When the FDA Requests a Trace-Back: What to Expect in the First 24 Hours

An FDA trace-back request is one of the most operationally time-sensitive events a food company's QA team will face. Under FSMA Rule 204, covered entities have 24 hours to respond to a written FDA request for traceability records. For QA directors and food safety managers who have not been through an FDA trace-back investigation, understanding what the request looks like, what FDA expects in the response, and how to prepare effectively can make the difference between a manageable compliance event and an operational crisis.

This article describes the FDA trace-back process in practical terms — what triggers a request, what a written request typically looks like, what your response must contain, and how to organize your preparation before the request arrives.

What Triggers an FDA Trace-Back Request

FDA trace-back requests arise in several contexts. The most common is an outbreak investigation — when FDA or a state health department identifies a cluster of illness cases potentially linked to a food product and needs to trace the product through the supply chain to identify the source of contamination. These investigations typically begin with patient interviews, illness onset data, and product purchase or consumption history, which lead FDA to identify a specific product category and time window of concern.

Other triggers include:

• A positive environmental or product sample result from FDA inspection or sampling program
• A consumer complaint involving confirmed illness or injury linked to a specific product lot
• A supplier-initiated notification that an ingredient lot has been identified as potentially contaminated
• A recall notification from another supply chain participant that references a lot code your facility received or shipped

Under FSMA Rule 204, FDA also has authority to request traceability records for any food on the Food Traceability List, without a specific contamination trigger, as part of routine compliance verification. This means that a trace-back request does not necessarily indicate that your product caused an illness — it may be a verification that your records are adequate. The 24-hour response requirement applies regardless of the reason for the request.

What an FDA Trace-Back Request Looks Like

Under 21 CFR Part 1, Subpart S, FDA requests for traceability records must be made in writing. In practice, this typically arrives as an email from an FDA district office or the Center for Food Safety and Applied Nutrition (CFSAN) to your regulatory contact of record. The request will typically specify:

• The specific food product(s) of interest (product name, description, and usually lot code or date range)
• The time period covered by the request
• The CTE record types requested (receiving, transformation, shipping, or all)
• The format in which records must be provided (sortable, searchable electronic format)
• The 24-hour deadline, calculated from the time of the written request
• The FDA contact person and submission instructions

Note that FDA may also be contacting other parties in your supply chain simultaneously — your ingredient suppliers, your co-manufacturers, your distribution partners. Each of those parties will receive their own trace-back request for their portion of the chain. Your 24-hour clock runs from the time FDA issues your request, not from when you first hear about a potential issue from a supply chain partner.

What Your Response Must Contain

Your response must include the traceability records for the requested CTE types, in a sortable, searchable electronic format, covering the specified product(s) and time period. In practical terms, a complete response for a finished goods manufacturer will typically include:

Receiving CTE records

For each FTL ingredient lot received during the relevant time period (or for the specific lot codes cited in the request), records showing: the supplier's TLC, quantity received, your receiving facility address, date of receipt, and the reference document number (BOL or PO number).

Transformation CTE records

For each production run that used the identified ingredient lot codes, or produced the identified finished goods lots: the input TLCs and quantities, the output TLC and quantity, the transformation facility address, and the date of transformation. This is the record that links ingredient lots to finished goods lots.

Shipping CTE records

For each shipment of the identified finished goods lots: the TLC, quantity, and description of the food shipped; the name and address of the immediate subsequent recipient; the date of shipment; and the BOL reference number. This is the record that links finished goods lots to distribution destinations.

The records must be provided in an electronic format that is sortable and searchable — meaning the fields (lot code, date, location, reference document) must be in separate columns or fields that can be sorted and filtered, not buried in narrative text or PDF documents.

Working the 24-Hour Clock

Twenty-four hours is less time than it sounds. If the FDA request arrives at 4:30 PM on a Tuesday, your response deadline is 4:30 PM on Wednesday — which includes Tuesday evening, overnight, and Wednesday morning. If your QA team works standard business hours and the request arrives at end of day, you have roughly a single business day to respond.

