire rewrites history with no trace of the swap. If that PIN is an electronic signature component, the reuse also runs into 11.100(a).

The fix that works on a wet floor

A defensible shared-device workflow needs three properties, and any one of them on its own leaves the hole open.

Per-person identity at the point of entry, in seconds. A four-digit PIN on a numeric keypad, or a badge tap, rather than a password typed on a screen keyboard. If identifying yourself costs more than a few seconds, the crew will route around it, and the record you get back is a lie told for convenience.

A session that expires on its own. The device stays signed in for the shift. The person doesn't. If an operator walks away and the next one picks up the tablet, the system should already have forgotten who the last one was. Part 11 describes this arrangement at 11.200(a)(1)(i): the full credential opens a single continuous period of controlled system access, and every signing inside that window still takes a component only that individual can use.

The record carries the operator, not the device owner. That's the genuinely architectural part. Most software has one concept of "the logged in user" and writes that name onto everything. A shared floor device needs two: the account the device is signed in under, and the person standing in front of it right now. The second one is what the signature has to say.

Part 11 comes at the same idea from the other direction at 11.200(a)(3): attempted use of someone else's electronic signature requires collaboration of two or more individuals. When a QA tech can sign for the whole crew with one tap, nothing in the design creates that friction.

Beacon's floor workspace separates the signed-in device from the active operator: the operator identifies with a PIN, the session expires fifteen minutes after their last activity, and the record carries the operator rather than the device account.

Run this on last week's sanitation records

Start with two checks: identify the signer, then verify the training record.

Pull last week's sanitation and pre-op verification records. Pick ten signatures or sets of initials at random. Write down the ten names.

If you can name all ten, do the second half, the one that matters on audit day. For each of those ten people, find the training record that qualifies them for the task they signed. Not a general orientation record. The one for that procedure.

If three of your ten come back as "that's the shift lead's account" or "that's whoever was on the tablet," you have your gap, and it's a records gap, not a sanitation gap. Fix the identity at the point of entry, then check that person's training record against the procedure. Identity doesn't prove qualification. It's what makes the training record findable.

This is a different failure from the one where your contracted sanitation crew hands you a service log instead of verification evidence, and different again from the Edition 10 records you can't backfill because they need elapsed time. Those are about what the record contains and how long it's been accumulating. This one is about whose name is on it. A record can have perfect content, perfect timing, and a year of history behind it and still be unusable because nobody can say who made the entry.

It's also the one of the three you can start fixing immediately, because it doesn't need elapsed time. If you're already working through a move off paper, sequence it by name: start with sanitation, pre-op, and CCP monitoring, where the daily execution records carry a person rather than a number.

Book a call to see how per-operator identity works on a shared device without slowing a crew down.

The clause changed its name, and the name is the argument

In Edition 9, element 2.5.3 was Corrective and Preventative Action. In the Edition 10 Food Manufacturing code it reads Corrections, and Corrective and Preventative Action, and SQFI lists it as a Core Clause.

Core Clause is a scoring designation. On the Edition 10 scale a minor costs one point and a minor against a core clause costs two. A major costs five and a core clause major costs seven. A critical costs fifty. Corrective action sits on that core clause list alongside the food safety plan (2.4.3), environmental monitoring (2.4.8), allergen management (2.8.1), product identification (2.6.1), and complaint management (2.1.3).

Edition 10 audits begin as early as January 2, 2027, and SQFI's Edition 10 FAQ states they won't commence any earlier than that date. The start depends on the GFSI benchmarking application and may move later. As of September 2026, Edition 9 is still the code being audited.

What changed is that the procedure is now written out. Element 2.5.3.1 requires the documented method to include, at a minimum:

i. Use of corrections, as applicable, to address the identified issue; ii. Method(s) of analysis used to investigate and identify the root cause; iii. Process for determining and implementing the corrective and preventative actions needed to address the root cause; iv. Verification of effectiveness of the implemented actions to prevent reoccurrence; and v. Communication of results to relevant site management and personnel.

The glossary SQFI posted for Edition 10 keeps the definitions the industry already works from. A correction is "action to eliminate a detected non-conformity." A corrective action is one "based on a root cause analysis with the intent to eliminate the cause of a non-conformity and prevent its recurrence." Edition 10 promotes the correction to step one of a five-step procedure, so the immediate fix and the root-cause fix become two entries with two dates.

SQFI's vice president of technical affairs framed the edition as built to help sites "demonstrate, not just describe" their commitment to food safety. For 2.5.3, that means the record has to run from the finding to the verified fix.

One word changed in the verification step

Edition 9 asked that corrective and preventative actions be "determined, implemented, and verified." Edition 10 asks for "verification of effectiveness of the implemented actions to prevent reoccurrence."

Verifying that an action happened and verifying that it worked are two records with two dates. Most CAPA logs carry the first one. A date in a closed column tells an auditor somebody did the task, not that anyone came back later and checked that the problem stopped.

The second record also needs time to pass. You retrain the crew in October and you find out whether the finding recurred by watching the same check through November and December. Closed corrective action loops belong in the pile of Edition 10 evidence that has to accumulate, which is the sorting exercise in the records you can't backfill.

The list of what feeds the process got longer and lost its hedge

Edition 9 said deviations from food safety requirements "may include" four categories, "as appropriate." Edition 10 says what the procedure covers "shall include, but not be limited to" nine.

Edition 9, element 2.5.3.1: "Deviations from food safety requirements may include customer complaints, nonconformances raised at internal or external audits and inspections, non-conforming product and equipment, withdrawals and recalls, as appropriate."

Edition 10, element 2.5.3.1: "These shall include, but not be limited to, deviations of critical food safety limits, complaints, findings at internal and external audits and inspections, non-conforming product and equipment, deficiencies found during annual tests and reviews, verification and validation activities, withdrawals and recalls, and regulatory infractions, and negative trends of the food safety system."

Four entries are additions to the Edition 9 list. (Critical food safety limits were already in Edition 9's own sentence, just before its list.) Deficiencies found during annual tests and reviews covers the mock recall that ran long, the trace test that lost a step, the food defense test, the crisis management test. Verification and validation activities covers the verifier who signed a monitoring record and noted the form was incomplete. Regulatory infractions covers the inspection report sitting on somebody's desk. Negative trends covers the pattern nobody wrote up because no single instance crossed a threshold.

All four get recorded somewhere at most sites. Almost none of them produces a corrective action record.

Environmental monitoring is a core clause of its own at 2.4.8, and a positive result is exactly the kind of issue 2.5.3 exists to catch. Cleaning the area and re-swabbing is a correction. Edition 10 wants the root cause behind the positive and the change that came out of it, which is the same argument running through environmental monitoring under Edition 10.

Contracted services reach the list through internal audit findings. A sanitation vendor's service log is the vendor's record of work performed. A finding against your sanitation program still needs your root cause in your own 2.5.3 record, which is the gap between what vendors hand you and what an audit counts as evidence.

The cross-references already existed. Edition 10 changed what travels along them

Edition 9 already pointed internal audits and complaints at 2.5.3 by number. What has to travel along those references changed, and the CCP deviation clause picked up the same language.

Internal audits (2.5.4). Edition 9 required corrective and preventative actions "of deficiencies identified during the internal audits." Edition 10 requires "root cause analysis, corrections, and corrective and preventative actions for deficiencies or trends indicating potential deficiencies, identified during the internal audits," undertaken according to 2.5.3. The trend half is the addition. Three small repeat findings across three internal audits may form a trend indicating a potential deficiency, and that trend has to enter the 2.5.3 process on its own. The communication item names a recipient with a job: audit results go to personnel "responsible for implementing and verifying the effectiveness of actions taken according to 2.5.3."

Complaints (2.1.3). Complaint management is a core clause in Edition 10. Element 2.1.3.2 requires that "root cause analysis and the corrective action process shall be completed for all adverse trends and serious incidents as outlined in 2.5.3." Edition 9 required root cause on adverse trends and corrective action "based on the seriousness of the incident." Serious incidents are now named alongside adverse trends.

CCP deviations (2.4.3). Edition 9 said deviation procedures "shall also prescribe actions to correct the process step to prevent recurrence of the safety failure." Edition 10 says they "shall include root cause analysis, corrections, and corrective and preventative actions to correct the process step to prevent recurrence of the safety failure." Same sentence, three items inserted: root cause analysis, corrections, and corrective and preventative actions.

Two more clauses read your corrective action records rather than feed them. Element 2.1.2.2 requires the monthly update to site management to include corrections and corrective and preventative actions, results from internal and external audits, and food safety complaints. Change management at 2.3.5.1 covers changes "made as a result of the corrective action process," so an action that alters a process routes back through change control and has to be confirmed or validated there.

Spreadsheets hold both ends and drop the join

The finding gets recorded. The action gets recorded. The key that joins them lives in somebody's head. Six places the thread breaks:

• The internal audit report numbers its findings one way and the CAPA log numbers its actions another. Nothing carries the first number into the second, so the only join is a person who remembers.

• One action absorbs three findings, or three actions come out of one finding. Neither direction survives a pull test.

• The root cause column holds a category instead of a method. "Operator error" is a category. Element 2.5.3.1 ii asks which method of analysis produced it, which means the procedure names the method you use (five whys, fishbone, fault tree) and the record shows it applied to this finding, with the answers written down.

• The closed column holds a date. It doesn't hold a verifier, a verification date, or the evidence that person checked.

• Communication of results lives in a sent-items folder that belongs to neither record.

