How long do I have to respond to an FDA traceback request under FSMA 204?

Under the Food Traceability Rule, when FDA requests your traceability records you have to provide them in an electronic sortable spreadsheet within 24 hours, or within a reasonable time FDA agrees to. FDA used exactly this mechanic in its 2026 tabletop exercises: locate the records for a specific product over a defined date range and deliver them as a sortable spreadsheet inside 24 hours. The clock is the point of the drill. Records that exist on paper but cannot be assembled into one sortable file in a day do not meet the standard.

What is the difference between a mock recall and a traceback?

A mock recall tests whether you can pull a specific lot off the market: who got it, how much, and how fast you can reach them. A traceback tests whether you can prove where that lot came from: which supplier lots went into it, on what date, at which location. FSMA 204 is built around the traceback direction, because that is how FDA works backward from sick people to a source. A complete drill runs both directions from one finished lot: one step back to your ingredient lots, one step forward to every customer who received it.

What records does FDA ask for in a traceback?

The Key Data Elements tied to each Critical Tracking Event for the lot in question. For a producer who transforms an ingredient into a finished food, that means the finished-lot Traceability Lot Code, the TLC source (where it was assigned), the input lot codes that fed the batch, the product description, quantity, the transformation date and location, and for shipping the ship date, ship-to location, and quantity for every customer. FDA's 2026 tabletop report found the TLC and TLC source were the hardest KDEs for firms to produce cleanly.

How often should a small food producer run a mock recall?

At least once or twice a year, and again after any change that touches your records: a new product, a new ingredient supplier, a new customer, or a switch in the software you log production or shipping in. Retailer programs often want a documented mock recall on a set cadence as a condition of approved-supplier status. The value is not the certificate, it is that timing the drill surfaces the broken link in your records before FDA or a buyer does.

Does FSMA 204 require mock recalls?

FSMA 204 does not use the words 'mock recall.' It requires you to maintain the traceability records and hand them to FDA in a sortable electronic spreadsheet within 24 hours of a request. A mock recall is simply how you find out, on your own schedule, whether you can actually do that. Retailer programs like Costco go further and expect documented mock recalls run against worst-case scenarios, so in practice most producers selling into grocery end up running them regardless.

← All posts

The 24-hour traceback drill: an hour-by-hour FSMA 204 mock recall for a small producer

A clock-running, hour-by-hour FSMA 204 mock recall for a small food producer. One fictional creamery lot, an FDA 24-hour traceback request, exactly where the trail breaks, and how to run the traceback exercise yourself.

Anas MarwanJuly 14, 202613 min read

FSMA 204mock recalltraceback24 hour tracebacksmall food producerstraceability lot code

Right now FDA and CDC are working a live one. A multi-state, multi-year outbreak of Listeria monocytogenes tied to requeson, a soft fresh cheese similar to ricotta, has sickened 12 people across four states, put 10 in the hospital, and killed one. Recalls have expanded from the original creamery to include additional companies and cheese types, and the investigation is ongoing. I am not going to dwell on it beyond this: a real family lost someone, and the point of a traceback is to shorten the days between the first sick person and the last recalled case.

That is the reason this post is not hypothetical. When an outbreak signal points at soft cheese, the question that lands on a producer's desk is narrow and dated: show us the records for this product, over this range, now. So instead of another generic mock-recall checklist, here is the thing nobody publishes: a clock, running, hour by hour, over one finished lot from one small creamery. We watch the drill fail. Then we fix the four things that broke it and watch it pass.

The setup

Meet Fernbrook Creamery, a fictional two-person operation that makes fresh queso-fresco-style cheese and sells it to a handful of grocery accounts. One make day, one lot. Here is the supply chain in full:

Raw milk comes in from one dairy, in bulk, a couple of times a week.
Culture and rennet come from an ingredient supplier, in dated lots.
On make day the milk becomes cheese. This is the one transformation event in the whole chain.
The cheese is packed, dated, and cold-chain shipped to four retail accounts.

