Recall software that runs the playbook before you need it.

I run a CFIA-licensed mushroom production facility in Brantford, Ontario. CFIA is the Canadian Food Inspection Agency — the federal regulator that enforces the Safe Food for Canadians Regulations (SFCR). Section 84 of the SFCR says every licensed food business has to have a written recall procedure and the ability to execute it. I wrote my first one in 2023. My first mock recall took half a day, and most of that half a day was me discovering that a customer phone number on file was three years out of date. The plan was fine. The execution would have been a disaster. That gap — between the plan that lives on the shared drive and the execution that has to work under pressure on a Friday afternoon — is what HACCPlan's recall module exists to close.

01The call you hope you never get

In July 2024, Boar's Head recalled 207,000 pounds of liverwurst. Four days later, the recall covered 7.1 million pounds across 71 products.

Ten people died. Sixty were hospitalized. It became the largest U.S. listeriosis outbreak since 2011. The Jarratt, Virginia plant where the contamination traced back never reopened — USDA permanently shuttered it on September 13, 2024. You can read the USDA post-mortem on Boar's Head if you have the stomach for it. I do not bring it up to make you scared. I bring it up because the 35-times expansion in four days is the part most operators do not plan for. A recall does not start at its final size. It starts small and grows as you find out where the implicated lots actually went.

Most of us will never run a recall that big. Some of us will run one that is, in proportion to our business, equally catastrophic. And every single one of us — under 21 CFR §117.139, under SFCR §84, under FSIS Directive 8080.1 if you are in meat or poultry — is required to have a written recall plan as part of our food safety system, and to be able to execute it. This page is about what that capability actually looks like, and how HACCPlan ships it.

02The regulation in 60 seconds

Four rule sets cover almost every food recall in North America. Here is what each one actually says.

If you read nothing else on this page, read this section. Every feature in the product maps to one of these four anchors.

21 CFR §117.139 — Recall plan as a Food Safety Plan element. This is the FDA preventive-controls rule for human food, enacted under the Food Safety Modernization Act (FSMA). If your facility has to follow FSMA preventive controls, you need a written recall plan covering four things: directly notify the customers you sold the implicated product to (the "direct consignees"), notify the public when appropriate, conduct effectiveness checks, and dispose of the recalled food properly. Section number on the books: 21 CFR §117.139. The Food Safety Plan itself has to be re-evaluated every three years under §117.155. Most auditors expect to see a mock recall every twelve months.

21 USC §350l — Reportable Food Registry, the 24-hour clock. A separate rule. The day you internally determine that a food you produced has a reasonable probability of causing serious adverse health consequences — Class I territory — you have 24 hours to submit through the FDA Reportable Food Registry portal. The clock starts at your internal determination, not at the moment FDA contacts you. This is the most-missed compliance window in small-operator recalls. People miss it because they spend the first day debating whether they "really" have a problem.

21 CFR Part 7, Subpart C — Recall classifications and procedure. This is the procedural backbone of every voluntary recall in the United States. It defines the three classes (Class I — reasonable probability of serious adverse health consequences or death; Class II — temporary or medically reversible adverse health consequences; Class III — not likely to cause adverse health consequences but in violation of the law). It also defines the nine elements every recall notification has to contain (§7.46) and how the recall gets terminated when you are done (§7.55). The FDA also has mandatory recall authority under FSMA §206 — 21 USC §350l(a), the Mandatory Recall Risk (MRR) provision. FDA can order a recall if you refuse to do one voluntarily and they believe the food is adulterated or misbranded with a reasonable probability of causing serious adverse health consequences.

SFCR §93 and §94 — the Canadian recall rules. Sections 93 and 94 of the Safe Food for Canadians Regulations require every licensed food business to be able to identify (i) every supplier the product or its ingredients came from, (ii) every customer the product was sold to other than the consumer, and (iii) every lot — and to have a written recall procedure under section 84 that lets you act on that information. CFIA's recall procedure guide walks through the steps. For meat and poultry under the U.S. side, USDA FSIS recalls run under 9 CFR Part 418 and FSIS Directive 8080.1, which is the same logic with FSIS-specific notification routing.

