Preventing Undeclared Allergen Recalls in Prepared Foods

Every undeclared-allergen recall traces back to the same moment: a label that shipped before someone checked it against the actual formula. Not a mystery contamination event, not a supplier fraud scheme — usually just a label that fell out of sync with what was in the package. That is the lesson worth sitting with before we get to the case study, because it means these recalls are, almost without exception, preventable with the controls FDA has already told manufacturers to have in place.

On July 2026, Fresh & Ready Foods LLC recalled a limited run of Sprig & Sprout and Fresh and Ready Spicy Breakfast Burritos because they contained undeclared soy. I'm not going to walk through the recall itself — FDA's notice covers the who, what, and where. What I want to walk through is what actually breaks in a manufacturing operation to let a product like this leave the plant, and the specific preventive controls under 21 CFR Part 117 that are designed to catch it first.

Why This Keeps Happening

Undeclared allergens are not a rare failure mode in food manufacturing — they are one of the most persistent causes of FDA recall activity, year after year, regardless of category. A few things worth sitting with before we get into the fix:

Soy is one of the nine major food allergens FDA and USDA require to be declared on a label, a list set by the Food Allergen Labeling and Consumer Protection Act of 2004 (FALCPA) and expanded most recently by the FASTER Act, which added sesame as the ninth allergen effective January 1, 2023. Food allergies affect an estimated 32 million Americans, including roughly 5.6 million children under age 14, according to Food Allergy Research & Education (FARE) — which is why FDA treats undeclared major allergens as a Class I recall by default, the agency's highest-risk category, reserved for situations with a reasonable probability of serious adverse health consequences or death. Multi-component prepared foods — burritos, bowls, sandwiches, sauced entrées — carry more allergen risk per SKU than single-ingredient products simply because they have more places for a label to fall out of sync with a formula: the tortilla, the filling, the sauce, and the seasoning blend may each come from a different supplier, each with its own spec sheet, and each capable of changing without the finished-goods label ever getting touched.

That last point is the one I'd underline. In my experience reviewing recall root causes with clients, the failure almost never starts with the plant floor. It starts upstream, with an ingredient supplier reformulating a spice blend, a sauce base, or a processing aid to include soy lecithin, soybean oil, or hydrolyzed soy protein — and the change never reaching the person responsible for the finished-product label.

The Regulatory Framework You're Actually Operating Under

Allergen control in the United States sits on two legal pillars, and it's worth being precise about which one does what.

FALCPA (2004) and the FASTER Act (2021) set the labeling requirement itself. They define the nine major allergens — milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and sesame — and require that each be declared either in the ingredient list (using its common name, e.g., "soy protein") or in a "Contains" statement immediately following the ingredient list, per 21 CFR 101.100(a)(3) and FDA's implementing guidance. This is a labeling law. It tells you what has to appear on the package. It does not, by itself, tell you how to prevent the mismatch between formula and label from happening in the first place.

The FSMA Preventive Controls for Human Food rule (21 CFR Part 117) is where the "how" lives. Published September 17, 2015, with staggered compliance dates by business size — large businesses by September 2016, small businesses (fewer than 500 full-time equivalent employees) by September 2017, and very small businesses by September 2018 — Part 117 requires covered facilities to conduct a hazard analysis that specifically evaluates allergen cross-contact and mislabeling as hazards requiring a preventive control, not just a hazard to note and move past.

Two subsections do the real work:

• 21 CFR 117.135(c)(2) requires "food allergen controls," including procedures, practices, and processes to ensure protection of food from allergen cross-contact and to ensure that the finished product label reflects the presence of any major food allergen.
• 21 CFR 117.139 requires a written recall plan for any hazard requiring a preventive control — meaning allergen risk isn't just a production-floor problem, it's a documented, audit-ready plan that has to exist before you ever need it.

If your facility has an allergen hazard in its hazard analysis (nearly every facility handling major allergens does) and doesn't have a written, monitored, verified control tied to label accuracy, that's a Part 117 compliance gap — independent of whether a recall has ever happened. FDA can and does cite this on Form 483 observations during routine inspections, not just after a complaint.

Where the Control Actually Fails

I've sat across the table from enough plant quality teams to know the pattern repeats. It's rarely one dramatic failure — it's usually one of four quieter ones:

Supplier specification drift. A co-manufactured sauce, seasoning blend, or filling changes formulation, and the change notice goes to purchasing but never reaches whoever owns the finished-product label. Under 21 CFR 117.410, receiving facilities are required to have a supply-chain program for raw materials and ingredients tied to a hazard requiring a preventive control — which allergens almost always are. A supplier approval program that only checks a Certificate of Analysis for micro results, and never re-verifies allergen content against the current spec sheet at defined intervals, misses exactly this failure mode.

Label changeover error. Facilities running multiple SKUs on shared lines — a plain burrito and a spicy burrito, say — are exposed at the changeover point, where the wrong label stock gets pulled, or the right label gets applied to product made from a filling batch that used a substituted ingredient during a shortage. A verified label reconciliation step at line startup, matching label lot to formula lot to packaging run, is the control that catches this before cases leave the dock.