The lot at the center of the drill is the queso fresco made on Saturday, June 20. We built its Traceability Lot Code in the worked-examples post: QF-20260620-001, assigned at transformation, linked back to the milk. That post shows you how to assign the code. This post runs the clock on the finished lot the code is stamped on.

This is exactly the drill FDA just ran with industry. Between March 9 and April 1, 2026, FDA held a series of traceability readiness tabletop exercises with 15 volunteer companies across six supply chains, one of which was soft ripened and semi-soft cheese. FDA emailed a records request, asked firms to locate the records for a specific product over a defined date range, and deliver them in an electronic sortable spreadsheet within 24 hours. Most firms responded in time. FDA's headline finding was that coordination, not technology, drove the best results, and that the Traceability Lot Code and its source were the single hardest data points to produce cleanly. Only 40 percent of participants' records captured the properly assigned TLC across every Critical Tracking Event they performed.

FDA's report is the retailer-and-restaurant view of that exercise. This is the runnable small-producer version it does not include. Set a 24-hour timer and let the clock start.

Hour 0: the request lands

An email arrives. FDA is requesting traceability records for Fernbrook's queso fresco associated with a retail account over a defined date window, and it wants them in an electronic sortable spreadsheet within 24 hours.

In FDA's real exercise the request started at the retail food establishment and worked upstream, supplier by supplier, until it reached the firm that first assigned the TLC. For a creamery that transforms milk into a listed food, you are that firm. You are the TLC source. When the trail runs back to its origin, it stops at you, which means the completeness of the whole chain's answer depends on records you either kept or did not.

Owner one starts pulling production records. Owner two starts pulling shipping records. The timer reads 24:00.

Hours 1-3: find the finished lot (break point 1)

First job: identify the exact lot. The retailer bought queso fresco in the requested window, so which make day produced it?

Fernbrook's production log is a paper make sheet in a binder. June 20 is there: milk in, culture and rennet added, yield, pack count. But the make sheet has no lot code written on it. The lot code lives only on the case label the cheese shipped under, printed from a separate label template. The binder says "queso fresco, June 20." The case said QF-20260620-001. Nobody wrote the code back onto the make sheet.

This is break point 1: no TLC captured at the transformation event. The finished food got a code on its label, but the record that proves what went into that code was never linked to it. In FDA's tabletop this was the most common gap in the field, and it is why only 40 percent of firms could show a properly assigned TLC across every event. If the difference between a TLC, a KDE, and a CTE is fuzzy, that primer untangles it. The short version: transformation is a Critical Tracking Event, and the TLC is a Key Data Element you are supposed to capture at that event, not reconstruct from a label later.

Two owners now argue about whether the June 20 make sheet is even the right one, because June 18 also had a small run. Forty minutes gone to a question the record should have answered instantly.

Hours 3-6: trace one step back (break point 2)

Assume they pick the right make day. Now trace back: which milk lot fed QF-20260620-001?

The milk came from the dairy on June 18. Fernbrook's receiving record is a note on a delivery slip: "milk received, June 18, ~200 gal." No supplier lot code. The dairy assigns its own lot codes to each bulk delivery, but Fernbrook never wrote it down, because for two years nobody ever needed it.

This is break point 2: the receiving record is missing the supplier's lot code. Fernbrook can say it received milk. It cannot say which milk lot, which means it cannot link its finished cheese back to a specific upstream source. In FDA's terms, the TLC source and the input KDEs are incomplete. In a real Listeria traceback, this is the hole that expands the recall, because if you cannot isolate the contaminated milk lot, every batch that might have used it is suspect.

Owner one calls the dairy to reconstruct the lot from the delivery date. The dairy is helpful but is now doing the creamery's recordkeeping for it, on a phone call, during an FDA clock. This is the opposite of what FDA saw work: the firms that finished fastest had already agreed with their suppliers, before any request, on what data moves and how.

Hours 6-10: trace one step forward (break point 3)

Now the other direction: who got QF-20260620-001?

Production lives in the binder. Shipping lives in Fernbrook's invoicing software, a completely separate system. To answer "who received this lot," owner two has to open every invoice from the days after June 20 and eyeball which ones were queso fresco, then guess which invoices drew from the June 20 make versus the June 18 make, because the invoices record "queso fresco, 12 units," not the lot code.