A note on the bigger traceability shift: FSMA Section 204, the foreign-supplier and supply-chain traceability rule, was finalized November 2022 and now has a compliance date of July 20, 2028 after the August 2025 extension. It does not replace recall procedure rules — it forces the supply-chain records that make a recall in hours instead of days physically possible. For the recall module to work fast, the underlying lot records have to be clean. That is why HACCPlan ships FSMA 204 and the recall workflow on the same data model.

03The five-step playbook

What HACCPlan does at each of the five steps in a real recall.

A recall is not one task. It is a five-step playbook executed under time pressure, with regulator clocks running in parallel to customer-call clocks. The recall module is structured around these five steps because every regulator framework — FDA, FSIS, CFIA — boils down to the same five.

1. 01

   Step 1 — Hold and decide

   A trigger arrives. It might be an internal lab result, a customer complaint, a supplier recall notice, a regulator letter, or a cluster of illness reports from a state health department. The recall module opens with one click — "Initiate Recall" — that does three things at once. It pulls every lot of the implicated product or input from your production records and flags them HOLD across inventory. It pages the named recall coordinator and alternates from your written plan (the 24-hour contact field is mandatory on those records — that is the first thing my mock-recall failure taught me). And it timestamps the decision so the audit trail starts the moment the trigger landed, not when somebody got around to writing it down.
   
   Inside the workflow you run a Health Hazard Evaluation (HHE) using the FDA framework: is this Class I (reasonable probability of serious adverse health consequences or death), Class II (temporary or medically reversible), or Class III (technical violation, no health risk)? The class drives everything downstream — whether you have a 24-hour Reportable Food clock, whether you need a public warning, what level of effectiveness check FDA will want.

2. 02

   Step 2 — Notify the regulator and your customers

   Two streams run in parallel. The regulator stream: if it is Class I, the system pre-fills your Reportable Food Registry submission inside the 24-hour window. It also looks up your FDA Division Recall Coordinator (DRC) by state and product type using the FDA's published Find Your Recall Coordinator app, so you are not calling 1-800-FDA and getting routed through three operators. For Canada it pulls the CFIA Notification Contact List by region. For meat and poultry it routes to the right FSIS District Office.
   
   The customer stream: distribution lists are auto-pulled from your invoices, scoped to every direct account that received any of the implicated lots. The module generates the §7.46 nine-element notification (product identity, reason, risk evaluation, total production amount and time frame, amount currently in distribution, direct-account count, proposed customer communication, recall strategy, contact for follow-up). That goes out as email and SMS in parallel. Fax remains an option because — and I say this without judgement — some older FDA inspectors and some older grocery chain QA desks still want a fax. Per-consignee delivery is tracked so on day three you can see which 6 customers out of 47 have not acknowledged.

3. 03

   Step 3 — Public warning, if it is Class I

   Per FDA's Public Warning guidance for 21 CFR Part 7 Subpart C, FDA expects a public warning for any Class I or potential Class I recall. The module generates a press release in FDA's expected format — company, product, sizes, lot codes, UPC, best-by dates, photo, distribution regions, reason for recall, consumer instructions, contact for refunds, illness count, FDA case number. For CFIA the regulator writes the public warning itself; the module prepares the data for them in the format CFIA's recall officer will ask for.
   
   The differentiator here, and the one I am proudest of: the press release is drafted in your own brand voice by the AI module, not in legalese cribbed from a vendor template. You review it before submission. You can rewrite any sentence. You can regenerate the whole thing in three different tones and pick the one you can live with on the front page of the local paper. People will be scared when they read this. The tone matters.

4. 04

   Step 4 — Execute the recall on the floor

   Three workstreams again, this time on the physical product. First, freeze and tag: every implicated lot in your control is moved to the Hold cage with a recall tag, and the Hold/Recall Log tracks each one by quantity, location, and condition. Second, returns: as customers ship product back, each return is reconciled against the distribution record. The target is 100 percent of distributed product accounted for, with mass-balance math the dashboard runs live (total produced − product still in your control − product returned − product destroyed by customer − product disposed by consumer = unaccounted).
   
