Annual QA Compliance Audit Prep: Building the Traceability Evidence Package

Annual QA compliance audits — whether GFSI certification audits, customer-imposed supplier audits, or internal review cycles — have added a new dimension since FSMA Rule 204 entered enforcement. Auditors are increasingly including traceability system verification as a standard audit element, and the questions they ask go beyond the traditional "can you run a four-hour traceability exercise" that GFSI schemes have required for years.

This article is a practical preparation guide for QA managers facing audit cycles that include FSMA 204 traceability scrutiny. It covers the evidence auditors are looking for, the gaps most commonly flagged, and how to organize your records and demonstration capability before the audit team arrives.

What Auditors Are Looking for in FSMA 204 Traceability

Auditors evaluating FSMA Rule 204 compliance — FDA investigators, GFSI-scheme auditors, customer QA teams — are looking for evidence on three distinct questions:

1. Do you have a system capable of creating and maintaining CTE records? This is a documentation question: can you show that your process generates a traceability record at each required CTE (receiving, transformation, shipping) that captures the required KDEs? The evidence is your traceability system configuration, your SOPs for CTE record creation, and actual records from recent production.

2. Are your records complete and accurate? This is a records quality question: do your actual CTE records have all required KDE fields populated with real data (not placeholder text or defaults)? Are the lot codes on your records the actual lot codes on the product? Do your records link correctly across CTEs — can you traverse the chain from a receiving CTE to the transformation CTE that consumed that lot, and from the transformation CTE to the shipping CTEs for the output lot?

3. Can you respond to a trace-back request within 24 hours? This is a demonstrated capability question: the auditor may ask you to perform a trace-back exercise during the audit. Your ability to execute it quickly and completely is direct evidence of your 24-hour response capability.

Pre-Audit Self-Assessment: The Six-Point Check

In the 4-6 weeks before an audit that includes FSMA 204 traceability, run through these six areas and resolve any issues before the audit team arrives:

1. CTE coverage audit

Review your last 90 days of production for completeness of CTE record creation. For every production run that used FTL ingredients:

• Is there a receiving CTE record for each FTL ingredient lot received? Are the supplier TLCs captured in those records?
• Is there a transformation CTE record linking the input ingredient TLCs to the output finished goods lot code?
• Is there a shipping CTE record for each shipment of finished goods, with the lot code and destination captured?

Any production run or receiving event missing a CTE record is a gap. Before the audit, determine whether the gap is a system configuration issue (the system should have created a record but did not) or an operational issue (the process step was skipped). Both types need corrective action documentation.

2. KDE completeness spot check

Select 10 CTE records at random — a mix of receiving, transformation, and shipping — and verify that every required KDE field is populated with a real value. Check specifically:

• Receiving CTEs: Is the TLC the supplier's lot code or your internal item number? (Must be the supplier's TLC.) Is the location description a full physical address?
• Transformation CTEs: Are all FTL input TLCs present? Is there one transformation CTE record per production run, or are multiple runs collapsed into a single record? (Each production run should have its own transformation CTE.)
• Shipping CTEs: Does the record capture the specific shipping destination address (DC address, not just company name)? Is the BOL number present and does it match the BOL for that shipment?

3. Mock trace-back exercise

Run a timed mock trace-back at least 3 weeks before the audit. Select a finished goods lot code from 60-90 days ago and measure how long it takes to produce a complete bidirectional trace chain. Time the query and document the result.

Target: complete trace chain (all input ingredient lots with sources, all output shipment destinations with BOL references) produced and exported in under 30 minutes. If your time is above 60 minutes, you have a gap that needs to be addressed before the audit. If it is above 120 minutes, your system configuration or data quality needs urgent attention.

Keep the dated mock recall report from this exercise. Showing an auditor a recent mock recall with time stamps and a complete trace chain is the most compelling evidence of your 24-hour response capability.

4. Supplier traceability records verification

Select 5 FTL-relevant supplier lots received in the past 90 days. For each:

• Is the supplier's TLC captured in your receiving CTE record?
• Is the TLC on the receiving record the same code that appears on the case label barcode and the COA?
• If you have a data sharing arrangement with the supplier (EDI 856 ASN, structured CSV), did those records arrive on schedule and were they imported correctly?

