What to hand your verifier after a simulated recall

The question of what a simulated recall is has already been answered, and answered better, by MPI. The question people actually get stuck on is the next one: when the exercise is over, what is in the folder?

If your verification visit is coming up and there is a half-filled recall form somewhere with last year’s date on it, this page is for you.

The obligation, and its date

Food businesses operating under a Food Control Plan, National Programme or Risk Management Programme are expected to run a recall exercise at least once every 12 months. That has been in force since 1 July 2023 — MPI’s announcement is here.

Two things follow from it being an annual obligation with a start date rather than good practice.

The first is that “we have never had to recall anything” is not an answer. The exercise is the evidence that you could. A business that has never recalled and can show it would manage one is in a better position than a business that has recalled and cannot show how it worked out the scope.

The second is that a verifier is entitled to ask when the last one was. If the answer is more than a year ago, that is a finding before anyone has looked at the quality of the exercise itself.

Why the blank form is the problem

The usual failure is not that a business skips the exercise. It is that the exercise is performed as paperwork.

Somebody downloads a recall form, writes the date, ticks that the procedure was followed, notes that it took two hours, and files it. Every box is filled. It demonstrates nothing at all, because at no point did anybody try to answer the only question that matters:

Product X is affected. Who has it, and how much?

An exercise that does not force you to actually resolve that — from a real code, through real records, to a real list of names — is a test of your photocopier.

Somebody who has read a hundred of these can tell the difference quickly, because a real exercise produces things a fabricated one does not: specific lot numbers, quantities that do not round, customers with names, and a conclusion that admits something went slightly wrong.

The exercise where nothing went wrong is the least convincing one.

What the exercise should leave behind

Four artefacts. If you have these, filled in with real values, the conversation goes well.

1. The scenario, written before you started

What you were pretending had happened, and where it came from. Origin matters more than people expect, because it changes the exercise. A supplier notification hands you their lot number and asks you to work forward. A customer complaint hands you a finished pack and asks you to work backward to the ingredient. A business that only ever drills one direction has only tested half its records.

Worth rotating the origin each year: a customer complaint, something found in-house, a supplier notification, a regulator enquiry, a routine drill.

2. The scope you resolved, with quantities

Not “12 cartons affected”. The chain: this supplier lot went into these batches, which filled these bins, which fed these pack runs, which went out on these dispatches, to these named customers, in these quantities — net of anything already returned.

This is the substance of the exercise. Everything else is administration.

3. The contact list, worked

Who you would contact, and — for a real recall — who was reached, when, by whom, by what method, and how much came back. In a simulation you are not ringing anybody, but the list must be real and reachable. A contact list with three “see file” entries in it is where a real recall stalls at 4pm on a Friday.

4. The conclusion

Time taken against the target you set. Passed or failed. And what you would change.

That last field is the one that persuades. A conclusion reading “went well, no issues” from a business with a paper receiving book is not credible. Compare: “Took 3h40 against a 4h target; most of it was finding which bin the second batch went into; we are now writing bin numbers on the batch sheet.” That is worth more than a pass.

About the four-hour target

Four hours gets quoted constantly as though it were the rule. It is not.

If you export, or you supply a customer who audits you against BRCGS, SQF or similar, then your scheme sets the target and you should use theirs. If you do not, you set your own — and then the exercise is judged against it.

Setting one is not really optional, though. A target you have written down is what turns the exercise into a test with a result. Without it every exercise passes, which is another way of saying none of them do.

Four hours is a defensible place to start; two is better if your records support it. A target you consistently miss is a finding waiting to happen — either fix the records or change the target and say why you changed it.

The distinction almost nobody explains

The scope of a recall is not one number. It splits by channel, and the split decides what kind of event you are having.

• Trade customers — distributors, retailers, manufacturers, food service. Businesses you can telephone. Six trade customers is a ring-around: uncomfortable, but containable, and it stays between businesses.
• Consumers — your own online shop, a farmers market, a retail counter. Product held by members of the public whose names you do not have. You cannot ring them. That is a public recall notice, and it is a different order of event: MPI involvement, media, and a decision that has to be made quickly and defended afterwards.

The same lot can be both. A batch that went to four wholesalers and also sold 60 packs through your website is a ring-around and a notice.

This is the single most useful thing an exercise can tell you, and it is the thing most exercises never surface, because the records lump every dispatch together. Know which situation you are in before you are in it — while there is time to think about it and nobody is waiting on an answer.

Where exercises actually come apart

Four failure modes, in rough order of how much they cost on the day.

You recorded your batch code but not the supplier’s lot number

When a supplier issues a withdrawal notice it names their lot. If your receiving records do not carry it, you cannot tell which of your batches are affected, and the honest answer becomes “all of them”. This is the most expensive record-keeping gap in food manufacturing and it costs nothing to close — you just have to write the number down at the door. There is a whole guide on this one, because it is the failure that costs the most.

Bulk bins double-count

A lot split across three batches, two of which went into the same bin, gets counted twice by a spreadsheet and once by reality. Exercises that resolve scope by hand almost always overstate.

The contact list is really a customer list

Names and companies, no phone numbers, no after-hours contact, no idea who at that business can actually stop stock going out. Fine at 10am. Useless at 6pm.

Returns were never netted off

Quantity dispatched is not quantity at risk. If some came back last month, the number you are chasing is smaller — and being wrong in that direction wastes the day.

How BatchIQ handles it

Every exercise starts from a scenario and an origin, and is anchored to an ingredient lot, a batch or a pack code. From that anchor it resolves the scope forward on its own — batches made from the lot, bins filled from those batches, pack runs drawn from either, dispatches, and the named customers holding stock, net of returns. Bins resolve once, so a lot split across batches is not counted twice.

A simulation is timed against the target you set and marked passed or failed, with the what-would-you-change note kept against it. An actual recall gets a contact list you work through and record against, including recovery quantities. The scope separates trade from consumer channels, so the ring-around question is answered before you have to decide.

A customer complaint can be turned directly into a recall, carrying its detail across — which is how most real ones start.

The handbook walks through a simulated recall step by step, and every screen in it is on the live demo.