• Complaints live in a third system, usually customer service, so the 2.1.3.2 pointer into 2.5.3 has no route at all.

Run the ten-finding trace test

Pull last year's internal audit report, pick ten findings, and give yourself two minutes per finding to produce six things.

1. The finding as written, with its date.

2. The correction taken, and when.

3. The root cause, and the method used to reach it.

4. The corrective or preventative action, its owner, and its due date.

5. The verification of effectiveness: who performed it, on what date, against what evidence.

6. Where the result was communicated, and to whom.

Then run it backward. Pick three corrective actions out of the log and name what triggered each one. An action with no source is as much a gap as a finding with no action.

Then run it for coverage. Read the nine sources listed in 2.5.3.1 and mark the ones with no route into your process at all. Annual tests, verification activities, and negative trends are the three that usually sit outside it.

Score which of the six steps drops out, and use the missing step to choose the repair. It's almost always step three and step five, and those are the two Edition 10 wrote out longhand.

The changeover timing for a site depends on its audit schedule, so confirm your Edition 10 timing with your certification body. Then work out how many complete finding-to-verification cycles will exist by that date. For the clause-by-clause view of everything else that moved, what changed in Edition 10 covers the rest, and our Edition 10 services cover the gap assessment itself.

This is the practical case for keeping findings, actions, and verifications in one record instead of three files. In Beacon an audit finding creates a CAPA that carries the finding's own number, an owner, and an investigation due date. People record the root cause and the effectiveness verification, and a closure approval gate controls the final close.

Run the trace test on last year's report first. It takes twenty minutes and it tells you which step your program is missing. If you want to see the whole chain come out as one record, book a call.

What the FDA table says this week

FDA's outbreak investigation table, current as of September 10, lists eight active investigations where the product is still Not Yet Identified. Together they carry 569 confirmed cases.

Salmonella Newport at 109 (ref 1403). Salmonella Oranienburg at 99 (ref 1387). Four separate Cyclospora investigations at 231, 38, 22 and 18 (refs 1392, 1385, 1398, 1384). Salmonella I 4,[5],12:i:- at 43 (ref 1402). Listeria monocytogenes at 9 (ref 1379). Traceback is underway on every one. None of them has a food. On ref 1384 the outbreak itself is already over and the investigation is still open with nothing named.

The romaine case is the one that closed. FDA posted ref 1382 on July 1, CDC declared the outbreak over on July 29, and FDA's note reads: "By the time romaine lettuce was identified as the likely source, product was beyond shelf life." Fourteen people and a commodity named. FDA did not name a grower or processor in its public table, and the row lists no recall or product-specific advisory.

That ending is normal. Of the 26 investigations FDA posted in 2025 and has since closed, twelve closed with the product listed as Not Identified, covering 286 confirmed cases. Nearly half.

A named source doesn't settle it either. CDC reported 19,595 laboratory-confirmed cyclosporiasis cases acquired in the United States between May 1 and September 8 of this year, against 1,180 between May 1 and August 31 of last year. The lettuce was named as an outbreak source, and CDC says that seasonal total includes both that outbreak, which recently ended, and cases not linked to it.

The read that gets you hurt

The easy read is that this is a produce problem. Farms, water, field-level contamination, a part of the chain you don't own.

That's the wrong lesson. The pattern in that table is about how much an investigation can settle before the trail goes cold. A closed row with no food named tells you what the investigation could establish, not what happened.

Now put your own plant in one of those rows. Nothing on the page promises a direct notification, and nothing in it would tell you that your product had been looked at and set aside. The outbreak can run its course and the file can close while you're reading the same table as everyone else.

The clock is the reason, and it varies by pathogen. CDC says it usually takes 3 to 4 weeks to determine whether a sick person is part of an outbreak, and its Cyclospora page puts about six weeks between the start of symptoms and CDC receiving the case information. Interviews and traceback both take time on top of that. In the romaine case, FDA said the product was beyond shelf life by the time it had a likely source.

Four signals that reach you before a phone call does

Four early signals you can control are already inside your own plant. Count how many of them you actually have.

Environmental monitoring positives you've trended. A site-level history you can read, so the third positive at the same drain reads as one pattern instead of three separate events. That pattern is the reason to investigate for harborage or a resident strain; WGS and the investigation are what establish whether the isolates are related. It's a warning you're already paying a lab for.

Complaint clusters you read weekly. Three "tasted off" calls on the same product in ten days is a signal. The same three complaints filed across three months in three folders is filing. Complaint handling only works as an early-warning system when someone reads the set instead of the ticket.

Supplier lots you can pull in an hour. One supplier lot code in, every finished lot it went into and every customer who received them out. Time that pull, because the elapsed time is what you're measuring.

Finished-product retains you kept past the code date. This is the one that decides whether you have anything left to test.

What "beyond shelf life" means for your retains

FDA's shelf-life sentence is the operator lesson in one line: the product that could have answered the question was gone before the question got asked.

An outbreak question arrives late on CDC's own intervals, weeks after illness onset at best. A retain program sized only to shelf life may discard the product before that question arrives.

So set the retain hold by the investigation clock instead of the consumer date. Shelf life plus the reporting lag, and hold longer on anything with a raw agricultural input or a shared line. If your retain schedule discards at the code date, then by the time anyone asks, you have a lot code and no product behind it.

21 CFR 117.315 requires records under the preventive controls rule to be retained for at least two years after preparation, and other than the food safety plan, those records may be stored offsite if they can be retrieved and provided onsite within 24 hours. For foods on the Food Traceability List, FSMA 204 requires two years of traceability records and availability to an authorized FDA representative within 24 hours of a request, or another reasonable time FDA agrees (21 CFR 1.1455(c) and (d)). FDA has proposed moving the compliance date to July 20, 2028, and Congress has directed FDA not to enforce the rule before that date. Two years of records against a retain program that ends at the code date is a gap you chose.

The horizon check

Run this today and time it. Three pulls and one question, one hour.

Pick one supplier lot received 90 days ago. List every finished lot that used it and every customer who got those lots. Time it.

Pick one environmental monitoring site. Pull its last 18 months of results as a series, not as individual reports. Can you see whether this year looks like last year?

Pick one product. Pull every complaint on it for the last 12 months in date order. Does a cluster show up, or do you get a folder?

Then the retain question. For a lot you shipped 60 days ago, is there still physical product on the shelf?

If the answers are "most of a day," "not as a series," "a folder," and "no," you have a horizon problem. Your ability to look backward is shorter than the time an investigation takes to develop, and that gap is the capability worth testing before one reaches you.

Go time the lot pull. An hour from now you'll know how long that one takes, and the retain and trend checks tell you the rest.

Beacon keeps environmental monitoring trends, complaint records and lot genealogy in one platform, so your team can read the signals together. If you want to see how that lines up against your own retain window, book a demo.

The lot code lives on the case, not on the product

For most produce, most dry ingredients, and most packaging, the lot identity exists in exactly one place: printed or labeled on the master case.

The units inside carry a UPC and sometimes a best-by date. A UPC identifies a product, not a lot. A best-by date narrows things to a few days of packing on a good day and to a month on a bad one. Neither one gets a recall down to the shipment that matters.

Sometimes the code was never there at all. In the 2026 Salmonella Javiana outbreak tied to fresh jalapeños, which reached 431 illnesses across 32 states with 57 hospitalizations as of FDA's August 21 update, Coast Citrus Distributors recalled bulk cases and told FDA in the enforcement record: "No lot code information. Recall is for all product with a pack date of 07/01/2026 through 07/31/2026."

That recall covered 53,760 cases. A month of pack dates, because a month was the smallest unit anybody could define.

That is the upstream version of the problem. The downstream version is the one you control, and it is worse, because the code existed and then got destroyed.

Seam one: the case gets opened

The chain breaks the first time a master case is opened and the product moves into a different container.

Receiving does its job. Supplier, PO, quantity, receipt date, and the lot code copied off the case label. That record is clean.

Then the case goes to the line and gets opened. Product moves into a tote, a lug, a hopper, a staging rack, a walk-in bin. The new container carries nothing.

The case gets flattened and goes in the baler at the end of shift. From that point forward, your storage record is a record of an unlabeled container.

Partial cases are the sharpest version. Half the case runs Tuesday, the rest sits in the cooler until Thursday, and by Thursday the cardboard is gone.

Commingling makes it worse. Two cases from two different receipts go into one tote, and every unit that leaves that tote now points at two lots. Forward trace doubles on the first step.

The batch record still has a box for ingredient lot, and somebody still writes something in it. What nobody asks is where that number came from and whether it can still be checked against anything.

This seam closes on the floor. One rule covers it: the case label does not get destroyed until its code is written onto whatever the product moves into.

A lot ticket zip-tied to the tote handle. A grease pencil on the lid. The panel cut off the case and taped to the container. Pick whatever survives a wash-down and make it the only accepted method. Partial cases get tagged before the case is broken down, and no container holds two lots unless the tag names both.

Seam two: the identity changes hands at the repacker

At repacking the lot code may survive, but the traceability lot code source changes to the repacking location, and the record that ties the two together stays in the repacker's building.

FSMA 204 defines a traceability lot code as "a descriptor, often alphanumeric, used to uniquely identify a traceability lot within the records of the firm that assigned the traceability lot code." The definition names the firm on purpose. The code means something inside that firm's records and nowhere else.

