Not an explainer of the rule. This is the audit-day readiness kit: what you need in hand before an FDA request lands, told for the person who owns the P&L and the recall risk, not the person who files the paperwork.
Read this first · Who this is for
This kit assumes you already know what FSMA 204 is and are past deciding whether it applies to you. If you want the plain-language explainer, read the FSMA 204 traceability guide first. This page is the operator's readiness kit: the checks, the drill, and the document list that decide whether your plant can actually answer FDA on the clock, or whether the answer comes out as a week of phone calls and binders.
There are no invented numbers on this page. The only figures here come straight from the federal rule, with a link to the text. Everything operational is something your own team runs or has ready, because an industry average would not tell you whether your plant is prepared.
Why an owner reads this, not just quality
An FDA traceability request is not a compliance line item. It is a clock that starts without warning, usually in the worst week, when a product you shipped is tied to an illness or a recall somewhere downstream. From that moment the question is simple and it is yours: can this plant produce the records, in the form the rule requires, before the window closes. If the answer is no, the exposure is not a fine. It is a broader recall than the incident deserved, because you could not narrow it to the lots actually involved, and it is the retail and brand cost that follows a slow, imprecise trace.
That is a P&L question, which is why it does not belong only to quality. The plants that clear an audit cleanly are not the ones with the thickest binder. They are the ones whose records already live where software can read them, so a trace is a query rather than a scavenger hunt. The gap between those two states is the whole subject of this kit.
The exposure
A slow trace widens the recall
When you cannot pinpoint the lots involved fast, the safe move is to pull more than you shipped in that window. The cost of an imprecise trace is measured in product you did not have to destroy and customers you did not have to notify.
The competitive read
Retail buyers ask before they sign
Traceability posture increasingly shows up in supplier qualification. Being able to demonstrate a fast, sortable trace is a commercial asset with your buyers, not only a defense against FDA.
The spend question
Readiness is a data problem first
The fix is rarely a new tracing app bolted onto paper records. It is getting the records off paper and into a connected layer. That is the same foundation everything else you buy, AI included, has to stand on.
The two facts that set the clock
Everything in the readiness kit is built to satisfy two requirements in the federal rule. These are public, they are not our interpretation, and they are the entire reason a paper-first plant is exposed. State them to your team exactly as written.
Fact 01 · The 24-hour window
Under the FDA Food Traceability Rule, which implements section 204 of the Food Safety Modernization Act, a covered firm must make the required traceability records available to an authorized FDA representative within 24 hours of a request, or within some reasonable time to which FDA agrees. Twenty-four hours is the working assumption you prepare against.
Fact 02 · The electronic sortable spreadsheet
During an outbreak, a recall, or other threat to public health, when FDA asks, the firm must provide the required information in an electronic sortable spreadsheet containing the relevant records, within 24 hours or a time FDA agrees to. A stack of scanned PDFs or a binder is not a sortable spreadsheet. This is the requirement a paper plant cannot meet by working faster.
Source: 21 CFR 1.1455, paragraphs (c)(1) and (c)(3)(ii), FDA Food Traceability Rule. Read the exact text before you brief your team.
What the full kit gives you
The two facts above are the free part, because they are public and every operator should have them verbatim. The operational kit, the part that turns the rule into audit-day readiness, opens with your work email. Here is what unlocks:
Part 01
The pre-audit checklist
The concrete yes-or-no checks that tell you, before FDA calls, whether your plant can actually produce a sortable trace on the clock.
Opens with work email
Part 02
The 24-hour trace drill
A step-by-step rehearsal you run on a real lot, on the clock, so the first honest attempt happens on your terms and not FDA's.
Opens with work email
Part 03
The document list
The records a plant needs staged and reachable, mapped to where FSMA 204 expects them, so nothing is a surprise on request day.
Opens with work email
The full kit
Open the pre-audit checklist, the trace drill, and the document list.
You have the two facts that set the clock. Enter your work email and the operational kit opens right here on this page, with a copy sent to your inbox to run with your team.
The pre-audit checklist, plain yes-or-no, that says whether you are ready
The 24-hour trace drill you rehearse on a real lot before FDA does
The document list a plant needs staged and reachable on request day
Work email only. We use it to send the kit and nothing else you did not ask for. Unsubscribe anytime.
Unlocked. The full kit is open below, and a copy is on its way to your inbox. If you checked the box, a Harmony engineer will reach out to run the trace drill with your team.
You have checked 0 of 0 items.
Part 01 · Pre-audit checklist
Can you produce a sortable trace on the clock
Work through it with your quality lead and your plant manager in the room. Check every one that is true on a normal week, not a rehearsed one. Every box left unchecked is a place the 24-hour clock beats you.
You could produce the required traceability records within 24 hours of an FDA request, without pulling anyone off the line for a day.
Those records can be exported as one electronic sortable spreadsheet, not a folder of scans.
Lot and traceability lot codes are captured at each critical tracking event, not reconstructed after the fact.
