Traceability System: The Complete ISO 22000 Clause 8.3 Guide

A traceability system under ISO 22000:2018 clause 8.3 has one job the standard states precisely: to be able to uniquely identify incoming material from the immediate suppliers and the first stage of the distribution route of the end product. Everything else in the clause serves that — considering the relationship of lots of received materials, ingredients and intermediate products to end products, the reworking of materials and products, and the distribution route; retaining the records for a defined period that includes at least the shelf life of the product; and verifying and testing that the system works. The same “one step back, one step forward” principle is law in the EU under Article 18 of Regulation (EC) 178/2002, and the US FDA’s Food Traceability Rule under FSMA section 204 adds lot-level critical tracking events and key data elements for foods on its Food Traceability List, with a compliance date now set at 20 July 2028. This guide sets out what clause 8.3 requires, the four design decisions — lot definition, links, rework and records — the regulatory requirements the system must also satisfy, how to test it with a mass-balance exercise, and the errors that produce findings at certification audits.

What clause 8.3 requires

Clause 8.3 does not prescribe lot sizes, coding formats or software. It requires a system whose design decisions are documented and whose output — the link from any supplier lot to any customer and back — can be produced on demand. Our guide to ISO 22000 covers where 8.3 sits in the operational clause; the ISO 22000 mandatory documents guide lists the records it generates.

The four traceability system design decisions

The regulatory layer the traceability system must also satisfy

The ISO 22000 system is the mechanism; the regulations set what it must contain and how fast it must answer. A site subject to FSMA 204 should design its lot codes and CTE records into the clause 8.3 system now, because the 2028 date is a compliance date, not a start date.

Testing the traceability system

Clause 8.3 requires verification and testing; certification bodies and GFSI schemes expect a documented trace exercise at least annually, and most sites run one each way every six months. The exercise has a standard shape.

1. Pick a lot at random. Forward test: a received ingredient lot. Backward test: a dispatched end-product lot. Choose one with rework involved once a year.
2. Trace forward. From the ingredient lot to every intermediate and end-product lot it entered, to every customer that received them, with quantities.
3. Trace backward. From the end-product lot to every ingredient and packaging lot and supplier, including rework sources.
4. Do the mass balance. Quantity received = quantity used + quantity in stock + quantity in rework + quantity wasted, within a defined tolerance (2% is a common target; the site sets its own). An unexplained gap is a break in the chain.
5. Time it. Record how long the trace took; a target of a few hours is typical, and FSMA 204’s 24-hour spreadsheet requirement sets the outer bound for listed foods.
6. Record and correct. Findings — an untracked rework lot, a missing supplier lot on a receipt, a customer not recorded on a dispatch — become corrective actions; the record is the 8.3 verification evidence and the management review input.

Our guide to product recall under clause 8.9.5 covers the exercise the traceability test is rehearsal for; run the mock recall on the output of the trace.

Traceability system errors that produce audit findings

• Rework without a lot. Rework added from a bin with no record of which lots it contains breaks both directions of the trace.
• Bulk ingredients without lot boundaries. A silo topped up daily needs a defined rule — first-in, a maximum blend window — or every end product traces to every delivery.
• Packaging not traced. Product contact materials are in scope of 8.3; a printed film recall is a real scenario.
• Dispatch records without lot numbers. The first stage of distribution has to be tied to the lot, not just the product.
• Retention shorter than the shelf life. A twelve-month retention rule for an eighteen-month product fails the clause on its face.
• A test that was never timed or balanced. A trace that finds the records but does not reconcile quantities has not verified effectiveness.

Frequently asked questions

What does ISO 22000 require for a traceability system?
Clause 8.3: the ability to uniquely identify incoming material from immediate suppliers and the first stage of distribution of the end product, considering the relationship of received lots to end products, rework, and the distribution route; records retained for at least the product’s shelf life; and verification and testing of the system’s effectiveness.

How often should traceability be tested?
ISO 22000 requires testing without setting a frequency; certification bodies and GFSI schemes expect at least an annual documented exercise, and most sites test forward and backward every six months with a mass balance.

What is one step back, one step forward?
The principle in Article 18 of EU Regulation 178/2002 — and in Codex — that every food business must be able to identify who supplied it and whom it supplied. ISO 22000’s supplier-to-first-distribution requirement is the same scope.

How does FSMA 204 change traceability?
For foods on FDA’s Food Traceability List, the rule requires traceability lot codes, records of critical tracking events with key data elements, a traceability plan, and an electronic sortable spreadsheet within 24 hours of a request. The compliance date is 20 July 2028.

How long must traceability records be kept?
ISO 22000: a defined period that includes at least the shelf life of the product. Regulations and customers may require longer; FSMA 204 requires two years.

Where this leaves you

Design the traceability system around the four decisions — lot definition, links that survive every transformation, rework as a traced material, and records kept at least the shelf life — build the EU Article 18 and FSMA 204 data elements into it rather than alongside it, and test it both ways with a mass balance and a stopwatch, because clause 8.3 is verified by whether the trace works, not by whether the procedure exists.

References

• ISO 22000:2018 — Food safety management systems — Clause 8.3, traceability system.
• Regulation (EC) No 178/2002 — General Food Law, Article 18 — EUR-Lex — Traceability at all stages.
• FDA — FSMA Final Rule on Requirements for Additional Traceability Records for Certain Foods — The Food Traceability Rule and the 20 July 2028 compliance date.

More on ISO 22000

• The traceability system — you are here
• ISO 22000: how the food safety management standard works
• Product recall under clause 8.9.5
• ISO 22000 mandatory documents
• ISO 22000 implementation: the 10 steps
• ISO 22000 vs HACCP

The Procedure for Identification and Traceability, the handling, storage and distribution procedure, the non-conforming product procedure and the emergency preparedness and response procedure are in the ISO 22000 Toolkit, or start with the free templates.