   Third, destruction or rework, per §7.49(b). Recalled food has to be disposed of in a way that is witnessed and documented. The module captures the destruction certificate from your licensed waste hauler, attaches it to the recall record, and the mass balance updates automatically. If you rework or relabel under FDA supervision, the same record path applies. None of this exists to give you new work — every step is documentation your Division Recall Coordinator will ask for when they review the recall at termination. The system collects it as you go so termination is a one-day task, not a two-week binder hunt.

5. 05

   Step 5 — Effectiveness check and termination

   Section §7.42(b)(3) requires effectiveness checks: you have to verify that consignees received the recall notice and took the appropriate action. FDA defines five levels: Level A is 100 percent of direct accounts checked, Level B is somewhere between 10 and 100 percent on a case-by-case basis, Level C is 10 percent, Level D is 2 percent, Level E is no checks at all. Class I almost always requires Level A.
   
   The module ships scheduled-call workflows with a phone script per consignee, fields for the call log (who you reached, what they confirmed, what they still had on shelves), and rollups for the DRC. Once effectiveness is documented to the level required, the §7.55 termination request package assembles itself: the original recall record, the final mass balance, the effectiveness check log, the disposition certificates, the public warning if there was one. You submit it to your DRC and you get the recall officially closed.

04Mock recall in 15 minutes

What we mean — and do not mean — by "mock recall in fifteen minutes."

A mock recall is a planned simulation of the real five-step playbook. You pick a trigger lot, trace forward through distribution to retailer and consumer, trace backward through receiving and batch records to your supplier inputs, run the mass balance, and produce an auditor-ready report. The mock does not appear on FDA's Enforcement Report because no actual product is being pulled — it is a rehearsal.

The certification scheme requirements: SQF Edition 9 requires an annual mock. BRCGS Issue 9 requires an annual mock with a four-hour internal target. FSSC 22000 v6 requires annual. CFIA SFCR §84 strongly recommends annual. And while §117.139 itself does not say "annual" out loud, the FDA Draft Guidance for the Food Safety Plan re-evaluation cycle (§117.155, every three years) effectively treats annual mock recalls as the working standard. The four-hour internal target from BRCGS has become the industry consensus benchmark. Costco specifies two hours for high-risk product.

The "fifteen-minute" claim needs unpacking because it is precise. Fifteen minutes is the operator time on the recall module when your underlying lot records are already in HACCPlan — that is, when you are also running the FSMA 204 module so the Key Data Elements (KDEs) at each Critical Tracking Event (CTE) are already captured. Inside that window: three minutes to pick a trigger lot, or accept a randomly chosen one for higher mock integrity; five minutes for the system to generate the forward and backward trace from the existing CTE records; five minutes to print the auditor-ready report (mass balance, contact-list validation, gap list); two minutes for you to review and sign. Total elapsed time can run up to sixty minutes if you include the system queries running in the background. If your lot records live on spreadsheets and paper rather than in the platform, the mock is a much bigger project — and you should budget at least a full day. I would rather tell you that on this page than have you trial the product and feel cheated.

1. 01

   What the auditor will actually check

   Was the trigger lot picked day-of, not pre-staged the week before? Total time under four hours (or the scheme's published benchmark)? Was the trace bidirectional — forward to consignees and backward to supplier inputs? Did the mass balance close to 100 percent, or were the gaps documented? Were the contact numbers on the recall coordinator list verified live (not just on paper)?

2. 02

   What gets you a finding even if the mock passed

   A stale customer phone number. A licensed waste hauler that no longer holds the license. A 24-hour contact field that nobody actually answers at 11 PM on a Sunday. An alternate recall coordinator who left the company months ago. The contact-list maintenance is the load-bearing wall under the whole plan, and the quarterly auto-validation feature exists specifically because almost every operator I have talked to has a stale contact list and does not know it.

3. 03

   What the printout actually contains

   Trigger lot identity. Forward trace (every distributor, retailer, account that received any of the lot, with quantities). Backward trace (every supplier input lot and supplier identity). Mass balance with a closed-loop check. Per-consignee contact verification status. Effectiveness check sample log. Any gaps flagged with a remediation owner and a due date. Sign-off from the recall coordinator. Date, time, duration. That is the document the SQF or BRCGS auditor wants to see, and it is the same document you would generate for a real recall — same template, same fields, different "REAL" or "MOCK" stamp in the header.