FDA's own Q&A is specific about what happens next. A new traceability lot code will usually need to be assigned to repacked product. It can be retained instead when the food stays inside the same traceability lot, what FDA calls repacking "like into like," but even then the traceability lot code source changes to reflect the place where the repacking occurred. Either way the repacker keeps the key data elements under 21 CFR 1.1350 for the listed food going in and the food coming out.

Those KDEs are the join between the code on your receipt and the code their supplier used. They live in their building, not yours.

The 2026 jalapeño recalls show both halves of the problem inside one outbreak. Coast Citrus, the distributor FDA's traceback pointed at, initiated its recall on July 22 with no lot code and a month-wide pack-date range.

Two weeks later, on August 5, repackers pulling jalapeños recalled under numbering of their own. Sirna & Sons Produce listed lot numbers 60947409 and 60991812 on product "repackaged into 1 lb. plastic bags," citing Salmonella Javiana by name. Dairyland Produce listed seven codes beginning with X27 on bags repacked from bulk.

Those codes resolve inside Sirna's and Dairyland's records and nowhere else. A buyer holding Dairyland lot X2744163 cannot answer "is this from the grower FDA named" out of their own files. Somebody at Dairyland has to pull a receiving record first, and if that trail runs back to a bulk distributor whose own recall carried no lot code, the chain ends there no matter how fast anyone moves.

One-up one-down isn't a gap in the rule. It's the design. It works when every firm in the chain holds its own records and answers fast, and it stops working the moment your one link up is a repacker and the question is two links up. That is the same mechanism behind the supplier-of-supplier recall cascade, arriving through a different door.

So ask before you need the answer. For every repacker, distributor, and broker in your supplier records: if I give you your lot code, how long does it take you to give me your supplier's lot code and the name behind it?

Write what they say in the supplier file next to the GFSI certificate. A day is workable. A week means your backward trace ends at their dock, and you want to know that now rather than during a recall.

At the finished-goods end, the identity becomes a date

Once an ingredient is inside a finished product, the identifier that reaches the customer is usually a date range, not a lot.

WFM Purchasing recalled ten prepared items made with the recalled jalapeños: guacamoles, salsas, pico de gallo, a trio dip. The FDA enforcement records identify each product by a PLU code under the bar code and a best-before window. Eight of the ten read 8/7/2026 through 8/12/2026. The other two read 8/9 through 8/14. Each record lists the same quantity, 12,995 units total.

FSIS issued a public health alert covering meat and poultry products made with the recalled peppers. Food Safety News reported the alert on August 8, 2026, covering 18 products whose "use by dates up to and including Aug. 15" were the identifier consumers were given.

Neither identifier points back at a pepper case. When the identity of the finished good is a date window, the recall is a date window, and everything made inside it goes whether or not it ever touched the implicated lot. The difference between recalling one day of production and recalling two weeks is the difference between a lot code that survived the case and one that didn't.

Why a mock recall doesn't find either seam

Mock recalls start from a finished-goods lot and work backward through the records that exist. Both seams are places where the record never existed.

The usual drill runs like this. Pick a finished lot. Pull the batch sheet. Read the ingredient lot off the batch sheet. Pull the matching receiving record.

Three hours, everybody signs, the file goes in the audit folder. Nothing in that sequence tests whether the number on the batch sheet is the number that was on the case, or whether anyone could still prove it. A number in the box passes the mock, because the mock is checking for completeness and not for whether the identifier resolves to anything upstream.

A facility can hit the 24-hour clock and still hand FDA a backward trace that dead-ends at a repacker's loading dock. Getting fast at the supplier recall stress test does not close either seam, because both of them sit upstream of the records you are moving quickly through.

If your mock recall has never started at a case on the receiving dock and run forward, the part that breaks has never been tested.

The drill to run this week

Pick one incoming ingredient and follow it forward, physically, from the receiving dock to a finished-goods lot. One ingredient, one afternoon.

1. Pick something on the Food Traceability List that you received in the last 30 days. Fresh peppers, leafy greens, fresh-cut produce, melons, fresh herbs, a soft cheese, a nut butter, shell eggs.

2. Photograph a case label at receiving. Write down every identifier printed on it: lot code, pack date, UPC, best-by, the grower or packer code, the PO number. That list is the maximum identity this ingredient will ever have.

3. Find where the case gets opened. Watch it happen, or ask the person who does it. Note what the product goes into and what identifier travels with it. If the answer is nothing, that's seam one and you just watched it happen.

4. Ask when the case gets broken down. If the cardboard goes in the baler at the end of shift, your lot code has a shelf life measured in hours.

5. Pull the batch record that consumed it. Compare the number in the ingredient-lot box to the number on the case label. If they don't match, or the box holds a receiving line number instead, the batch record can't take you upstream.

6. Call the supplier of that ingredient and ask the one question: if I give you your lot code, how fast can you give me your supplier's lot code and the name behind it?

Step six decides the outcome. A same-day answer means the chain holds through the handoff. Anything longer means your backward trace stops at their dock, and the peppers or the seasoning behind them stay anonymous until FDA names them.

Run steps two through five on a second ingredient next month. Two afternoons gives you an honest map of where your traceability actually ends.

The 2028 date doesn't close either seam

Two separate things pushed FSMA 204 to 2028, and it helps to keep them straight. Congress directed FDA not to enforce the Food Traceability Rule before July 20, 2028. FDA separately proposed extending the compliance date by 30 months to that same date.

Neither instrument changed a requirement, which is the part worth planning around. Neither seam is going to close on its own between now and then. Both are habits, and habits change on the floor, not on a purchase order.

That part is on you. The case is the only thing carrying the identity, and the case gets opened and thrown away in the ordinary course of running a line. Somebody has to write the number down before the cardboard goes in the baler.

What a system can do is make the number go somewhere it survives. Beacon creates the lot at receiving and holds the case lot code on that record, keeps the parent link when the lot is split into the containers that go to the line, and carries the genealogy through production, so a finished lot resolves back to the case in both directions. It won't invent a code that was never printed on the case.

Run the drill first. If it comes back clean on both ingredients, you don't need anything. If it stalls at either seam, book a call and I'll walk your receiving flow with you.

What FDA actually proposed

The voluntary GRAS notification program becomes mandatory, with seven exceptions.

The proposed rule (91 FR 51834, Docket No. FDA-2025-N-3262) would amend 21 CFR parts 170 and 570 so that any person introducing a substance into interstate commerce under the GRAS provision of section 201(s) of the FD&C Act has to notify FDA of the basis for that conclusion, unless one of the exceptions in proposed 170.205(b) applies. It reaches ingredients and substances that get into food indirectly, including from packaging. For a qualifying food-contact substance, a supplier can file a food contact notification (FCN) instead.

Three dates matter. A final rule would take effect 60 days after it publishes. Proposed sections 170.205 and 570.205 would carry a compliance date 18 months after that. And for substances already in interstate commerce before the effective date, proposed subpart F opens a one-year window to file a short-form submission instead of a full GRAS notice. After that, the subpart closes.

Comments are due December 9, 2026.

This is not a premarket approval program

The proposal wouldn't halt marketing while FDA decides whether to file a notice, and it wouldn't make an otherwise unlawful food lawful either.

FDA is direct about the first half: a company may keep marketing a purported GRAS substance before it submits a notice, and after it submits one while FDA decides whether to file it. What changes is what FDA does with a missing filing. Noncompliance would be "a factor in its prioritization of food substances for post-market review."

The older consequence doesn't move. If a use isn't GRAS and lacks another applicable authorization, such as a food additive regulation or an effective FCN, it can be an unapproved food additive use. Food bearing an unsafe food additive is adulterated under section 402(a)(2)(C) of the FD&C Act. That's the hook behind warning letters, seizures, and import alerts.

FDA puts the ingredient question on the manufacturer

FDA's position is that the manufacturer of any food is responsible for all ingredients used complying "with specifications and limitations in all applicable authorizations." This rule doesn't invent that.

In 2022, a firm used tara flour as an ingredient in a human food product. The product drew roughly 400 adverse event reports covering gastrointestinal distress, hepatotoxicity, and hospitalization. The firm recalled it and ran a root cause analysis that pointed at tara flour. FDA asked for records showing a GRAS conclusion on that ingredient. The firm didn't produce any. Tara flour had never been the subject of a GRAS notice or a pre-submission meeting, and FDA determined there weren't enough data to consider it GRAS.

Recalls are usually initiated by a manufacturer or a distributor, and FDA's recall guidance puts obligations on everyone in the chain once one starts. The assessment sits upstream of that. Whether the ingredient was cleared for that use was the food company's call before anything shipped.

Many supplier approval programs check allergen status, micro specs, and a COA. Fewer ask what authorizes the ingredient's use, or who decided it.

How to find out which of your ingredients are self-affirmed

Ask the supplier what authorizes the ingredient's use, per ingredient, in writing.

Under the proposal, a use needs a GRAS notice unless one of the seven exceptions in proposed 170.205(b) applies:

1. A "no questions" letter from FDA covers the substance under those conditions of use.

2. It's listed or affirmed as GRAS in 21 CFR parts 182, 184, or 186.

3. It's GRAS under 170.30(d) or (i)(1).

4. FDA already considered the use through an established process for evaluating potential unapproved food additives, and the public documentation doesn't call for a notice.

5. It holds a threshold of regulation exemption under 170.39.

6. An effective food contact notification covers it, and the material comes from the manufacturer or supplier named in that FCN.

7. Information about it went in under proposed 170.305 and sits on FDA's public list, unless FDA later determines a notice or a petition is required.

