How to run a mock recall in your packhouse (and pass it)

Why the drill exists, and what an audit expects to see

A mock recall exists because a real recall is the worst possible moment to discover your records do not connect. By the time a buyer or a regulator asks where a contaminated lot went, you need an answer in hours, not days, and it needs to be complete: every customer, every quantity, no guessing. The drill finds the gaps while the cost of finding them is an afternoon of staff time, not a product withdrawal or a regulatory finding.

An auditor reviewing your traceability program is not looking for a perfect system, they are looking for evidence that you test it: a written record of at least one drill in the last year, a defined scenario, a measured time-to-complete, a reconciliation that either passed or shows what you did when it did not, and a corrective action log if gaps were found. A packhouse that can produce that file moves through the traceability section of an audit in minutes. A packhouse that says it does mock recalls but cannot produce one gets treated as if it does not do them at all, because an undocumented drill and no drill look identical from the auditor's chair.

Choosing the scenario and the lot to trace

Pick a lot dispatched two to four weeks ago, not last week. Recent lots are still fresh in people's memory, and staff will reconstruct the trace from what they recall rather than what the records say, which defeats the point. Two to four weeks is close enough that the paperwork should still be easy to find, and far enough that memory will not do the work your system should be doing.

Pick a lot with some complexity to it, not the cleanest one in the building. A single-grower, single-customer lot that moved on one pallet tests almost nothing. A better choice is a lot that drew from more than one input lot or grower, that was split across multiple pallets, and that shipped to more than one customer. That is the shape of a lot that would actually generate a difficult recall, and it is the shape that exposes whether your system tracks splits and merges or only tracks the simple case.

Write the scenario down before the clock starts: the product, the lot code, and the pretend trigger, for example a foreign-object complaint from a customer or a positive pathogen result on a routine swab. The scenario matters because it sets who gets pulled in and how the trace should read once it is done; a foreign-object complaint from one customer reads differently to an auditor than a pathogen result that could implicate every customer who received the lot.

The clock, and what a realistic target looks like

Start a timer the moment the exercise begins, and do not stop it until the trace is complete and the reconciliation is done. Time-to-complete is the headline number in the file you keep, and it is the number an auditor will ask for first.

Two hours is the commonly cited outer limit for a full one-back, one-forward trace, and it is a reasonable ceiling if your records are still largely paper or spread across separate systems that do not talk to each other. But treat two hours as the fallback, not the target: several major buyer programs now expect well under that, and some ask for evidence you can produce a full trace in under an hour. If your last drill took ninety minutes and involved three people pulling folders from two different rooms, that is useful information, not a pass. It tells you where the next investment in your system should go.

A packhouse running receival, pack run, pallet, and dispatch records through one connected system should be able to pull a full trace in minutes, because the links already exist and do not need reconstructing by hand. The gap between a two-hour drill and a ten-minute one is almost never staff effort; it is whether the chain is captured automatically as product moves, or rebuilt after the fact.

The trace: backward first, then forward

Run the backward trace first. From the lot code, identify every input lot that fed it, the growers or blocks each input lot came from, and the receival date and quantity for each. If the finished lot was a blend of two or three input lots, as many packed lots are, the backward trace has to hold all of them, not just the largest one. This is the step that answers where the problem could have come from.

Run the forward trace second. From the same lot code, identify every pallet the lot went onto, every dispatch each of those pallets left on, and every customer that received product from it, with the quantity each customer received. This is the step that answers who needs to be told. A forward trace that stops at 'shipped to distributor X' without the quantity, or without which of that distributor's onward customers received it if you have that visibility, is not complete enough to act on in a real event.

Keep the two directions separate in your documentation: an auditor wants clearly what came in and what went out as two distinct answers, not one narrative that blurs them together.

Reconciliation and the pass threshold

Reconciliation is the step that fails most drills the first time a packhouse runs one, and it is the step an auditor will scrutinise hardest, because it is the arithmetic check that proves the trace is complete rather than merely plausible. The rule: quantity received should equal quantity packed, plus waste and downgrades, plus stock still on hand, plus quantity shipped. Add those four buckets up and they should land back at the quantity that came in the door.

A worked example: 4,000 kilograms received against that lot code. Say 3,400 kilograms went out the door across all customers, 250 kilograms is recorded as waste and downgrade, and 300 kilograms is still sitting in the cold room as stock on hand. That totals 3,950 kilograms against 4,000 received, a 50 kilogram gap, about 1.25 percent. Most buyer programs treat a small tolerance like that as acceptable, reflecting ordinary handling loss and rounding in weighing. A 50 kilogram gap against 4,000 received is very different from a 400 kilogram gap: the first is explainable shrinkage, the second is product nobody can locate, and in a real recall an unexplained gap of that size gets treated as product you must assume is affected and account for regardless.

The pass threshold most buyer audits apply has three parts, not any one alone: the trace completed inside your target time, reconciliation within a small, defined tolerance, and contact details for every named customer ready to hand. Miss any one and the drill fails, even if the other two look clean.

Who to involve, and documenting the run

Run the drill with the people who would actually be pulled into a real recall, not just quality assurance working alone at a desk. That typically means someone from receival who can speak to input lot records, someone from packing or production who can speak to how lots get blended and split, and whoever owns dispatch and customer records. If your business has a nominated recall coordinator or a documented recall plan, that person should run the drill, because the drill is also the test of whether they know the plan.

Tell the team it is a drill before it starts, name the scenario, and set the expectation that gaps found are the point, not a mark against anyone. A team that hides a weak spot to look good in the drill will hide it in a real recall too.

Document the run as you go, not from memory afterward: the scenario and lot code, the start and finish time, the backward and forward trace results, the reconciliation calculation with actual numbers, any gaps or delays and what caused them, and the corrective actions assigned with an owner and a date. A one-page summary with those elements, kept with your other quality records, satisfies most audit programs outright; a verbal account of how the drill went generally does not.

Common failures, what they cost you, and the follow-up

Missing shipment records is the most common failure and the most expensive one: a dispatch that happened but was never logged against the lot code, usually because a pallet moved on a rush order outside the normal process. In a real recall this means a customer who received affected product does not get contacted, and you find out only when they call you, or a regulator does.

Unlabelled rework is the second. Product that gets repacked, regraded, or blended with another lot needs a new lot record linking back to everything that went into it. When rework happens off the books, a contaminated component can disappear into a lot that looks clean on paper, and the forward trace from the original lot code simply stops short of the real scope.

Mixed lots is the third, and it inflates the scope of a real recall the most. It happens when product from two lots ends up on the same pallet without a record showing the split, usually at a receival or packing bottleneck where speed wins over paperwork. Trace to a mixed pallet with no split record and the only safe assumption is that the whole pallet is affected, turning a contained recall into a far larger and costlier one.

A drill with no gaps at all is worth treating with some suspicion; it usually means the lot chosen was too simple. Close each real gap with a corrective action that has an owner and a deadline, fix the process that produced it, and schedule the next drill on an unannounced lot rather than waiting for the audit calendar to force it.