FSMA 204 Readiness Self-Assessment: 15 Questions Every QA Director Should Answer

FSMA Rule 204 enforcement began in January 2026. If your company handles food on the Food Traceability List — as a manufacturer, CPG brand, or distributor — you are now operating under an active regulatory obligation to maintain CTE records and respond to FDA trace-back requests within 24 hours.

This self-assessment is designed for QA directors and food safety managers who want to evaluate their current readiness with honest specificity. It is organized into five functional areas, each with a set of verification questions and a readiness scoring framework. Use it to identify your highest-priority gaps and prioritize remediation before your next audit cycle or FDA inquiry.

How to Use This Assessment

For each question, assess your current state against four levels:

• 3 — Verified: You have done this and can show documentation that it works. A mock recall, audit report, or system screenshot demonstrates the capability.
• 2 — Implemented but untested: You have a system or process in place, but you have not verified it performs as expected under realistic conditions.
• 1 — Partially in place: Some aspect of this is addressed, but there are known gaps. You are aware of what is missing.
• 0 — Not in place: This has not been addressed, or you are genuinely uncertain whether it exists.

After scoring each area, the questions in each section where you score 0 or 1 are your remediation priorities. Score 2s are testing and verification priorities — capabilities you have but have not validated.

Area 1: Product Coverage Assessment

Before evaluating your operational systems, confirm that you have correctly identified which of your products are subject to FSMA Rule 204.

1. FTL coverage determination: Have you reviewed the FDA Food Traceability List against your complete product portfolio (finished goods and ingredients) and documented which products are covered?

   Scoring guide: 3 = documented review with written determination per SKU, including analysis of ingredients. 2 = review done but not formally documented. 1 = preliminary review, some SKUs uncertain. 0 = not yet reviewed.

2. Covered entity confirmation: Have you confirmed that your company meets the definition of a "covered entity" under the rule for all relevant products — including assessment of any exemptions that may apply (e.g., small business exemption, direct farm sales exemption)?

   Scoring guide: 3 = written legal or regulatory analysis confirming covered entity status. 2 = internal determination, not formally documented. 1 = assumed covered without detailed analysis. 0 = not assessed.

3. Co-manufacturer coverage assessment: If you use co-manufacturers, have you confirmed that your co-mans are also covered entities for the products they produce on your behalf, and that they have their own compliance obligations for those products?

   Scoring guide: 3 = written confirmation from each co-man that they maintain FSMA 204 records for your products. 2 = verbal confirmation, not documented. 1 = assumed but not confirmed. 0 = not assessed.

Area 2: CTE Record Creation

This area assesses whether your operational processes create the required CTE records at each point in the supply chain.

1. Receiving CTEs — FTL ingredients: Is there a documented process for creating an electronic receiving CTE record for every FTL ingredient lot received at your facility, capturing the supplier's TLC, quantity, location, date, and reference document?

   Scoring guide: 3 = SOP exists, process is operational, and recent records show consistent compliance. 2 = process exists but not consistently followed for all FTL ingredients. 1 = partial process (some ingredients, some staff). 0 = not implemented.

2. Transformation CTEs — multi-ingredient production: Is there a documented process for creating a transformation CTE record for each production run that uses FTL ingredients, linking all input ingredient TLCs to the output finished goods TLC in a single electronic record?

   Scoring guide: 3 = SOP exists, system creates linked transformation records, verified in mock recall. 2 = process exists, transformation records created, not verified by mock recall. 1 = batch records capture some input lot codes but not all FTL inputs. 0 = not implemented.

3. Shipping CTEs — finished goods: Is there a documented process for creating a shipping CTE record at the lot level for each shipment of FTL-covered finished goods, capturing the TLC, quantity, destination address, date, and BOL number?

   Scoring guide: 3 = shipping records capture lot-level data per destination, linked to BOL. 2 = shipment records exist but at order level, not lot level. 1 = lot codes on some shipments, not all. 0 = not implemented.

4. Co-man CTE data: If you use co-manufacturers for FTL products, is there a documented process for receiving transformation CTE data from each co-man (input lots, output lot, quantities, production date) and incorporating it into your trace chain?

   Scoring guide: 3 = structured data sharing established, records incorporated into your trace chain, verified by mock recall. 2 = arrangement exists but not tested end-to-end. 1 = informal process, co-man provides some data on request. 0 = no process established.

Area 3: KDE Completeness and Record Quality

This area assesses whether the records being created actually contain the required data.

1. Supplier TLC capture at receiving: Do your receiving CTE records contain the supplier's traceability lot code as assigned (not your internal item number or receiving reference)?

   Scoring guide: 3 = confirmed via records spot check. 2 = believe this is happening but not spot-checked. 1 = some suppliers' TLCs captured, others not. 0 = internal numbering used instead of supplier TLC.

2. Input TLC completeness in transformation records: Do your transformation CTE records contain the TLCs for all FTL ingredient lots used in each production run (not just one lot per ingredient, or only the primary ingredient)?

   Scoring guide: 3 = all FTL input TLCs captured, verified in spot check. 2 = believe all TLCs captured but not verified. 1 = primary ingredient TLCs captured, secondary or minor ingredients may be missing. 0 = transformation records do not capture input TLCs.

3. Electronic format — sortable and searchable: Are your CTE records maintained in an electronic format where individual KDE fields (lot code, date, location, reference document) can be sorted and filtered independently?

   Scoring guide: 3 = records in a database or structured format with sortable fields; can produce sorted query on any field within 2 minutes. 2 = records electronic but in spreadsheet with inconsistent formatting; partially sortable. 1 = records in PDF or email form; not sortable. 0 = primarily paper records.