A substance authorized by a food additive regulation isn't under the GRAS provision at all, so it sits outside the list.

If none of that fits, the supplier is relying on an independent GRAS conclusion. That's what people mean by self-affirmed, and it's what the rulemaking is aimed at. There may be no GRN with a no-questions letter behind it, and FDA may never have evaluated it, so ask whether any earlier notice drew a cease-to-evaluate letter. FDA estimates roughly 2,000 independent GRAS conclusions in use across about 1,028 firms, 1,885 in human food.

Two traps sit inside exception one.

A "no questions" letter covers the substance under the conditions of its intended use. A GRN issued for a beverage at one use level isn't coverage for a bakery application at a different one. Get the GRN number, then read what the conditions of use say.

The second trap is procedural. Under proposed 170.265, the notification requirement is met when FDA files the submission, not when the supplier sends it. If FDA declines to file, or FDA grants the notifier's request to cease evaluating the notice, the requirement is not met. Ask whether FDA filed it.

What goes on the specification

One field: the authorization, plus the GRN number or CFR citation behind it.

That's the change that survives turnover. A questionnaire answer sits in a folder somebody has to find two years later. A field on the specification travels with the material every time it's ordered, received, and reviewed.

If you import any of these ingredients, this sits on top of work you already owe. FSVP warning letters keep landing on manufacturers who didn't realize they were the importer. A May 26, 2026 letter cites 21 CFR 1.502(a) against an importer with no FSVP on file for anything it brought in.

Beacon's supplier file keeps the COA, the allergen declaration, and the document requests you've sent in one place, so the answer lands in the file instead of in an email thread.

What to watch before December 9

Watch whether your suppliers are getting ready to file.

FDA estimates about 32 hours of work per short-form subpart F submission. An ingredient distributor sitting on forty independent GRAS conclusions is looking at real labor against a hard cutoff. A supplier that misses the window can't use that path, and has to work out which authorization or exception covers the ingredient.

Two provisions deserve a close read if you're commenting. Proposed 170.305(d)(1) says FDA will post these submissions publicly and that posting doesn't mean FDA reviewed the substance's GRAS status. Proposed 170.305(d)(3) lets FDA later require a full GRAS notice or a food additive petition anyway. Listing is disclosure. FDA can still pull a listed ingredient into full review.

New York's legislature has moved on the same question. The Food Safety and Chemical Disclosure Act passed both chambers in April and would require manufacturers to report self-designated GRAS substances and their safety basis to the state, which would publish them. We covered what that does to ingredient intake when it passed.

Three questions for the supplier approval questionnaire

Add these for every ingredient. Start with flavors, colors, enzymes, processing aids, and anything you buy as a blend.

1. What authorizes this ingredient's use in food? Name the specific path from the list above.

2. If there's a GRN, does the no-questions letter cover our food category, our use level, and our purpose? Send the GRN number with the answer.

3. If it's an independent conclusion, do you hold the supporting dossier, and which path will you file under if the rule is finalized?

Send them now, while the answer is a routine request rather than a deadline. FDA estimates 1,740 GRAS conclusions reached by association expert panels rather than by the agency, including substances evaluated by the Flavor and Extract Manufacturers Association. Check whether any of them are in your formulas.

Book a call and we'll walk through what a supplier file looks like when the authorization lives on the record. See how it works.

Documents are fast. Records with dates on them aren't.

Most gap-closure plans treat Edition 10 as a documentation project. Read the code, list what's missing, write it, train on it, done. That works for every clause that asks you to have a program. It doesn't work for the clauses that ask you to show the program running.

An auditor reading your food safety culture plan is reading a document. An auditor asking whether your culture score moved is reading two measurements taken months apart. You can produce the first one in an afternoon. The second one you either started earlier or you didn't.

What actually needs a running start

Four areas need elapsed time, not effort. If you haven't started them, starting them is this month's work.

Food safety culture measurement

One survey is a data point. A trend needs a second survey months later, with real intervention in between. That interval is the part you can't compress: if you have one survey from last spring and nothing since, no amount of December effort produces the second measurement.

What auditors look for behind the number is its own subject, covered in what auditors want to see behind your food safety culture score and how to build a food safety culture plan that actually passes an audit. For planning purposes, only the interval matters.

Environmental monitoring trends

Your EM program probably already runs. The question is whether anyone reads it as a series. Trending means you can show your baseline, where you exceeded it, and what the data did after you responded. A stack of individual results isn't a trend.

If you have twelve months of results and no graphs, the trending itself is quick. If you have twelve months of gaps because sampling slipped during a busy quarter, that history is what the auditor sees, and you can't re-swab last March. The program-level expectations are in environmental monitoring under SQF Edition 10.

Internal audits and the corrective actions that came out of them

Corrective and preventive action (2.5.3) is a Core Clause in Edition 10, which changes the scoring math: a minor finding against it deducts two points and a major deducts seven, per SQFI's Edition 10 scoring table. And a corrective action isn't finished when it's written. It's finished when it's verified.

That's a chain: audit, findings, actions, verification. An annual internal audit schedule gives you one cycle. If findings from February are still open in December, you walk in with an open loop and no history of closing them. The planning question is arithmetic: how many complete cycles will exist by your audit date.

Change management

Change management (2.3.5) is retrospective by nature. It asks what changed and what you did about it. You changed a supplier in March, a sanitizer concentration in May, a line speed in June. Each of those should have triggered a look at whether your hazard analysis still holds. If it did, there's a record. If it didn't, there's nothing honest to write in December.

Personnel changes count too, which trips people up. You can only start following the process now, which gets you six months of real records instead of twelve.

Work backward from your audit date

Start with your actual recertification date, not January 2. SQFI's rule: audits before January 2, 2027 run on Edition 9, and anything on or after runs on Edition 10. So the January date is when Edition 10 audits become possible, not when yours happens. Pull your certificate and find the real one. (SQFI has noted the date could still move with the GFSI benchmarking process. A date that moves later only ever helps you.)

Take a site recertifying in March 2027:

• Culture: two survey points six months apart means the first survey goes out by September 2026. That's weeks away.

• EM: twelve months of trended data means the series started in March 2026. Graph what you have and find the gaps.

• Internal audit: one full cycle means auditing by October 2026, closing the corrective actions by January, and documenting verification in February, before the auditor arrives.

• Change management: a log started this month shows seven months of records on audit day. Started in December, it shows three.

Now run the same subtraction with your date. Any start date already in the past is the real gap, and you close it by starting immediately, not by working harder in the fourth quarter. A short real series beats a long invented one, and an auditor can tell the difference.

The part that's genuinely fast

Most of the list is still ordinary writing. Procedures, policy updates, org charts, scope statements, training materials, updated forms: someone who knows the site can produce all of that in a concentrated few weeks. If your gap list is mostly documents, you're in better shape than you think.

The mistake is treating the whole list as that kind of work. Sort your gaps into two piles on day one: things you can write, and things that have to accumulate. Pile two sets your real deadline, and it's almost always smaller and more urgent than pile one. For the clause-by-clause view of what moved in this edition, I wrote SQF Edition 10: what changed and how to prepare when the code was released.

What to do this month

Three things, in order.

Find your real audit date, not the January one. Everything else keys off it.

Sort the gap list into write-it and accumulate-it. Anything with a trend, a cycle, a follow-up measurement, or a closed loop goes in the accumulate pile.

Start the accumulate pile this week. If the culture survey has never gone out, send it. If EM results have never been graphed, graph what you have. If audit findings sit open, close them and record the verification. If changes happen without a reassessment step, start logging them today. Rough is fine, as long as the dates are real.

This is also the practical argument for keeping culture measurements, EM results, audit findings, corrective actions, and change records in one system instead of five. Not because software creates history, but because on audit day the chain has to come out in minutes, and chains that span a shared drive, an email thread, and someone's laptop usually don't.

If you want to see how that looks in practice, book a call and I'll walk you through it. If you'd rather work through the transition with help, our SQF Edition 10 services cover the gap assessment itself. Either way, do the backward-count this week. It takes an hour and it changes what you do in September.

For years, the broker in the middle of your supply chain was a blind spot. You qualified the manufacturer. You qualified the grower. The trading company that connected you to them sat outside your audit scope, because there was nothing to audit. That changed on July 6.

What the SQF Agents & Brokers Code covers

The code certifies the controls a non-handling trade business runs in its systems and on paper. SQFI lists the requirement areas as supplier approval, traceability, complaints management, documentation controls, and risk-based decision-making.

None of that involves a production line, because these businesses don't have one. An agent or broker's product is the transaction: matching a buyer to a supplier, moving the paperwork, and standing behind the claim that the goods are what the documents say. The code audits whether that business can actually trace a lot back to its source, whether it approved the supplier it sold you, and whether it has a real process when a complaint or a recall lands.

Who needs it, and who doesn't

The code applies to agents, brokers, traders, merchants, importers, and exporters. Virtual operations are fully eligible, so a broker running the entire business from a laptop can certify. SQFI is explicit that physical footprint is not a barrier.

What it does not cover is anyone who touches the product. Receiving, storage, and physical handling fall under separate SQF codes. If a company warehouses your goods or repacks them, the Agents & Brokers Code is the wrong standard. The line is simple: if they hold inventory, they need a different code. If they only hold the deal, this is the one.

Why this matters for your supplier qualification

Here is the operator problem it solves. When you buy an ingredient through a broker, your supplier-approval program has a gap. You can qualify the producer if you can see them. But the broker who sourced the lot, consolidated it, or relabeled the documents has been effectively invisible, and in a trace-back, that middle link is where the chain breaks.

