---
title: "Costco Addendum requirements: the 2-hour traceability test"
description: "Costco Addendum V3.0 scores traceability in two clauses worth 10 of 65 points. The 2-hour limit, 100% accountability, and the auditor-initiated trace."
canonical: https://fsma204hub.com/blog/costco-addendum-traceability-requirements
published: 2026-08-25
updated: 2026-09-09
---

# Costco Addendum requirements: the 2-hour traceability test

> Costco Addendum V3.0 scores traceability in two clauses worth 10 of 65 points. The 2-hour limit, 100% accountability, and the auditor-initiated trace.

The Costco post on this site gets more traffic than everything else here combined. The single most common follow-up question is not about GS1 labels or EDI. It is this:

> "The buyer keeps saying 'the Addendum.' What is actually in it?"

Fair question, because the Addendum is the part of the Costco program that is hardest to see from outside. Your GFSI certificate is a public standard you can read. The Costco Addendum is a scored form your certification body fills in during the audit, and most producers never see a blank copy before an auditor is standing in their facility with one.

So this post is the traceability half of that form, clause by clause, from **Costco Addendum V3.0**.

Here is the headline, and it is the number most producers get wrong:

**Costco gives you two hours. FDA gives you twenty-four.**

## The form itself

Costco Addendum V3.0 is a 13-question module, scored out of **65 points**. Each question takes a score of 5, 4, 3, 2, 1, 0, or N/A, and the form carries an audit result plus a "CAP Required?" flag for a corrective action plan.

The 13 questions cover supplier approval, foreign material control, product traceability, allergen control, microbiological testing, personnel hygiene, and irradiation. The form also captures your facility profile, including one field worth noticing: **"% of Facility Production For Costco."** Costco is sizing its own exposure to you while it audits you.

Two of the thirteen questions are traceability: clauses **3.1.5** and **3.1.6**. That is **10 of the 65 points, about 15% of the Addendum**, sitting on the exact records this site is about.

This module is scored on top of a GFSI certificate, not instead of it, and it is filled in during the audit visit itself ([what actually happens on the day, including how V3.0 changed the announced/unannounced rule](/blog/costco-food-safety-audit)). The certificate is the entry ticket; [the layers above it](/blog/costco-supplier-traceability-requirements) are where small producers actually fail. Costco's updated audit expectations took effect **September 1, 2025**, and they hand the announced versus unannounced decision back to your certification scheme. Guidance published before that date, including [SQFI's own supplier addendum page](https://www.sqfi.com/sqf-professionals/supplier-addendums), still tells suppliers that Costco requires all supplier food safety audits to be unannounced. That describes the superseded V2.0 program.

## Clause 3.1.5: the 2-hour, 100% trace

This is the clause that decides whether your records work. In Costco's words, the requirement has four parts:

1. **Frequency.** Suppliers must show traceability exercises "were conducted independently at least twice during the year."
2. **The standard.** "The system must be able to account for 100% of the product in a 2-hour timeframe."
3. **Coverage.** Separate trace exercises for **two of three** areas: finished goods, raw material and ingredients, and primary packaging.
4. **The ambush.** "The third area should be the subject of the onsite auditor-initiated trace exercise."

Then the line that ties it together: "Each exercise must be completed within a 2-hour limit and account for 100% of the selected sample."

Read part 4 again, because it is the part producers do not plan for. You choose two areas and document them on your own schedule. **You do not choose the third.** The auditor picks it, on the day, and watches you run it. Your two rehearsed exercises are evidence; the third is a live test.

### Why 100% is harder than 2 hours

Most producers who fail this clause do not fail on the clock. They fail on the word **100%**.

Accounting for 100% of a lot means the quantity math closes at every step. You received 400 kg of an ingredient lot. You can show where all 400 kg went: into finished batches, into rework, into waste, into what is still on the rack. If 12 kg is unaccounted for, you have not traced 100% of it, and the exercise fails no matter how fast you were.

That reconciliation is the same discipline as [mass balance](/blog/costco-supplier-traceability-requirements), and it is where spreadsheets quietly break. A spreadsheet will happily let you record 400 kg in and 388 kg out. Nothing objects. The gap only surfaces when an auditor adds up the columns in front of you.

### Primary packaging is the one nobody rehearses

Of the three areas, finished goods and raw materials are the ones producers practise. **Primary packaging is the sleeper.**

Primary packaging is the material in direct contact with the food: the film, the tub, the pouch, the liner. It carries real recall risk, because a packaging defect or a mislabelled film reel affects every unit it touched. Most small producers can tell you which supplier the film came from. Far fewer can tell you, within two hours, which **finished lots** used which **reel**, in what quantity, with the numbers closing.

If you have rehearsed two areas and one of them is not packaging, packaging is a strong candidate for the auditor's pick.

## Clause 3.1.6: the intermediary mock recall

The second traceability clause is narrower, and the first thing to check is whether it applies to you at all.

