Farm Food Safety Compliance: What Auditors Look For and How to Be Ready

Key Takeaways

• Food safety compliance is now a condition of doing business, not a voluntary program. More than 70 retailers including Walmart, Kroger, and Albertsons have established their own traceability requirements, many of which exceed federal standards and are already being enforced.
• FSMA 204’s enforcement deadline is July 2028, but Walmart’s supplier deadline was August 2025. For operations selling through major commercial channels, the federal timeline is not the one that matters.
• Auditors across all major programs check four things: a current, documented food safety plan; lot-level traceability from field to first sale; complete pesticide and chemical application records; and worker health and hygiene documentation.
• The 24-hour record retrieval requirement changes what “having records” means. Producing an electronic, sortable traceability file within 24 hours of an FDA request is operationally impractical with paper records at commercial scale.
• Good traceability protects you from other people’s problems. In overly broad recalls, producers not connected to a contamination event have incurred median costs of $3.0 million to $72.7 million per firm simply because the source could not be quickly identified.

Introduction

Farm food safety compliance looked different five years ago. A third-party audit was something most commercial produce buyers asked for and most growers completed once a year. It was a checkbox. The buyer got the certificate, the grower filed the report, and both parties moved on.

That dynamic has changed. Walmart moved its full food traceability supplier requirement to August 2025, separate from the FDA’s enforcement timeline. Kroger and Albertsons have their own programs. More than 70 retailers, wholesalers, and foodservice companies have established traceability requirements that run parallel to. In many cases ahead of, federal regulations. For any farm operation selling through commercial channels, audit readiness is no longer a seasonal exercise. It is a baseline operating requirement that determines access to markets.

This post covers what auditors actually look for across the major programs, why the records problem is harder than it sounds. What it takes to build compliance infrastructure that holds up under scrutiny.

The Compliance Landscape Has Changed

The first thing to understand is that farm food safety compliance is not a single requirement. It is a layered system of federal regulations, retailer mandates. Third-party certification programs that overlap, interact, and in some cases conflict.

Federal Requirements: FSMA 204 and the Food Traceability Rule

The FDA’s Food Traceability Final Rule requires any entity that manufactures, processes, packs, or holds foods on the FDA Food Traceability List to maintain enhanced traceability records and capture Key Data Elements at Critical Tracking Events. Records must reach the FDA in an electronic sortable format within 24 hours of request.

The Food Traceability List covers the fresh produce categories with the highest historical outbreak frequency. That includes leafy greens (all varieties), tomatoes, cucumbers, melons, peppers, fresh herbs, sprouts, tropical tree fruits, and fresh-cut fruits and vegetables. If a farm grows and ships any of these crops through commercial channels, FSMA 204 applies.

The enforcement deadline moved. Barley Snyder’s legal summary confirms that a November 2025 Congressional appropriations act directed the FDA not to enforce the rule before July 20, 2028. That extended the original January 2026 deadline by 30 months. The rule itself did not change. The requirements did not change. Only the federal enforcement date moved.

That distinction matters because the plain-language analysis from Relia Magazine makes the operational reality clear: the rule does not mandate any specific technology. The 24-hour response requirement and the multi-party data-sharing requirement make paper-based and disconnected systems impractical for most covered operations at commercial scale. Operations that treat the 2028 date as a pause are building toward a harder transition, not a later one.

Retailer Requirements: What Walmart and Others Are Enforcing Now

The more immediate pressure for most commercial growers is not federal. Walmart required all food and beverage suppliers to comply with FSMA 204 traceability ASN and packaging requirements as of August 1, 2025. Has stated it expects suppliers to maintain those timelines regardless of the FDA extension, according to Walmart’s supplier-facing food traceability page. Compliance is tracked inside Walmart’s SQEP Dashboard, and enforcement fines are expected as the program matures.

Walmart is not alone. According to Grocery Dive’s reporting on retailer traceability programs, more than 70 retailers, wholesalers. Kroger and Albertsons have established their own traceability requirements. Many of these are more extensive than the federal rule and predate the FDA’s enforcement deadline. For operations selling into these channels, the compliance clock has already run out.

Third-Party Audit Programs: GAP, GLOBALG.A.P., and PrimusGFS

Alongside federal and retailer requirements, most commercial buyers require certification under one or more third-party audit programs. The main ones for produce operations are covered clearly in UC Davis’s UC Small Farm Food Safety audit scheme overview.