5. Document your SOPs

Auditors will ask to see the Standard Operating Procedures (SOPs) for your CTE record creation process. These should document:

• Who is responsible for creating receiving CTE records, and when (at dock receipt, before product is put to location, by end of receiving day?)
• Who is responsible for creating transformation CTE records, and when (at production run start, at completion, by end of shift?)
• Who is responsible for creating shipping CTE records, and how (manual entry, ERP export, automated from WMS scan?)
• The escalation process if a required CTE record cannot be created (e.g., supplier COA lot code is missing)

If your SOPs predate FSMA Rule 204 enforcement (January 2026) and have not been updated to explicitly address CTE record creation, update them before the audit. An SOP that mentions "lot code recording" but does not reference CTEs or KDEs will not satisfy an auditor reviewing FSMA 204 compliance.

6. Training records

Anyone involved in receiving, production, or shipping who is responsible for creating CTE records should have documented training records for FSMA 204 traceability procedures. This includes:

• Training on the CTE concept and the specific KDE requirements for their job function
• Training on your traceability system (the specific screens or process steps for creating records)
• Competency verification (quiz, observation, or mock record creation)

Check that training records are current — specifically for anyone hired or transferred into a CTE-relevant role in the past 12 months.

Preparing for the Audit-Day Trace-Back Exercise

If your audit includes a live trace-back exercise (increasingly common for GFSI audits and customer audits that include FSMA 204 elements), prepare specifically:

• Know in advance which system your QA team will use to run the trace-back (the traceability platform, not the ERP or a spreadsheet lookup), and confirm the system is accessible and responsive on the morning of the audit
• Designate the specific person who will operate the system during the trace-back — someone who has practiced the query workflow and is comfortable under time pressure
• Prepare a printed or screen-shared trace chain template showing what the complete output looks like — so the auditor can see the structure of a full response before they call a lot code for the live exercise
• Have at least one recent mock recall report ready to present as evidence of periodic trace-back testing

Common Audit Findings in FSMA 204 Traceability

Based on the kinds of gaps that surface during compliance assessments, the most common audit findings in FSMA 204 traceability include:

• Missing receiving CTEs for some ingredient lots: Typically because high-volume or commodity ingredients were not recognized as FTL-covered, or because the receiving process was not consistently applied across all receiving staff.
• Transformation CTEs that capture the output lot but not all input TLCs: Usually because the batch record format was not updated to require input lot code capture for all FTL ingredients, or because some ingredients were added without being recorded at the lot level.
• Shipping CTE records at the order level, not the lot level: The ERP records which customer received a shipment but not which specific lot codes were on that shipment. Requires either a WMS scanning upgrade or a manual lot-level packing list process.
• Records maintained as PDFs rather than in sortable format: COAs and batch records are filed as PDFs and are not searchable by lot code as discrete fields. Valid as supporting documentation but not as the primary CTE record.
• No documented mock recall testing: The company has a traceability system but has not run a timed exercise to verify that the 24-hour response capability exists in practice.

Building the Audit Evidence Package

A well-organized audit evidence package for FSMA 204 traceability gives the auditor a clear, efficient path through the evidence they need to see. A practical structure:

1. Program overview: one-page summary of your FSMA 204 traceability program — scope of products covered, CTE types maintained, system used, and last mock recall date and result
2. SOPs: the current SOPs for receiving CTE creation, transformation CTE creation, and shipping CTE creation
3. Training records: recent training records for CTE-relevant staff
4. Sample records: 2-3 complete trace chains from recent production (from finished goods lot back through ingredients, and forward to shipping destinations), with KDEs highlighted
5. Mock recall report: the most recent timed mock recall report with timestamp and complete trace chain output
6. Supplier traceability documentation: evidence that key FTL suppliers are providing FSMA 204-compatible lot code data (sample COAs, EDI 856 records, or supplier traceability questionnaire responses)

Having this package ready at the start of the audit — rather than assembling it in response to individual auditor requests — projects a well-managed program and reduces audit duration. Auditors who have to wait for records to be found or assembled form a negative initial impression that is hard to reverse.

Foodtrce generates the evidence package components directly from the platform: mock recall reports, KDE completeness reports, and exportable trace chain samples. If your audit cycle is approaching, we can help you run the pre-audit self-assessment and prepare the documentation your auditor will request.