Recall Management Plan

A Recall Management Plan connects the people authorized to act, the evidence used to identify affected food, the instructions sent to recipients, and the records showing what happened. It should answer practical questions before an incident: who can stop shipment, who assesses uncertain boundaries, who approves communications, and how the business distinguishes product accounted for from product actually recovered.

This guide addresses US FDA-scoped human-food manufacturing, using a fictional bakery example. Drug and device recalls, USDA-FSIS responsibilities, foreign-market duties, and separate statutory reporting regimes are outside its scope. It describes plan architecture rather than a minute-by-minute response playbook. Operational recommendations and examples below are planning practice, not additional legal requirements.

The legal trigger in 21 CFR 117.139 is specific: for food with a hazard requiring a preventive control, a written recall plan is required where that provision applies. The plan must describe steps and assign responsibility for direct-consignee notification, appropriate public notification, effectiveness checks, and appropriate disposition. Do not replace that trigger with a blanket assertion that every food business has the same obligation.

Applicability comes first. Section 117.5 contains exemptions, including the qualified-facility exemption from subparts C and G, subject to its conditions and modified requirements. Section 117.7 addresses facilities solely storing unexposed packaged food. A bakery label alone establishes neither coverage nor exemption; assess the facility, activities, food, and applicable conditions.

For covered operations, section 117.126 includes the required recall plan within the written food safety plan, whose preparation must be performed or overseen by one or more preventive controls qualified individuals. Keep that connection visible rather than maintaining an unrelated emergency document.

Distinguish this from Part 7's scope: FDA enforcement practices and guidance for voluntary removal or correction of marketed violative products. Its recall provisions inform strategy and communications; they should not be presented indiscriminately as binding food-manufacturing statutes. Useful planning can extend beyond a particular legal minimum without changing its status.

As planning practice, identify a recall leader with authority to coordinate the incident and obtain resources. Assign a deputy who can exercise defined authority when the leader is unavailable. A contact list without delegated decisions is incomplete: a night-shift supervisor needs to know whether a shipping hold can begin immediately and who can subsequently change it.

Separate technical assessment from commercial pressure. Food-safety personnel assess the hazard and affected-food boundary; operations establish physical control; logistics identify shipments and recipients; communications manage approved messages. Leadership authorizes business decisions, while a designated regulatory liaison maintains contact with FDA. Small businesses may combine roles, but should still identify each responsibility, backup, and decision record.

Give every role access to the records it needs, including outside normal working hours. Maintain contacts for contract warehouses, carriers, distributors, ingredient suppliers, laboratories, and advisers where relevant. Record who can obtain shipment detail from a third party and how the team proceeds when that person cannot be reached. Verify contact changes through normal business maintenance rather than waiting for an incident.

Define approval boundaries explicitly. A warehouse employee may block stock without being authorized to release it. A customer-service representative may collect quantities without deciding that a customer's response proves effectiveness. Document disagreements and escalation routes, particularly where incomplete evidence creates pressure to narrow scope. The plan should allow protective action while information develops, with a named human accountable for each material decision and revision.

Practice triggers include a supplier alert, complaint suggesting injury, laboratory finding, labeling discrepancy, process deviation, or discovery of an unrecorded ingredient substitution. A trigger opens an assessment; it does not automatically establish the hazard, affected lots, or final recall scope. Record what was reported, by whom, when it was received, and what remains unverified.

Preserve the original alert, relevant labels, production and dispatch records, test reports, and communications before working copies are annotated. Maintain sample identity and custody where samples are relevant. Distinguish observations from interpretations: a supplier's preliminary lot range, for example, is evidence to assess rather than an automatically complete boundary for the bakery's finished products.

Maintain a decision log showing the question, available evidence, decision-maker, conclusion, and reason. Include decisions not to expand a boundary and the evidence supporting them. An absence of recorded complaints is not equivalent to evidence that an identified hazard is controlled. Likewise, a negative result requires interpretation in light of the sample and question it actually addresses.

Where boundaries remain uncertain, document a protective working scope and the investigation needed to refine it. Do not use missing records as evidence of absence. Under section 7.42, the firm need not delay initiating a recall pending FDA review of its strategy; the assessment process should not become an administrative reason for inaction.

