Salmonella Controls That Prevent Powdered Food Recalls

When a company like Ghirardelli ends up issuing a voluntary recall over potential Salmonella contamination in its powdered beverage mixes, the first question worth asking isn't "what went wrong at Ghirardelli?" — it's "what does a manufacturer need to have in place so this doesn't happen to them?"

The FDA recall notice tells us that Ghirardelli's situation traces back upstream: a California Dairies, Inc. milk powder recall triggered a cascading concern about Salmonella contamination in any finished product that used that ingredient. That's a supplier-originated risk that worked its way into a finished consumer product. It's a scenario that plays out across the food industry more often than most people realize, and it's largely preventable — if the right systems are functioning before the ingredient ever reaches your production floor.

I've worked with food manufacturers and dietary supplement companies through dozens of FDA inspections and recall-prevention audits over the years. In my view, the Ghirardelli situation is a clean illustration of a gap that shows up repeatedly: companies invest in their own manufacturing controls but underinvest in the supplier verification side of their food safety program. That gap is exactly where Salmonella finds its way in.

Here's what a well-built system actually looks like — and what the regulations require you to have.

What the Regulations Actually Require

The core regulatory framework for this kind of hazard lives in two places: 21 CFR Part 117 (Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food — commonly called the FSMA Preventive Controls rule) and 21 CFR Part 112 where sprouts are involved. For powdered beverage manufacturers, Part 117 is the operative standard.

Under 21 CFR Part 117, Subpart C, a food manufacturer is required to conduct a hazard analysis that identifies known or reasonably foreseeable hazards — and Salmonella in milk powder is absolutely a known hazard. The FDA's own Bacteriological Analytical Manual lists Salmonella spp. as a primary concern in low-moisture dairy ingredients. Your hazard analysis must address it.

Beyond identifying the hazard, 21 CFR Part 117.135 requires that you establish preventive controls — process controls, sanitation controls, supply-chain controls, or some combination — that are appropriate for the nature of the hazard and your specific food. For a product like powdered beverage mix that contains milk powder as a raw ingredient, the supply-chain program under 21 CFR Part 117.410–117.430 is the primary line of defense. These regulations went into full effect for large businesses in September 2016 and have been binding ever since. There is no grace period left. If you're producing food and you don't have a documented supply-chain program for ingredients that carry a Salmonella risk, you are out of compliance — and a supplier-originated recall is a foreseeable consequence.

What changed in FSMA that made this more consequential than prior GMP regulations is the shift from reactive to preventive. The old framework expected manufacturers to detect problems. FSMA expects manufacturers to prevent them, and it assigns accountability for supplier hazards squarely to the receiving facility. That's the regulatory logic that makes the Ghirardelli situation a compliance question, not just an unfortunate circumstance.

How Salmonella Gets Into Powdered Dairy Ingredients

Understanding the mechanism matters if you want to build controls that actually work. Salmonella in powdered dairy ingredients — milk powder, whey, nonfat dry milk — typically enters through one of three routes.

Raw milk contamination is the most common upstream source. Salmonella can colonize dairy cattle asymptomatically, and if contaminated milk enters a processing stream before adequate pasteurization, the organism can survive in dry form once the moisture is removed. Low water activity (Aw) inhibits growth but does not kill the pathogen. This is a point most manufacturers understand conceptually but don't always operationalize in their supplier assessments.

Post-pasteurization recontamination is the more insidious route. Dry-processing environments — powder handling, packaging, bagging — can harbor Salmonella in environmental niches where it persists for months or even years. The 2009 Peanut Corporation of America outbreak and several subsequent powdered formula incidents were driven by this mechanism. A supplier can be pasteurizing correctly and still ship contaminated product if their environmental monitoring program has gaps.

Ingredient blending and transfer creates cross-contamination risk whenever multiple ingredients converge. In a powdered beverage facility, you're often combining cocoa, sweeteners, flavoring agents, and dairy powders in a single processing stream. If any one of those ingredients carries the pathogen, the blend becomes the vehicle.