This is break point 3: the shipping log is in a different system than the production log, and the two do not share the lot code. The production record knows the lot but not the customers. The shipping record knows the customers but not the lot. Nothing joins them except the owner's memory of which batch went out which day. Costco is blunt about why this fails: its supplier program expects a one-up, one-down traceback in 2 to 4 hours, not days, and "let me open every invoice and reconstruct it from memory" is a days answer wearing an hours costume. That Costco post is the single page producers click most on this site, because the 2-to-4-hour bar is the one that scares people into timing themselves.

Hours 10-20: build the sortable spreadsheet (break point 4)

Say Fernbrook has now, painfully, reconstructed the chain on scratch paper: milk lot, culture lot, rennet lot, transformation date, finished TLC, four customers, quantities. The records exist, spread across a binder, a pile of PDF invoices, and two phone calls.

FDA did not ask for a story. It asked for an electronic sortable spreadsheet. So now the two owners are hand-keying paper and PDF data into a spreadsheet at hour fourteen, on no sleep, and every retyped lot code is a chance to fat-finger a digit. Columns do not line up. One owner types dates as 6/20, the other as June 20. The "sortable" requirement is not satisfied by a scan of the binder or a stack of invoice PDFs, and it is the step that turns a records problem into a formatting scramble right at the deadline.

This is break point 4: the deliverable format. Even when the underlying facts are all technically retrievable, "retrievable across four places by two exhausted people" is not the same as "sortable spreadsheet in 24 hours." This is precisely the gap FDA's report was measuring, and it is why the agency framed readiness around coordination and clean capture rather than any particular software.

Hour 24: the drill fails

The timer hits zero. Fernbrook has a partial spreadsheet. The forward trace to customers is complete but was rebuilt from memory. The backward trace to the milk lot depends on a number the dairy read off its own records, not Fernbrook's. The TLC never appeared on a single internal record until an owner typed it in at hour fourteen.

In a paper drill, that is a fail you learn from. In the live Listeria investigation happening right now, that is days added between the first sick person and the last case pulled from a shelf. The drill's entire job is to make you feel the failure on a Tuesday afternoon instead of during an outbreak.

Now fix four things and run it again

None of the four break points needed software to fix. They needed the record to carry the lot code end to end.

Write the TLC onto the make sheet at transformation. The moment milk becomes cheese, QF-20260620-001 goes on the production record, not just the case label. Now the finished lot and the batch that made it are one record. Before you print it on anything, run the code through the free TLC Validator so a malformed or duplicate code never enters the chain.
Record the supplier's milk lot at receiving. When the dairy delivers, the dairy's lot code goes on the receiving record next to the date and quantity. Agree the format with the dairy once, in advance, so it is the same string every delivery. This is the coordination FDA found mattered more than any technology.
Put the lot code on the shipping record too. When the June 20 cheese ships, QF-20260620-001 goes on the invoice or shipping doc for each of the four accounts. Now production and shipping share a key, and "who got this lot" is a filter, not an archaeology dig.
Keep it in one sortable place. One spreadsheet (or one tool) where each finished lot is a row and the columns are the KDEs a retailer or FDA will ask for: input lot codes, transformation date, finished TLC, quantity, each customer and ship date. Sortable by design, not assembled under a deadline.

Run the same 24-hour request against the fixed records and the drill collapses into minutes. Filter to QF-20260620-001. The row shows the milk lot, culture lot, rennet lot, make date, quantity, and all four customers with ship dates. Export the sortable spreadsheet. Hour 0 to answer: not 24 hours, closer to 24 minutes. Same facts, same creamery, same two people. The only thing that changed is that the lot code lived on every record instead of only on the label.

Run this drill yourself

You do not need our permission or our product to do this. Do it this week:

Pick one finished lot you actually shipped in the last month. A real one, not your cleanest one.
Set a timer for 24 hours on paper, or be honest and give yourself the 2 to 4 hours Costco expects if you sell into a program that enforces it.
Produce two things from that one lot code, as one sortable spreadsheet: every ingredient lot that went into it (one step back), and every customer who received it with quantities and dates (one step forward).
Write down where it broke. It will break at one of the four points above. That break point is your next fix, and it is worth more than any audit certificate because you found it before anyone asked.