A useful genealogy follows actual material use, not just the recipe expected to be used. Connect supplier lot identifiers to receipts, ingredient issues, production batches, authorized rework, finished pack lots, and actual shipments. Preserve split and merged relationships. The lot genealogy explanation provides supporting terminology; the recall plan specifies who retrieves and interprets those relationships.

In the fictional bakery scenario below, ingredient lot S enters batches A and B. Before the incident, material from B was authorized as rework R and incorporated into C. That historical authorization establishes a traceability link; it does not establish present safety or authorize reuse after the concern emerges. C therefore belongs in the affected-food assessment.

Retain the supplier's original code alongside any internal code. Repacking, relabeling, pallet changes, and transfers should not erase ancestry. A finished-code search alone can miss products that inherited material through rework or a shared intermediate. Use the ingredient traceability guide when evaluating how those links are recorded.

Identify where food actually went, not merely the invoice customer or intended delivery address. Investigate split deliveries, cross-docking, transfers, and onward distribution where relevant. Treat a missing shipment-to-pack-lot link as an unresolved boundary problem. Narrowing the affected set requires evidence, not an assumption that the oldest stock must have shipped first.

All quantities in this example are illustrative. Assume assessment includes finished pack lots PA, PB, and PC because of ingredient lot S and the historical rework link to C. Their combined output is 1,200 packs: 900 dispatched and 300 originally onsite. This is finished-pack accounting, not an ingredient mass-balance calculation.

At one defined snapshot, the direct consignees report the following mutually exclusive statuses. Returned quantities have physically arrived back at the bakery; a promised return would not yet belong in that column. Each consignee's categories reconcile to its original dispatched quantity.

The distribution equation is 900 = 150 returned + 400 retained + 250 reported sold/used + 100 unresolved. Current onsite physical holding is 450 = 300 original onsite + 150 returns. Overall, 1,200 = 300 original onsite + 150 returned + 400 retained + 250 sold/used + 100 unresolved. Adding the current holding of 450 to all four distribution categories would double-count the 150 returns.

Keep original location, current location, and movement history separate. A return changes current location without deleting its original dispatch. A later disposal records another movement or disposition event; it does not create another recovered pack. Preserve snapshot dates so revised responses do not silently rewrite earlier reports. Link each quantity to a shipment, receipt, response, or other supporting record.

The equations balance while 100 packs remain unresolved and 250 are reported sold or used. Even the 400 retained packs need evidence of appropriate action rather than a quantity statement alone. Reconciliation proves only that this accounting model balances. It does not prove safety, complete retrieval, effective notification, or recall closure. Do not describe this snapshot as complete recovery, and do not turn an unknown into a disposal estimate merely to remove an exception.

The standing plan explains how to develop a strategy; the incident-specific strategy identifies what this recall will do. Under section 7.42, strategy addresses recall depth, public warning, and effectiveness checks. Relevant considerations include the health-hazard evaluation, ease of identifying the product, whether the deficiency is obvious, and how much product remains unused.

Depth identifies how far into distribution the recall extends: wholesale, retail including intermediate wholesale, or consumer/user level including relevant intermediaries. It is not simply the number of customers on the manufacturer's sales ledger. As practice, document the rationale and the evidence needed from intermediaries to identify further recipients. Record who approves a change when new distribution information emerges.

Part 7 describes public warnings as alerting the public to a serious health hazard, reserved for urgent situations where other means of preventing use appear inadequate. It also describes FDA consultation and review of a firm's proposed warning. Separately, an applicable section 117.139 plan includes public notification when appropriate to protect public health. Neither point makes every incident's communication strategy identical.

Distinguish purpose from the selected checking level. The stated purpose is to verify that all consignees at the specified recall depth received notification and took appropriate action. The strategy nevertheless specifies the methods and level of checks. This is not a universal instruction to check every consignee in every recall, nor permission to choose the least demanding level without a case-specific strategy.

For implementation, define the relevant population, selected recipients, contact method, questions, evidence, and escalation for failures. A small consignee population can require particular care when applying a percentage; document the approach rather than inventing a rounding rule. Preserve the distinction between notifying affected direct accounts and conducting effectiveness checks. The Part 7 levels do not erase applicable Part 117 planning responsibilities.

Use section 7.49 as the communication foundation. Its guidance addresses prompt notification of affected direct accounts, stopping further distribution or use, onward notification where appropriate, and instructions for the food. Messages should be brief and direct, with no promotional language or qualifications that weaken the safety message.