Rework mismanagement. Rework and trim from an allergen-containing product line getting folded into a batch of an allergen-free product is one of the oldest and best-documented causes of undeclared-allergen recalls in the industry. Part 117 requires rework to be handled under a documented procedure specifically because of this risk.

No periodic label-to-formula audit. Many facilities check a new label against a new formula once, at launch, and never again. Ingredients get substituted for cost or availability reasons months or years later, and nobody re-runs the comparison. A scheduled, calendar-driven label verification — not just a launch-time check — is the difference between catching a formulation drift in week two and catching it after a recall.

The Controls That Would Have Stopped This

Every row in that table is a control FDA already expects a covered facility to have. None of it requires new technology. It requires a documented procedure, a person accountable for running it, and a monitoring record that proves it happened — which is precisely what an FDA investigator asks to see first when a complaint or recall triggers a for-cause inspection.

Building the Label Control Program

A practical allergen label-control program has five components, and I'd encourage any quality lead to check their program against all five rather than assuming the presence of one covers the rest:

1. A current allergen matrix for every ingredient, updated at supplier reformulation, not just at initial approval — this is the single document an investigator will ask for first.
2. A supplier change-notification clause built into the vendor agreement itself, obligating the supplier to notify you in writing before any formulation change that could affect an allergen declaration. Silence from a supplier is not the same as no change.
3. A label reconciliation step at every changeover, verified by a second person, not just the line operator who applied the label.
4. A rework log cross-referenced against the allergen matrix before any rework batch is used, with a documented rejection path if the match can't be confirmed.
5. A scheduled, calendar-triggered label audit — I recommend annually at minimum, and at any ingredient substitution — that re-runs the full label-to-formula comparison independent of whether anything is believed to have changed.

None of this is exotic. It is the ordinary discipline of a mature quality system. What tends to be missing isn't the concept — it's the documented, monitored version of it that survives an audit and a personnel change.

What to Do If You Find a Gap

If a self-audit turns up a mismatch between a current formula and a shipped label, the corrective action path under 21 CFR 117.150 requires you to evaluate whether product already in commerce is affected and to take action — which may mean a voluntary recall coordinated with FDA under the agency's Reportable Food Registry framework, and separately, food facilities must submit a report to the Reportable Food Registry within 24 hours of determining that an article of food is a "reportable food," per Section 417 of the FD&C Act. Waiting to see if a complaint arrives is not a defensible response once the mismatch is confirmed internally. I've walked clients through this exact judgment call, and the ones who move fast on a confirmed label gap consistently fare better — with FDA, with retailers, and with their own liability exposure — than the ones who wait for outside pressure to force the decision.

FAQ

What is the difference between FALCPA and FSMA when it comes to allergens?

FALCPA (2004) and the FASTER Act (2021) set the legal labeling requirement — which nine allergens must be declared and how. FSMA's Preventive Controls for Human Food rule (21 CFR Part 117) requires the operational controls, monitoring, and verification that keep the label accurate in practice. You need both: a law that defines the requirement, and a system that makes sure you meet it every batch.

Is soy always required to be declared even in small amounts?

Yes. Under 21 CFR 101.100(a)(3), a specific exemption process exists for certain highly refined oils and similarly processed derivatives, but it requires a formal petition or notification to FDA — it is not a blanket exemption a manufacturer can assume applies. Absent an approved exemption, any soy-derived ingredient must be declared regardless of the quantity present.

How often should a food manufacturer audit its labels against current formulas?

At minimum annually, and immediately at any supplier or formula change. Many facilities check the label once at product launch and never again, which is exactly the gap that lets a supplier's quiet reformulation months later go undetected until a complaint or recall surfaces it.

What triggers a Class I recall versus a Class II or III?

FDA classifies a recall as Class I when there is a reasonable probability that use of the product will cause serious adverse health consequences or death. Undeclared major food allergens are treated as a Class I hazard by default because of the risk of anaphylaxis in sensitized individuals, which is why allergen mislabeling recalls are handled with the same urgency as pathogen contamination recalls.

Does a co-manufacturer's supplier change count as my responsibility if I'm the label owner?

Yes. Under 21 CFR 117.410, the facility responsible for label accuracy is required to have a supply-chain program that verifies ingredients continue to match specification — that obligation doesn't transfer to the supplier just because the supplier made the change. A vendor agreement with a mandatory change-notification clause is the practical tool that closes this gap.

If your facility is carrying allergen risk on a hazard analysis without a documented, verified label-control procedure behind it, that gap is worth closing before an inspector or a complaint finds it for you. Certify Consulting's FSMA Preventive Controls compliance services build the label reconciliation, supplier verification, and recall-readiness documentation that FDA expects a covered facility to have on hand — and our food labeling and allergen review services can run the label-to-formula audit described above as a standalone engagement if a full systems review isn't yet needed.

Last updated: 2026-07-29