Paprika recall: traceability and withdrawal decision
A spice blender produces paprika, cumin and chili blends for 14 food manufacturers. Lot codes are date-based (YYDDD) and printed on 25 kg bags; the same lot code can cover two production days if the silo is not emptied. The company received a supplier notice that a paprika lot (supplier lot P-2291) may contain ethylene oxide above the EU limit. The blender used P-2291 in three blends over two weeks. The traceability record shows 6,000 kg received, 5,700 kg issued to production, and 300 kg in stock; finished goods records are on paper in the production office. Two customers have already received product; one is a retailer that requires notification within 4 hours. A traceability test last year took 26 hours to reconcile 92% of lots. The QA manager wants to wait for the supplier’s confirmatory test before telling customers.
1. Evaluate the traceability system and decide whether the company can confidently identify all affected finished goods from supplier lot P-2291.
Read the worked answer
The mass balance closes on paper (5,700 kg issued plus 300 kg in stock equals 6,000 kg received), but that is not enough. Traceability must link incoming lots to batches and finished goods, and then to customers. Date-based lot codes that can cover two production days, paper records held in the production office, and a previous reconciliation of only 92% are all warning signs.
The company cannot confidently identify every affected finished good. It needs immediate reconciliation using production batch sheets, silo and line records, customer orders and distribution records. If the link cannot be established for part of the lot, the precautionary scope should be widened rather than narrowed.
The 26-hour retrieval time is also inadequate for a retailer requiring 4-hour notification. The company should treat this as a system weakness, not only as an incident. The 300 kg remaining in stock should be quarantined immediately.
2. The QA manager wants to wait for the supplier’s confirmatory test before notifying customers. Advise on the withdrawal/recall decision and communication.
Read the worked answer
Waiting for the confirmatory test is risky. If the supplier notice indicates a possible unsafe product and ethylene oxide is a significant hazard, the company should act on the precautionary information available. ISO 22000 requires withdrawal or recall of unsafe product and notification of interested parties; contractual notification deadlines also apply.
The decision is withdrawal versus recall. Withdrawal removes product from the market or customers; recall removes it from consumers as well. Two customers have received product, so withdrawal from those customers is the minimum. If product has reached consumers and cannot be stopped at customer level, recall is needed. The retailer’s 4-hour requirement means notification must start immediately while the investigation continues.
Communicate with the supplier, affected customers and the competent authority as required. The confirmatory test can refine the scope but should not delay precautionary action. The hazard analysis and supplier approval process should be updated because ethylene oxide is a supplier-introduced hazard.
3. Identify the corrective actions and system changes needed to prevent recurrence.
Read the worked answer
Corrective action must address the cause, not just retrain staff. The lot-coding design allows one code to cover two production days, so the company should assign a unique batch code per production run and link it to incoming lot, line, time and customer. Records should be centralised and retrievable within the required notification time, not held only on paper in the production office.
The supplier approval process should be strengthened for high-risk spices: specification, certificate of analysis, risk assessment for ethylene oxide, and verification testing or supplier audit. The mock traceability exercise should be repeated at least annually with a defined target, such as 4 hours and full reconciliation. The company should verify effectiveness by running another traceability test that includes a supplier recall scenario.
Management review should consider the incident, the failed traceability test and the resource needed for the system change. Root cause is the combination of lot-coding design, paper records and weak supplier verification, not individual carelessness.