Retailers already know this. SQFI notes that major retailers including Aldi require their agents and brokers to hold recognized third-party certification. The demand is not new. The SQF certificate is just a new way to meet it.

So the move is straightforward. If a supplier in your program is a broker or trading company, you can now require the Agents & Brokers certificate as part of qualification, the same way you require an SQF or BRCGS certificate from a manufacturer.

One caution, because it is the difference between a real control and a checkbox. The certificate verifies the broker's own systems: their traceability, their supplier approval, their complaint handling. It does not certify the food itself, and it does not replace qualifying the actual producer. A broker with a clean certificate can still sell you a lot from a manufacturer you never approved. Use the certificate to close the middle-link gap, not to skip the producer.

The FSMA 204 angle

There is a regulatory reason this code arrived now. The FDA Food Traceability Rule (FSMA 204) requires every company in the supply chain for a listed food to capture and pass Key Data Elements at each Critical Tracking Event. Brokers, importers, and traders are a link in that chain, and they are frequently the link that cannot produce a clean record, because they never had a food safety system built to.

A certification that audits a broker's traceability is the trade layer catching up to the rule the rest of your suppliers already live under. If you handle a 204 food, the intermediary's traceability is not optional, and now there is a standard that tests it.

How the audit works

The audit is annual, announced, and short. SQFI sets a minimum of half a day, with the certification body deciding the final length based on the size and complexity of the business. Audits run 100 percent remotely, which is what keeps the cost down. There are no unannounced audits unless a company specifically requests one. Annual registration is $650.

Agents & Brokers Code vs the Food Safety Services Code

These are two different SQFI codes for two different kinds of non-manufacturer, and they are easy to confuse. We covered the Food Safety Services Code when it went to public comment. The Services Code targets the vendors who perform work at your site: sanitation crews, pest control, calibration, maintenance. The Agents & Brokers Code targets the companies that trade your product without ever being at your site or touching it.

Both exist for the same reason. The SQF system is extending certification to the businesses around a certified site that used to sit outside anyone's audit.

What to do this quarter

Pull your approved-supplier list and flag every entry that is a broker, trader, or importer rather than a manufacturer or grower. Those are the ones the certificate is built for.

Then add the Agents & Brokers certificate to your qualification requirements for that group, with a date. Ask each broker whether they plan to certify and when. Certification is new, so most will not have it yet, and that is fine. The point is to put the requirement in writing now, so the ones who never intend to certify surface before your next audit, not during a recall.

And keep the producer qualification separate. The broker certificate is a new control on the middle of the chain. It is not a shortcut around the two ends.

Frequently asked questions

What is the SQF Agents & Brokers Code?

It is an SQFI certification standard, Edition 9, published July 6, 2026, for businesses that buy, sell, or broker food and general merchandise without physically handling it. It certifies their supplier approval, traceability, complaints management, and documentation controls.

Who needs SQF Agents & Brokers certification?

Agents, brokers, traders, merchants, importers, and exporters, including fully virtual operations. Companies that receive, store, or physically handle product are excluded and fall under other SQF codes.

Is the SQF Agents & Brokers Code GFSI recognized?

Not yet. SQFI expects formal GFSI benchmarking in 2027. Until then it is a valid SQF certification, but not a GFSI-benchmarked one.

How much does SQF Agents & Brokers certification cost?

Annual registration is $650. The audit is announced, runs a minimum of half a day, and is conducted 100 percent remotely, so audit fees are lower than an onsite standard.

Does a broker's certificate replace qualifying the manufacturer?

No. It verifies the broker's own systems and traceability. You still have to qualify the actual producer of the ingredient. Use the certificate to close the intermediary gap, not to skip the source.

The bottom line

The businesses in the middle of your supply chain just became auditable. That is the whole story: a link that used to sit outside every audit now has a certificate you can require and check.

If you run supplier approval on spreadsheets, adding a new certificate requirement and tracking who holds it is the kind of thing that quietly falls apart between audits. Beacon keeps supplier qualification, certificate expiry, and traceability in one place. If your broker records live in an inbox, see how it works.

What actually happened

A cyclosporiasis outbreak sickened more than 1,600 people across five states, by laboratory-confirmed count, before anyone named a product. CDC and state health departments linked the illnesses through interviews. About 90 percent of the people they talked to had eaten iceberg lettuce at the same restaurant chain. FDA's traceback pointed to iceberg lettuce grown on a single farm in Mexico and supplied through Taylor Farms. FDA said the implicated farm represents less than one percent of the U.S. iceberg supply.

FDA then reported a positive cyclospora result on the lettuce itself. Taylor Farms recalled shredded iceberg and salad sold through Walmart and foodservice.

The next day, FDA pulled the result back. Its lab experts re-reviewed the sample and concluded the finding "does not represent true amplification" and should be treated as a false positive. Cyclospora is hard to detect, and the molecular test that flagged the sample could not be confirmed.

The recall did not get reversed. The outbreak investigation still pointed at the same lettuce, with more than 90 hospitalizations and thousands of additional suspected illnesses under review across dozens of states.

The test was never the case

The evidence that implicated the lettuce was the outbreak investigation, not the sample. Patient interviews and traceback did the work. The positive result arrived late and left early, and the conclusion didn't move when it disappeared.

This is the part operators get backwards. A single positive feels like proof, so a single negative feels like a clearance. Neither is true. A lot can test negative and still be the vehicle, because contamination is rarely uniform and a sample plan catches a fraction of a fraction. A lot can throw a positive that a second method can't confirm, the way this one did.

Your incoming COA works the same way. A negative result on a sampling plan you didn't design and can't see is not the same thing as a clean lot.

Where the 2 a.m. decision goes wrong

Most recall decisions get made under time pressure with incomplete data, and most facilities improvise them. Someone forwards a positive from a customer, a third-party lab, or a regulator, and the room argues about whether to pull product while the clock runs. That argument should have happened months earlier, on paper. We've written before about the first 24 hours after a supplier causes a recall, and the pattern is always the same: the facilities that move cleanly already decided how they'd move.

Write the decision rule before you need it. What triggers a hold. What triggers a market recall. What a single presumptive or molecular positive means versus a confirmed one. Who has the authority to pull the trigger at midnight without waiting for a callback. If those answers live in someone's head, they change every time the pressure changes.

Taylor Farms moved fast on a regulator's positive during an active outbreak. That was the right call, and the later retraction doesn't make it wrong. Fast was correct because the epidemiology already existed. The mistake would have been waiting for a confirmatory test that, as it turned out, would have pointed the wrong way.

What to check this week

Pull your recall plan and find the sentence that tells you what to do with a single unconfirmed positive. Most plans don't have it.

Then run this drill. A customer emails you a molecular positive on a lot you shipped three weeks ago. Their retest is pending. Walk it through. Do you notify? Do you hold your remaining inventory? Do you initiate a recall now or wait for confirmation? Who signs off? Time the decision. If it takes more than an hour, or the answer depends on who's in the room, your plan has a gap a real event will find.

Do the same for the inverse. A lot you were worried about comes back negative. Does that close the file, or do you still hold on the epidemiology? If negative auto-closes, you've built the same single-result trap in reverse.

A recall program isn't the plan document. It's whether the decision is already made when the positive lands. Beacon keeps the recall decision tree, the traceability records, and the hold authority in one place, so the call at midnight follows the rule you wrote at noon. If your recall plan still lives in a binder, see how it works.

What actually happened

Two premium organic formula brands, made by different companies, were linked to infant botulism within seven months of each other.

Nara Organics recalled all lots on June 13, 2026, after three infants in California, Pennsylvania, and Washington got sick, with onset in April and May. ByHeart recalled all its formula on November 11, 2025, in an outbreak that grew to 48 infants across 17 states.

The two brands share two upstream suppliers: Organic West Milk for the organic whole milk, and Dairy Farmers of America for the spray-dried powder. FDA has said plainly that it does not yet have enough evidence to call that shared milk the source. So I won't either. "Shared a supplier" is not "caused the outbreak," and the difference matters.

Here is the part that should stop you. During the ByHeart investigation, Organic West Milk gave FDA a customer list. That list did not show its milk reaching the makers of Nara Organics. FDA only learned about the connection during the current investigation, when the supplier said the earlier list had been incomplete.

The obvious diagnosis is the wrong one

The easy read is "foreign plant, bad inspection, infant formula problem, not mine." FDA did inspect two foreign manufacturing plants before the outbreak and found deficiencies. That part is real. But it isn't the operator lesson, because you don't run your supplier's inspections and you can't see them.

The lesson is the blind spot. A second brand using your exact upstream supplier had an outbreak. That is about the strongest early warning a supplier relationship can produce. And it never reached the other brand, because the only map of who buys from whom lived with the supplier, and that map was wrong.

Why one-up, one-down doesn't catch this

Traceability is built one up, one down. You record where a lot came from and where it went next. FSMA 204 sharpens that with lot codes and key data elements, but it doesn't change the shape. You see your direct supplier and your direct customer.

Shared-supplier risk lives two nodes away, sideways. The brand that buys the same milk powder you do is not your supplier and not your customer. It's a sibling you never see. One-up, one-down was built to trace a contaminated lot forward and backward through the chain after something goes wrong. It was not built to tell you that a company you've never heard of buys the same input you do and just recalled product over it.

So the signal exists. The path to deliver it to you does not. Unless you build one.