4. Reference document linkage: Do your CTE records contain actual reference document numbers (BOL numbers, production order numbers) that link to retrievable documents in your system?

   Scoring guide: 3 = reference document numbers present and cross-referenced in records management system. 2 = numbers present but some are placeholder values. 1 = inconsistent capture of reference document numbers. 0 = reference document field absent or consistently blank.

Area 4: 24-Hour Trace-Back Response Capability

This area assesses whether you can actually produce a complete trace chain within the 24-hour window.

1. Bidirectional query capability: Can your traceability system, starting from any finished goods lot code, produce a complete backward trace (all input ingredient lots and their sources) and complete forward trace (all shipment destinations) in a single query?

   Scoring guide: 3 = demonstrated in timed mock recall; complete bidirectional result in under 30 minutes. 2 = system can perform the query; time not measured. 1 = partial query possible; requires multiple lookups in different systems. 0 = no query capability; manual assembly required.

2. Electronic export for FDA response: Can your system export the complete trace chain in a sortable, searchable electronic format (CSV or Excel with discrete KDE columns)?

   Scoring guide: 3 = export tested, format reviewed against KDE requirements, produces compliant output. 2 = export function exists but output format not reviewed against KDE requirements. 1 = export produces some data but not structured by CTE type with all KDEs. 0 = no export function; manual report assembly required.

3. Mock recall testing: Have you conducted a timed mock trace-back exercise within the past 12 months, documented the time to produce the complete trace chain, and retained the mock recall report?

   Scoring guide: 3 = timed mock recall completed, documented, and under 24 hours (preferably under 4 hours). 2 = mock recall exercise conducted but not formally timed or documented. 1 = trace-back simulation discussed in planning but not executed. 0 = no mock recall conducted.

4. After-hours response plan: Is there a documented plan for how a 24-hour trace-back response would be executed if the FDA request arrived outside business hours? Does your team know who to contact and how to access the traceability system remotely?

   Scoring guide: 3 = written emergency contact and response protocol; system accessible via mobile/VPN after hours. 2 = informal understanding of who handles it but not documented. 1 = no after-hours plan; response would wait for business hours. 0 = not considered.

Area 5: Supplier Traceability Chain Integrity

Your trace chain is only as complete as your suppliers' records. This area assesses the integrity of the upstream chain.

1. FTL supplier identification: Have you identified all suppliers who provide FTL-covered ingredients, confirmed that they are covered entities under FSMA Rule 204, and documented their own compliance obligations?

   Scoring guide: 3 = complete list of FTL suppliers with compliance status confirmed in writing. 2 = list exists but compliance status not confirmed. 1 = approximate list, some FTL suppliers not identified. 0 = not completed.

2. Supplier TLC data format compatibility: Have you verified that each FTL supplier's TLC format is compatible with your receiving system — specifically, that the lot code appears in a scannable or structured format on the case label or shipping documentation?

   Scoring guide: 3 = verified for all FTL suppliers; GS1-128 or structured data confirmed for all. 2 = verified for major suppliers; some smaller suppliers not tested. 1 = some suppliers verified, others use paper-only formats. 0 = not assessed.

3. Supplier shipping CTE data access: Do you have a process to obtain shipping CTE records from each FTL supplier within 8 hours of a written request, to support your own 24-hour FDA response?

   Scoring guide: 3 = formal arrangement documented with each key FTL supplier; tested with at least one drill. 2 = arrangement exists informally; not tested. 1 = would request records reactively; no pre-established arrangement. 0 = no consideration of this requirement.

Scoring Interpretation and Next Steps

Total the scores across all questions. The maximum possible score across 15 questions is 45 (all 3s). Interpret your total:

• 40-45: Strong readiness. Your program has verified capability across all functional areas. Priority: maintain and continue periodic mock recall testing.
• 30-39: Solid foundation with gaps. Most capabilities are in place; identified gaps are addressable with targeted remediation. Priority: address the 0 and 1-scored questions systematically.
• 20-29: Partial readiness with material gaps. Key capabilities are in place but several areas are implemented but untested or partially implemented. Priority: run a timed mock recall immediately to understand your actual trace-back response time; then address structural gaps.
• 10-19: Early-stage implementation. Significant gaps exist across multiple functional areas. Priority: develop a 90-day remediation roadmap starting with CTE record creation processes.
• Below 10: Pre-implementation. Immediate action needed. This scoring level in a covered entity operating after January 2026 represents active regulatory exposure. Priority: engage regulatory counsel and begin implementation immediately.

The Single Most Important Test

If you take only one action from this self-assessment, make it a timed mock trace-back. The questions above can be answered with some uncertainty — records may be complete but you are not sure, systems may be configured correctly but you have not tested them. A mock trace-back removes the uncertainty. It tells you definitively: here is what our trace chain contains, and here is how long it takes to produce it.

Enter your most recently completed finished goods lot code that involves FTL ingredients. Start a timer. Query backward to all input ingredient lots and their sources. Query forward to all shipping destinations. Export the result in a format you could provide to FDA. Stop the timer.

That time is your current FSMA 204 readiness number. If it is under 2 hours, you are in strong shape. If it is over 8 hours, you have a gap that requires immediate attention. If the exercise reveals missing links in the chain — lots you cannot trace forward or backward — those missing links are your highest-priority remediation items.

Foodtrce can run this exercise with you. In a 30-minute demo, we will load a representative sample of your supply chain structure and run a live trace-back against it — showing you what a complete CTE chain query looks like and how the FDA-format export is generated. If the exercise reveals a gap in your current system, we can discuss the most direct path to addressing it.