The call comes on a Tuesday morning. An FDA investigator is working a multi-state Salmonella outbreak linked to a leafy greens supplier, and your brand is on the list of companies that purchased from that supplier in the last 90 days. The investigator needs two things: first, which specific lots of that supplier's greens your facility received and on what dates. Second, which finished products those lots went into and where those products are right now, down to the distributor and retail account level. Your receiving records are in a three-ring binder in the back office. Your production records are in a spreadsheet that three different people have edited over the past year. It takes your team three days to compile a coherent answer. The FDA expected it in 24 hours.
This scenario is not hypothetical. It is the exact situation FSMA 204 was designed to prevent. The rule, which applies to companies handling foods on the FDA's Food Traceability List, requires covered entities to maintain records that support traceability in both directions: backward from a finished product to its ingredient sources, and forward from a raw material lot to every finished product and customer it reached. If you can only do one direction, or if doing either direction takes more than a few hours, your traceability system is not compliant and it is not protecting your brand.
Backward Traceability vs. Forward Traceability: The Actual Definitions
Backward traceability means you can start with a finished product, a specific lot code, or even a single ingredient lot and trace it back upstream through your supply chain to its origin. You are answering the question: where did this come from? Which supplier shipped this ingredient, from which farm or facility, on which date, under which lot code? In a recall investigation, backward traceability is how you confirm whether a specific contaminated input actually made it into your product.
Forward traceability means you can start with a raw material lot at the point of receiving and trace it forward through every step of your operation: which production batches it was used in, which finished product lots those batches became, which cases were packed from those lots, and which customers or distribution points received those cases. You are answering the question: where did this go? Forward traceability is how you execute a targeted product withdrawal or notify specific customers that a product may be affected.
The distinction matters because the two directions serve different operational purposes. Backward traceability is primarily reactive. An investigator or your own quality team identifies a problem and needs to understand the source. Forward traceability is both reactive and proactive. Once you know a source is compromised, forward traceability is how you contain the damage by finding every product that touched that source and getting it out of commerce as quickly as possible.
Backward traceability answers "where did this come from?" Forward traceability answers "where did this go?" You need both. One without the other leaves you unable to either confirm a contamination source or execute a targeted recall, and FSMA 204 requires both directions to be documented and retrievable within 24 hours of an FDA request.
Why You Need Both Directions and When Each Is Used
Most food brands, when they think about traceability at all, think about it in the backward direction. They want to know where their ingredients came from. They have supplier documentation, certificates of analysis, and receiving logs. That is a reasonable starting point, but it is only half the picture, and it is the less operationally demanding half.
Backward traceability is used primarily during investigations. An outbreak is identified, a contaminated lot is traced to a supplier, and regulators need to know which brands received that lot. Your backward traceability records tell the investigator whether you are in scope. If you received the implicated lot, the investigation moves to the next question: what did you do with it? That is where forward traceability takes over.
Forward traceability is used for recalls, withdrawals, and customer notifications. Once you know a specific ingredient lot is compromised, you need to identify every finished product batch that used it, every case packed from those batches, and every customer who received those cases. The faster you can answer those questions, the more targeted your recall can be. A brand with strong forward traceability can pull 200 specific cases from three specific retail accounts. A brand without it has to recall an entire product line across all channels because they cannot narrow the scope. The difference in cost, brand damage, and regulatory exposure between those two outcomes is enormous.
There is also a proactive use case for forward traceability that most brands overlook. If a supplier notifies you that a lot they shipped may have been compromised before any illness is reported, your forward traceability records let you get ahead of the problem. You can identify the affected product, initiate a voluntary withdrawal, and notify customers before FDA is involved. That kind of proactive response is treated very differently by regulators than a reactive one.
Backward traceability tells you whether you are affected by a supply chain problem. Forward traceability determines how you respond. Brands that invest only in backward traceability can confirm they received a contaminated lot but cannot execute a targeted recall. That is the worst possible position: you know you have a problem but you cannot contain it efficiently.