You can tie an inbound ingredient lot to the finished lots it went into, and to where those finished lots shipped.
The key data elements for each event live in a system, not only on a batch sheet or a traveler.
One named owner and one backup know how to run the export, and both are reachable on a bad day.
You have run this end to end in the last twelve months and timed it.
What these mean
Each unchecked box is a manual step you would be improvising while the clock runs. The rule does not grade effort. It grades whether the records show up, in a sortable form, inside the window. If the trace depends on one person's spreadsheet or a binder in a back office, you do not have a compliant process. You have a process that has not been tested yet.
Requirements from 21 CFR 1.1455 (c)(1) and (c)(3)(ii).
Part 02 · The 24-hour trace drill
Rehearse it before FDA runs it for you
Pick one real finished lot from a normal week. Do not warn the floor and do not stage it. Start a timer and walk it exactly as you would under an actual request. The first honest attempt is your true readiness number.
Start the clock. Name a real finished lot and note the exact time you begin. This is the number that matters, not how long it takes once you are warmed up.
Assign one person to run it and one to observe and time. No help from IT unless that help would also exist on a real request day.
Trace back to inbound. From the finished lot, identify every ingredient and material lot that went into it, and the supplier and receipt for each.
Note every place you had to leave a system: a phone call, a binder, a text to a supervisor. Each one is a failure point under time pressure.
Trace forward to shipped. From the same finished lot, identify every customer and shipment it went out on, down to the ship date and quantity.
If forward and backward trace live in different systems that do not join automatically, write down who stitches them and how long it took.
Assemble the sortable file. Put the key data elements for each critical tracking event into a single spreadsheet you could hand over, columns FDA could sort and filter.
A pile of PDFs does not pass here. If you cannot get to one sortable sheet, note where the data resisted export.
Stop the clock and debrief. Record the elapsed time against 24 hours, then list every manual step and hand-off the drill exposed.
The list of manual steps is your remediation backlog, ranked by how much of the clock each one ate. That backlog is Phase 1 work.
Why the drill is the real test
A trace has to cross receiving, production, quality, and shipping in one pass, so anything disconnected surfaces immediately as a phone call or a binder. You want that discovery to happen during a drill you control, not during an FDA request you do not. The elapsed time and the list of manual steps tell you, in your own numbers, exactly how far you are from a query-speed trace.
Part 03 · The document list
What a plant needs staged and reachable
These are the records that carry a trace. The test is not whether they exist somewhere. It is whether you can reach each one and pull it into the sortable file inside the window. Check the ones you could produce today, on demand.
Your traceability plan: the written description of how you assign and maintain traceability lot codes and who is responsible.
Receiving records tying each inbound lot to its supplier, with the key data elements captured at receipt.
Transformation records linking ingredient lots to the finished traceability lots they became.
Shipping records tying each finished lot to its customer, ship date, and quantity.
A current list of the foods you handle that fall on the Food Traceability List, so scope is not argued on request day.
The export routine that turns all of the above into one sortable spreadsheet, documented so a backup can run it.
What these mean
The document list is where paper plants quietly fail, because the records genuinely exist, just not anywhere a system can assemble them fast. A record you can find in a week is not a record you can produce in 24 hours. The goal is not a thicker binder. It is every one of these living in a connected layer so the sortable file is an export, not a project. Confirm the exact record set for your operation against 21 CFR 1.1455 and the related recordkeeping sections of the rule.
Where readiness actually comes from: Phase 1
Notice what the checklist, the drill, and the document list all keep pointing at. None of them is solved by a tracing app. Every one of them is solved by getting records off paper and into one connected layer that software can read. That is not a FSMA project. It is the same first step every serious operation takes before it automates or buys AI, and it is the reason readiness and modernization are the same spend, not two.
Phase 1
Lay the Data Foundation · Digitization
Every pen-and-paper record digitized at the station, every software system connected, and all of the data unified into one live layer. A 24-hour sortable trace is a byproduct of this, not a separate build.
Phase 2
Production & Operations Scale
Factory operations turn proactive: live sensors and machine data, the AI scheduling board, predictive maintenance before failure.
Phase 3
AI-Native Operations
Agents across the floor and the back office act on the live layer: quality signals, reports, copilots. Humans approve.
The Harmony pilot starts exactly here: a fixed engagement, $15,000 to $20,000 one time, 4 to 6 weeks, with working software by the end of the pilot, forward-deployed engineers doing the digitizing on your floor. Audit readiness is one of the first things that falls out of it, because the sortable trace the rule wants is just a query against the layer we build. Want the rule itself explained plainly first? Read the FSMA 204 traceability guide. Want to know whether the rest of your floor is ready for AI at all? Run the AI Readiness Assessment.
Rather have engineers run the drill on your floor?
The 24-hour trace drill is one of the first things a Harmony pilot does on-site, with forward-deployed engineers timing it alongside your team and then closing the gaps it exposes. Phase 1 first, because that is the order it has to happen in. See what the live layer looks like.