The USDA GAP/GHP audit program verifies an operation’s efforts to minimize contamination risk across growing, harvesting, packing, and handling. It is voluntary at the federal level but required by a large number of buyers. GLOBALG.A.P. is a private-sector standard widely required for operations selling into international channels or to buyers with global sourcing programs. It covers the full production process from soil management to pesticide traceability to worker welfare. PrimusGFS is a GFSI-recognized certification covering Good Agricultural Practices, Good Manufacturing Practices, and Food Safety Management Systems. It is the most commonly required standard for produce growers selling into major US retail and foodservice accounts.

Each program has its own scoring structure and non-conformity protocols. They share a core set of requirements that form the practical audit agenda.

What Auditors Actually Check

Regardless of which program is being audited, auditors arrive looking at four primary areas. An operation that has these four things documented, current, and retrievable will pass most audits. An operation that does not will fail on the fundamentals before the auditor ever reaches the secondary items.

A Current, Documented Food Safety Plan

The food safety plan is the first thing an auditor reviews. According to the University of Kentucky Extension’s USDA GAP audit training materials, the General Mandatory section of every USDA GAP/GHP audit. This section must pass before any other section is scored. It requires a current food safety plan, along with worker health and hygiene documentation, traceability records, and pesticide and chemical records.

A food safety plan that exists but has not been updated. The last audit, or that exists on paper but is not being followed in practice, is a non-conformity. Auditors look for evidence the plan is in use: records of staff training, signatures on procedures, documented corrective actions when deviations occurred. A plan that cannot be tied to operational records is a document, not a system.

Lot-Level Traceability and the 24-Hour Test

Lot-level traceability is the structural requirement that everything else hangs on. Under FSMA 204, the Critical Tracking Events for farms are harvesting, cooling. Initial packing of raw agricultural commodities, as Rutgers NJAES Extension’s FSMA 204 farm guide explains. A Traceability Lot Code gets assigned at the first packing event. That code must link forward through every subsequent movement and backward to the field, the harvest date, the harvest crew. The inputs applied to that field in that season.

The practical test is the mock recall. An auditor, or an FDA investigator, will name a lot code and ask for the complete traceability chain: where it was grown, when it was harvested, where it went after leaving the farm, and what inputs went on to that field. Croptracker’s FSMA 204 resource guide notes that records must stay on file for at least two years and must be quick to retrieve in a sortable format. Paper records are explicitly not advisable given the 24-hour response requirement.

Pesticide and Chemical Application Records

Chemical application records must show what was applied, to which field or block, on which date, by whom, and at what rate. For crops sold into channels requiring a residue certificate or buyer audit, chemical records must connect to the lot harvested from that field. Filing them separately in a binder that does not reference the harvest record is not enough.

Pre-harvest intervals for each chemical must be documented and verifiable. If the field was harvested 10 days after application of a compound with a 14-day PHI, that lot has a compliance problem. The record needs to make this traceable in both directions: from the chemical application to the affected lot. From the lot back to the chemical records.

Worker Health, Hygiene, and Training Records

Every major audit program requires documentation that workers have been trained on hygiene protocols, that sick workers are excluded from harvest activities. That sanitation procedures for equipment and facilities are being followed and recorded. These are not checked by walking the field. They are checked by reviewing sign-in sheets, training logs, and sanitation records. An operation where the training happens but the records are not kept has no way to demonstrate compliance when the auditor asks.

The Records Problem

Most farm operations do the right things. Inputs get applied correctly. Harvest crews follow hygiene protocols. Lot codes get assigned. Audit failures come down to documentation in the majority of cases. Records do not exist, or they exist in disconnected systems that cannot be assembled quickly. Sometimes they exist on the farm but do not connect forward to buyer-facing shipping documents.

The consequence of that gap is not just a failed audit score. In a contamination outbreak, operations that cannot demonstrate their lot-level records clearly face recall costs. This happens even when their product was never implicated. Womble Bond Dickinson’s food traceability analysis describes the pattern from past romaine lettuce investigations. Companies with no connection to the outbreak faced product holds, suspended shipments, and forced disposal. The source could not be quickly identified and their records could not rule them out.

A 2025 Journal of Food Protection study found that producers incur median costs of $3.0 million to $72.7 million per firm from overly broad recalls. In those events, their product was not actually implicated. The variability in that range reflects the size of the operation and the breadth of the recall. The point holds: good traceability records protect you from other people’s problems. Poor records expose you to the full cost of those problems even when your product is clean.

There were 422 FDA food and beverage recall events in 2024. A Loftware analysis of FDA recall data published by New Food Magazine put total direct recall expenses at $1.92 billion across the industry. That figure uses the Grocery Manufacturers Association’s average estimate of $10 million per event. The frequency is rising. The cost per event is not falling.

