RISK ASSESSMENT · TRACEABILITY AND RECALL

Traceability, Withdrawal and Recall: The Risk Assessment Behind a Plan That Works Under Pressure

By Mthokozisi Nkosi, Food Safety Specialist & Lead Auditor, ASC Food Safety · 15 min read

Traceability is one of the twelve fundamental requirements of BRCGS Global Standard Food Safety Issue 9, at clause 3.9, and a major against its statement of intent costs certification and forces a further full audit. Four hours is the working expectation for that test, set by the site in its own procedure, with quantities reconciled at both ends. The Traceability, Withdrawal and Recall Risk Assessment Template (RA20) is R690.

What is the difference between a withdrawal and a recall?

Clause 3.11 of BRCGS Issue 9 covers incidents, withdrawal and recall. A withdrawal removes affected product from the supply chain before it reaches the consumer. It stops at your customers, your distributors and your depots. A recall goes further and asks consumers to return or destroy product they already hold, which means public notification. The step up is triggered by two facts: whether product has reached the consumer, and whether it presents a safety risk.

Sites get this wrong in both directions. Some call everything a recall and frighten a customer into delisting them over a labelling typo on stock that never left the depot. Others call a genuine safety event a withdrawal because the word is cheaper, keep it quiet, and then have to explain to a regulator why consumers were not told. Tone has nothing to do with it. The choice is documented, made against written criteria by a named person, and your procedure must contain those criteria.

On classification, be careful about which model you are using. The three class system, where Class I covers a reasonable probability of serious health consequences or death, Class II a temporary or medically reversible consequence, and Class III a situation unlikely to cause an adverse health consequence, comes from United States Food and Drug Administration practice. It is a useful internal severity scale and many South African manufacturers adopt it in their procedures for exactly that reason. It is not a South African statutory classification, so write it in your procedure as your own severity scale rather than presenting it as law.

Withdrawal or recall is a decision, and a decision needs written criteria, a named decision maker and a time stamp. Everything else is improvisation.

What does a traceability and recall risk assessment actually assess?

It assesses the points where identity is lost, which is where a clause 3.9 trace actually breaks. Every trace failure has the same shape: product changed form, changed container or changed hands, and the code did not travel with it. The register runs by break point rather than by product, scores likelihood of loss against the difficulty of recovering the link, and produces a control and an owner for each row above the threshold.

That is a different unit of assessment from most of the risk assessments in a management system, and it is why a generic template rarely works here. A hygiene risk assessment runs by area. A supplier assessment runs by material. A traceability assessment runs by transition: the moments in your process where one identified thing becomes another identified thing. List those transitions honestly and the register almost writes itself.

• Goods receiving, where a supplier lot number is transcribed into your system, often by hand, often at speed, often at night
• Bulk decanting, where a 25 kg bag or a 1,000 litre intermediate bulk container is emptied into a hopper or a silo and the original lot identity ends
• Silo and tank blending, where two or more incoming lots occupy the same vessel and the trace becomes a range rather than a lot
• Part used containers, where the remainder goes back to the store with the label torn, the seal open and the lot marked on tape
• Rework, where yesterday’s product re enters today’s batch and drags an extra set of raw material lots with it
• The coder, where a mechanical or software failure prints the wrong date, a repeated code or nothing at all
• Repack, relabel and promotional packing, often done by a third party who does not carry your codes through
• Outsourced storage and transport, where a third party warehouse picks by product code rather than by batch and ships mixed pallets
• Dispatch allocation, where a delivery note records the product but not the batch, so the forward trace becomes an assumption

Score each break point on two axes. First, how likely is the link to be lost, given the current control and the current records. Second, how much product would fall inside the trace boundary if you had to assume the worst at that point. A break at the silo loses a link and widens the recall at the same time. That second axis is what turns the assessment from a compliance document into a commercial one, because it puts a number on the exposure your process design has created.

What does one step back, one step forward mean in practice?

Under clause 3.9 of BRCGS Issue 9 it means you can identify the immediate supplier of every material received and the immediate customer of every batch dispatched. You are not obliged to trace to the farm or to the individual shopper. You are obliged to make the two links either side of your gate complete, dated, quantified and retrievable without reconstructing them from memory, from an email folder or from a driver’s recollection.