05The supplier cascade

When a supplier recalls tomorrow, can you tell which of your finished SKUs contain that lot in fifteen minutes?

This is the question that broke for a lot of operators in October 2024 when Taylor Farms recalled slivered onions. The McDonald's E. coli outbreak — 104 illnesses across 14 states, 27 hospitalizations, 1 death — traced back to Taylor Farms onions and triggered a voluntary supplier recall on October 22, 2024. Every restaurant chain that used Taylor Farms onions had hours, not days, to figure out which of their menu items contained that supplier's lots and which locations had received them.

The product I run at Nature Lion is mushrooms grown in Brantford. I receive substrate from one supplier, spawn from a second, packaging from a third, labels from a fourth. If any one of those four calls me Friday afternoon with a recall, I need to know within the same business day which of my finished lots used inputs from the affected supplier batch, which customers received those finished lots, and what is sitting in my warehouse versus already shipped versus already eaten. That is the traceability lot-history feature in the recall module: from any supplier lot, instant view of every downstream finished lot and consignee; from any finished SKU, instant view of every input lot and supplier upstream. Both directions of the trace, one click each.

This is the part where FSMA 204 and the recall module are the same product, not two products. The Key Data Elements you capture at each Critical Tracking Event under the FSMA 204 Foreign Supplier Verification and traceability rule are the records the recall trace runs against. Without them you are trying to run a recall on invoices and memory, which is what most spreadsheet-based operators end up doing — and that is how a half-day mock turns into a six-hour real-recall scramble. I cross-link the /product/fsma-204 page for the deeper FSMA 204 module write-up.

“

My brand-owner client called Wednesday saying our SQF auditor wanted to see our written recall plan and last mock recall report by Friday. I had a recall plan, technically. It was four pages on a shared drive. I had never run a mock. I had two days, no budget for a consultant, and three other plates spinning. The deciding factor was that the trial was real software, not a templated PDF, and the mock could actually be done in an afternoon if I committed to it.

”

Composite — QA manager, 12-person specialty co-packer, Hamilton

06The contact list

The single most-failed mock-recall element, and how the module keeps your contact list current.

I have already mentioned the stale phone number from my first mock. The reason I keep coming back to it: FDA's own Draft Guidance on §117.139 calls the contact list out as the foundation of every recall plan, and the most common mock-recall finding I see operators self-report is a contact-list failure rather than a procedural failure. The plan can be written perfectly. If the recall coordinator's alternate left the company eight months ago and nobody updated the record, you have a non-plan the moment the call comes.

The contact list inside the recall module is structured into four buckets, and each bucket has automatic validation built in.

07The honest list

What HACCPlan's recall module does not do.

Honest positioning matters more than the marketing line. The recall module is built for operators in the $300K to $15M revenue band — independent producers, co-packers, specialty manufacturers, regional brands. There are five things it does not do, and I would rather you know now than discover after you trial it.

1. 01

   It is not in the ReposiTrak network

   ReposiTrak is the supplier-side network required by some major grocery chains — Kehe, UNFI, AWG among them. HACCPlan exports your recall records in CSV format so you can upload them, but the platform itself is not in the ReposiTrak network. If your distributor mandates ReposiTrak membership, that remains a separate subscription on your side.

2. 02

   No GDSN or Networked Ingredients Marketplace

   The Global Data Synchronization Network and the supplier-network ingredient marketplaces are a different product category. Operators with hundreds of suppliers across a complex multi-tier network will need a platform built around that capability. HACCPlan's strength is the recall workflow and the FSMA 204 KDE capture for a more focused supplier base, not a 75,000-supplier directory.

3. 03

   No recipe-level nutrition labeling

   Nutrition Facts label generation, ingredient declaration optimization, and the recipe-formulation modeling that comes with it is a separate lane. HACCPlan tracks ingredient identities and allergen flags well enough to drive a recall trace, but a dedicated nutrition labeling platform is a better fit if that is your primary need.

4. 04

   No physical destruction service

   The module captures and stores destruction certificates from your licensed waste hauler. It does not arrange the pickup, transport the product, or witness the destruction. That remains your hauler's job.