What to actually do

You can't fix a supplier's customer list. You can change what your own supplier program assumes.

1. Map your shared and single-source inputs. For every critical ingredient, ask who else buys from this supplier. You usually won't get a complete answer. Ask anyway, and write down what you learn. The exercise alone tells you where you are exposed.

2. Put a notification clause in the contract. Your supplier agreement should require the supplier to tell you, fast, about any recall, outbreak, illness, or regulatory action tied to a lot, line, or process that also feeds you. Make the clock a number. "Within 24 hours," not "promptly." When a supplier recall lands, the first 24 hours decide how bad it gets.

3. Pull public history into supplier approval. FDA publishes warning letters, import alerts, inspection classifications, and recall history. A COA tells you about one shipment. That record tells you about the supplier. Check it at approval and at every re-approval, not only after something breaks.

4. Watch your siblings. When a brand in your category recalls product, the first question is not "glad that wasn't us." It's "do we share any of their suppliers?" Answering it takes a current supplier list and five minutes. Most teams never ask.

5. Rehearse the pull. If a shared input gets named tomorrow, how fast can you list every finished lot that used it and reach every customer holding it? If the honest answer is "a few days," you have a recall problem stacked on top of a supplier problem.

The takeaway

You can't audit a supplier you don't know you share.

The contamination source in these two outbreaks may never get pinned down. The operator lesson doesn't depend on it. The warning that should have traveled from one brand to the other got stuck inside a supplier's incomplete customer list. The fix isn't another round of finished-product testing. It's a contract clause and a habit: know who shares your suppliers, and make those suppliers tell you the moment something moves.

This is the same gap that turns one bad lot into a supplier-of-supplier recall cascade. The contaminant changes. The blind spot doesn't.

Supplier records, COAs, and the enforcement history behind them belong in one place you can search the minute a sibling brand recalls, not scattered across an inbox and a binder. That's why supplier management and traceability live in the same system in Beacon.

If you want to see how that holds up against a real recall drill, book a demo.

Sources:

• Outbreak Investigation of Infant Botulism: Powdered Infant Formula (June 2026), FDA

• Nara Organics Recalls All Lots of Nara Infant Formula, FDA recall notice

• FDA knew of deficiencies at foreign plants that produced infant formula, Food Safety News

What actually happened

A shrimp-containing soup got packed into the minestrone cup. Minestrone is a vegetable soup. The product is sold as vegetarian, and the cup says so on the lid and the front.

The recall covered 4,496 units across 17 states and Washington, D.C., plus online orders through Whole Foods and Amazon. It's Class I because crustacean shellfish is one of the nine major allergens and a shrimp reaction can be life-threatening.

The part that should bother you: the mismatch turned up during an in-store inspection that found a single cup with the wrong product in it. Not at fill. Not at release. At the store.

This is a different failure than the label getting it wrong

Most undeclared-allergen recalls are label problems. The formula changed and the label didn't. The "Contains" statement missed an ingredient. The wrong label printed on the line. I've written about the label-to-product mismatch and the formulation change that outran the label before.

This one is the opposite. The label is right. It accurately describes a vegetarian minestrone. The contents are wrong. A whole different soup went into the package.

That's a product-identity failure. A line-clearance and changeover problem, not a labeling or cross-contact problem. Cross-contact is a trace amount from a shared surface. This was a full serving of the wrong soup. The fix lives on the production line, not in the label-approval workflow.

The Vegetarian claim is an allergen control, not marketing

A vegetarian or free-from claim is a control point. Treat it like one.

People with a shellfish allergy use that claim to screen. A shopper avoiding shrimp sees "Vegetarian Minestrone" and assumes no shellfish. That assumption is the whole reason a wrong-product mix-up became Class I instead of a quality complaint. The claim raised the stakes.

So the claim has to be backed by a controlled line, not just a correct recipe card. If you run an allergen-bearing SKU and a free-from SKU through the same filler, the claim is only as good as your changeover.

Where the control should have been

The question isn't how shrimp got into one company's soup. It's what stands between fill and ship in your plant.

Walk one changeover. Pick any allergen-bearing product that shares a line, a filler, or a packaging station with a free-from product. Then answer two questions.

What physically prevents product A from ending up in product B's labeled package? Documented, verified line clearance, or an operator who's supposed to remember.

What at the end would catch it if it happened anyway? A finished-goods check that the contents match the label, or just a check that the label printed correctly.

If your honest answer to the second one is "a customer would notice," your last line of defense is a store shelf. That's exactly what happened here.

The drill

Run a changeover audit on your highest-risk pair: the allergen-bearing SKU and the free-from SKU that sit closest together on the floor.

Document the line-clearance steps and make the verification a signature, not a habit. Add one finished-goods check that confirms the product in the package is the product on the label. By recipe, by appearance, by net weight, by whatever actually tells the two apart. Pull that sample at the start of every run after a changeover, not once a shift.

None of this is exotic. It's the difference between catching a wrong-product fill at your line and reading about it in a Class I recall notice.

Make the verification live on the line

This is the kind of control that's invisible on paper and obvious in software. The changeover record, the allergen matrix, and the label claim usually live in three different places, so nobody can see that a free-from cup just ran on a line that handled shellfish an hour earlier.

Beacon keeps them connected. The allergen rules and the changeover verification sit on the line, where the check has to happen, instead of waiting for a store inspection to find the one cup that's wrong.

If you want to see how that works, book a call.

What actually happened

Clover Hill Dairy of Mechanicsville, Maryland recalled all of its requeson after the FDA and CDC tied it to a Listeria outbreak. Nine people infected with the outbreak strain across Maryland, New York, and Virginia. Eight hospitalized. One death in Maryland. The state suspended Clover Hill's operating license.

Two details matter more than the headline. The sick people's samples were collected over a span running from March 6, 2023 to May 10, 2026, and CDC says the isolates are closely related genetically. And an unopened 18-pound tub of the requeson tested positive for the same strain. The cheese in the cooler matched the people in the hospital.

A second company, Nelson & Isa Lacteos in Bay Shore, New York, recalled requeson the same week. They didn't make it. They bought Clover Hill's 18-pound tubs and repacked the cheese into one-pound containers under their own name. Same product, second label, second recall. If you repack or private-label someone else's bulk, their contamination becomes your recall, and the lot identity has to survive the repack or you can't pull it cleanly.

The obvious read, and why it's wrong

The easy diagnosis: a small cheese maker had a contamination event, found it, recalled it, done. Clean up and move on.

The three-year span breaks that read. Transient contamination shows up as a cluster over weeks. A thread of genetically matched cases running from 2023 into 2026 is the signature of a strain that has been living somewhere in the process, not a one-time slip. The strain was circulating for years before anyone connected nine dots across three states.

A strain that persists like that survives routine cleaning. You don't catch it by cleaning harder. You catch it by proving it's the same strain showing up again, until you've cornered where it lives.

Resident or transient is a sequencing question

A positive tells you Listeria was on that surface the day you swabbed. It doesn't tell you whether it's the same Listeria you found last quarter. That distinction is the whole game, and most environmental monitoring programs never make it.

Here's the cycle that hides a resident strain. You get a positive in Zone 2. You clean. You re-swab. It comes back negative. You close the corrective action. Next quarter, another positive, same general area. You clean, re-swab, close it again. Every positive gets treated as a fresh event. The paperwork looks healthy: positives found, investigated, resolved.

Whole genome sequencing is what tells you those two positives are one organism. Match this month's isolate to last quarter's and you haven't found two transients. You've found a resident living in a floor drain, a hollow conveyor roller, a cracked weld, or a worn gasket, seeding your line on a schedule. The surface keeps coming back clean because you keep cleaning the surface. The source never moves.

None of this is specific to cheese. Any ready-to-eat operation with zones carries the same exposure: deli, bakery, prepared foods, smoked fish, dairy. The same post-lethality pattern hit an RTE pork outbreak earlier this year, where the cook step was fine and the contamination came from zone contact after the kill step.

The drill

Pull every environmental Listeria positive from the last eighteen months. For each one, you did one of two things: you sequenced it, or you cleared it and moved on. If it's all detect-and-clear, that's your gap. A presence/absence result can't separate a resident from a transient.

Three changes fix it.

Bank your isolates. When an environmental sample comes back positive, have the lab keep the isolate instead of just reporting the result. You can't sequence what you threw away.

Sequence on the second hit. When you get a second positive in the same area within a season, send both for WGS. If they match, stop treating it as a sanitation problem. A resident strain calls for teardown: dismantle the equipment, find the harborage, not another pass with the same chemical.

Trend the site, not the swab. A positive means more when you see it against that exact location's own history. Edition 10's environmental monitoring expectations are already pushing programs toward this kind of trend analysis. The facilities that find residents are the ones watching sites over time, not filing each swab on its own.

What it comes down to

The facilities that catch a resident strain aren't the ones that swab the most. They're the ones that ask whether this positive and that positive are the same strain. Most never ask. They swab, they clear, they close.

Go look at your last year of EM positives. If you cleared them one at a time, you don't actually know what's living in your plant. A strain matched across three years is what that looks like when it finally surfaces, and by then it's nine people and a suspended license.

Beacon logs environmental monitoring results as a trended series per site, so a positive shows up against its own history instead of as a one-off you close and forget. If you want to see how that works on your own program, book a demo.

What actually failed

The label never changed when the recipe did.

