Salmonella Controls That Prevent Chocolate Recalls

When a chocolate manufacturer voluntarily expands a recall due to possible Salmonella contamination — as Spring & Mulberry did in May 2026 — the instinct is to read it as someone else's problem. It rarely is. The same gaps that open the door to a Salmonella event in one facility exist, in varying degrees, across dozens of others producing similar products. In my view, the more useful question is not "what happened to them?" but "what would have stopped it?"

That is what this article is about — the specific controls, testing protocols, and quality system requirements that, when properly implemented, make this kind of event far less likely.

Why Chocolate Is a High-Risk Environment for Salmonella

Salmonella in chocolate is not a new story. The FDA has documented multiple chocolate-related Salmonella outbreaks going back decades, including a notable multi-country outbreak linked to contaminated cocoa powder in 2022 that sickened more than 150 people across at least 10 countries. The pathogen survives in low-moisture, high-fat environments far longer than most manufacturers expect — studies have found Salmonella viable in chocolate for over 12 months under normal storage conditions.

This is what makes chocolate genuinely tricky. The fat content creates a protective matrix around Salmonella cells, and the low water activity (typically aw < 0.5) does not kill the organism — it just slows its growth while keeping it alive and infectious at very low doses. The infectious dose for Salmonella in high-fat foods is estimated to be as low as 1–100 CFU/gram, compared to much higher thresholds in aqueous environments.

So the baseline risk is real, and it is built into the ingredient profile. The question is what a well-run operation does about it.

The Regulatory Framework: What FDA Actually Requires

The legal foundation here is 21 CFR Part 117 — Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food, commonly called the FSMA Preventive Controls rule. It has been fully in effect for most manufacturers since September 2016, with compliance deadlines staggered by facility size.

Under 21 CFR Part 117, Subpart C, manufacturers of foods where a known or reasonably foreseeable hazard exists — and Salmonella in chocolate ingredients absolutely qualifies — are required to:

• Identify the hazard through a written Hazard Analysis (21 CFR §117.130)
• Establish process preventive controls, allergen controls, or supplier controls to address the hazard (21 CFR §117.135)
• Validate that those controls are capable of controlling the hazard (21 CFR §117.160)
• Implement monitoring, corrective action, and verification procedures (21 CFR §117.145–§117.155)
• Maintain records sufficient to document all of the above (21 CFR §117.190)

The rule does not give manufacturers the option to acknowledge a hazard and then decide not to control it. If Salmonella is reasonably foreseeable — and in a product containing cocoa, it is — a documented, validated control must exist.

When a recall happens, it is almost always traceable to a gap in one or more of these five requirements. The facility may have identified the hazard but failed to validate the kill step. Or they validated the process but did not verify it was working during production. Or their supplier controls looked good on paper but were never actually confirmed through testing or audits. The recall is downstream evidence of an upstream gap.

What a Preventive Controls System Actually Looks Like

Supplier Verification for High-Risk Ingredients

Cocoa powder, cocoa liquor, and other raw botanical ingredients are the most common entry point for Salmonella in a chocolate facility. Under 21 CFR §117.135(c)(2) and §117.136, supplier controls are a required preventive control category when the hazard in a raw material will not be controlled by a subsequent process step at your facility — or when you are relying on your supplier to have controlled it.

A compliant supplier verification program for a high-risk ingredient like cocoa powder includes:

The key word in that table is "independent." A CoA from your supplier tells you what their lab found. It does not tell you what is actually in the lot you received. For a pathogen like Salmonella, where even a single contaminated lot can trigger a recall, relying solely on supplier-provided CoAs is a documented pattern in recall investigations — and FDA inspectors know to look for it.

Environmental Monitoring Programs (EMPs)

An Environmental Monitoring Program is one of the most direct tools a food manufacturer has for detecting Salmonella before it reaches a finished product. The logic is straightforward: Salmonella does not appear in finished product unless it is present somewhere in the environment first. A well-designed EMP finds it in the environment — drains, floors, equipment harborage points, air handling — and triggers corrective action before product is affected.

Under FDA's 2022 draft guidance on Environmental Monitoring (finalized guidance expected through 2025–2026), effective EMPs for Salmonella-risk environments include:

• Zone 1 sampling: Direct product contact surfaces
• Zone 2 sampling: Equipment surfaces near Zone 1
• Zone 3 sampling: Non-product-contact surfaces within the production area
• Zone 4 sampling: Remote areas (entryways, break rooms, drains at facility perimeter)

Most facilities that experience Salmonella recalls have either no EMP, an EMP that is too narrowly focused on Zone 1 only, or an EMP where positive results were handled as isolated incidents rather than triggers for a broader root-cause investigation. According to FDA's FSMA enforcement data, environmental controls are among the most frequently cited deficiencies during food facility inspections.

Process Validation for Kill Steps

If your process includes a thermal kill step — roasting, conching at high temperature, or any other heat treatment — that step must be validated to demonstrate it achieves the required log reduction for Salmonella. This is not a suggestion under 21 CFR §117.160; it is a requirement.

Validation means you have scientific evidence, generated under conditions representative of your actual process, that the step consistently achieves the target lethality. A common mistake I see is facilities that have internal temperature records showing they hit their target temperature, but no validation study demonstrating that temperature actually produces the required kill. Those are two different things, and FDA distinguishes between them.

For chocolate specifically, the complexity is that heat treatment of cocoa ingredients typically happens upstream of final formulation, and post-roast recontamination is a documented mechanism in recalls. This means kill-step validation alone is insufficient — you also need controls to prevent recontamination after the kill step, including hygienic zoning, one-way flow, and dedicated equipment for post-lethality handling.

