Salmonella in Dry Snacks: Controls That Prevent FDA Recalls

A May 2026 recall of Giant Eagle Baked Pita Chips traces back to a contaminated milk powder supplier — and the real lesson isn't about pita chips at all.

When Legacy Snack Solutions of Waukesha, Wisconsin, voluntarily recalled certain batches of Giant Eagle Baked Pita Chips With Parmesan, Garlic & Herb on May 7, 2026, the root cause wasn't a breakdown in their own facility. It was a downstream consequence of a California Dairies, Inc. milk powder recall — a contaminated ingredient from a supplier that, once it entered the seasoning blend, moved product all the way to retail shelves.

That chain of events is the real story. And it's one I've seen play out in different forms across more than 200 client engagements over eight-plus years: a company does everything reasonably well internally, but their supplier qualification program has a gap, and that gap becomes their recall.

The good news is that this is a preventable failure. The controls exist. The regulations require them. The question is whether manufacturers are implementing them with enough rigor to actually catch the problem before it ships.

Why "Low-Moisture" Doesn't Mean "Low-Risk"

There's a persistent assumption in the snack food industry that low-moisture, shelf-stable products are relatively safe from pathogen risk. That assumption has been eroding for years, and the science is clear enough now that regulators have stopped treating it charitably.

Salmonella can survive for extended periods in low-moisture environments — including dry seasoning powders, spice blends, nut flours, and dairy-based flavoring ingredients like parmesan powder. The FDA's own risk assessments have documented Salmonella survival in dry matrices at water activity levels below 0.60 Aw. A 2021 outbreak linked to tahini and a 2009 peanut butter outbreak that killed nine people both involved low-moisture products. The pattern is not new.

What's new is the regulatory posture. Under 21 CFR Part 117 (the Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls rule, commonly called the FSMA Preventive Controls rule), manufacturers of human food are required to evaluate Salmonella as a known or reasonably foreseeable hazard in any ingredient where the pathogen is historically associated. For dairy powders, spice blends, and nut-based ingredients, that evaluation is not optional — it is required by the regulation.

The May 2026 recall is a timely reminder that the regulation's logic is sound. The ingredient that carried the risk was a dairy powder. The finished product was a baked chip with a seasoning blend. If the hazard analysis for that seasoning supplier had been built correctly, the supplier's own recall would have triggered an immediate hold-and-test protocol before any finished product shipped.

What the Regulations Actually Require (and Where Gaps Appear)

The FSMA Preventive Controls rule at 21 CFR Part 117 Subpart C establishes the framework that applies here. Let me walk through the specific requirements that are most relevant to this type of failure — because understanding the gap is the first step toward closing it.

Hazard Analysis: 21 CFR § 117.130

Every facility covered by the Preventive Controls rule must conduct a written hazard analysis for each type of food manufactured. The hazard analysis must identify known or reasonably foreseeable hazards — including biological hazards like Salmonella — and determine whether each hazard requires a preventive control.

For a baked pita chip with a parmesan, garlic, and herb seasoning, a properly conducted hazard analysis would identify Salmonella as a hazard requiring a preventive control specifically in the dairy powder component. The key word is "requiring." The hazard analysis doesn't just identify the risk; it forces a decision about what control actually addresses it.

A common gap I see: manufacturers identify the hazard but classify the kill step (baking) as the sole control. For a fully seasoned chip, that logic may be sound if the seasoning is applied before baking. If it's applied post-bake — which is common in flavored chip manufacturing to preserve volatile flavor compounds — the kill step doesn't cover the contaminated ingredient, and the hazard is uncontrolled.

Supplier Verification: 21 CFR § 117.410–117.430

This is where the May 2026 recall is most instructive. The FSMA Preventive Controls rule requires that when a supplier is providing an ingredient that contains a hazard that the receiving facility's process does not control, the receiving facility must implement a supply-chain program that verifies the supplier is controlling that hazard.

Under 21 CFR § 117.410(b), the type and frequency of supplier verification activities must be based on the hazard and the risk associated with the supplier. For a dairy powder ingredient with Salmonella risk, the minimum verification activity is annual on-site auditing or sampling and testing of the ingredient — and that's the floor, not the ceiling.

The regulation further specifies at § 117.430 that when the receiving facility relies on the supplier's preventive controls as the basis for not applying its own preventive control, the supply-chain program must include:

• A written procedure for conducting supplier verification activities
• Documentation of those activities for each supplier and each ingredient
• A corrective action procedure triggered by supplier failures

When a supplier like California Dairies, Inc. issues a recall for a product, that recall is a supplier failure signal. A functioning supply-chain program should treat any FDA-linked supplier recall as an automatic trigger for the receiving facility's corrective action procedure — which means placing finished product on hold, conducting testing, and making a disposition decision before goods ship.