**It applies** to finished food products shipped to an intermediary facility before delivery to a Costco depot or warehouse. Think of a co-packer, a third-party cold store, or a consolidator sitting between your production line and Costco's receiving door.

**It does not apply** if you ship direct. The clause carries an explicit **Direct Shipment Exclusion**: suppliers shipping finished food products directly to a Costco depot or warehouse "are exempt from these intermediary facility-specific mock recall requirements." If you ship direct, this should be **N/A**, not a score against you. Know that before the audit, because an N/A you failed to claim is points you gave away.

If it does apply, the annual mock recall has to do three specific things:

| The requirement | What the auditor wants to see |
|---|---|
| **Verify contact information** | Proof the intermediary facility's current contact details are accurate, not last year's |
| **Reconcile quantities** | The quantities received and distributed by the intermediary **match your production and distribution records** for a selected lot code |
| **Document the exchange** | Evidence of communication with the intermediary, including the verification and the quantity reconciliation to that specific lot code |

The middle row is the hard one. You are not certifying your own records. You are proving that **someone else's numbers agree with yours** for a named lot. That means you need a working relationship with a records contact at that facility, and you need it before the auditor asks, not during.

The contact-verification requirement exists because this is the step that rots. Cold stores change staff. The person who answered your trace request last year has left, and the number in your recall plan rings an empty desk. Costco has written the annual check for that failure directly into the clause.

## Costco's clock versus FDA's clock

Put the two side by side, because they are not the same requirement and producers routinely assume clearing one clears the other.

| | FSMA 204 (federal) | Costco Addendum V3.0 |
|---|---|---|
| **Time limit** | 24 hours to produce records | **2 hours** per exercise |
| **Scope** | Foods on the Food Traceability List | Every product you ship Costco |
| **Proof required** | Records produced on request | 100% accountability, evidenced twice a year |
| **Who tests you** | FDA, if there is an outbreak | An auditor, against a lot you did not choose |
| **In force** | Compliance date [July 20, 2028](/blog/retailer-fsma-204-deadlines) | **Now** |

FSMA 204 requires records to be furnished within 24 hours of a request. Costco requires the exercise to close in two. That is a **12x tighter clock**, applied to your whole catalogue rather than just [Food Traceability List items](/blog/what-is-a-traceability-lot-code), and it is being enforced today while the federal deadline is still nearly two years out.

This is the point that reframes the whole compliance conversation for a Costco supplier. If you build your records to satisfy FDA in 2028, you will still fail a Costco audit in 2026. If you build them to clear Costco's two hours at 100%, [FSMA 204 falls out for free](/blog/retailer-fsma-204-deadlines).

An earlier version of our main Costco post described the trace expectation as "2 to 4 hours," which reflected practitioner reports rather than the published form. Addendum V3.0 states a **2-hour limit** in clause 3.1.5. Two hours is the number to plan against. We have corrected that post.

## Run the clause as written, before someone else does

The useful thing about a scored form is that you can self-audit against it. Block out an afternoon and run 3.1.5 exactly as the auditor will.

1. **Pick a lot you did not plan for.** Have someone else in the building choose it. Self-selection is how rehearsed exercises pass while real ones fail.
2. **Start a timer.** Two hours, visibly running. The clock is part of the requirement, so it should be part of the practice.
3. **Trace one step back and one step forward.** Supplier lot into your lot, your lot out to every customer who received it.
4. **Close the quantity math.** Received, used, reworked, wasted, on hand, shipped. If it does not add to 100%, note exactly where the number is lost. That gap is your finding.
5. **Do it for the third area too.** Whichever of finished goods, raw materials, or packaging you have not rehearsed, that is the one the auditor is most likely to call.
6. **Write it up as evidence.** Date, lot, who ran it, elapsed time, the reconciliation, and any gap plus corrective action. An exercise you cannot evidence did not happen as far as the Addendum is concerned.

If you want a longer, hour-by-hour version of that drill, [the 24-hour traceback walkthrough](/blog/mock-24-hour-traceback) runs the same exercise against the federal clock. Compress it to two hours and you have Costco's version.

## Where this gets easier

Everything above is a records problem, not a food safety problem. Facilities fail 3.1.5 while making genuinely safe product, because the records live in four places and the reconciliation is done by hand under a timer.

That is the specific job [FSMA204Hub](/) does. Supplier lots are captured with their [Key Data Elements](/blog/fsma-204-kde-checklist) at receiving, linked to the production batches that consumed them, and linked forward to what shipped, so a trace is a query rather than an afternoon. The quantity math closes because the links are the records, not a separate spreadsheet someone maintains alongside them.

If you want to know where you stand before an auditor tells you, [the free readiness score](/score) walks the same ground in about two minutes, and the [lot code checker](/tools/tlc-check) will tell you whether your codes are unique enough to survive a trace in the first place.

Two hours, 100%, twice a year, plus one you do not see coming. That is the clause. Now go run it.

---

Source: https://fsma204hub.com/blog/costco-addendum-traceability-requirements (https://fsma204hub.com)