According to the CDC, Salmonella causes approximately 1.35 million infections, 26,500 hospitalizations, and 420 deaths in the United States each year — making it one of the most consequential foodborne pathogens in terms of public health burden. Low-moisture products including powders account for a meaningful share of those outbreaks. The FDA has documented that Salmonella can survive in low-moisture food matrices for 12 months or longer under standard storage conditions — which is why end-product testing alone is an inadequate control strategy.

The Supplier Verification Program: What It Has to Contain

This is the piece most manufacturers either underbuild or treat as a paperwork exercise. The FSMA supply-chain program requirements at 21 CFR Part 117.410–117.430 are not optional and they are not satisfied by a supplier questionnaire alone. Here's what a compliant, functional program looks like for an ingredient like milk powder.

Approved Supplier List and Hazard-Based Stratification

Every supplier of a raw material that carries a significant hazard — Salmonella in dairy powder qualifies without question — needs to be on an approved supplier list that reflects your hazard analysis. The approval process should involve more than verifying that a supplier has a food safety certificate. It should include a documented assessment of the specific hazard they control, the controls they use to control it, and evidence that those controls are working.

In practice, this means stratifying your supplier list by hazard level. A supplier of high-risk dairy powder gets a more intensive verification regime than a supplier of packaging materials. That stratification should be explicit in your written program and defensible to an FDA investigator.

Supplier Audits: Frequency and Scope

For ingredients that carry pathogen risk, FDA expects supplier audits to be conducted by a qualified auditor — meaning someone with training and experience in food safety relevant to the hazard being assessed. Frequency should be at minimum annual, with more frequent review if there are any quality signals: a prior recall, a regulatory action against the supplier, or results from your own testing that fall outside expectations.

Audit scope for a dairy powder supplier should specifically examine their environmental monitoring program for Salmonella and Listeria, their pasteurization records and validation documentation, and their finished-product testing protocols. If a supplier can't show you environmental swab data and trending analysis, that's a gap worth probing hard.

Certificates of Analysis Are Not a Verification Program

This comes up in almost every audit I run. A Certificate of Analysis from your supplier is useful documentation, but it is not a supply-chain verification activity under 21 CFR Part 117.410. The regulation is explicit: the appropriateness and frequency of supply-chain verification must be based on the hazard analysis, not on the convenience of paper review. For a pathogen hazard in a ready-to-use ingredient (one that won't receive a kill step in your process), FDA expects actual verification — meaning testing, auditing, or a combination.

Kill Step Analysis: Know Whether Your Process Controls the Hazard

One of the most important questions to answer in your hazard analysis is whether your manufacturing process includes a step that kills Salmonella. For many powdered beverage mixes, the answer is no — the powders are blended and packaged without a validated thermal kill step, and the consumer reconstitutes the product with hot or cold water and drinks it. That's a "no kill step" scenario, and it changes the entire calculus of your preventive controls.

When there is no validated kill step in your process, the burden falls entirely on your supply-chain program and incoming verification testing to ensure the hazard is controlled before it enters your facility. That's a high bar, and it requires a testing program with genuine statistical rigor — not spot-check testing of a bag or two per lot.

The key comparison here is between treatment-dependent and supply-chain-dependent hazard control:

If you're in a "supply-chain dependent" scenario — meaning your process doesn't kill the pathogen — you need to treat incoming ingredient testing as genuinely load-bearing, not as a formality.

Environmental Monitoring: The Control Most Facilities Underinvest In

Environmental monitoring programs for pathogens in dry processing environments are technically demanding and easy to do badly. A program that swabs the same surfaces in the same locations on a predictable schedule will, over time, stop finding anything — not because the environment is clean, but because the pathogen has learned to hide in places you're not looking. That's not a metaphor. Salmonella forms biofilms in harborage sites that resist standard sanitation and survive routine surface swabs.

A defensible environmental monitoring program for a facility handling dairy powders should include:

• Zone-based sampling strategy (FDA's four-zone framework in its Guidance for Industry on Listeria is the right template, and the logic applies to Salmonella as well)
• Rotating sampling locations that change over time so the program doesn't become predictable
• Investigative sampling triggered by any positive result — not just corrective action, but expanded sampling to characterize the scope of any positive finding
• Annual program reassessment that reviews your historical data and adjusts zones and frequency based on what you've found

The FDA's draft guidance on environmental monitoring for Salmonella in powdered infant formula facilities (issued 2022, revised 2024) provides the most detailed publicly available framework for building a robust program. Even if you're not producing infant formula, that guidance is worth reading as a template.