FSMA 204's Specific Requirements for Each Direction
FSMA 204 organizes traceability requirements around two concepts: Critical Tracking Events (CTEs) and Key Data Elements (KDEs). A Critical Tracking Event is any point in the supply chain where a food changes hands, changes form, or changes location in a way that is significant for traceability purposes. The rule defines five CTEs: growing, receiving, transforming, creating, and shipping. For most food brands that are not primary growers, the relevant CTEs are receiving, transforming or creating, and shipping.
At each CTE, the rule requires you to capture specific Key Data Elements. The KDEs are the actual data points that make traceability possible in both directions. Here is what the rule requires at each CTE relevant to a food brand:
At the receiving CTE, you must capture the traceability lot code for each food received, the quantity and unit of measure, the location description for the immediate previous source, the date you received the food, and the reference document type and number. This is the foundation of your backward traceability. If you do not capture the supplier's lot code at receiving, you cannot link your finished product back to the source lot when an investigation requires it.
At the transformation or creation CTE, you must capture the new traceability lot code you assign to the finished product, the lot codes of all inputs used in the transformation, the quantity and unit of measure of the output, the location where the transformation occurred, and the date of the transformation. This is the link that connects your backward and forward traceability. It is also the link that most brands fail to maintain consistently.
At the shipping CTE, you must capture the traceability lot code of the food being shipped, the quantity and unit of measure, the location description for the immediate subsequent recipient, the date of shipment, and the reference document type and number. This is the foundation of your forward traceability. Without shipping records that tie lot codes to specific customers, you cannot execute a targeted recall.
| Critical Tracking Event | Traceability Direction Supported | Core KDEs Required |
|---|---|---|
| Receiving | Backward (source identification) | Supplier lot code, quantity, source location, date received, reference document |
| Transforming / Creating | Both (links input lots to output lots) | Input lot codes, output lot code, quantity, production location, date of transformation |
| Shipping | Forward (customer identification) | Finished product lot code, quantity, recipient location, date shipped, reference document |
The rule also requires that all traceability records be maintained for two years and that they be provided to FDA in an electronic, sortable spreadsheet format within 24 hours of a request. That last requirement is what catches most brands off guard. Paper binders and disconnected spreadsheets cannot be sorted and filtered quickly enough to meet a 24-hour deadline when the request covers multiple lot codes across multiple production runs.
FSMA 204 does not just require that you have records. It requires that those records be linkable across CTEs, maintained for two years, and producible in a sortable electronic format within 24 hours. The rule is explicit about both directions of traceability. If your records cannot connect a supplier lot code through production to a specific customer shipment, they do not meet the standard.
The 3 Critical Traceability Links Food Brands Most Often Miss
Most food brands have some version of receiving records and some version of shipping records. The gaps are almost always in the connections between those records, specifically at three transition points where lot-level information gets lost or disconnected.
1. The Receiving-to-Production Link
This is the link between the lot codes you recorded at receiving and the production batches that actually used those lots. The failure mode here is almost always a timing or documentation gap. Ingredients are received, logged into a receiving binder or spreadsheet, and then moved to a storage area. When production runs, the team pulls ingredients from storage but does not formally record which specific lot codes were pulled for which batch. The receiving record exists. The production record exists. But there is no documented connection between them. When an investigator asks which production batches used lot 2024-0312 from your leafy greens supplier, you cannot answer with certainty because the link was never captured.
2. The Production-to-Packaging Link
This gap appears most often in brands that run production and packaging as separate operations, or that use a co-packer for one and not the other. A production batch is completed and assigned a batch number. That batch then goes into a packaging run, but the packaging record uses a different identifier, often a finished goods lot code that was generated independently rather than derived from the production batch number. The result is two sets of records that describe the same product but cannot be linked to each other without manual cross-referencing. If your production batch number and your finished goods lot code are not explicitly connected in your records, you have a gap in your forward traceability chain.
