One up, one back traceability means every business in a food chain can say who it got each food from (one step back) and who it sent it to (one step forward), with enough detail, ideally a lot code, to follow one particular lot. Nobody holds the whole chain; each link holds its own two ends, and a problem is traced from business to business. In the US it's a legal requirement for most food manufacturers, processors, packers and distributors under 21 CFR 1.337 and 1.345, and the part that's easy to forget is the link inside your own kitchen: which ingredient lots went into which batch.
The short version
- One back: for everything you receive, the supplier, the product, the date, the quantity and the lot.
- One up (forward): for everything you ship, the customer, the product, the date, the quantity and the lot.
- In between: which ingredient lots went into which finished lot. Without it, back and forward don't connect.
- FDA can ask for the records within 24 hours in a serious food safety situation.
- TaroStack keeps all three links as part of receiving, making and shipping. More below.
What the federal rule asks for
The records rule that came from the Bioterrorism Act covers anyone who manufactures, processes, packs, transports, distributes, receives, holds or imports food in the US, unless excluded (21 CFR 1.326). Farms and restaurants are excluded, as are retail food establishments with 10 or fewer full-time-equivalent employees (apart from the sections on access to records), and nobody has to record what they sell directly to consumers (21 CFR 1.327).
| One back (food you receive) | One up (food you ship) | |
|---|---|---|
| Rule | 21 CFR 1.337 | 21 CFR 1.345 |
| Who | The previous source's name, address and phone | The next recipient's name, address and phone |
| What | Product, with brand and variety | Product, with brand and variety |
| When | Date received | Date shipped |
| How much | Quantity and how it's packed | Quantity and how it's packed |
| Which lot | The lot or code, for manufacturers, processors and packers, to the extent it exists | The same |
| Carrier | Who transported it to you | Who transported it from you |
And one sentence covers the middle: your records "must include information reasonably available to you to identify the specific source of each ingredient used to make every lot of finished product" (1.345(b)). That's the batch record.
Keep the records 6 months for food that spoils within 60 days, 1 year for food that lasts up to 6 months, and 2 years for longer-lived food. When FDA reasonably believes a food presents a threat of serious adverse health consequences, the records must be made available as soon as possible and within 24 hours of an official request (21 CFR 1.361).
This is general information, not legal advice; your inspector has the last word.
One recall, link by link
Windward Roots, the made-up taro business I use in these examples, fries taro chips in coconut oil. Its oil supplier calls on a Monday: oil lot CO-0910 may be contaminated.
| Link | Record | What it says |
|---|---|---|
| One back | Receiving log | Lot CO-0910 arrived September 10: 40 L, from the oil supplier, delivered by its own truck |
| In between | Batch records | CO-0910 went into chip batches C260918 (16 L) and C260922 (18 L); 4 L are still in the store room; 2 L were spilled |
| One up | Invoices and transfers | C260918 went to the grocery chain (480 pouches), the gift shop (96) and the company's shops (260); C260922 to the grocery chain (480) and online customers (112) |
The oil supplier, holding lot CO-0910, looked one step back to its own supplier. Windward Roots looked one step back (it received the lot), across its own kitchen (which batches used it), and one step forward (which customers got those batches). The grocery chain will look one step forward to its stores. Nobody needed anyone else's files.
Without the middle link, the forward step would have to cover every chip batch made since September 10, because nobody could say which ones used the bad oil. That's the difference between calling two customers about two lots and calling everyone about everything. A full drill of this kind, timed, is in a food mock recall example.
One up, one back is not the whole chain
It's the minimum, and it's slow at the scale of a national outbreak, because each link has to be asked in turn. For foods on FDA's Food Traceability List, the newer FSMA 204 rule adds more: specific data for each receiving, making and shipping event, traceability lot codes that travel with the food, and records handed over as a sortable spreadsheet. FDA has proposed moving that rule's compliance date to July 20, 2028, and Congress directed it not to enforce the rule before then; FDA says it will comply. The records are in the food traceability Excel template, and how the whole chain fits together is in how does food traceability work.
Where this stops working
Each link is simple. Keeping all three every day is where it slips. The receiving log needs the lot from every case, written at the door. The batch record needs every ingredient lot, written at the mixer, including when a batch takes the end of one lot and the start of the next. And the invoices need the lot on every line, which is easy to leave off when the order is packed in a hurry. A trace is only as good as the weakest of the three on the day you need it.
How TaroStack does it
TaroStack keeps the step back, the step across and the step forward as part of the work, so they're there on the day you need them. Receiving records the supplier and the supplier's lot, or your own code, with the date and quantity, and scanning a GS1-128 case label fills in the lot and use-by date. Recording a batch takes ingredients from the lots that expire first and notes which lots it used and how much, which is the middle link written without anyone copying codes. Shipping and transfers carry the lot onto each order.
So the trace in this article is one report: pick lot CO-0910 and you get the batches it went into, the customers who received them with quantities, what's still on your own shelves, and who to call. Timed, logged drills let you prove it to a buyer or an auditor before it matters.
Lots and recalls are on every plan, from $49 a month; recording batches against recipes is on Standard at $99. The first 30 days are free. If you'd like a hand setting up, ask, and we'll do it with you.