Backward, that means a receiving record that carries the supplier, the supplier’s lot, the quantity, the date, the vehicle and the internal lot you assigned, linked to the goods receiving check and the certificate of analysis. Forward, it means a dispatch record that carries the customer, the delivery address, the batch, the quantity in units and the date, linked to a signed proof of delivery. Both must survive a system change and a staff change.

The weak side is almost always forward. Sites invest heavily in receiving because that is where the supplier approval programme lives, then dispatch mixed pallets on a delivery note that names the product and the case count but not the batch. When the trace is called, the answer becomes “it went to these four customers, probably”. Probably is not a trace. If your warehouse management system cannot allocate batch to delivery note, that is a finding waiting to be written, and it belongs in the register as a high scoring break point with a dated action against it.

How should you decide your lot coding, and what does that decision cost?

Lot coding is a risk decision, not a printing decision. The narrower the code window, the smaller the quantity you have to withdraw when something goes wrong, and the more work the line has to do to change codes. Regulation 11 of R146 of 2010 requires batch identification on the label. Regulation 11 does not tell you how wide the batch may be, so the width is yours to justify.

Take a filling line producing 26,540 one litre cartons over a ten hour run. The table below shows what the same day looks like under four coding conventions. Nothing about the product changes. Only the exposure changes.

Two practical rules come out of this. First, align the code to a real physical reset in the process, normally the mixing vessel or the tank, because a code that does not match a physical boundary forces you to widen the trace anyway. Second, whichever convention you choose, the code has to be verified, and the verification record is what an auditor reads. A coder start up check, a check at each change and a check at the end of the run, each signed with the code observed, is the minimum. Code verification failures are one of the most common reasons a real withdrawal becomes wider than it needed to be.

What is the four hour traceability test and how do you pass it?

The four hour test is a timed exercise in which you take a real batch and trace it backward to every raw material and packaging lot and forward to every customer, with quantities reconciled at both ends. BRCGS Issue 9 deals with traceability at clause 3.9, and requires the site to define its own timescale and to test at least annually across product groups. The clause states no number. Four hours is the working expectation most certification bodies and retail customers apply, so it is the objective most sites write into their own procedure.

Sites fail the four hours for reasons that have nothing to do with the four hours. They fail because one person holds the knowledge and that person is on leave. They fail because the raw material records are in a book in the store and the dispatch records are in a system in the office and nobody has ever joined them. They fail because the batch chosen had rework in it and the rework record does not say which batch the rework came from. Time is the symptom.

1. Start the clock and record itWrite the start time, the person who called the exercise, the batch selected and the reason it was selected. An exercise with no recorded start time cannot demonstrate a four hour result, and that alone loses the point at audit.
2. Trace backward to every input lotEvery raw material, every processing aid, every primary packaging component, every label and every rework addition, each with its supplier, supplier lot, your internal lot and the quantity used. Packaging and labels are the two most commonly omitted, and the label is what carries the allergen declaration.
3. Trace forward to every outputEvery customer, delivery note, quantity, date and destination, plus stock still held, product on hold, samples retained and anything sold as second grade or to staff. Second grade sales and staff shop sales are the classic missing line.
4. Reconcile quantities at both endsInput received against input used, held, sampled and wasted. Output produced against output dispatched, held, sampled and rejected. Report the unaccounted difference as a percentage against a tolerance you set in advance.
5. Stop the clock and record the resultEnd time, elapsed time, what was found, what could not be found, and the corrective action with an owner and a date for anything that failed. A test that found nothing wrong and took three hours fifty is worth less than a test that found two gaps and closed them.

How do you run a mass balance reconciliation?

Mass balance reconciles quantity in against quantity out over a defined boundary, then reports the unaccounted difference as a percentage against a tolerance set in advance. Matching codes proves your records are linked. Reconciling quantities proves the records are true. BRCGS Issue 9 expects quantity checks where the trace covers raw materials through to finished product, which is why auditors ask for numbers rather than codes.

Here is a worked example on a single batch of one litre chilled apple juice, batch 26104A, produced from apple juice concentrate lot AJC-2604. The figures are illustrative and are used to show the method, not to describe any real site or product.