3. The Packaging-to-Shipment Link
This is the link between finished goods lot codes and specific customer orders. The failure mode here is usually that shipping records capture order numbers and customer names but not the specific lot codes that were picked and shipped for each order. A warehouse team picks cases from multiple pallets without recording which lot codes went into which order. The shipping document shows the customer and the quantity but not the lot. When you need to notify a specific customer that they received product from an affected lot, you cannot do it because the lot-to-customer link was never captured at the point of shipment.
The three links that break traceability chains are receiving-to-production, production-to-packaging, and packaging-to-shipment. Each one is a point where lot-level information is present in one record but not carried forward to the next. Fixing traceability is not about creating more records. It is about ensuring that lot codes are explicitly linked across these three transitions every time, without exception.
See How Guidance Connects Every Lot Code Across Your Operation
Guidance gives food brands a single system for receiving, production, and shipping records that are linked by lot code from the moment an ingredient arrives to the moment a case leaves your dock.
Get Early AccessHow to Build Forward Traceability Into Your Receiving and Production Process
Forward traceability starts at receiving, not at shipping. The moment an ingredient arrives at your facility, you need to capture the supplier's lot code and assign it a position in your own system so that it can be tracked through every subsequent step. Here is how to build that process in practice.
Step one is to require supplier lot codes on every inbound delivery and refuse to accept product without them. This sounds obvious, but many brands accept deliveries with only a purchase order number or a generic batch reference. If you do not have the supplier's actual lot code, you cannot link your finished product back to the source in a backward traceability exercise, and you cannot confirm which of your production batches used a specific supplier lot in a forward exercise. Make lot code capture a non-negotiable condition of receiving, and document it on your receiving log at the time of delivery, not after the fact.
Step two is to assign an internal lot code to each received ingredient lot and label the physical inventory with that code. Your internal lot code should reference the supplier lot code, the date received, and the item. When that ingredient is pulled for production, the internal lot code travels with it to the production floor. The production record then captures which internal lot codes were used in each batch, creating the receiving-to-production link that most brands miss.
Step three is to build lot code capture into your production batch records as a required field, not an optional one. Every production batch record should list every ingredient lot code used, the quantity of each, the batch number assigned to the output, and the date and location of production. If you are using a paper batch record, this means a dedicated section for ingredient lot codes that must be filled in before the record is considered complete. If you are using a spreadsheet or software system, it means a required field that cannot be bypassed.
Step four is to link your production batch number to your finished goods lot code explicitly. If your finished goods lot code is derived from your batch number, document that derivation. If they are separate identifiers, maintain a cross-reference table that connects them. This is the production-to-packaging link. Without it, your forward traceability chain breaks between production and the finished product that leaves your facility.
Step five is to verify the chain at the end of each production run by confirming that every ingredient lot code used in the batch is captured in the batch record and that the batch record is linked to the finished goods lot code. This takes five minutes and prevents the kind of documentation gap that turns a 24-hour FDA response into a three-day scramble.
How to Build Backward Traceability Into Your Shipping and Distribution Records
Backward traceability from the customer side requires that your shipping records capture finished goods lot codes at the time of shipment, not just order numbers and quantities. This is the packaging-to-shipment link, and it is where forward and backward traceability meet. A customer receiving a case of your product should be traceable back to the production batch that made it, the ingredient lots that went into that batch, and the suppliers who provided those ingredients. That chain only works if the lot code is captured at every step, including at the point of shipment.
The practical requirement is that every outbound shipment record, whether it is a bill of lading, a packing slip, or an order confirmation, must include the finished goods lot codes for every item shipped. If you are shipping mixed lots to a single customer, each lot code must be listed with its corresponding quantity. This is not just a regulatory requirement. It is the information you need to execute a targeted recall without pulling product that is not affected.