Corrective Action and Recall Readiness: What Good Looks Like

Even in a well-run food safety program, signals emerge — a supplier issues a recall, a COA result looks anomalous, an environmental swab comes back positive. What separates a minor quality event from a public recall is usually whether the corrective action process caught the signal early and acted on it decisively.

Under 21 CFR Part 117.150, corrective actions must be taken when a preventive control is not properly implemented or when a food safety problem is identified. The regulation requires that you identify and correct the problem, reduce the likelihood of recurrence, evaluate affected food for safety, and prevent affected food from entering commerce. That last point is the one that matters most in a supplier-contamination scenario: do you have the traceability systems to quickly identify every lot of finished product that contains a potentially affected ingredient?

Lot-level traceability — the ability to link every unit of finished product back to the specific raw material lots used in its production — is foundational to recall readiness. The FDA's Food Safety Modernization Act also includes traceability provisions under Section 204 (now implemented in the Food Traceability Rule at 21 CFR Part 1, Subpart S), with full compliance required by January 20, 2026 for many food categories. Powdered beverage mixes that contain dairy ingredients may fall within covered food categories under that rule.

If you don't have lot-level traceability in place today, that's both a recall-readiness gap and, depending on your product, an upcoming compliance deadline you need to be working toward.

What a Pre-Recall Self-Audit Should Examine

If the Ghirardelli situation prompts you to take a fresh look at your own program, here's where I'd focus. These are the questions I ask first when I'm brought in for a food safety gap assessment:

1. Hazard analysis currency — Has your hazard analysis been reviewed in the last 12 months? Has it been updated to reflect any new ingredients, new suppliers, or changes in your processing environment?

2. Supplier verification records — Can you produce, for each high-risk ingredient supplier, documentation of the verification activities conducted in the past year? Not just COAs — actual audit reports or qualified third-party audit records.

3. Kill step identification — Do you know, for each significant hazard in each product, whether your process includes a validated kill step? Is that documented?

4. Incoming testing program — For "no kill step" scenarios, what is your testing frequency and sample size per lot? Is it statistically meaningful?

5. Environmental monitoring data — How long has your current program been running? When did you last have a positive result, and what was the investigative response?

6. Traceability — Pick a lot of finished product and trace it back to its raw material lots. How long does that exercise take? If the answer is "hours" or "days," your recall response will be proportionally slow.

These aren't abstract questions. An FDA investigator who walks into your facility following a supplier recall will be asking versions of all of them. The time to discover the answers is before that visit.

The Practical Bottom Line

Supplier-originated contamination events are preventable — not with certainty, but with meaningful probability — when a manufacturer has built a supply-chain program that treats the hazard analysis as a real document rather than a compliance artifact. The regulatory requirements in 21 CFR Part 117 have been in force for nearly a decade. The tools are well understood. What tends to go wrong is execution: the program exists on paper but the verification activities aren't happening, the testing program is too light to catch a low-level contamination event, or the traceability system breaks down when it actually needs to work.

In my view, the right response to a recall like Ghirardelli's isn't to update your crisis communications plan. It's to go back to your hazard analysis, your supplier verification records, and your incoming testing data and ask honestly whether they would have caught this before it became a problem. If the answer is uncertain, that's where the work starts.

Certify Consulting works with food manufacturers, dietary supplement producers, and consumer goods companies to build compliant, audit-ready food safety programs under FSMA and FDA's GMP regulations. If you'd like a frank assessment of where your current program stands, reach out to schedule a consultation.

For manufacturers who also need to understand how food safety documentation connects to broader quality management requirements, our work on quality management system implementation provides a practical bridge between FSMA compliance and ISO-aligned quality frameworks.

Source: FDA Recall Notice — Ghirardelli Chocolate Company Recalls Powdered Beverage Mixes Because of Possible Health Risk. Available at fda.gov/safety/recalls-market-withdrawals-safety-alerts.

Last updated: 2026-05-12