FSIS found the dumplings were formulated with peanut oil, with peanut nowhere on the finished label. The establishment determined that a formulation change led to the mislabeling. So the formula moved, the allergen profile moved with it, and the label stayed where it was. (FSIS recall notice.)

Here's the part worth sitting with. FSIS inspection personnel caught it during a routine allergen verification task. Not the company's own review. The check that should fire on any recipe change, a fresh look at allergens and the label, didn't fire inside the plant. It fired when a federal inspector checked the formula against the label.

This isn't the label-to-product mismatch from April's two-recall day, where the artwork was correct and the wrong product landed in the bag. Here the recipe changed and the artwork never did. Different failure, same place it shows up: the label.

The allergen re-check has no owner

In most plants, nobody owns the re-check, and that's the gap.

Someone changes an ingredient. A cost-driven oil swap, a new supplier, a reformulation to hit a texture. The change moves through R&D or procurement and into production. The label sits in a folder as artwork that already got approved once. The allergen assessment sits in a binder from the last audit. Nothing connects "the formula changed" to "re-run the allergen assessment, update the ingredient list, update the Contains statement."

When that connection depends on a person remembering, it breaks the first busy week. Allergen labeling is built on the Big 9, and peanut is one of the nine. A change that adds one of them is exactly the event your food safety plan is supposed to catch before product ships. FSIS makes the trigger explicit: you reassess the HACCP plan whenever a change could affect the hazard analysis, and the rule lists product formulation by name (9 CFR 417.4). FDA-regulated plants run the same logic under preventive-controls reanalysis (21 CFR 117.170). SQF says it again in change-management language. Every one of them assumes the re-check happens. None of them makes it happen.

"Exempt" peanut oil still has to be on the label

Highly refined peanut oil is exempt from the allergen declaration, not from the ingredient list.

This one trips up good operators. FALCPA leaves highly refined oils out of the major-allergen definition, so a fully refined peanut oil doesn't trigger a "Contains: Peanut" statement. People stop reading there and treat peanut oil as a free ingredient. It isn't. Even an exempt oil has to appear in the ingredient statement by its name. Leave "peanut oil" off the ingredients and you're misbranded no matter how refined it is. And if the oil isn't fully refined, you also owe the Contains statement.

Either way, adding peanut oil means changing the label. "We used the exempt kind" was never a defense for a label that never moved.

The drill

Pull your last ten formula changes and check whether each one triggered a documented allergen re-check.

Not the allergen matrix from your last audit. The last ten times someone changed an ingredient, a supplier, or a spec. For each one, find the record that says QA re-ran the allergen assessment and signed off on the label before product moved. If you can't produce it for even one change, you have the Synear gap, whether or not an inspector has found it yet.

The fix isn't more allergen training. People already know peanut is an allergen. The fix is a gate: no formula or supplier change closes until the allergen re-check and label review are done and recorded. The system refuses to advance without them, so the re-check stops being something a busy person has to remember.

That's what change management is for. In Beacon, a formulation or supplier change opens a change record that won't close until the allergen reassessment and the label review are attached. The software isn't the point. The point is that the most failure-prone step, remembering to look again, isn't left to memory.

FAQ

Does highly refined peanut oil have to be declared as an allergen?No. FALCPA excludes highly refined oils from the major-food-allergen definition, so refined peanut oil doesn't require a "Contains: Peanut" statement. It still has to appear in the ingredient list by name, so leaving it off the ingredient statement is misbranding even when the allergen declaration is exempt. If the oil isn't fully refined, the Contains statement is required too.

Why did FSIS handle a dumpling recall instead of FDA?The dumplings contain pork, which makes them a meat product under FSIS jurisdiction. FSIS enforces allergen labeling on meat and poultry and runs routine allergen verification tasks at the establishments it inspects. That verification task is how this recall started.

What changes should trigger an allergen reassessment?Any change that can move the allergen profile: a new ingredient, an ingredient or oil swap, a new supplier or a changed supplier spec, a reformulation, or a rework that brings another product's ingredients onto the line. FSIS HACCP reassessment (9 CFR 417.4) and FDA preventive-controls reanalysis both require you to look again when a change could affect the hazard analysis, and undeclared allergens are near the top of that list.

The allergens were never the problem

The peanut was real and the risk was real. But the failure sat upstream of the label. Someone changed the recipe and nothing in the plant made a person check the allergens again. That's a fixable gap, and it's a lot cheaper to fix before an inspector finds it than after a recall notice goes out with your name on it.

Pull your last ten changes this week. If you want to see how a change record forces the allergen re-check before anything ships, book a demo.

First Summit for me. Walked in fresh. The veterans of this conference may have stopped seeing the gap. I couldn't.

The AI workshop made the gap obvious

Cindy Jiang ran the opening AI workshop. It was the most informative session I sat in on all week.

The breakout discussion was more useful than the keynotes. The QA leads at my table were all using ChatGPT, Claude, or Gemini at work, with almost no prompting technique. A few had picked up the trick of having one model check another's output. Most hadn't. Citations, hallucinations, accuracy: every objection I heard is the same objection I heard from the same role two years ago.

Two things stuck.

Sean Leighton at Cargill said from the stage that the AI and software systems they're building have potentially prevented something like 42 food safety incidents. I don't know exactly how Cargill defines that and I doubt it's a public number. The directional point is right. AI applied against your own data finds things human review misses.

From a slide in the opening AI workshop. The case for AI run against real data at scale.

Lisa Shelley at NC State said the future is company-specific AI, not generic chatbots. I've been saying the same thing for two years. It's the entire reason I built Beacon the way I built it. Generic ChatGPT doesn't know your CCPs, your supplier list, your last three CAPA closures, or the equipment your second shift hates. A company-specific model that does is a different category of tool.

Another speaker in the AI workshop, same thesis. The company-specific AI argument came from more than just Shelley.

The gap: nobody in the room had a clean way to get there. The big companies were funding internal builds. Everybody else was prompting ChatGPT on a phone.

The harborage walk got uncomfortable fast

Sharon Birkett ran the pathogen-control workshop. The format was good: walk a notional plant, identify every spot a pathogen could hide, talk through mitigation.

I hadn't thought to look in half these places. Cable tray crevices. Drain housings. Gasket seams on equipment that hasn't been opened in five years. The underside of a conveyor support arm where condensation collects. Under every example was the same problem. A lot of harborage sites live on equipment that's older than the people running it.

That part didn't get answered.

Attendees raised the 20- to 30-year-old equipment problem. A speaker referenced an equipment-replacement budget. That works for the speaker's company. The 25-person family-owned operation in Michigan, Wisconsin, Iowa, or Texas can't run that play. If the slicer is running, the slicer stays. Nobody had an answer for the SMB version. Managing pathogen risk on equipment that predates your employment and has no service history.

This is a data problem before it's a capex problem. If you can't replace the equipment, you have to track every sanitation event against every harborage site you've identified. And you have to do it in a way the next QA Manager can pick up. Paper logs don't survive that. Spreadsheets don't survive an auditor asking "show me every clean of point 14 in the last 18 months" on the spot.

"Food safety economics" was a great session for big companies

The food safety economics workshop covered how to communicate cost-benefit of food safety to leadership. Good premise.

The math was solid. ROI calculators showing prevention of a recall saves seven or eight figures. Cost-of-prevention curves. Frameworks for justifying a sanitation overhaul to a CFO.

None of it fit a manufacturer doing $5M to $20M in revenue.

For a small operator, the financial math isn't "prevent a $10M recall." The financial math is "one bad event closes the business." There's no insurance product that makes a 30-person plant whole after a regulatory shutdown that lasts six months. The decision isn't an ROI calculator. The decision is whether you survive.

I'd like to see a session next year aimed at that math. What the prevention investment looks like when the alternative is bankruptcy. What a 1.5-person QA team buys with $50K. The rank-order of investments for a plant with no margin for error.

Nestlé's digital HACCP rollout was the cleanest case study of the week

David Clifford walked through Nestlé's global HACCP digitization. Pilot, lessons, global rollout, master data, training.

Clifford presenting Nestlé's modular digital HACCP approach.

Two things I took from it that apply at any scale.

One: clean, centralized master data is the prerequisite. If your equipment list, your CCP definitions, and your supplier records don't match across plants, digitizing your HACCP doesn't give you a global HACCP. It gives you a digital version of the chaos.

Two: digitization fails when you don't bring the floor along. The thread through every digital migration I've watched (and a few I've run) is the same. If the line lead doesn't trust the new system, they'll keep the paper backup, and you'll get exactly zero of the value you paid for.

One line from the talk stuck with me afterward.

Clifford mentioned, almost in passing, that two years into Nestlé's rollout with a large enterprise vendor, he still doesn't have role-based access permissions he can configure himself. He sounded frustrated. I would be too.

Read that twice. Nestlé. Two years. I'd guess millions in. Still no RBAC.

That's not a Nestlé problem. That's an enterprise food safety vendor problem. RBAC is week-one functionality. If you can't configure permissions yourself two years into a multi-million-dollar contract, the vendor's priorities are not yours.

The cost-center-to-value-creator session needed an SMB seat

A session on translating food safety into financial relevance for executives. Good content. Real point.

The implicit audience was the QA Director at a $500M company who reports to a VP of Operations and has to make a case to a CFO. The SMB version of this conversation is different. At a 30-person plant, the QA lead, the owner, and the CFO are usually three people who can be in the same room in five minutes. The silo to break isn't finance vs. quality. It's "QA is the person who writes the SOPs" vs. "QA is the person who tells me when a decision is going to cost us our customer."

