Bioterrorism Recordkeeping Essentials

Dec. 19, 2005
This month, FDA expects food companies to start "one-up, one-down" recordkeeping.
There's nothing like a compliance deadline to bring into focus a number of small, unanswered questions about a new law or regulation. This has been true of the new allergen labeling requirements and is also true of the recordkeeping rule under the 2002 Bioterrorism Act.The compliance deadline for the recordkeeping rule was Dec. 9. Later deadlines are available for small businesses. What exactly happens on the compliance dates? As of those dates, the Food and Drug Administration (FDA) will expect persons handling food to establish and maintain records regarding the immediate previous source of all food and ingredients received and the immediate subsequent recipients of all food and ingredients released. This is referred to as "one-up, one-down" recordkeeping. The requirement extends generally to persons who manufacture, process, pack, transport, distribute, receive, hold or import food.The recordkeeping rule also addresses the circumstances under which the FDA can demand access to records. Upon a reasonable belief that a food is adulterated and presents a threat of serious adverse health consequences or death (whether or not caused by terrorism), FDA may demand access to the one-up, one-down records as well as all other records relating to the manufacture of the food (excluding access to recipes, pricing data and certain other sensitive information). FDA's authority to access existing records appears to have become effective when the Bioterrorism Act became law.
The final rule requires persons who manufacture, process or pack food to include lot codes in the one-up, one-down records. Photo courtesy of Cat2,

Following publication of the final rule in December 2004, FDA held public meetings with the food industry, published transcripts, fact sheets, and guidance documents on its web site, including an extensive Q&A document that will be updated.A few of the issues that have received attention include transfers of food within vertically integrated companies, the need to include lot codes in one-up, one-down records, and the meaning of the term "food."FDA has clarified, for example, that under certain circumstances a vertically integrated company does not need to establish and maintain records to track internal transfers of food. If a company produces raw materials, manufactures a finished food using them and then distributes the finished food to its own warehouses, the food has not necessarily changed hands. Importantly, however, if this company uses a third-party transporter to move raw materials or finished food from one part of the company to another, releasing product to the third party qualifies as a release and disrupts the vertical integration. In that case, records would need to be maintained tracking the movement of the food.The final rule requires persons who manufacture, process or pack food to include lot codes in the one-up, one-down records, to the extent this information exists. Thus, the food manufacturer must have the ability to associate a lot code (if it exists) with all incoming foods and ingredients and all outgoing foods and ingredients.The final rule exempts persons who merely hold food from the need to record lot codes. Therefore, a distributor that is not engaged in processing or packaging need not keep records describing food shipped to a specific retailer by lot code.Some questions that surround lot codes include: Can an expiration date be used in the one-up, one-down records in place of a lot code? In the case of a vertically integrated company, does a warehouse owned by the manufacturer need to record lot codes?What are the potential consequences of noncompliance with the rule? As with other violations of the Food, Drug, and Cosmetic Act, failure to establish or maintain records properly or failure to make records available to FDA when demanded is a "prohibited act." The government can bring an action in federal court to enjoin noncompliance and can also prosecute persons who fail to comply.As a practical matter, FDA's ability to monitor compliance is limited. The agency does not seem to have authority to demand access to records during a routine inspection, for the purpose of confirming that the proper records exist. Rather, FDA can demand access to records only upon a reasonable belief that a food is adulterated and presents a threat of serious adverse health consequences or death.Hopefully, FDA will not often find itself in a position to demand access to records. However, the food industry should take its obligations under the recordkeeping rule very seriously. While warning letters involving minor questions of interpretation do not seem likely, failure to produce the required records during an emergency will likely result in adverse publicity at a minimum, a public health crisis and criminal prosecution at worst.David Joy is a partner at the Washington, D.C. law firm of Keller and Heckman LLP. He specializes in food and drug law with emphasis on the domestic and international regulation of food, food additives, food labeling, antimicrobial pesticides, and medical devices. He is a member of the District of Columbia Bar and holds a bachelor's degree in chemistry. For more information about Keller and Heckman, visit the firm's web site at

Sponsored Recommendations

F&B Manufacturer Implements Powerful Cybersecurity

A leading F&B manufacturer has moved to harness the skills of Rockwell Automation and Claroty to harden their OT and IT defences.

6 Ways to Augment Your Food and Beverage Workforce

Modern digital tools and technologies help attract, retain and empower a modern workforce.

2024 Manufacturing Trends - Unpacking AI, Workforce, and Cybersecurity

The world of manufacturing is changing, and Generative AI is one of the many change agents. The 2024 State of Smart Manufacturing Report takes a deep dive into how Generative ...

Better OT Asset Management Increases Uptime

A food and beverage company streamlines and simplifies its OT cybersecurity to increase system reliability and uptime.