For brands selling through distributors, the challenge is that distributors often break cases and commingle lots before delivering to retail. Your obligation under FSMA 204 is to your immediate subsequent recipient, meaning the distributor. The distributor has their own FSMA 204 obligations for the next step in the chain. What you must ensure is that your shipping records clearly document which lot codes went to which distributor on which date, and that you retain those records for two years in a format that can be provided to FDA electronically.
For brands selling direct to retail or through e-commerce, the lot-to-customer link is more direct and more complete. Every order should have a lot code associated with it at the time of fulfillment. If you are fulfilling orders from multiple lots, the fulfillment record should capture which lot was used for each order. This level of detail makes a targeted customer notification possible in hours rather than days.
The internal link that supports backward traceability from the shipping record is the finished goods lot code to production batch connection described in the previous section. If your shipping records capture finished goods lot codes, and your production records link those lot codes to ingredient lots, and your receiving records link those ingredient lots to supplier lots, you have a complete backward traceability chain from customer to farm. That is what FSMA 204 requires and what an FDA investigator will expect to see.
For a comprehensive overview of all the records and processes required under FSMA 204, see our FSMA 204 compliance checklist for food brands.
Backward traceability from the customer side depends entirely on capturing finished goods lot codes at the point of shipment. If your shipping records do not include lot codes, you cannot trace a customer complaint or a recall notice back through your production records to the ingredient source. The lot code on the shipping document is the anchor point for the entire backward traceability chain.
Manual Workflow vs. Guidance Workflow: Responding to an FDA 24-Hour Traceability Request
What happens when FDA calls at 9am and needs records by 9am tomorrow
- Locate the receiving binder for the relevant time period. If it covers multiple months, this means pulling multiple binders and searching by date. Estimated time: 45 minutes to 2 hours depending on how records are organized.
- Identify which receiving entries correspond to the implicated supplier and lot code. If the supplier's lot code was not consistently recorded, this step may be inconclusive. Estimated time: 1 to 3 hours.
- Cross-reference the receiving dates against production spreadsheets to identify which batches were run during the period when the affected ingredient was in inventory. This requires manually reviewing production records and making inferences about which lots were used, because the receiving-to-production link was not explicitly captured. Estimated time: 2 to 4 hours.
- Identify finished goods lot codes associated with those production batches. If the production batch number and finished goods lot code are different identifiers, this requires another manual cross-reference. Estimated time: 1 to 2 hours.
- Search shipping records for orders that included those finished goods lot codes. If shipping records do not include lot codes, this step requires estimating based on ship dates and inventory levels. Estimated time: 2 to 4 hours, with significant uncertainty in the result.
- Compile all records into a spreadsheet format suitable for FDA submission. Estimated time: 2 to 3 hours.
Total estimated time: 9 to 18 hours, with meaningful gaps and assumptions in the chain. High probability of missing the 24-hour deadline. High probability that the records contain gaps FDA will flag as non-compliant.
What happens when FDA calls at 9am and needs records by 9am tomorrow
- Open Guidance and search by supplier name or supplier lot code. Every receiving record that matches appears immediately, with dates, quantities, and internal lot codes. Estimated time: 2 minutes.
- Select the affected supplier lot codes. Guidance automatically surfaces every production batch that used those lots, because the receiving-to-production link was captured at the time of production. Estimated time: 3 minutes.
- From the production batch records, Guidance displays every finished goods lot code associated with those batches, including quantities and pack dates. Estimated time: 1 minute.
- From the finished goods lot codes, Guidance displays every outbound shipment that included those lots, with customer names, ship dates, quantities, and reference document numbers. Estimated time: 1 minute.
- Export the complete traceability chain as a sortable spreadsheet in the format FDA requires. Estimated time: 2 minutes.
Total estimated time: under 15 minutes. Complete, linked records from supplier lot to customer shipment. No gaps, no assumptions, no missed deadline.
