Mock Recall and Lot Coding: Run One Before You Need It

The Question Nobody Can Answer on a Friday Night

It is 6 p.m. on a Friday. A customer emails a photo of a jar with something in it that should not be there. The lot code on the jar reads a string of digits. Someone asks you a simple question: how many jars carry that code, and where are they?

If the answer is "about 4,000 jars, and they went to these seven accounts, and 1,900 are still in the co-packer's warehouse," you have a contained, expensive, survivable problem. If the answer is "that code is our whole spring run" or, worse, "I would have to ask the co-packer on Monday," you have something else.

The difference between those two Fridays was decided months earlier, by how you designed your lot code and whether anyone ever tested it.

What the Rules Actually Require, and What They Do Not

Let me separate the legal floor from the practice, because they are not the same.

If your food has a hazard requiring a preventive control, 21 CFR 117.139 requires a written recall plan. The regulation is specific about what the plan contains: procedures with assigned responsibility for directly notifying your direct consignees, for notifying the public when appropriate to protect public health, for conducting effectiveness checks, and for appropriately disposing of the recalled food, including reprocessing, reworking, diverting to a use that does not present a safety concern, or destroying it.

Separately, under the Reportable Food Registry provisions, a responsible party that determines an article of food is a reportable food generally has to submit a report to the FDA within 24 hours. That clock is short, and it runs on a determination you make, which is one reason you want the recall decision path written down before you are inside it.

Here is what the federal rules do not do: they do not name a mock recall frequency for a food facility. What exists is a regulatory expectation that the recall plan works, plus GFSI-benchmarked schemes like SQF and BRCGS that require traceability to be tested and verified at defined intervals, which is what actually puts a mock recall on most facilities' calendars.

So the honest framing for a small brand is this: nobody is going to fine you for skipping one. The exercise is not compliance theater, it is the only way to find out whether the records you think you have can be assembled under time pressure. Almost every operation I have tested has had at least one break in the chain, and none of them knew about it beforehand.

Designing a Lot Code That Limits Your Exposure

A lot code has exactly one job: to let you draw a boundary around a defined quantity of product that shares a production history, and to exclude everything outside that boundary. Every design decision follows from that.

Granularity is the whole decision

The most consequential choice is how much product one code covers.

One code per production day is what most small co-packers default to. It is easy, and it is why small brands recall far more product than they need to. If you ran three kettle batches on Tuesday and the problem came from the second, a date-only code sweeps all three.

One code per batch is the better default. Each kettle charge gets its own code, so the boundary matches the physical reality of what could have been affected.

Finer than a batch usually costs more than it saves, with one exception worth knowing: if a single batch is filled across a break, a shift change, or a mechanical stoppage, some operations subdivide the code at that point, because a fill interruption is exactly when a foreign material or seal integrity problem is introduced.

The counter-argument to fine granularity is real. More codes means more code changes on the line, more chances of a mislabeled case, and more inventory complexity. I would rather a brand run reliable batch-level codes than aspirational codes nobody maintains.

What to encode

Keep it short enough to print reliably and rich enough to be useful without a lookup. A workable pattern encodes the production date, the facility if you run more than one, and a batch sequence. Julian dating (day of year plus year) is common and compact, with a real downside: consumers cannot read it, and neither can a retailer's receiving clerk at 11 p.m.

Whatever you choose, write the decoding rule into your spec. I have watched a founder stare at their own code unable to remember whether the middle two digits were the batch or the line.

Where it has to appear

The code has to be on the unit, on the case, and on the pallet. A brand that codes jars but not cases cannot tell a distributor which pallets to pull, which means the distributor pulls all of them. Make sure the case code is legible after the case has been handled, which is a real consideration given everything that happens in transit, covered in packaging that fails.

The record is the code's other half

A code that is printed but not recorded is decorative. For each lot you need: which ingredient lots went in, the quantities, the process records (times, temperatures, pH, fill weights), how many units were produced, and where every one of them went. That last part is the piece brands most often do not own, because the co-packer ships and the distributor distributes, and nobody made shipment records part of the agreement. Put it in the co-manufacturing brief before you need it.

How to Actually Run a Mock Recall

Block three hours. Do not warn anyone beyond the people who need to participate, and do not pick an easy lot.

Step 1: Pick the lot cold. Ideally someone hands you a jar from a shelf or a case from the warehouse and you start from the code printed on it. Choosing a lot you have good records for defeats the purpose.

Step 2: Start the clock. Write down the time. The point of the exercise is partly the completeness and partly the speed.

Step 3: Trace backward. From the finished lot, identify every ingredient lot that went into it, with supplier and receiving date, and every packaging component lot. This is where the receiving records discussed in the FSMA 204 piece earn their keep. If an ingredient lot leads to a supplier you cannot reach, note it as a gap.

Step 4: Trace forward. Every unit of that lot: shipped to whom, on what date, in what quantity, on what document. Then push one step further and ask whether your direct customers can tell you where it went from there. A distributor that cannot break a shipment down by store is a real limitation on any recall you run.

Step 5: Reconcile. This is the step that separates a real exercise from a paper one. Units produced should equal units shipped, plus units on hand, plus samples pulled for QA, plus product destroyed or reworked. If those numbers do not close, you do not know where your product is. Many operations aim to reconcile a high percentage of a lot within a few hours as an internal target; the specific number matters less than whether you can explain every unit that does not reconcile.

Step 6: Stop the clock and write down what broke. Not what worked. What broke. Then assign each gap an owner and a date, and close them. An exercise that produces a clean result and no action items usually means the lot was too easy.

The Failures I See Most Often

The ingredient lot dead end. A spice arrives in a poly bag with no supplier lot, or the co-packer decanted three supplier lots into one bin. Trace stops there. Fix it at receiving, not at recall.

Co-packer records you cannot reach. The production records exist, in their system, and your agreement never said you get them. Agree in writing on the response time you need.

Rework that vanishes. Product held, reworked into a later batch, and never linked. Rework is a bridge between lots and it has to be documented as one, or a recall on the earlier lot silently fails to reach the later one.

Allergen reruns. A lot that ran right after an allergen-containing product on a shared line is a different risk profile than one that did not, which is why sequence records matter. That interaction is covered in allergen control in co-packing.

Nobody knows who decides. A recall decision has to be made by a named person, quickly, with a documented basis. Committees do not make this decision well at 6 p.m. on a Friday.

The Part Founders Resist

Running a mock recall feels like preparing for a disaster you do not expect, on a Saturday you would rather spend selling. But the cost of the exercise is one afternoon, and the cost of the alternative is recalling six months of product because you could not prove which batch was affected.

The brands that come through a real event intact are almost never the lucky ones. They are the ones whose lot code was designed to draw a tight boundary, whose records closed the reconciliation, and who had already found their gaps in a drill where the stakes were zero.

Sources: eCFR, 21 CFR 117.139, Recall plan · FDA, Draft Guidance for Industry: Hazard Analysis and Risk-Based Preventive Controls for Human Food, Chapter 14, Recall Plan · FDA, Reportable Food Registry for Industry · FDA, Initiation of Voluntary Recalls guidance · FDA, Recalls, Outbreaks and Emergencies