5. 05

   Not a substitute for legal counsel during a real recall

   The press-release generator is a draft to review with your lawyer, not a publication-ready release to fire without one. Recall communications carry legal risk. The module reduces the time-to-draft from hours to minutes; it does not replace the counsel who reads the draft before it goes out.

08The module

What is inside the HACCPlan recall module at launch.

Twelve features ship at launch. Each one exists because a real operator asked for it, or because I needed it for my own facility under SFCR §93 and §94 and could not find a clean version of it anywhere else for under enterprise pricing.

1. 01

   Written recall plan template, auto-populated

   The §117.139 plan template plus the SFCR §84 elements, auto-populated from your facility onboarding. Coordinator and alternates, recall management team, decision matrix, notification scripts, contact lists, inventory and destruction forms, effectiveness check log, retention schedule. The plan that lives in the system, not on a shared drive that nobody updates.

2. 02

   Contact list maintenance with quarterly auto-validation

   Auto-population from invoices, quarterly validation emails to every contact, flag-on-non-response, FDA Division Recall Coordinator lookup by state and product, CFIA Notification Contact List, FSIS District Office lookup, 24-hour contact field required on coordinator and alternates. The load-bearing wall.

3. 03

   Mock recall scheduler with random trigger-lot picker

   Annual scheduler with reminders at the 30-day and 7-day marks. The system picks a random trigger lot from your production records — you can override, but the integrity of the mock is higher when you do not. Forward and backward trace runs against the existing CTE records, mass balance auto-computes, audit-ready printout drops as a PDF.

4. 04

   Five-step recall execution workflow

   The Hold-Decide-Notify-Public-Warning-Execute-Effectiveness playbook from Section 03 above, with timestamped audit trail and per-step assigned ownership. Every state change is logged with who, what, when. The audit trail itself is what your DRC will work through at termination.

5. 05

   Live inventory pull dashboard with mass balance

   Per-lot view of recovered, in-transit, destroyed, customer-disposed, and unaccounted. Mass balance auto-computes as data comes in. Per-customer return confirmation. Destruction certificate upload with timestamp and witness signature. The single screen your recall coordinator works off during the execution phase.

6. 06

   Customer notification automation

   Distribution list pulled from invoice records scoped to the implicated lots. §7.46 nine-element URGENT FOOD RECALL letter generated, sent as email and SMS in parallel, fax option available for older customers. Per-consignee delivery and acknowledgement tracking visible on the dashboard.

7. 07

   AI-drafted recall press release in your brand voice

   FDA-format public warning, pre-filled with the recall data from the workflow, drafted in your brand voice rather than generic vendor template language. Three regeneration variants per draft so you can pick the tone you can live with. Reviewable and editable before submission.

8. 08

   Traceability lot history, bidirectional

   From any supplier input lot, instant view of every downstream finished lot and consignee. From any finished SKU, instant view of every input lot and supplier. The McDonald's-onion answer to the supplier-cascade question. Built on the FSMA 204 KDE structure on the same platform.

9. 09

   FSMA 204 KDE compliance, bundled

   Traceability Plan generation, Traceability Lot Code generator, seven-CTE capture at receive-transform-create-ship events, 24-hour sortable spreadsheet output, two-year retention. Bundled with the recall module because the same records drive both. See the /product/fsma-204 module page for the full FSMA 204 write-up.

10. 10

    Reportable Food Registry pre-fill

    The RFR (Reportable Food Registry) submission auto-pre-fills from the workflow data, ready for one-click submission inside the 24-hour 21 USC §350l window. Confirmation receipt stored against the recall record for the audit trail.

11. 11

    Effectiveness check workflow, Level A through E

    Phone-script library per consignee, scheduled-call queue with deadlines, per-consignee log fields for who you reached and what they confirmed. Rollup view for the DRC. Level A (100 percent) through Level E (no checks), with the workflow scaled to the FDA expectation for the recall class.

12. 12

    §7.55 termination request package

    Auto-assembled package for DRC submission: original recall record, final mass balance, effectiveness check log, disposition certificates, public warning if applicable. The two-week binder hunt becomes a one-day handoff.

09From the operator's chair

A note on operator credibility, and why this product exists.