Now consider the failure that matters. If the dispatch figure had come back as 26,780 against 26,540 cartons produced, you would have shipped 240 more cartons of batch 26104A than you made. That is not a rounding problem. It means either the coder repeated the previous day’s code, or a delivery note was allocated to the wrong batch, or product from another batch was picked and shipped under this one. All three of those widen a withdrawal, and all three are found by counting rather than by matching.

Set the tolerance before you run the reconciliation and write it into the procedure with a justification. A tolerance is a statement about your process losses, not a cushion for missing records. When the variance falls outside it, the exercise is not finished until an investigation record explains where the difference went, and root cause work is what turns that into a closed finding. Our companion guidance on corrective action and root cause analysis for audit findings sets out how to structure that investigation.

How do you run a mock recall that produces usable evidence?

Clause 3.11 of BRCGS Issue 9 covers withdrawal and recall, and a mock recall is not a traceability test with a different name. The trace answers where the product is. The mock recall answers whether you could get it back, how fast, and who you would have told. A defensible exercise uses a real dispatched batch, involves the actual crisis team, contacts a sample of real customers, and produces an effectiveness figure.

The effectiveness figure is what most sites leave out. Trace the batch, then ask: of the quantity dispatched, how much did we account for through customer responses within the time we set. If 25,900 cartons went to four customers and three customers confirmed their holdings within two hours, covering 21,400 cartons, your effectiveness at two hours was 82.6 per cent, and the exercise report should say so and say why the fourth customer did not respond. That single number tells an auditor more than ten pages of procedure.

Who sits on the recall crisis team, and what does each role do?

ISO 22000:2018 puts withdrawal and recall at clause 8.9.5, and the team behind it is a named list of people with defined authority, contactable outside working hours, each with a named deputy. Seven roles cover most manufacturers: team leader, technical lead, operations and warehouse, commercial and customer contact, regulatory liaison, communications, and a records keeper. The records keeper is the role sites omit and the one an auditor misses immediately, because without it there is no timeline.

Two design rules matter more than the org chart. First, one person cannot hold the technical decision and the media role at the same time, because both peak in the same hour. Second, the deputy list must be real. Test it by removing the leader at the start of an exercise. Emergency preparedness sits alongside this as its own assessment, because a recall may run at the same time as a power failure, a water interruption or a fire, and the plans have to work together rather than compete for the same people.

Who must you notify in South Africa when you recall food?

Customers first, then the National Consumer Commission. The Consumer Product Safety Recall Guidelines, published on 13 June 2012 in Government Gazette 35434 under Notice 490 in terms of the Consumer Protection Act 68 of 2008, ask a supplier to notify the Commission within two days of commencing a recall action, and to submit a recall strategy. That is a paraphrase of the Guidelines, not a quotation.

Section 60 of the Consumer Protection Act 68 of 2008 is headed “Safety monitoring and recall”, and it places the Commission at the centre of the system: the Commission maintains the practice for receiving notice of consumer complaints and returned goods, and it may issue a written notice requiring a recall where a supplier has not acted. Section 61, “Liability for damage caused by goods”, imposes liability on producers, importers, distributors and retailers for harm caused by unsafe goods, product failure, defects or hazards, or by inadequate instructions or warnings, irrespective of negligence. Those two sections are why the recall file is also a legal file.

Build this list into your plan with names, numbers, email addresses and the physical addresses of the local authority office, and review it at every mock recall. A generic line saying “notify the relevant authorities” is the version that fails when someone has to act on it at seven on a Friday evening. Our guide to South African food legislation sets out how these instruments fit together across the whole system.

What goes in the customer notification and the public recall notice?

Both documents must be drafted in advance, approved in advance, and stored where the team can reach them without opening a shared drive that needs a password. The customer notification identifies the product precisely, by the batch identification regulation 11 of R146 of 2010 already requires on the label, states the action and the deadline, and asks for written confirmation of holdings. The public notice adds what consumers should do and how to get a refund.

Draft them as fill in the blank documents with the variable fields marked. Under pressure, people write badly, and a notice that is vague about which batches are affected causes customers to block far more stock than necessary. Precision here is not legal caution, it is commercial protection.