Environmental Monitoring: 21 CFR § 117.165(a)(3)

If a facility has identified Salmonella as a hazard requiring a preventive control, and if that facility handles open product in an environment where cross-contact is possible, environmental monitoring is a required verification activity. The regulation at § 117.165(a)(3) requires testing of environmental samples for the presence of the pathogen or an appropriate indicator organism.

This is not a vague standard. The FDA's Guidance for Industry on Hazard Analysis and Risk-Based Preventive Controls (September 2016, updated) provides specific guidance on what a compliant environmental monitoring program looks like — including zone-based sampling, corrective action triggers, and recordkeeping requirements.

Many small-to-mid-size snack manufacturers have environmental monitoring programs on paper that don't hold up in practice. They sample infrequently, they concentrate samples in easy-to-access areas rather than harborage zones, and they treat a single positive result as an anomaly rather than a signal. That's not a compliant program; it's a documentation exercise.

The Supplier Qualification System That Would Have Caught This

Let me be direct about what a well-built supplier qualification program looks like for a situation like this, because "supplier qualification" can mean anything from a signed questionnaire to a full audit program, and only one of those actually works.

Ingredient Risk Classification

The foundation of any effective supplier program is a written ingredient risk classification. Not all ingredients carry the same risk, and the program should reflect that. A reasonable classification system looks something like this:

This classification should be built into the hazard analysis and drive verification activity frequency. A parmesan powder supplier in 2026 should be classified as high-risk by default. If your program puts them in a lower tier without documented justification, that's a gap a Food Safety Preventive Controls Alliance (FSPCA)-trained auditor will find — and so will an FDA investigator.

Supplier Approval and Monitoring

The approval step matters less than the ongoing monitoring, and this is where I see the most drift. Companies do a solid job onboarding a supplier — they get the audit, the food safety plan, the COA template — and then they treat that supplier as perpetually approved until something goes wrong.

The regulation doesn't allow for perpetual approval without re-verification. 21 CFR § 117.430(e) requires that verification activities be conducted at the frequency specified in the written procedure, and that the procedure be reviewed and updated when there is a change in the supplier, the ingredient, or the risk profile.

A supplier recall is a risk profile change. Full stop. If California Dairies, Inc. issues a Salmonella-related recall, every facility that received milk powder from that supplier in the relevant date range has a regulatory obligation to re-evaluate their supply-chain program and take corrective action.

The practical implication: your supplier monitoring program should include a mechanism for capturing supplier recall notifications in near-real time. FDA's Recall Database is publicly searchable. Industry recall alert services exist. If you're not monitoring those signals actively, you're relying on your supplier to notify you — and that notification may come after product has already shipped.

Incoming Lot Testing

Certificate of Analysis (COA) review is not testing. I say that plainly because many facilities treat COA acceptance as equivalent to a pathogen verification step, and it isn't. A COA reflects the supplier's data, which may be accurate and may not be. The only way to independently verify the safety of a high-risk ingredient is to test it yourself or to have an accredited third-party laboratory test it for you.

For dairy powder ingredients with Salmonella risk, incoming lot testing at a meaningful sampling frequency is the control that would most directly have caught this problem. The FDA's Bacteriological Analytical Manual (BAM) methods for Salmonella in dairy matrices are well-established. A positive result on an incoming lot triggers hold-and-investigate — no product ships.

The cost of lot-level testing for high-risk ingredients is real. I understand that. But the cost of a recall — including the FDA-mandated corrective action, the reputational damage, the retailer chargebacks, and in severe cases the consent decree implications — dwarfs it by an order of magnitude. The math isn't close.

Building the Food Safety Plan That Actually Works

Under FSMA, every covered facility must have a written Food Safety Plan that includes a hazard analysis, preventive controls, monitoring procedures, corrective action procedures, verification procedures, and a recall plan. The regulation at 21 CFR § 117.126 is specific about what the plan must contain.

The recall plan requirement at § 117.126(b)(1)(vii) often gets treated as a formality — a template document that satisfies the checklist but hasn't been tested or integrated into operations. A recall plan that hasn't been practiced is not a functioning system; it's a document. The difference becomes apparent very quickly when an actual recall event begins.

