Implicated In a Recall. What Do You Do?

Food recalls are continually in the news, particularly those for unlabeled allergens, which means that FDA/USDA traceback and inspection are continually on the hunt to link illness with foods. But just how does it all begin? What will be your first alert if your product is in the line of traceability of an implicated product?

There are four primary ways that a food business will know there is a problem:

1. Your testing results in a positive for a path-ogen or allergen in your product;
2. You get a call from your supplier to tell you they have shipped something to you that has a problem and needs to be recalled;
3. You get a consumer or downstream customer complaint, a call that there has been an illness or allergic reaction after your product was consumed; or,
4. You get an unannounced visit or a call from a regulator.
    

Any of the first three could be a sporadic event, but if you are getting a visit or call from the FDA, your facility is likely going to be inspected as part of a “for cause” response. An outbreak is defined as two or more people being negatively affected (illness, allergic reaction, etc.) from the same organism or exposure (e.g., food, beverage, restaurant dining).
 

Outbreak Response.

So what do you do? If the issue was discovered through your own testing (#1), you should immediately begin an investigation to determine what caused the problem, where any potentially contaminated product is now, and what should be done about it (e.g., file an RFR report, recall, stop distribution, stop production, etc.). Then find and correct the root cause. An unexpected “positive” test result should trigger a line of action, even if you don’t yet know if anyone has been affected.

If you get a call from your supplier, first determine the level of risk to you and your customers and what you have done with the ingredient/product that was shipped to you. This investigation will trigger next steps which, like #1, may be a variety of things, including filing an RFR report, recalling product, stopping distribution, stopping production, etc. Then work with your supplier to determine what went wrong and if you should continue to source from that supplier.

If consumer complaint(s) are received (#3), you also will need to conduct an investigation; determine if it is a single incident (or even truly from your product); or, if more than one complaint has been received, determine the extent of the problem and likely recall food. You also will need to find and correct the root cause, as in #1.

If a regulatory inspector shows up at your door, it gets a bit more complicated. If you are reading this and don’t have a clear policy of what to do when a regulator shows up then I strongly recommend you write one. The first thing you need to do is determine the strength of evidence against you: What evidence does FDA have that implicates your product? Ask questions that enable you to explore the epidemiology with them: How many people were affected (2? 10? more?). What can they share about what they’ve learned about exposure, traceback, testing? You need to find out more about the case and determine if it is simply speculation at this point or if there is a solid case against you. You may find that the regulators are not willing to share a whole lot on the first conversation, but learn what you can, and, if the inspector is not willing to pass on much information, ask whom you can speak with that can tell you more.

It can also be a tricky situation because you need to find a balance between cooperation and responsiveness. That is, don’t just roll over and play dead—saying “Okay. You found it, we’ll recall everything.” But if you respond with “I’m not saying anything until I call my lawyer,” you will create an adversarial situation which is likely to make it more difficult for you.

Best case is that you receive a call rather than having a regulatory official show up at the door. At that point, you can say, “We’d like to learn more, but I’d like to have my boss, the food safety manager, etc., participate, so can we set up a call in two hours?” The official will generally agree. With this scenario you can then include your crisis consultant and/or legal advisor on the call as a silent, unannounced participant. This way he or she will hear it all first hand, but the regulator won’t feel that you are throwing up a defense.

While getting a call is certainly preferred to opening the door to a regulator showing you his ID, you need to be prepared for either scenario. Every food company, anywhere in the supply chain, should have a written policy on what to do if your product is implicated in an outbreak. At its most basic, the policy should include a call to a specific person who then cascades calls to all those who need to know. The written policy should include information on who is to engage with the regulator and how that is to be done; and company executives should always be notified immediately. But, above all, staying cooperative, answering questions, and working with the regulator will provide the best overall outcome for all involved.
 

Records Access.

There are a lot of requests that FDA can make for records, particularly with the increased access provided by FSMA. Probably the most notable aspect of the rule is that access to records has been reduced from credible evidence to reasonable probability of a serious adverse health consequences or death (SAHCD), giving FDA easier access to records with a lower bar for requesting them. FSMA also allows FDA to request records beyond those directly related to the implicated food (as was the limit in the past). Today, FDA is authorized to look at the records of other articles of foods that may have been impacted.

Although I have been phrasing these sentences with the words “request access,” denying the “request” could result in stiff penalties including facility registration suspension, administrative detention of the food, mandatory recall, or even civil or criminal action.

That said, you should know the limits of FDA authority (e.g., they cannot access product recipes/formulas and financial records), and ask that the regulator explain the situation so that you understand why your food is believed to be linked to the outbreak—and push back if needed. But to intelligently understand or push back, you also should understand the principles of regulatory outbreak attribution: When a person gets sick from a reportable food, the health official will ask where and what they ate. For Salmonella and E. coli, the query would extend to a week prior; for Listeria and hepatitis A, it would need to go back a month. Of course, the further back such questioning goes, the fuzzier will be the data.

If a specific restaurant or event is suspected, all those in attendance may be questioned, or asked to complete a form on every food/drink consumed, whether they got sick or not. From the responses, the regulators will develop a general hypothesis of likely food or place. When more than one item is suspect, they will look at the typical consumption of those who were ill to find the uncommonality. A very sophisticated epidemiological investigation may involve a case control study, but this is costly and time consuming so would likely be a last effort.

Additionally, regulators showing up at your door are unlikely to have this depth of information. In fact, if you ask them if your product was tested as positive for the adulterant, you may get the response, “Yes, it was tested, but no it wasn’t positive.” That would mean the regulators are most likely linking your food to illness through a consumer complaint they received or an epidemiological investigation. Unfortunately, that doesn’t mean you’re off the hook, as pathogens are not homogeneous throughout a food.

On the other hand if the answer is “Yes, it was tested; and yes, it was positive,” no further epidemiology is needed. Your product is implicated. You could question the validity of their testing and ask for the testing records, and FDA will typically give you those. But it is not likely to make a lot of difference in the long term. So, do ask to see the lab protocols and results, but don’t try to fight and say their procedures are flawed. It’s very, very difficult to prove.

Assuming the regulator’s test is positive or the explanation seems logical and statistically sound, your response should be to immediately go into response/correction mode—doing whatever is needed to protect the public and your brand.

Being involved in an outbreak in any way is not a pleasant experience for anyone. But to do your best to protect the consumer and your brand, you have to be fast; and the way to be fast is to have a plan.