Where the recall involves an undeclared allergen, name the allergen exactly as regulation 43 of R146 of 2010 lists it, because that is the wording consumers and clinicians recognise. Our allergen labelling guide covers the South African list and the wording conventions, and the Allergen Management in Food Supply Chain course at R1,450 trains the team that has to make that call at speed.

What is in the evidence pack the auditor reviews after a mock recall?

The auditor wants a single file that proves the clause 3.9 exercise happened, that it used real records, that it was timed, that quantities reconciled and that the failures produced actions with owners and dates. Ten items cover it. Sites that keep these ten in one folder, dated and signed, hand the auditor a complete section instead of assembling one in front of them.

• The scenario brief stating what was simulated, the batch selected, why that batch, who called the exercise and the start time
• The team attendance record with roles, and a note of who was deliberately declared unavailable
• The withdrawal or recall decision record showing the criteria applied and the person who made the call, with a time stamp
• The backward trace output listing every raw material, packaging and rework lot with supplier, supplier lot and quantity used
• The forward trace output listing every customer, delivery note, quantity, date and destination, plus stock held, on hold and sampled
• The mass balance reconciliation with the input and output figures, the tolerance applied and the investigation of any variance outside it
• The notification log with the time each customer and each authority was contacted, by whom, by what means, and what was acknowledged
• The effectiveness calculation showing quantity dispatched against quantity confirmed by customers within the time set, expressed as a percentage
• The timing record with start time, end time and elapsed time for the trace and for the notification round
• The exercise report and corrective action plan naming what failed, the root cause, the action, the owner, the due date and the verification of closure

Add the previous exercise report with its actions marked closed and verified. A file containing three years of exercises, each with two or three findings that were closed and verified, is the strongest evidence in this whole section, because it shows a system that improves. A file containing three identical reports that all say the exercise was successful shows a system that is being filled in. Keeping these records is also part of the wider records discipline covered in our note on the food safety records every South African food business must keep.

Which traceability and recall findings come up most often?

Findings against clause 3.9 and clause 3.11 cluster in a small number of places, and most are structural rather than technical. The exercise was a trace and not a recall, quantities were never reconciled, the contact list was out of date, rework broke the backward link, or the previous exercise raised actions that were never closed. Those five account for most of what I write against this section. None of them need money to close.

• The mock recall was really a traceability test. Codes matched, no customer contacted, no effectiveness figure calculated, no notification log. The two exercises answer different questions and both are needed.
• No quantities anywhere. A trace that lists batch codes and delivery notes without kilograms, litres or units cannot demonstrate that the records are true.
• Packaging and labels left out of the backward trace. The label carries the allergen declaration and the date code, so a trace that ignores it misses the most common cause of a real recall.
• Rework unrecorded. Rework added without naming the source batch and the quantity, so the backward trace stops at the hopper and the affected boundary has to be widened.
• Second grade, staff sales and donations omitted from the forward trace. Product that left the site through a non standard route is still product that left the site.
• Emergency contact list out of date. Numbers for people who left, no after hours numbers, no deputies, and no evidence the list was ever tested by dialling it.
• No recorded start and end time. Without timings the exercise cannot demonstrate a four hour result, whatever the trace itself shows.
• Withdrawal and recall criteria not written down. The procedure describes the process but never states what facts move an event from one to the other, or who decides.
• No South African notification detail. A plan that names an overseas authority inherited from a group template, with no National Consumer Commission contact and no local authority environmental health office.
• Actions from the last exercise still open. The single most damaging finding in this area, because it shows the exercise is run to satisfy a clause rather than to fix anything.
• Certification body never notified of a real incident. BRCGS Issue 9 clause 3.11 requires it, and a certification body that discovers a recall from the press rather than from you has a certificate decision to make.

Where a finding has already been written, resist the urge to reissue the procedure. Work back to why the exercise was thin: usually no owner, no time allocated and no method for the quantity side. Our guides to BRCGS Issue 9 implementation, the 25 most common FSSC 22000 non conformances and the complete guide to food hygiene audits cover how findings are graded and closed out. If you are moving to the new scheme edition, the complete guide to FSSC 22000 Version 7 in South Africa carries the transition dates.

Read next from the ASC risk assessment library

Frequently asked questions

Published by ASC Food Safety, South African food safety and quality consultants. This article is general guidance and not a substitute for certification-specific advice.