Glossary: Traceability, Audits, and Recalls

The terms behind tracing a lot in both directions, proving it to an auditor, and pulling product back when something goes wrong — defined plainly and traced to their source.

~5 min

These are the terms that decide two things: whether you can follow a lot in both directions and show your work to an auditor, and what happens when finished product has to come back off the shelf. Each is defined here in plain language, at the altitude of someone running the floor, with every regulatory term traced back to the rule or standard it comes from.

FSMA and the traceability rule

FSMA — The Food Safety Modernization Act, signed into law in 2011 and the largest overhaul of US food-safety law in decades. It moved FDA's job from reacting to outbreaks toward preventing them, and it is the parent law behind preventive controls, the produce rule, foreign-supplier verification, and the traceability rule below. When people say "FSMA," they usually mean that whole family of rules — see FDA's FSMA hub.
FSMA 204 — Shorthand for the Food Traceability Rule (21 CFR Part 1, subpart S), which adds recordkeeping beyond the basics for foods on the Food Traceability List. If you make, pack, or hold a listed food, you have to keep specific records and hand them over fast. The compliance date was pushed 30 months, from January 2026 to July 20, 2028 (Federal Register, August 2025, reinforced by a 2025 act of Congress directing FDA not to enforce before then). Confirm the live date on FDA's rule page before you plan around it — checked July 2026.
CTE (critical tracking event) — Under the traceability rule (21 CFR 1.1310), a point in a food's journey where you must capture traceability data: harvesting, cooling, initial packing, first land-based receiving of seafood, shipping, receiving, and transformation. Each CTE is a moment the rule says to write it down.
KDE (key data element) — The specific pieces of information the rule wants recorded at each critical tracking event — the traceability lot code, quantities, locations, dates, and who you got the food from or shipped it to. A CTE is the when; its KDEs are the what you record (21 CFR 1.1310).
Traceability Lot Code — A unique code that identifies a traceability lot — a batch of a listed food after it has been initially packed, first received as seafood, or transformed. It is the thread that ties every record together, and under the rule you are the one who assigns it at those points (21 CFR 1.1310).
Food Traceability List (FTL) — FDA's published list of foods that trigger the added recordkeeping — soft cheeses, shell eggs, nut butters, leafy greens, certain fish, fresh-cut produce, and more. If nothing you make, pack, or hold is on it, the rule's extra records do not reach you; if something is, they do. The list can change, so check the current one at FDA.
One-up/One-down — The traceability floor every operator should be able to meet: know exactly who you got each ingredient lot from (one step back) and exactly who you shipped each finished lot to (one step forward). SQF requires at least this — one step back, one step forward. It is the starting line, not the finish; real recall readiness ties the two ends together through your batch records.

Certification and the schemes behind it

GFSI (Global Food Safety Initiative) — Not a certificate you can hold, but the body that benchmarks food-safety standards against a common bar and recognizes the ones that clear it. When a retailer asks for "a GFSI-recognized certification," they mean one of the schemes GFSI recognizes — SQF, BRCGS, FSSC 22000, IFS — not a certificate from GFSI itself.
SQF (Safe Quality Food) — A GFSI-recognized certification scheme, common in the US, run by SQFI. Its Edition 9 code sets the requirements an auditor checks you against, and its quality code can certify food quality on top of food safety.
BRCGS — The certification standard from BRCGS (originally the British Retail Consortium), GFSI-recognized and often the scheme UK and European retail buyers ask for. Same job as SQF — a food-safety certificate a customer trusts — different scheme and origin.
FSSC 22000 — A GFSI-recognized scheme built on the ISO 22000 management-system standard plus sector-specific prerequisite programs. It tends to appeal to operations that already run ISO-style management systems and want a food-safety scheme that fits alongside them.
SQF Practitioner — The named person an SQF-certified site must have: an employee trained in SQF and HACCP who owns the day-to-day food-safety system. SQF spells out the requirements in Part B of the code; it is a role you assign to a real person, not a title you buy.

Audits and findings

Non-conformance — Audit and quality language for anything that fails to meet a requirement — a regulation, a customer spec, or your own written procedure. An auditor writes up non-conformances as major or minor, and each one needs a root-cause fix and evidence you closed it, not just a promise to do better.
Internal Audit — Your own scheduled check of your own system against the standard, run before the certification body arrives. Done honestly, it is where you catch your non-conformances first and fix them on your terms; the GFSI schemes require you to run them.
Mock Recall — A practice run of your recall: pick a lot, trace it forward to every customer and backward to every supplier, and time yourself. SQF requires you to test and verify the recall system at least once a year. Worth knowing: the SQF code sets no two-hour clause — the "trace 100% in 2 to 4 hours" bar operators repeat is a customer and industry expectation, not a line in the standard (checked July 2026).

When product has to come back

Recall vs Withdrawal — Two different removals under FDA's rules (21 CFR 7.3). A recall pulls back product that violates the law FDA enforces — a safety or misbranding problem serious enough that the agency could take action. A market withdrawal pulls back product for a minor issue that would not draw legal action, or for no violation at all, like a torn label or a quality complaint. Same logistics on the floor, very different regulatory weight.
Class I / II / III Recall — How FDA ranks a recall by health risk (21 CFR 7.3). Class I is a reasonable probability of serious harm or death. Class II is temporary or reversible harm, or serious harm only remotely likely. Class III is unlikely to cause harm at all. The class drives how urgent and how public the recall has to be.