The 24-Hour Requirement Is a System Design Problem

FSMA 204’s 24-hour record retrieval requirement is not an administrative detail. It defines what kind of record system is actually compliant in practice, regardless of what the rule technically permits.

The rule does not specify what technology to use. Paper records are technically permitted. Producing a complete, electronic, sortable spreadsheet covering the full traceability chain for a recalled lot is not achievable from paper files at commercial scale. That spreadsheet must cover field records, harvest date, crew records, input applications, lot code assignment, shipping documents, and buyer identity. It must reach the FDA within 24 hours. The plain-language FSMA 204 guide from Relia Magazine puts it directly. The honest operational answer is that compliance requires integrated digital records across trading partners, even though the rule technically allows paper.

The 24-hour requirement also means that records assembled at audit time are not sufficient. Traceability data compiled from memory during an inspection will have gaps. Records assembled under pressure rather than captured as part of normal operations will have inconsistencies that an auditor or investigator will find. Systems that capture lot-level data at the point of harvest and link it forward through packing and shipping in real time can respond to a 24-hour request. The work has already been done.

Building Audit-Ready Records From the Ground Up

The practical starting point is accepting that lot codes are the connective tissue of the whole system. Every other record has to connect to a lot code to be usable in an audit or recall response. That includes input applications, harvest logs, worker records, and shipping documents.

Assign Lot Codes at the Point of Harvest or First Packing

The lot code needs to be created at the first critical tracking event. For farms is typically initial harvest or first packing. At that point, the code should be tied to the field or block, the harvest date, the variety, and the harvest crew. Every subsequent step (cooling, staging, packing, loading) should reference that code. That any downstream document can be traced back to the originating field and date.

Operations that assign lot codes at the packing shed, disconnected from the field record, create a gap. It is invisible day-to-day and expensive during a recall. The field record should produce the lot code. Not the other way around.

Link Every Input Record to the Lot or Field It Covers

Chemical application records, fertilizer logs, and water source records need to reference the specific field or block covered, not just the date and product. When a lot code is later tied to that field, the input records become part of the lot’s traceability chain automatically. Without that connection, input records and traceability records are two separate filing systems that an auditor has to manually reconcile. Under time pressure, that reconciliation produces errors.

For ongoing cost tracking, input records tied to specific fields also feed into per-acre cost calculations. The farm cost tracking approach and the compliance record system are the same records used differently. Is an argument for capturing them in the same place from the start.

Connect Field Records to Shipping Documents Before Product Leaves the Farm

The gap that most frequently causes compliance problems is not at the field level. It is at the handoff from field to shipping. Lot codes that exist on harvest tags but do not carry through to packing labels, bill of lading references, or buyer-facing shipping documents create a break in the chain. That break cannot be repaired after the product has left the farm.

Before any lot leaves the operation, the shipping document should reference the lot code. That lot code should trace back to a complete harvest record. This is not additional paperwork. It is the same information in a connected format rather than two separate formats that do not reference each other.

What Changes When Records Are Centralized

The compliance records that auditors check (food safety plans, lot codes, input applications, worker logs, shipping documents) exist in almost every commercial farm operation. The problem is that they exist in separate places. A binder in the office, a notebook in the cab, a spreadsheet in accounting, a folder of shipping documents. When an audit arrives or a recall request comes in, assembling a complete record from those sources takes time the operation does not have.

A connected farm management system captures these records at the point they occur and links them to the lot codes they belong to. Input applications get recorded against the specific field where they happened. Harvest records generate lot codes that carry forward to packing and shipping documents automatically. Worker training logs and daily hygiene records are stored in the same system as the production records they support.

AgriERP’s farm management capabilities include field-level record keeping, lot-level traceability, and input tracking across growing, harvest, and shipping operations. The system is structured around the CTE and KDE framework that FSMA 204 requires and GAP audit programs verify. For operations already using precision farming tools and field-level recording, the incremental step is connecting those records to a unified traceability system. Managing them as separate data streams is what creates gaps.

Where AgriERP Fits

AgriERP is built for commercial produce, orchard, and specialty crop operations. Third-party audit compliance and buyer traceability requirements are part of doing business. It is not the right fit for a direct-market farm with a single buyer and no third-party audit requirement. At that scale, a structured binder and a well-maintained spreadsheet may be entirely sufficient. The investment in a connected ERP system pays off. The records problem is large enough that assembling them manually creates real audit risk or recall exposure.

If your operation is at the point where compliance documentation is taking meaningful time away from operations, or. A failed audit or recall exposure is a genuine business risk, request a demo with AgriERP to see how field-to-shipment traceability works in practice.