Do it once a year at minimum, and again every time you add a product, an ingredient supplier, a customer, or change the software you log things in. Retailer audits from Whole Foods on down will ask for the documented result; the untimed version does not count.

One more reason to run it now rather than wait for the 2028 deadline: FDA is still shaping the lot-level rules. The comment window on FDA's lot-level flexibilities discussion paper (docket FDA-2014-N-0053) closes tomorrow, July 15, and a second FDA public meeting is set for November 6. The deadline is not the reason to be ready. An outbreak does not check your calendar.

Where FSMA204Hub fits

Everything above is doable in a spreadsheet if you have the discipline to keep the lot code on every record and never let production and shipping drift into two systems that do not share a key. That discipline is exactly what breaks under a real deadline, which is the whole reason the drill fails at hour zero and not hour twenty.

That is the bet behind FSMA204Hub: one place where each finished lot is a row, the input lots and the customers hang off the same lot code, and the answer to "trace this lot both directions" is a filter and an export, not a 24-hour scramble. The compliance score on the dashboard answers the one question a traceback really asks: can you prove, right now, where your lots came from and where they went? Green means the 24-hour request is a two-minute export. Amber tells you which batch to fix before FDA or a buyer makes you find out the hard way.

If a soft-cheese recall in the news just made this feel less academic, start a free 14-day trial. No credit card. We answer questions within a working day.

Running the drill this week and hit a break point you cannot fix? Reply to our newsletter or email [email protected] and tell me which of the four points it broke at. I will tell you the cheapest fix for your setup.

Further reading

Related on this site

Written by Anas Marwan, Co-founder of Darza Technologies. Last reviewed 2026-07-14.

Frequently asked questions

How long do I have to respond to an FDA traceback request under FSMA 204?: Under the Food Traceability Rule, when FDA requests your traceability records you have to provide them in an electronic sortable spreadsheet within 24 hours, or within a reasonable time FDA agrees to. FDA used exactly this mechanic in its 2026 tabletop exercises: locate the records for a specific product over a defined date range and deliver them as a sortable spreadsheet inside 24 hours. The clock is the point of the drill. Records that exist on paper but cannot be assembled into one sortable file in a day do not meet the standard.
What is the difference between a mock recall and a traceback?: A mock recall tests whether you can pull a specific lot off the market: who got it, how much, and how fast you can reach them. A traceback tests whether you can prove where that lot came from: which supplier lots went into it, on what date, at which location. FSMA 204 is built around the traceback direction, because that is how FDA works backward from sick people to a source. A complete drill runs both directions from one finished lot: one step back to your ingredient lots, one step forward to every customer who received it.
What records does FDA ask for in a traceback?: The Key Data Elements tied to each Critical Tracking Event for the lot in question. For a producer who transforms an ingredient into a finished food, that means the finished-lot Traceability Lot Code, the TLC source (where it was assigned), the input lot codes that fed the batch, the product description, quantity, the transformation date and location, and for shipping the ship date, ship-to location, and quantity for every customer. FDA's 2026 tabletop report found the TLC and TLC source were the hardest KDEs for firms to produce cleanly.
How often should a small food producer run a mock recall?: At least once or twice a year, and again after any change that touches your records: a new product, a new ingredient supplier, a new customer, or a switch in the software you log production or shipping in. Retailer programs often want a documented mock recall on a set cadence as a condition of approved-supplier status. The value is not the certificate, it is that timing the drill surfaces the broken link in your records before FDA or a buyer does.
Does FSMA 204 require mock recalls?: FSMA 204 does not use the words 'mock recall.' It requires you to maintain the traceability records and hand them to FDA in a sortable electronic spreadsheet within 24 hours of a request. A mock recall is simply how you find out, on your own schedule, whether you can actually do that. Retailer programs like Costco go further and expect documented mock recalls run against worst-case scenarios, so in practice most producers selling into grocery end up running them regardless.