Was this helpful?

Real help from real food people

Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.

FSMA and the traceability rule

FSMA — The Food Safety Modernization Act, signed into law in 2011 and the largest overhaul of US food-safety law in decades. It moved FDA's job from reacting to outbreaks toward preventing them, and it is the parent law behind preventive controls, the produce rule, foreign-supplier verification, and the traceability rule below. When people say "FSMA," they usually mean that whole family of rules — see FDA's FSMA hub.

FSMA 204 — Shorthand for the Food Traceability Rule (21 CFR Part 1, subpart S), which adds recordkeeping beyond the basics for foods on the Food Traceability List. If you make, pack, or hold a listed food, you have to keep specific records and hand them over fast. The compliance date was pushed 30 months, from January 2026 to July 20, 2028 (Federal Register, August 2025, reinforced by a 2025 act of Congress directing FDA not to enforce before then). Confirm the live date on FDA's rule page before you plan around it — checked July 2026.

CTE (critical tracking event) — Under the traceability rule (21 CFR 1.1310), a point in a food's journey where you must capture traceability data: harvesting, cooling, initial packing, first land-based receiving of seafood, shipping, receiving, and transformation. Each CTE is a moment the rule says to write it down.

KDE (key data element) — The specific pieces of information the rule wants recorded at each critical tracking event — the traceability lot code, quantities, locations, dates, and who you got the food from or shipped it to. A CTE is the when; its KDEs are the what you record (21 CFR 1.1310).

Traceability Lot Code — A unique code that identifies a traceability lot — a batch of a listed food after it has been initially packed, first received as seafood, or transformed. It is the thread that ties every record together, and under the rule you are the one who assigns it at those points (21 CFR 1.1310).

Food Traceability List (FTL) — FDA's published list of foods that trigger the added recordkeeping — soft cheeses, shell eggs, nut butters, leafy greens, certain fish, fresh-cut produce, and more. If nothing you make, pack, or hold is on it, the rule's extra records do not reach you; if something is, they do. The list can change, so check the current one at FDA.

One-up/One-down — The traceability floor every operator should be able to meet: know exactly who you got each ingredient lot from (one step back) and exactly who you shipped each finished lot to (one step forward). SQF requires at least this — one step back, one step forward. It is the starting line, not the finish; real recall readiness ties the two ends together through your batch records.

Certification and the schemes behind it

GFSI (Global Food Safety Initiative) — Not a certificate you can hold, but the body that benchmarks food-safety standards against a common bar and recognizes the ones that clear it. When a retailer asks for "a GFSI-recognized certification," they mean one of the schemes GFSI recognizes — SQF, BRCGS, FSSC 22000, IFS — not a certificate from GFSI itself.

SQF (Safe Quality Food) — A GFSI-recognized certification scheme, common in the US, run by SQFI. Its Edition 9 code sets the requirements an auditor checks you against, and its quality code can certify food quality on top of food safety.

BRCGS — The certification standard from BRCGS (originally the British Retail Consortium), GFSI-recognized and often the scheme UK and European retail buyers ask for. Same job as SQF — a food-safety certificate a customer trusts — different scheme and origin.

FSSC 22000 — A GFSI-recognized scheme built on the ISO 22000 management-system standard plus sector-specific prerequisite programs. It tends to appeal to operations that already run ISO-style management systems and want a food-safety scheme that fits alongside them.

SQF Practitioner — The named person an SQF-certified site must have: an employee trained in SQF and HACCP who owns the day-to-day food-safety system. SQF spells out the requirements in Part B of the code; it is a role you assign to a real person, not a title you buy.

Audits and findings

Non-conformance — Audit and quality language for anything that fails to meet a requirement — a regulation, a customer spec, or your own written procedure. An auditor writes up non-conformances as major or minor, and each one needs a root-cause fix and evidence you closed it, not just a promise to do better.

Internal Audit — Your own scheduled check of your own system against the standard, run before the certification body arrives. Done honestly, it is where you catch your non-conformances first and fix them on your terms; the GFSI schemes require you to run them.

Mock Recall — A practice run of your recall: pick a lot, trace it forward to every customer and backward to every supplier, and time yourself. SQF requires you to test and verify the recall system at least once a year. Worth knowing: the SQF code sets no two-hour clause — the "trace 100% in 2 to 4 hours" bar operators repeat is a customer and industry expectation, not a line in the standard (checked July 2026).

When product has to come back

Recall vs Withdrawal — Two different removals under FDA's rules (21 CFR 7.3). A recall pulls back product that violates the law FDA enforces — a safety or misbranding problem serious enough that the agency could take action. A market withdrawal pulls back product for a minor issue that would not draw legal action, or for no violation at all, like a torn label or a quality complaint. Same logistics on the floor, very different regulatory weight.

Class I / II / III Recall — How FDA ranks a recall by health risk (21 CFR 7.3). Class I is a reasonable probability of serious harm or death. Class II is temporary or reversible harm, or serious harm only remotely likely. Class III is unlikely to cause harm at all. The class drives how urgent and how public the recall has to be.