The first column summarizes guidance; the other columns are implementation practice. Test the instructions against the recipient's task: can a warehouse worker identify the correct cases without opening unrelated stock? Can a retailer distinguish similar pack sizes? State the unit being requested so cases, trays, and individual packs are not combined without documented conversion.

Track message sent, delivery evidence, acknowledgment, reported action, and effectiveness-check findings separately. An acknowledgment may show receipt without proving isolation or onward notification. Section 7.49 calls for follow-up where necessary when recipients fail to respond. As practice, record failed contacts and alternate routes rather than marking an account complete because an email was attempted.

For a firm-initiated removal believed to involve violative product, section 7.46 requests immediate notification to the appropriate FDA office. Its information list includes product identity, discovery circumstances, risk evaluation, produced and distributed quantities, distribution information, communications, proposed strategy, and the firm's contact. Prepare those fields without disguising estimates as confirmed facts.

Maintain one approved source for message text and record revisions. If scope changes, identify which recipients received which version and what supplementary instruction they need. Public communications, direct-account notices, and internal warehouse instructions serve different audiences; consistency matters, but copying the same document to everyone can leave essential actions unclear.

As practice, combine an inventory-status hold with physical identification and a check that the food is actually controlled. Record pack lot, quantity, location, hold reason, authorizer, and any movement permission. Include offsite storage and stock staged for loading. A blocked sales order alone does not show that a pallet already on a trailer has been stopped.

Create a distinct return receipt linked to the original shipment and incident. Confirm identity and count, record discrepancies, and place returned food in an appropriate controlled location. Do not automatically merge it with ordinary saleable stock. Where mixed or damaged returns make identification uncertain, preserve that uncertainty and obtain a documented assessment instead of assigning the most convenient lot.

The disposition examples in section 117.139 include reprocessing, reworking, diversion to a use without a safety concern, and destruction. These are examples of appropriate disposition, not automatic permission to rework recalled food. A human safety assessment should establish whether a proposed route is appropriate and meets applicable requirements before anyone authorizes it.

For each authorized route, specify quantity, method, destination, responsible party, and evidence of completion. Retain supporting destruction, correction, or treatment records as relevant. A transport booking proves an arrangement, not completed disposition. Likewise, a credit note resolves a commercial transaction but does not prove that the food was returned, isolated, destroyed, or otherwise appropriately dealt with.

Use movement history to preserve sequence. If 150 packs return and are later destroyed, the return remains a historical event while current physical stock decreases. Do not add returned and subsequently destroyed quantities as separate packs recovered from distribution. Keep financial adjustments in a linked but distinct record so refunds, replacements, and physical quantities cannot silently substitute for one another.

For records subject to section 117.305, requirements include accuracy, indelibility, legibility, concurrent creation, and enough detail to show the history of work performed. As implementation practice, preserve earlier entries and identify corrections, their author, and their reason. Make release from hold a controlled human decision supported by evidence, not an automatic consequence of an inventory adjustment.

Maintain separate views of product accounting, communication progress, effectiveness findings, and unresolved decisions. A single completion percentage can conceal important differences: every direct account might have replied while some product remains unlocated, or quantities might reconcile while recipient actions remain unverified. Use measures that state exactly what has been counted and what evidence supports the count.

Under section 7.53, FDA requests periodic recall status reports and specifies frequency in each case according to relative urgency. Do not convert this into a universal reporting schedule. The listed report information includes notifications and methods, responding and nonresponding consignees, quantities returned or corrected, products accounted for, effectiveness-check results, and estimated completion time frames, unless otherwise specified or inappropriate.

As practice, give every report a snapshot time, scope version, preparer, and review record. Explain changes since the previous snapshot. If a consignee revises a quantity from retained to sold, show the correction and its source rather than treating it as additional distribution. Attach an exception list with owners and next actions for unresolved quantities, contacts, and evidence gaps.

Effectiveness findings should address action, not simply message delivery. Ask whether the correct product was identified, distribution or use stopped, relevant stock controlled, and onward instructions carried out where applicable. Record contradictory evidence. A response stating that nothing remains may need clarification about whether the food was sold, consumed, transferred, returned, or disposed of; those situations are not interchangeable.