Your Records Need to Be Ready Before the Audit Call

Auditors do not give advance notice of what they will ask for. FDA investigators arrive with a lot code and a 24-hour clock. Building the records after the request is made is not a compliance strategy.

Explore AgriERP for produce and specialty crop operations to see how connected recordkeeping supports audit readiness year-round, not just at certification time.

Frequently Asked Questions

What is the FSMA 204 compliance deadline for farms?

The federal enforcement deadline for FSMA Section 204, the Food Traceability Rule, is July 20, 2028. The original deadline of January 20, 2026 was extended 30 months by a November 2025 Congressional appropriations act. The rule itself did not change. Only the enforcement date moved. However, major retailers including Walmart set their own supplier deadlines independently: Walmart’s requirement took effect August 1, 2025. The company has stated it expects suppliers to comply on the original timeline regardless of the FDA extension. For operations selling through major commercial channels, the practical deadline is the retailer’s, not the FDA’s.

Does FSMA 204 apply to all farms, or only certain crops?

FSMA 204 applies only to operations that grow, pack, hold, or ship foods on the FDA Food Traceability List. For produce farms, covered crops include leafy greens (all varieties), tomatoes, cucumbers, melons, peppers, fresh herbs, sprouts, tropical tree fruits, and fresh-cut fruits and vegetables. Farms that do not grow or ship any FTL-listed food are not subject to the rule’s traceability requirements. Small farms with $25,000 or less in annual produce sales are exempt. The FDA’s Food Traceability List page is the authoritative source for coverage determinations.

What is a Traceability Lot Code and when do you assign one?

A Traceability Lot Code (TLC) is the unique identifier connecting all records for a specific batch of food. That includes field of origin, harvest date, crew, input applications, packing records, and shipping destination. Under FSMA 204, the TLC gets assigned at the first Critical Tracking Event. For farms is typically initial harvest or first packing. The code must travel with the product through the supply chain and must be referenced in all downstream shipping and receiving records. If the product is repackaged or transformed, the new packaging must carry either the original TLC or an updated one traceable to it.

What is the difference between a USDA GAP audit and GLOBALG.A.P. certification?

The USDA GAP/GHP audit is a voluntary US government program that verifies an operation’s practices to minimize contamination risk. It is required by many domestic buyers but is not a GFSI-recognized standard. GLOBALG.A.P. is a private-sector standard widely required for operations selling into international channels or to buyers with global sourcing programs. It is GFSI-recognized and covers a broader scope including soil management, pesticide traceability. Worker welfare across the full production process. PrimusGFS is also GFSI-recognized and is the most commonly required standard for produce growers selling into major US retail and foodservice accounts. Which standard is required depends on the buyer. Confirm the required program with your commercial customers before scheduling.

What records do you need to produce within 24 hours of an FDA request?

Under FSMA 204, an FDA request during a recall investigation requires an electronic, sortable spreadsheet with all traceability records for the specified lot codes or date ranges. For a farm, that means the field or block where the lot was grown, the harvest date and crew, and the lot code assigned at first packing. It also includes all input applications to that field in the relevant period (pesticides, fertilizers, water source), the initial shipping destination, and any subsequent movement records. These records must stay on file for at least two years and must be quick to retrieve. Paper systems are impractical at commercial scale for exactly this reason. The records must be provided onsite to FDA within 24 hours, regardless of who is maintaining them on the operation’s behalf.

What happens if a farm cannot identify a specific lot during a recall?

A farm that cannot quickly document the chain of custody for a recalled lot risks being swept into a broader recall. This can happen even when the farm’s product had no connection to the contamination. In past outbreaks involving leafy greens, produce operations with no connection to the contamination faced product holds, suspended shipments, and disposal costs. The source could not be quickly identified and their records could not exclude them. Research published in the Journal of Food Protection in 2025 found that producers incur median costs of $3.0 million to $72.7 million per firm from overly broad recalls affecting unimplicated operations. The ability to produce a clean, complete lot-level record quickly is the operational protection against that exposure.

How does farm management software help with food safety compliance?

Farm management software helps in two ways: it captures compliance records as part of normal operations rather than as a separate documentation task. It connects those records to the lot codes that auditors and investigators use to trace a product through the supply chain. Input applications recorded against a specific field automatically become part of that field’s lot-level traceability record. Harvest logs that generate lot codes at the point of packing carry those codes forward to shipping documents without a manual transcription step. When an audit arrives or an FDA request comes in, the records are already organized, linked. Retrievable rather than assembled under time pressure from multiple disconnected sources.