The time allocation in a realistic response scenario looks something like this:

• 0-2 hours: Initial triage. Who received the request? Notify QA director, regulatory affairs, senior leadership, and legal counsel. Identify the scope of the request and begin gathering system access.
• 2-6 hours: Record retrieval. Run the trace-back query in your traceability system. Identify any gaps — missing input TLCs, incomplete shipping CTEs, records that need to be requested from co-mans or 3PLs.
• 6-12 hours: Gap filling. Contact co-manufacturers, 3PLs, or other supply chain partners for records you don't have directly. Export records from external sources and integrate with your response package.
• 12-20 hours: Response assembly and review. Compile the complete trace chain into the response format. Legal review of the submission. QA director sign-off on completeness.
• 20-24 hours: Submission. Deliver the response package per FDA's submission instructions. Document the time of submission.

If your trace-back query takes 6 hours to run because your records are not in a queryable system, you are already in the gap-filling window before you even start assembling the response. If it takes 30 minutes because your traceability platform returns a complete chain on a single query, you have hours of buffer for legal review and coordination with external supply chain partners.

What Not to Do

A few common mistakes in FDA trace-back response situations:

Do not submit an incomplete response with a note that the rest is coming. If you cannot assemble a complete response within 24 hours, contact the FDA liaison identified in the request before the deadline and request a brief extension, explaining what records are outstanding and what steps you are taking to obtain them. Submitting a clearly incomplete response without communication is worse than requesting an extension.

Do not submit PDF scans of paper records as your primary response. Paper records or PDF scans do not satisfy the "sortable and searchable" electronic format requirement. If your only records are paper, you are likely in violation of the rule's record format requirement — address this proactively rather than discovering it during a response.

Do not reconstruct records from memory or estimates. All records submitted must reflect actual contemporaneous records from the time the events occurred. Retrospectively reconstructing a receiving record or shipping record that was never actually created is not acceptable — and the discrepancy between your records and the records of other supply chain parties will often make reconstructions detectable.

Do not delay notifying legal counsel. An FDA trace-back request is a regulatory action. Your legal counsel should be aware from the moment the request arrives, and any outgoing communications to FDA (including the formal response) should be reviewed before submission.

Preparing Before the Request Arrives

The operational preparation for an FDA trace-back request is the same as the preparation for a good mock recall exercise. The questions to answer before a request arrives:

• Who is FDA's regulatory contact of record for your facility? Is that contact list current? Does it include a backup if the primary contact is unavailable?
• Who is the QA director or food safety manager authorized to approve the trace-back response submission? Is there a clear chain of authority if that person is unavailable?
• What is your traceability system's query capability? How long does a full trace-back query take, from lot code entry to exported report?
• Which supply chain partners (co-mans, 3PLs, major ingredient suppliers) would you need to contact to obtain records not in your own system? Do you have after-hours contact information for the relevant QA or operations contacts at those organizations?
• Is your legal counsel briefed on FSMA Rule 204 and the trace-back response process? Do they have a template for FDA communication in a trace-back context?

Answering these questions in advance — and testing the operational sequence in a mock trace-back exercise at least annually — is the difference between a company that can respond within the 24-hour window and a company that cannot. The time to discover gaps in your process is during a scheduled test, not at 5:00 PM on the day the FDA request arrives.

After the Response: What Comes Next

Submitting your trace-back records is not necessarily the end of the process. FDA may follow up with additional questions, a request for additional records, or a request for an on-site inspection. If your records revealed a supply chain gap — an ingredient lot with an unknown source, a shipment destination that cannot be confirmed — FDA will likely want to understand how that gap occurred and what your corrective action plan is.

If the trace-back investigation results in a recall determination, a separate process begins involving recall strategy, public notification, and product retrieval. Your traceability records are the foundation of that process — the better your records, the more precisely you can scope the recall and communicate to trade partners and consumers.

Foodtrce's recall readiness module supports the complete trace-back response workflow — from initial lot code query through export of the formatted CTE chain. If your QA team wants to run a timed mock FDA trace-back exercise against your actual production data, we can set that up as part of an onboarding evaluation session.