I wrote my first SFCR §84 recall procedure in 2023, ran my first mock recall later that year, and have rebuilt parts of it three times since as I learned what actually held up under pressure. I contribute Chapter 29 to Mushroomology (Brill, 2026, ISBN 9789004751699), which keeps me current on specialty-cultivation regulatory pressure — the Diamond Shruumz recall in June 2024 (48 illnesses, 27 hospitalizations, 1 death) is the cautionary tale at the edge of my own niche. I built this product because the gap between the recall plan that exists on a shared drive and the execution that works under pressure on a Friday afternoon is the gap that breaks small food businesses. The closer the software stays to what the operator on the floor actually has to do, the smaller that gap gets.

10Getting started

What the first week on the recall module actually looks like.

Realistic onboarding for a single-facility operator runs about a week of part-time work. If you have your existing recall plan, invoice records, and supplier contacts already digital, it is faster. If you are starting from a paper binder, budget two weeks.

1. 01

   Day 1 — load the facility profile and coordinator team

   Create the facility, add the named recall coordinator and at least two alternates with their 24-hour contact fields filled, add the full Recall Management Team across QA, ops, customer service, accounting, legal, PR, and sales. The system loads the §117.139 plan template against this team automatically.

2. 02

   Days 2 to 3 — load the regulator contacts

   The FDA DRC lookup populates by state and product, the CFIA Notification Contact List by region, the FSIS District Office if you are meat or poultry. Verify the entries match your understanding. Add your licensed waste hauler, food-safety counsel, PR firm, and third-party lab.

3. 03

   Days 4 to 5 — load the customer distribution list

   Auto-population from your invoice records covers the past 36 months of direct accounts. Walk the list, validate the contacts, attach the lot-level distribution data where you have it. This is the slowest part of onboarding for most operators and the part that pays the biggest dividend on the first mock.

4. 04

   Day 6 — review the written plan and customize the scripts

   The §117.139 plan template is the starting point. Walk through it section by section, customize the decision matrix to your product categories, edit the notification scripts to match your customer-relationship tone, schedule the annual mock for a date that makes sense against your audit calendar.

5. 05

   Day 7 — run the first mock

   Pick a trigger lot (or accept the random pick), run the forward and backward trace, print the audit-ready report, review the gaps with your team. This is where you find your stale phone number. This is where you find the alternate coordinator who left. This is where you find the licensed waste hauler that no longer serves your region. None of those gaps would have shown up on a paper review. All three would have made a real recall significantly worse.

By the end of week one you have a written plan that maps to §117.139 and SFCR §84, a verified contact list with the 24-hour fields filled, an executed mock recall with a printed report, and a remediation list of the gaps the mock found. That packet is what your SQF, BRCGS, or FSSC 22000 auditor will ask to see. It is also the packet your Division Recall Coordinator will reference if a real recall lands.

Footnotes

1.21 CFR §117.139 — Recall plan (FSMA preventive controls for human food) — law.cornell.edu

2.21 USC §350l — Reportable Food Registry / mandatory recall authority (FSMA §206) — law.cornell.edu

3.21 CFR Part 7 — Recalls (classifications, §7.46 nine elements, §7.55 termination) — law.cornell.edu

4.9 CFR Part 418 — FSIS recalls (meat, poultry, egg products) — ecfr.gov

5.FSIS Directive 8080.1 Rev. 8 — Recall procedure — fsis.usda.gov

6.Federal Register — FSMA 204 compliance date extension to July 20, 2028 — federalregister.gov

7.FDA Find Your Recall Coordinator app — fda.gov

8.FDA Public Warning Notification guidance under 21 CFR Part 7 Subpart C — fda.gov

9.CFIA Recall Procedure Guide (SFCR §84, §93, §94) — inspection.canada.ca

10.USDA FSIS Boar's Head Public Report (January 2025) — fsis.usda.gov

11.FDA Outbreak Investigation — E. coli O157:H7 — Onions (October 2024) — fda.gov

12.FDA Investigation — Diamond Shruumz (June 2024) — fda.gov

13.Food Safety Magazine — Hospitalizations and deaths from foodborne illness more than doubled in 2024 — food-safety.com

14.Food Logistics / Aon — 2024 food recall cost data — foodlogistics.com

Andrew Langevin·CFIA-licensed facility, Brantford ON· Published 2026-06-04· 11 min read· Wikidata Q139112497