Product Recall: A Clear ISO 22000 Guide to Clause 8.9.5

A product recall procedure is the part of a food safety management system that gets written once and tested never. ISO 22000 does not allow that: clause 8.9.5 requires the ability to withdraw or recall unsafe product, the arrangements to do it, and — the part organizations skip — verification that the arrangements work.

This guide covers the difference between withdrawal and recall, what the procedure has to contain, how to run the mock exercise auditors ask about, and the traceability limits that decide how much product you lose.

Withdrawal and product recall are not the same

A withdrawal and a product recall start the same way and diverge on one question: has any of it reached a consumer. Write both paths into one procedure, because the team will not have time to work out which they are running.

What the product recall procedure has to contain

1. Triggers and the decision authority. What conditions oblige a decision, who may call it, and who deputises at 2am. Name roles, not individuals, and keep a contact list that is verified quarterly.
2. Notification list. Competent authority, customers, distributors and — for a recall — consumers. Include the regulator’s out-of-hours route, and the legal timescale that applies to you.
3. Identification of affected product. Batch or lot definition, date coding, and how you convert a suspect production window into a list of despatches.
4. Control of recovered stock. Where it goes, how it is segregated and marked, who authorises disposal or reprocessing, and the records that prove it did not re-enter the chain.
5. Cause investigation and corrective action. The recall closes when the cause is understood and the control that failed is fixed, not when the stock is back.
6. Verification of the arrangements. The clause requires them to be tested and reviewed. In practice, that is the mock exercise.

The mock product recall auditors actually ask about

Pick a real batch, from a real day, and trace it in both directions under time pressure. Forward, to every customer and quantity despatched. Backward, to every raw material lot, supplier and process record. Record how long it took, what percentage of the product you accounted for, and what stopped you accounting for the rest.

Two rules make it worth doing. Do not warn the team, and do not stop at the first gap — a test that ends when you find the problem tells you nothing about how many more there are. Then treat the shortfall as a nonconformity, with an owner and a date, exactly like any other finding.

Traceability decides how much you lose

Every product recall is bounded by how precisely you can define the affected product. If a rework stream mixes batches without recording it, or a bulk tank blends lots without a changeover record, the affected batch becomes “everything made that week” — and you recall product that was never at risk.

The lever is lot definition. Tighter lots cost more in changeover and coding and cost dramatically less in a recall. That trade-off is a business decision, and it should be made in advance rather than discovered during one. Our guide to the HACCP plan covers the control side of this, and OPRP versus CCP covers where the loss of control is likeliest to happen.

Where recall procedures fail on the day

Contact details from the last audit. Distributor contacts turn over constantly, and a list verified annually is out of date within months.

No product held back. If retained samples are not systematically kept, you cannot test the hypothesis and cannot narrow the scope.

The decision waits for certainty. Recall decisions are made on incomplete information by design. A procedure that requires laboratory confirmation before acting guarantees delay.

Nobody owns the customer message. Technical teams handle the product and the communication drifts, which is how a controlled recall becomes a news story.

Frequently asked questions

What does ISO 22000 clause 8.9.5 require?
The ability to withdraw or recall unsafe product in a timely manner, defined arrangements including who may act and who is notified, control of recovered product, and verification through testing of the arrangements.

How often should we run a mock recall?
At least annually, and more often where product, customers or systems change. Certification schemes commonly expect a documented exercise within the last twelve months.

What is an acceptable traceability result?
Many schemes work to accounting for the affected product within four hours at a high percentage. Set your own target, measure against it, and improve it rather than adopting a number you cannot meet.

Do we have to notify the authority?
Where the product is unsafe and has left your control, yes — food law in most jurisdictions requires prompt notification. That obligation sits outside ISO 22000 and overrides your commercial judgement.

Who should lead a product recall?
A named senior role with authority to stop despatch and commit money, supported by technical, quality, logistics and communications. It is not a job for the food safety team alone.

Where this leaves you

Write one procedure covering both withdrawal and product recall, with named roles, a verified contact list and a decision rule that does not wait for laboratory confirmation. Test it unannounced at least once a year, measure how much product you could account for and how quickly, and treat the gap as a nonconformity. Then look hard at lot definition — the size of your batch is the size of your recall.

References

• ISO 22000:2018 — food safety management systems, including clause 8.9.5.
• Codex Alimentarius codes of practice — general principles of food hygiene and traceability guidance.

More on food safety

• The product recall procedure — you are here
• How ISO 22000 works
• OPRP vs CCP
• Food fraud and food defense

Recall procedures, mock exercise records and traceability forms are in the ISO 22000 Toolkit, or start with the free ISO templates.