Here's what a genuinely functional food safety plan includes that many facilities miss:

Lot traceability to the ingredient level. If you can't identify, within a few hours, which finished product lots contain ingredients from a specific supplier lot, your recall plan is already behind. One-step-back, one-step-forward traceability is a legal requirement under 21 CFR § 1.345 and § 1.350 (the Traceability Rule, with compliance required for certain high-risk foods by January 20, 2026). For pita chips with dairy-based seasonings, that traceability chain needs to connect the finished product case to the seasoning blend lot to the dairy powder lot from the ingredient supplier.

Defined hold authority. The food safety plan should designate specific individuals who have authority to place product on hold without additional approval. When a supplier recall notification arrives at 4 PM on a Friday, the hold decision cannot wait for a Monday morning management meeting. Someone needs to have the authority and the protocol to act that night.

Pre-established testing laboratory relationships. If your corrective action procedure says "send samples to a qualified laboratory," you should already know which laboratory, what the submission requirements are, what the turnaround time is, and what the decision tree looks like while you're waiting for results. Working that out during an active recall event adds days you don't have.

Communication templates. FDA expects timely notification when a recall is necessary. Having communication templates pre-built — for FDA, for distribution customers, for retail accounts, and for consumers — reduces the lag between the decision to recall and the actual notification.

The Regulatory Timeline That Matters Now

Several regulatory developments in 2025–2026 are directly relevant to the risk profile this recall illustrates.

FSMA Traceability Rule. The FDA's final rule on Food Traceability (21 CFR Part 1, Subpart S) established a compliance deadline of January 20, 2026, for entities subject to the rule. Foods on the Food Traceability List (FTL) require enhanced recordkeeping across the supply chain, and while baked pita chips are not currently on the FTL, dairy ingredients and certain processed foods have been the subject of ongoing FDA consideration for future FTL additions. Facilities that haven't confirmed their traceability obligations under the current rule should do so now.

FDA's Increased Scrutiny of Low-Moisture Foods. The FDA has publicly signaled, through its New Era of Smarter Food Safety initiative and its fiscal year 2025–2026 compliance priorities, that low-moisture food facilities remain a focus of inspection activity. Facilities producing dry snacks, seasoned chips, and flavored crackers with dairy or spice-based seasonings are in a category that FDA has identified as higher-risk for pathogen contamination.

FSPCA Preventive Controls Training. If your Preventive Controls Qualified Individual (PCQI) — required under 21 CFR § 117.4 — hasn't had refresher training in the past two years, now is a reasonable time to revisit it. The FSPCA curriculum has been updated to reflect enforcement trends, and the expectations around supply-chain program documentation have tightened meaningfully since the initial compliance deadlines in 2016–2018.

What I Tell Clients Who Are in This Position

When a client comes to me after a supplier recall notification and they're trying to figure out what they're obligated to do, the conversation usually moves through four questions:

Do we have affected ingredient in inventory or in finished product? Answer this first. Pull lot records now, before anything else.

Did our hazard analysis identify the hazard in this ingredient? If yes, the supply-chain program should have a corrective action procedure that tells you what to do. Follow it and document that you followed it. If no — if the hazard analysis didn't address Salmonella in this ingredient — you have a more significant problem, and you need a PCQI to help you conduct an emergency reassessment.

Have we contacted our supplier and obtained the full scope of the recall? Date ranges, lot numbers, affected product lines — you need this information in writing from the supplier, and you need it confirmed against your own receiving records.

Do we need to notify FDA? If you have distributed product that you have reason to believe may be adulterated, you have an obligation to consult your recall plan and, if appropriate, initiate contact with FDA's Office of Regulatory Affairs. Do not make this decision alone if you're uncertain — get experienced regulatory counsel involved.

The Honest Bottom Line

The Legacy Snack Solutions recall is a clean case study in how a supplier failure becomes a finished product recall. The ingredient came in contaminated, the control that would have caught it didn't function as needed, and the result was a voluntary recall of a retail product that had nothing wrong with it except its seasoning's supply chain.

In my view, the most important thing snack manufacturers can take from this event is a specific question to ask about their own programs: if your highest-risk ingredient supplier issued a Salmonella recall today, what exactly would happen in your facility in the next six hours?

If you can answer that question with a specific procedure, specific names, and specific documented steps, your program is in reasonable shape. If the answer is "we'd figure it out," that's the gap worth closing — before FDA closes it for you.

Certify Consulting works with food manufacturers at every scale on FSMA Preventive Controls implementation, food safety plan development, and supplier qualification programs built to withstand FDA scrutiny. If you'd like to assess where your program stands, contact us at certify.consulting.

Source: FDA Recall Notice — Legacy Snack Solutions, May 7, 2026. Available at FDA.gov.

Last updated: 2026-06-08