How to Test Your Traceability System Before an FDA Inspection
The only way to know whether your traceability system actually works is to test it under conditions that approximate a real FDA request. A paper audit of your procedures tells you what your process is supposed to do. A mock recall drill tells you what it actually does.
Run a forward traceability drill at least twice a year. Pick a specific ingredient lot code that was received in the last 90 days and give your team a timer. Their task is to identify every production batch that used that lot, every finished goods lot code produced from those batches, and every customer who received product from those lots. Record how long it takes and document every point where the team had to make an assumption or could not find a definitive link. Those gaps are your compliance risks.
Run a backward traceability drill on the same schedule. Pick a finished goods lot code from a recent shipment and trace it back to every ingredient lot it contained, including the supplier name, supplier lot code, and date received for each ingredient. Again, record the time and document every gap. If tracing a single finished goods lot back to its ingredient sources takes more than 30 minutes, your backward traceability chain has structural problems that need to be addressed.
After each drill, document the results formally. Note the time to completion, the gaps identified, and the corrective actions taken. This documentation serves two purposes. First, it gives you a record of continuous improvement that demonstrates good faith compliance effort to FDA. Second, it forces accountability for fixing the gaps rather than just noting them.
Pay particular attention to the three critical links described earlier in this article. After each drill, specifically verify whether the receiving-to-production link, the production-to-packaging link, and the packaging-to-shipment link were all captured explicitly in your records or whether the team had to infer them. Inferences are not compliant records. If your team is making inferences to complete a traceability chain, that is a documentation gap that needs to be closed before FDA asks the same questions for real.
For guidance on evaluating software options that can automate lot tracking and make these drills faster and more reliable, see our comparison of the best food traceability software for FSMA 204 compliance.
A traceability system that has never been tested is not a traceability system. It is a set of records that might support traceability under ideal conditions. Run mock recall drills in both directions at least twice a year, time them, document the gaps, and fix what you find. The drill is the only honest assessment of whether your system will hold up when FDA calls.
Frequently Asked Questions
What is the difference between forward and backward traceability?
Backward traceability means you can start with a finished product or ingredient lot and trace it back to its origin: which supplier, which farm, which harvest. Forward traceability means you can start with a raw material lot and trace it forward through production and shipping to identify every finished product it touched and every customer who received it. You need both directions to respond to an FDA investigation or execute a targeted recall.
Does FSMA 204 require both forward and backward traceability?
Yes. FSMA 204 requires covered entities to maintain records that support traceability in both directions. The regulation requires you to capture Key Data Elements at each Critical Tracking Event, and those records must allow FDA to trace a food both back to its source and forward to its recipients within 24 hours of a request.
What is the 24-hour traceability requirement under FSMA 204?
Under FSMA 204, when FDA requests traceability records during an investigation, covered entities must be able to provide the relevant records within 24 hours. This means your lot-level data must be organized and searchable, not buried in binders or scattered across multiple spreadsheets. The 24-hour window applies to the records themselves, not just an acknowledgment that you received the request.
What are the Critical Tracking Events under FSMA 204?
The Critical Tracking Events defined under FSMA 204 are: growing, receiving, transforming, creating, and shipping. At each of these events, covered entities must capture specific Key Data Elements including lot codes, quantities, dates, locations, and the identity of the immediate previous and next trading partners. The exact KDEs required vary by event type and whether the food is being received, transformed, or shipped.
How do I test whether my traceability system actually works?
Run a mock recall drill at least twice a year. Pick a specific ingredient lot code that was received in the last 90 days and time how long it takes your team to identify every finished product batch that used it and every customer who received those batches. Then run it in reverse: pick a finished product lot and trace it back to every ingredient lot it contained. If either exercise takes more than two hours, your system has gaps that need to be closed before an FDA investigator calls.
Build Traceability That Holds Up When FDA Calls
Guidance connects your receiving, production, and shipping records by lot code so you can answer a traceability request in minutes, not days.
See Guidance in Action