Section 7.55 makes termination an FDA determination based on reasonable removal or correction efforts under the strategy and appropriate disposition or correction commensurate with the hazard. It provides for written notification and for a firm's supported written termination request. A balanced spreadsheet or internal management approval is not that FDA determination.

Keep site corrective and preventive action separate. Root-cause work, supplier follow-up, revised controls, and checks that improvements work may continue on their own documented track. Conversely, completing those tasks does not itself terminate the recall. Maintain distinct decisions for product disposition, operational restart, site improvement closure, and the FDA termination process so one approval cannot be mistaken for another.

A mock exercise tests whether the standing plan can be used; it is not an actual recall announcement. As practice, mark exercise records clearly, isolate test recipient lists, and prevent simulated messages from reaching real customers or regulators. Use a designated internal recipient for simulated regulatory communications. Never send a fake regulator notice merely to demonstrate that a communications workflow operates.

Choose a scenario that requires more than a convenient finished-lot search. Ask the team to retrieve an ingredient receipt, establish actual batch use, follow a rework relationship, identify pack lots, locate dispatch evidence, and reconcile a defined snapshot. Rehearse physical identification and retrieval of held stock, not just production of a report. Record unavailable records and uncertain links honestly.

Exercise objectives and timing observations should reflect the operation and scenario; this guide sets no universal drill frequency or invented completion target. Observe whether deputies can act, third-party records are accessible, and units reconcile. The mock recall program explanation addresses the exercise concept; the plan remains the standing authority and procedure used during a real event.

Common mistakes include tracing the recipe rather than actual consumption, excluding rework descendants, treating an invoice address as the receiving site, and counting returns twice. Communication mistakes include equating an email attempt with notification effectiveness and recording a credit as destruction evidence. Decision mistakes include narrowing scope without supporting evidence or waiting for a perfect report before taking justified protective action.

Trade-offs deserve explicit discussion. A broad working boundary may control uncertainty but include more unaffected food; an overly narrow boundary can omit affected food. Detailed checks consume resources but can expose failures hidden by acknowledgments. Centralized approvals support consistency but create a bottleneck without deputies. Document the chosen approach and its rationale rather than hiding those tensions behind a generic promise of complete recovery.

Close the exercise with assigned improvements, evidence of implementation, and a targeted retest where useful. A successful rehearsal should not mean that unknowns were guessed away. It should show that people recognized uncertainty, maintained control, escalated appropriately, and produced records another authorized person could understand without reconstructing the exercise from memory.

Build a controlled plan with usable annexes rather than one oversized document that nobody can navigate. Keep the decision structure stable while maintaining contacts, product identifiers, distribution routes, and templates as operational information changes. The following is a practical implementation checklist, not a substitute for determining applicable legal responsibilities.

• Document scope, facility applicability, covered products, relevant boundaries, and responsibilities that require a separate assessment outside this plan.
• Name decision owners and deputies; define authority to hold, communicate, change scope, authorize disposition, and release controlled stock.
• Map actual ingredient, batch, rework, pack-lot, and shipment relationships, including records held by third parties and unresolved link types.
• Prepare decision logs, approved communication templates, structured recipient responses, and a versioned incident-specific strategy record.
• Separate original dispatch, current location, movement events, and disposition so returns and later destruction cannot be double-counted.
• Define effectiveness-check evidence, exception handling, case-specific reporting arrangements, and the distinction between FDA termination and site improvement closure.
• Rehearse record retrieval and physical control in an isolated exercise, then assign owners to gaps and verify completed improvements.

Evaluate tools using your own difficult examples. Can users represent split lots, merged batches, and historical rework without losing ancestry? Can they distinguish planned from actual shipments, preserve corrections, show the evidence behind a decision, and export a dated reconciliation? Can permissions separate data entry from approval? Ask how offline or unavailable-system conditions are handled, and test the answer rather than accepting a demonstration's assumptions.

When comparing recall-management options or food traceability software, keep questions neutral and evidence-based. No software selection establishes that the hazard assessment is sound, the scope is complete, or recipients acted appropriately. Review both the records the tool can represent and the operating procedures needed to keep those records reliable.

For bakery-specific implementation, connect this plan with bakery manufacturing workflows and recipe control. Keep detailed allergen prevention within its own control program rather than duplicating it here. The recall plan's job is to connect hazards, affected food, authorized decisions, recipient action, and defensible evidence when those controls may have failed.