Setting Supplier Traceability Requirements: What to Ask Before You Sign

Supplier onboarding is the right time to establish FSMA Rule 204 traceability requirements — not after a supplier has been producing for six months and you discover their lot code format is incompatible with your receiving system. For QA managers and supply chain teams responsible for approved vendor programs, incorporating traceability requirements into the onboarding process prevents compliance gaps before they become trace chain breaks.

This article covers what traceability capabilities to assess during supplier onboarding, how to communicate the requirements clearly, and how to structure the ongoing data relationship to support your FSMA 204 compliance program.

Which Suppliers Have FSMA 204 Relevance

Not every supplier in your approved vendor list (AVL) has FSMA Rule 204 traceability implications. The relevant suppliers are those who provide you with food on the FDA's Food Traceability List (FTL) — or with ingredients that contain or are derived from FTL-covered foods. Before beginning the traceability-specific onboarding process, categorize your incoming supply as:

• FTL-covered: Fresh leafy greens, fresh herbs, fresh tomatoes/cucumbers/peppers, fresh-cut produce, shell eggs, nut butters, ready-to-eat deli salads, covered finfish and shellfish. Suppliers providing these items have their own FSMA 204 shipping CTE obligations and must provide you with a TLC-compliant shipping record at each delivery.
• FTL-ingredient-containing: Ingredients derived from or containing FTL-covered foods as a significant component — for example, a fresh herb paste that contains basil covered by the FTL. Whether the ingredient itself is on the FTL requires a product-specific assessment; involve your regulatory team for borderline cases.
• Non-FTL: Ingredients that are not on the FTL and do not contain FTL-covered components as a primary ingredient. These suppliers do not have FSMA 204 shipping CTE obligations for the ingredient in question, though they may have other traceability record requirements under your own supplier program or other regulations.

For FTL-covered and FTL-ingredient-containing suppliers, the onboarding process should include the traceability requirements described in this article. For non-FTL suppliers, standard quality onboarding applies without the FSMA 204-specific traceability requirements.

Traceability Capability Assessment at Onboarding

The supplier questionnaire — a standard component of any quality onboarding process — should include a traceability capability section for FTL-relevant suppliers. The questions to include:

Lot code assignment

• Does your facility assign a unique traceability lot code (TLC) to every production lot of the product we are purchasing?
• What is the format of your TLC? (Please provide an example.)
• Is the TLC encoded in a machine-readable barcode on your case labels? If yes, what barcode symbology do you use? (GS1-128, QR, other?)
• Does the TLC appear on your Certificate of Analysis (COA) for each lot?

Shipping CTE record capability

• Do you maintain electronic shipping records that capture, for each shipment: the TLC, quantity shipped, receiving entity identity and address, date of shipment, and BOL number?
• In what format are these records maintained? (ERP, WMS, standalone software, Excel?)
• Can you provide these records in a sortable, searchable electronic format within 24 hours of request?
• Have you produced traceability records in response to an FDA request or customer trace-back request? If yes, what was the response time?

Data sharing format

• Can you include lot-level data (TLC per line item) in EDI 856 Advance Ship Notice transactions?
• Can you provide a lot-level packing list or shipping report in a structured format (CSV, Excel) with each shipment?
• Do you use a GS1 Global Location Number (GLN) to identify your shipping facility?

Minimum Acceptable Capability Standards

Based on the FSMA Rule 204 regulatory requirements and the operational realities of supply chain data exchange, the minimum traceability capability standards for FTL-relevant supplier approval should include:

TLC assignment: The supplier must assign a unique TLC to every production lot of FTL-covered product. The TLC must be present on the COA for each lot and on the product label or case label at the lot level.

Electronic records in compliant format: The supplier must maintain shipping CTE records electronically, with all required KDEs captured in discrete, sortable fields. Paper shipping logs or non-structured spreadsheets are not acceptable as the primary format.

24-hour response capability: The supplier must be able to provide traceability records to you within 24 hours of a written request — to support your ability to respond to FDA within the 24-hour window. In practice, suppliers need to respond in 8-12 hours or less, to give you time to incorporate their records into your response.

TLC on shipping documentation: The TLC must appear on the shipping documentation (packing list, BOL, or COA accompanying the shipment) so that your receiving team can capture it at dock receipt. A lot code that is only discoverable after calling the supplier's QA team is operationally unacceptable.