The bridge the session described is real. The bridge for a small plant is shorter and louder.

The Town Hall heard the room

The 15th annual Town Hall sat senior regulators from AFDO, CDC, FDA, and USDA on one stage.

The audience pushed hard on one point. The regulatory agencies are too siloed and the system is too complicated to work through. A manufacturer in our space ends up dealing with FDA for one product line, USDA for another, state ag for another, and the rules read differently depending on which inspector walked in that morning. Several attendees floated the idea of a cross-agency team for food safety.

I don't know if a single agency is politically possible. I know the request from the room wasn't framed as an aspiration. It was framed as exhaustion. The people in the room run plants. They're spending real money translating between three regulators who don't coordinate. That's not a technology gap. It's the kind of problem a shared platform across agencies could absorb in a hurry. I doubt that gets built. I'd like to be wrong.

The Tech Tent talk that surprised me

Dr. Alex Athey at Zeroic presented ozone nanobubble technology. Eight years of validation, independent lab trials, plant trials on produce and proteins. The pitch is that ozone delivered via nanobubbles works as an antimicrobial without the chemical residue or the costs that killed previous ozone attempts.

I don't have the chemistry background to evaluate the science. The pitch and the data looked compelling. If you run a produce wash line, this is worth twenty minutes.

Food safety culture was the thread under every session

Every session ended back there. The AI panel did. The harborage walk did. The Town Hall did.

The version of food safety culture I heard on stage is the one I believe. It isn't a poster on a wall. It's the line operator on third shift who stops the line because something doesn't look right, and the owner who backs that decision the next morning. It's QA having authority that doesn't require a manager to sign off. It's leadership understanding what a CAPA actually costs to close, not just what it costs to open.

The SQF Edition 10 auditor interpretation came up several times. Auditors are walking the floor and asking line workers what they do and why. They aren't asking to see the checklist. They're asking the operator to explain the food safety reason behind the step they're doing. If the operator can't, the culture isn't real, no matter what the score is. We wrote more about what auditors actually look for behind a food safety culture score if that part of Edition 10 is on your list this year.

That's the right test. It's also the test paper-based and checklist-based compliance systems can't help you pass. You either build the culture or you don't.

What I took home

The summit was well-run. Good size, well-programmed, the right people in the rooms. I learned things I'll use.

What I kept noticing was who wasn't in the conversation. Every case study, every framework, every "here is how we built it" came from a company with the headcount and capex budget to build it. The small to mid-size manufacturer, which is most of the industry by plant count, was in the audience, not on the stage.

That gap is why I built Beacon. I needed a compliance platform that fit a small SQF-certified plant in Michigan, not a Cargill global rollout. Everything on the market either cost six figures and took six months to implement, or cost less and only did 80% of the job. I built the version for the scale this industry actually runs at.

If you run an SMB plant and want to talk through how Beacon could fit, book a call. Happy to walk you through it.

Three different mechanisms. Three different points on the line.

If you read this as a string of unrelated incidents, you go back to your daily work. If you read it as a prompt to audit your own physical-hazard control program, you find the gap before the recall traces back to you.

That distinction is the whole article.

Lactalis Canada: glass in creme brulee

Class II recall, initiated April 14, 2026.

The product: Specially SELECTED brand Vanilla Creme Brulee, 3.6 oz cups. Specially Selected is Aldi's US private-label premium line. Lactalis Canada is the firm of record on the recall.

Reason FDA published: "Product may contain foreign objects, specifically glass."

Distribution: NY, IN, FL, IL, VA, MD, and MI. Seven states.

What FDA did not publish: where the glass came from. That gap is important. Glass contamination in a chilled dessert plant typically comes from one of three sources. A cracked vessel during cream or sugar handling. A finished-glass container that fractured on the line. A maintenance work order that left glass debris in a zone the cleaning crew did not catch. Each of those root causes lives in a different SOP, so the corrective action is different.

If a plant cannot reconstruct which of the three it was within 24 hours, the recall scope expands because they cannot bracket the affected production cleanly.

For any plant running multiple private-label customers on shared equipment, the additional pressure is that every customer who shares that line is now asking the same question. The glass policy and the changeover protocol need to be documented in a way that holds up to seven different customer audits in the same week.

The Mochi Ice Cream Company: foreign object in frozen dessert

Class II recall, initiated April 20, 2026.

The product: My Mochi Strawberry flavored Non-Dairy Frozen Dessert, 7.5 oz containers, six pieces per package. UPC 0-70934-99645-8. Distributed to six retail consignees with locations nationwide.

Reason FDA published: "Foreign object found inside retail container."

That is the entire description. No identification of what the object was. No identification of where it entered the product.

When the regulatory record is that thin, two things are usually true. The operator did not characterize the contamination before initiating the recall, which means the corrective action is generic and the same gap stays open. And the contaminant was not caught by a routine on-line control, because a metal-detector hit or an X-ray reject produces a known reject record with an investigation tag, not a thin one-line entry. When the public record reads this way, detection was usually after the fact and often through a consumer complaint, not at the line.

The audit question for your own facility is straightforward. When your line generates a foreign-object reject, the rejection-disposition record should identify what the object was, where it likely entered the stream, and whether the upstream control needs adjustment. If the record just says "foreign object," the line is pushing units aside without capturing what would let you stop it from happening again.

Straus Family Creamery: metal in organic ice cream

Recall announced May 16, 2026. Distribution began May 4.

The product: Straus Family Creamery Organic Super Premium Ice Cream across five flavors and six SKUs. Vanilla Bean pint. Strawberry in pint and quart. Cookie Dough pint. Dutch Chocolate quart. Mint Chip pint. Best-by dates December 23 to 30, 2026.

Distribution: 17 states. Arizona, California, Colorado, Connecticut, Florida, Georgia, Iowa, Illinois, Indiana, Maryland, New Jersey, Oregon, Pennsylvania, South Carolina, Texas, Washington, Wisconsin.

Reason in the recall notice: metal pieces. Source not disclosed.

The product mix tells you something. Three of the recalled flavors run through downstream inclusion injection (Cookie Dough chunks, Mint Chip chocolate chips, Strawberry fruit pieces). Vanilla Bean carries particulates blended into the base mix, not injected downstream. Dutch Chocolate is a base ice cream with no particulates at all. Both of the no-inclusion-injection flavors are on the recall anyway, which means the metal entered the product before the inclusion stage. The source is upstream of the inclusion feeder. That points to the mix tank, the homogenizer, the pump train, or the scrape blades inside the continuous freezer barrel.

Six SKUs on the same recall also says the contamination was not a single spike. Whatever shed metal was shedding across the duration of a base-run cycle, long enough to land in multiple consecutive flavor productions.

Three different controls, not one

If you treat all three of these as "foreign-material problems," you go to the metal detector and the X-ray as your answer. That misses two of the three.

A metal detector does not catch glass. Glass control is a separate program. A glass-and-brittle-plastic register that lists every glass surface in the facility. A routine inspection log for each surface. A no-glass-above-the-line rule for exposed product zones. A maintenance-work-order procedure that requires a glass check before the line restarts.

A metal detector does not catch a foreign object that is not metal. Plastic, bone, wood, and stone pass through every metal detector regardless of sensitivity. The control there is upstream. A sieve, a filter, a magnet on a powder line, a sift screen on a dry-ingredient hopper, sized to the smallest contaminant you can reasonably expect to enter that stream.

A metal detector does catch metal, but only if the detector is positioned where the metal actually enters the product and only if the sensitivity is set to catch the size of fragment the most likely source produces. A detector at finished-pack catches large fragments. It does not reliably catch small shavings from a slowly worn scrape blade, because detector sensitivity is calibrated for the finished-pack profile and small particles can fall below the threshold. A blade can shed below-threshold fragments for the length of a base-run cycle before anyone notices.

For each physical-hazard class, the control sits at a different point on the line. The plants in these three recalls had metal detectors. Two of the three failures were not metal-detector misses.

The drill that finds your gaps

Pull your physical-hazard control program. For each hazard class (glass and brittle plastic, metal, wood, hard plastic, foreign matter from raw materials), answer the following.

1. Is there a written control specific to that hazard, not just a reference to the metal detector?

2. Is the control positioned at the point on the line where that hazard is most likely to enter?

3. Is the rejection-disposition record specific enough to identify what was rejected and why?

4. When a hazard is caught, does the investigation route to the upstream source, or does it stop at "reject and continue"?

5. For glass specifically, is there a current glass-and-brittle-plastic register, and was it inspected this month?

If you cannot answer yes for all five on any one hazard class, that is the gap.

Then run the audit on your last 90 days of rejection records. If every reject says "foreign object" with no further detail, your line is generating data the way the My Mochi recall record reads. That data does not support root-cause analysis when a recall does happen.

What we built into Beacon

When we built Beacon's HACCP module, we made physical hazards a first-class hazard category alongside biological and chemical, each tied to the process step where it can enter the product. Every physical hazard you identify gets a risk score, a CCP if you assign one, a critical limit, and a monitoring record format. When a monitoring record comes in outside the limit, the system auto-creates a deviation that routes through immediate action, evaluation, and CAPA linkage. You cannot close the deviation without filling out what happened.

That does not replace your glass-and-brittle-plastic register or your metal detector log. It does mean the records that live inside the HACCP plan stay connected to the rest of your food safety system instead of sitting in a separate binder. When the supplier recall 24-hour clock starts, the records pull from one place.

Book a call and I'll show you how the workflow runs.