Compliance
Recall and incident management
Nobody plans a recall, which is exactly why you must. The businesses that survive one are the ones that could trace the batch in an hour, had the contacts on a card, and wrote the notice from a template instead of from panic. This page is the plan — write yours, then prove it with the mock-recall exercise at the end.
The recall decision
The decision is a risk classification, not a feeling. Most jurisdictions use a two- or three-tier system; the questions below mirror them.
| Level | Situation | Typical action |
|---|---|---|
| Class I / highest | Reasonable probability of serious health consequences or death — undeclared major allergen, pathogen (Salmonella, Listeria, botulinum toxin), glass/metal in pack | Immediate public recall; notify authority; media statement |
| Class II / medium | Temporary or medically minor harm possible — undeclared sulfite at moderate level, mold-adjacent off-odour, mislabelled variety | Recall or market withdrawal per authority guidance |
| Class III / lowest | Unlikely to cause harm — labelling error without safety impact, weight shortfalls | Market withdrawal or correction |
| Not a recall | Internal quality failure caught before shipping | Re-grade or destroy; document as internal nonconformity |
No business has ever been ruined by recalling product that turned out fine. Businesses and people have been ruined — and hurt — by the opposite. The cost asymmetry is total.
Roles and contacts — write this down now
| Role | Owns | Fill in for your operation |
|---|---|---|
| Incident manager | Decision authority; single spokesperson | |
| Traceability lead | Pulls batch records; quantity, customers, destinations | |
| Communications | Customer notice, public statement, social channels | |
| Operations | Halts production, quarantines stock, arranges returns | |
| Authority liaison | Notifies regulator; manages inspection follow-up |
In a one-person business you hold all five roles — write the card anyway, and add the external numbers: local food authority emergency line, lab, lawyer, insurer, largest customer's quality contact.
The first 24 hours
- Hour 0–1: stop and confirm Halt shipments of the suspect batch. Pull a retain sample and the batch record. Decide the class (above).
- Hour 1–2: quantify Traceability lead answers: how much product, which lots, where is it now — warehouse, customers, sold on. One step back (supplier), one step forward (customers).
- Hour 2–4: notify Authority notification per your jurisdiction's rules (in the EU via the local authority into RASFF; in the US, FDA recall notification; UK, FSA incident team). Draft the customer notice from the template.
- Hour 4–24: contact every affected customer Directly, with: product, lot, dates, hazard, exact instruction (do not eat; return/dispose; refund route), and a contact for questions. Log each contact.
- Day 1: public notice if needed Class I almost always needs a public statement — plain language, hazard, action, apology, contact details.
| Every notice must state | Why |
|---|---|
| Product name, size, lot/date codes affected | Customers must identify their packs precisely |
| The specific hazard | Enables informed risk decisions (allergen sufferers especially) |
| The exact action: do not eat; return or dispose; how | Ambiguity is what spreads harm |
| Refund/replacement route and timescale | Reduces friction, accelerates returns |
| A reachable human contact | Trust is the recovery currency |
Root-cause analysis after the fire is out
- Preserve evidence Retain samples, batch records, logs, cleaning records, calibration records — freeze the paper trail literally and figuratively.
- Ask "why" five times e.g. Mould arrived in retail packs → jar moisture high → conditioning skipped → batch rushed for market deadline → no CCP check on conditioning completion → corrective action: add a signed conditioning-release step to the batch record.
- Fix the system, not the symptom If the fix is "be more careful", it is not a fix.
- Verify the fix — next batches measured against the failure mode; record the verification.
- Update the SOP and retrain anyone it affects. An incident that changes nothing repeats.
The mock recall exercise
A mock recall is a drill: pick a real past batch and time how fast you can answer the five questions below, using only your records. Do it twice a year. Most first attempts fail on questions 4 and 5 — that is the point of practising.
- Pick a lot code at random from a real shipment (e.g. L2026-07-11-B, apple rings, 22 packs).
- One step back — which raw-material lots went into it? Supplier, dates, quantities. Time target: 15 minutes.
- One step forward — who received the finished packs? Markets, direct customers, online orders. Time target: 30 minutes.
- Mass balance — kg in, kg packed, kg sold, kg still held: do the numbers reconcile to within normal drying yield? A mismatch is an unaccounted lot — find it.
- Simulate the notice — draft the customer/public notice from the template using only record data. If you cannot write it in 20 minutes, your records are thin.
- Debrief honestly — log the gaps found, assign fixes with dates, and re-drill after fixes. Score: questions answered within target = pass.
Operations with tight batch records can recall one lot precisely. Operations with loose records must recall everything — the whole product line, months of sales. Records are not bureaucracy; they are the size of the blast radius.
Recovering after a recall
- Close the loop with the authority — submit the effectiveness check: what was recovered, disposition of returns, verification that the fix works.
- Handle returns — segregate, document, destroy or denature; returned product never re-enters sale.
- Tell the truth once, completely — customers forgive incidents; they do not forgive discovering you under-communicated.
- Consider a relaunch gesture — improved packaging, a cleaner label, third-party testing published. Turning the fix into a visible feature is the strongest recovery there is.