Communicating Requirements to Suppliers

Supplier traceability requirements are most effective when communicated in writing as part of the supplier qualification and agreement process, not as ad hoc requests after qualification. The communication should cover:

Supplier Traceability Requirements Specification

A written document (often a one-to-two page attachment to the supplier quality manual or purchasing agreement) that specifies:

• The regulatory basis for the requirement (FSMA Rule 204, 21 CFR Part 1, Subpart S)
• The TLC format you require on shipment documentation (and whether GS1-128 encoding is required or preferred)
• The required fields on the COA: lot code, pack date, quantity, test results
• The data sharing mechanism for shipping CTE data (EDI 856 with lot-level line items, structured CSV, or supplier portal entry)
• The response time requirement for trace-back record requests (your standard: within 8 hours of written request)

Initial onboarding training

For suppliers who are new to FSMA 204 requirements — particularly smaller regional suppliers who may not have a formal compliance program — a brief onboarding conversation (30-minute call with your QA team and their QA contact) can prevent the common misunderstandings: providing an internal item code instead of the TLC, providing the COA lot code in a format that does not match the case label, or sending lot information only by email rather than in a structured data format.

Onboarding Verification Steps

Supplier traceability capability should be verified before the first production order is placed, not after the first delivery arrives with inadequate documentation. The onboarding verification process should include:

Sample shipment test

Before full production volumes begin, request a sample shipment (or arrange for a pre-production trial run) and verify:

• The case label contains a machine-readable barcode encoding the TLC (scan it with your dock barcode reader to confirm readability)
• The TLC on the label matches the TLC on the COA
• The COA includes all required fields in a format that can be entered into your receiving system
• The BOL includes the TLC for each line item (or the packing list does)

Mock trace-back drill with the supplier

For high-volume or critical-path FTL suppliers, conduct a mini mock trace-back during onboarding. Send the supplier a written request for the shipping CTE records for the sample shipment (or a recently completed shipment), specifying the 24-hour response window. Evaluate the response: did they provide records within the window? Are the KDEs complete? Is the format sortable and searchable?

This drill gives you real data on the supplier's response capability before you are dependent on them during an actual FDA trace-back. It also demonstrates your program's seriousness to the supplier in a way that a questionnaire alone does not.

Handling Suppliers Who Cannot Meet Requirements

During onboarding, some suppliers will reveal that they cannot meet one or more traceability capability standards — often because they do not encode their TLC in a GS1-128 barcode, or because their records are maintained in a paper or non-searchable format. The response depends on the supplier's criticality and their willingness to develop capability:

Conditional approval with remediation timeline: If the supplier is critical-path and the gap is addressable, issue a conditional approval with a written remediation plan specifying the capability required, the timeline (e.g., 90 days), and the verification step. Document the conditional status in the AVL with expiration of the condition.

Supplier corrective action request (SCAR): If the supplier has an existing relationship and a capability gap was identified post-qualification, issue a SCAR with the same content — required capability, timeline, and verification step. Track the SCAR to closure in your supplier management system.

Alternative sourcing assessment: If a supplier cannot meet the basic requirements (unique TLC per lot, TLC on COA and shipping documentation, electronic records) and is unwilling to develop that capability, assess whether the risk of non-compliant traceability from this supplier is acceptable. For FTL-covered ingredients where the supplier's TLC is a required element of your trace chain, a supplier who cannot provide a TLC is a compliance gap you cannot work around indefinitely.

Ongoing Monitoring After Onboarding

Supplier traceability capability is not a one-time onboarding check — it needs ongoing monitoring. The most common post-onboarding failure modes:

• Supplier changes their lot code format without notifying you — the new format is not compatible with your receiving system's TLC field
• Supplier switches their COA template and the TLC field moves or is dropped
• Supplier's quality staff turns over and the new QA contact is not familiar with the traceability documentation requirements
• Supplier's ERP upgrade changes the data export format, breaking the structured CSV transfer you had established

Including a traceability data quality check in your routine receiving inspection — flagging shipments where the TLC format has changed or the COA TLC does not match the case label — catches these issues quickly before they accumulate into a trace chain gap.

Foodtrce's supplier compliance module includes an automated TLC format validation at receiving: when a lot code is scanned or entered that does not match the expected format for that supplier-product combination, the system flags it for QA review before the lot is accepted into inventory. This reduces the incidence of TLC format changes silently breaking the trace chain between supplier re-qualifications.