Managetraceability requirements

A food-safety plan is not a binder

What a digital safety plan changes

• Records are timestamped and signed — a temperature logged on a phone carries the real time and the identity of whoever took it. A sheet filled in from memory at the end of the week proves nothing, and an inspector knows it.
• Tasks remind themselves — cleaning, goods-in checks, frying oil readings. A scheduled task left undone leaves a trace, which is worth more than a box ticked after the fact.
• Non-conformities become usable — an out-of-range temperature triggers a recorded corrective action. That is exactly what a control looks for: not the absence of incidents, but proof that an incident was detected and handled.
• Evidence is found in seconds — a search by date, batch or product replaces digging through the binder.

In many businesses the safety plan exists as a binder: procedures written once, temperature logs on loose sheets, and a pile of delivery notes kept just in case. That setup roughly satisfies an inspection as long as nobody asks anything precise, and collapses the moment a chain has to be walked back.

The question an inspection really asks is not "do you have procedures" but "can you prove what you did, that day, on that batch". That is a traceability question, not a documentation one, and it is answered with dated, linked records rather than a binder.

Upstream and downstream traceability: the full chain

The three links not to break

What a product recall actually demands

• Goods-in — the supplier batch, its use-by date and its temperature on arrival are captured while unloading, in the receiving check. What is not captured there never will be.
• Storage — every batch lives in stock with its expiry. That is what allows rotation by age rather than by whatever is nearest the door.
• Production — the batch produced inherits the batches consumed. A stock used in six dishes propagates its traceability to all six.

Useful traceability connects both ends. Upstream, knowing which supplier batch each raw material came from; downstream, knowing which dishes and which customers that batch went to. In between, production makes the link, provided batches are attached to it.

That chaining is what turns a product recall into a targeted operation. Without it, one suspect batch forces you to withdraw everything that might have contained it — a cost with no relation to the withdrawal actually required.

A supplier recall rarely arrives at a convenient moment, and it is judged on one thing: how long it takes to answer "where did that batch go?". With a complete chain the answer is one search away: the receipts concerned, the productions that consumed them, the dishes sold or delivered, and the destination sites.

Without that chain, the only defensible answer is a broad withdrawal — everything that might have contained the batch, across the whole period it might have been used. The difference between the two is measured in food binned and days of trading disrupted, for an identical safety risk.

Allergens and consumer information

The most common traps

The records that matter, at a frequency that holds

• Chamber temperatures — twice daily at minimum, recording the deviation and the corrective action when a threshold is crossed. The most scrutinised control in an inspection, because its failure has the most direct consequences.
• Temperatures at goods-in — while unloading, product by product on sensitive goods. Refusing a delivery is justified with that record, and only with it.
• Frying oil — polar compounds or visual check depending on the setup, with the change date. An unmonitored fryer always ends up changed either too late or too early.
• The cleaning schedule — by zone and frequency, with who did it. The easiest record to fill in from memory, therefore the one whose timestamp is worth the most.
• The allergen hidden in a preparation — mustard in a vinaigrette, gluten in a stock. Without nested recipes it appears nowhere.
• A supplier change not carried through — same product, different composition. The most frequent cause of a declaration that has quietly become wrong.
• Manual labelling — a re-typed label is a label that drifts. Generated from the recipe and the production batch, it stays correct.

Allergen declaration is the most visible obligation and the one most often handled backwards: filled in dish by dish, by hand, in a document separate from the recipe reference. It then diverges at the first ingredient substitution, and nobody notices.

Derived from recipes, it follows composition changes automatically, including through intermediate preparations. A supplier changing the recipe of their sauce updates the dishes using it with no intervention.

Not all obligations carry the same real risk. A chiller drifting for a few hours puts food at stake; a cleaning schedule slipping by a day, far less. Ranking records by risk is what lets a system survive rather than be abandoned after three weeks.

These records feed the same history as batches and productions. Facing a non-conformity on a dish, that is what lets you check the state of the chambers and the controls on that day in a single search.

Frequently asked questions about hygiene and traceability

Can records support an external audit?

Where do we start when everything is on paper?

Does this replace the food-safety plan?

What does an inspection look like with digital records?

Are connected probes required?

What about contract catering?

Who actually enters the records?

What happens on a non-conformity?

How long must records be kept?

Production teams, on a phone, as the operation happens. It is the only arrangement that produces reliable data: a record centralised on an office workstation is a reconstructed record, and it shows.

It is recorded with its corrective action — product set aside, chamber brought back to temperature, batch blocked. An inspection does not fault the incident, it faults the absence of detection and handling.

The retention period depends on the type of food and the applicable regulation, which is exactly what makes the paper binder fragile: digital retention removes the archiving volume question and makes the requested period directly exportable.

Yes: the full history is exportable over the audited period, records and corrective actions included. It is the format certification bodies expect, as do groups auditing their franchisees.

With chamber temperatures and goods-in checks. They carry the most risk, are the most scrutinised in an inspection, and are the simplest to move onto a phone because they slot into gestures that already happen daily. The cleaning schedule and batch traceability follow naturally once the team has got used to recording on the floor rather than filling in a sheet at the end of the week.

No: the plan remains the business's own reference document, with its hazard analysis and critical control points. What changes is execution — records, tasks and evidence stop being paper.

Records are exportable over the period requested. The difficulty of an inspection is never producing a document, it is producing the right document for the right date — which a search settles in seconds.

Not a prerequisite. Timestamped manual capture on a phone covers most of the obligation; probes automate chamber readings and remove the forgotten weekend, which makes them worthwhile at higher volumes.

Requirements are heavier — retained samples, allocation, vulnerable diners — and downstream traceability becomes central: knowing which batch went to which site. See central kitchen management.