Hygienic Zoning: The Control Nobody Implements Early Enough

Hygienic zoning is the practice of physically and operationally separating areas of a facility based on their risk profile. In chocolate manufacturing, the critical separation is between raw ingredient handling areas (where Salmonella may be present) and post-process handling areas (where it must not be present).

The FDA's draft guidance on sanitary transportation and facility design, along with GFSI benchmark standards including SQF Edition 9 and FSSC 22000 Version 6, all treat hygienic zoning as a foundational prerequisite. Key elements include:

• Physical barriers (walls, doors, positive pressure differentials) between raw and finished product areas
• Separate personnel flow — gowning changes, footwear controls, or dedicated personnel by zone
• Dedicated equipment and utensils that do not cross zone boundaries
• Documented cleaning and sanitation procedures differentiated by zone risk level

In my experience working with food manufacturers across the country, hygienic zoning is the control that gets underestimated most consistently in smaller and mid-size operations. The facility was not designed with it in mind, adding it feels expensive or disruptive, and so it gets deferred. Then an environmental positive surfaces, or a recall happens, and the retrofit ends up costing far more than the original investment would have.

Testing Finished Product: Necessary But Not Sufficient

Finished product testing for Salmonella is a common practice, but it is worth being honest about what it can and cannot do. A negative finished product result does not prove the lot is Salmonella-free — it proves the samples tested were negative. Given the statistical limits of sampling (typically n=5 to n=60 depending on the protocol and lot size), finished product testing has real detection limits, particularly when contamination is sporadic rather than uniform.

The FDA's Bad Bug Book and ICMSF sampling guidelines are clear that finished product testing functions as verification, not as a primary control. Relying on finished product testing as your main Salmonella control is a compliance gap under 21 CFR Part 117, and it is a gap that has been cited in multiple Form 483 observations I have reviewed.

This does not mean skip finished product testing. It means do not let it substitute for upstream controls. The hierarchy that actually works:

1. Supplier controls (prevent Salmonella from entering your facility)
2. Process controls with validated kill steps (eliminate Salmonella during production)
3. Hygienic zoning and sanitation controls (prevent post-process recontamination)
4. Environmental monitoring (detect harborage before product is affected)
5. Finished product testing (verification that upstream controls are working)

When a recall happens, it is usually because a facility was relying on step 5 to do the work of steps 1 through 4.

Record-Keeping and Traceability: What Makes a Recall Manageable

Here is something that does not get enough attention: when a recall does happen — and over a long enough timeline, events do happen even in well-run facilities — the quality of your record-keeping determines whether the recall is a targeted, manageable event or a sprawling, brand-damaging expansion.

The Spring & Mulberry situation involved an expansion of a previously announced recall. Recall expansions typically happen for one of two reasons: either the original scope was defined by product codes and the lot traceability was insufficient to bound the risk, or the investigation revealed the contamination source was broader than initially identified. Either way, strong traceability systems narrow the scope.

Under 21 CFR Part 1, Subpart J (the FSMA Traceability Rule, with compliance deadlines for most manufacturers by January 20, 2026), food manufacturers are now required to maintain Key Data Elements (KDEs) at Critical Tracking Events (CTEs) for foods on the Food Traceability List — which includes foods with a history of Salmonella risk. This rule became a compliance deadline that many facilities are still working toward.

A traceability system that can answer "which finished lots contain ingredient lot X?" in under four hours is not just a compliance checkbox — it is the difference between recalling 12 cases and recalling 12,000.

Practical Steps to Assess Your Own Exposure

If you manufacture products containing cocoa, tree nuts, spices, or other low-moisture ingredients with a documented Salmonella history, here is where I would start an honest gap assessment:

Review your Hazard Analysis. Is Salmonella listed as a known or reasonably foreseeable hazard for each relevant ingredient? If the answer is "we rely on our supplier to control it," make sure your supplier verification program is actually documented and being executed — not just described in a policy.

Pull your last EMP summary. When did you last have an environmental positive? How was it investigated? Was root cause identified and corrected, or was the result treated as an isolated anomaly?

Check your process validation records. For every kill step in your process, does a validation study exist? Was it conducted under production conditions, not ideal laboratory conditions?

Audit your hygienic zoning. Walk the facility and trace the path from raw ingredient receiving to finished product packaging. Where do personnel, equipment, and air cross from raw to post-process areas? Those crossing points are your risk profile.

Test your traceability. Run a mock recall. Pick a raw material lot number and see how long it takes your team to identify every finished product lot that contains it. If the answer is longer than four hours, that is a gap worth closing before FDA asks the same question under less favorable circumstances.

If you find gaps across more than two of these five areas, you are operating with meaningful exposure. The good news is that all of them are fixable with the right systems and the right support.

At Certify Consulting, we have helped more than 200 food and pharmaceutical manufacturers close exactly these kinds of gaps — and every single one of our clients has passed their first-time audit. Explore our food safety compliance services to see how we approach this work.

A Note on GFSI Certification as a Verification Layer

For chocolate manufacturers selling into major retail and foodservice channels, GFSI-benchmarked certification (SQF, FSSC 22000, BRC, or similar) provides an additional layer of third-party verification that your controls are actually working. The SQF Edition 9 standard, for example, requires documented environmental monitoring programs, validated process controls, and hygienic zoning assessments as certification prerequisites — meaning a third-party auditor has confirmed those systems exist and are functioning.

GFSI certification does not make recalls impossible, but it meaningfully reduces the probability of the upstream gaps that cause them. If you are manufacturing chocolate or confections and you are not yet certified to a GFSI-benchmarked standard, that conversation is worth having soon — particularly given FDA's increasing scrutiny of low-moisture food facilities following a string of high-profile Salmonella recalls over the past three years.

Learn more about GFSI certification pathways and what to expect from the audit process on our site.

Source reference: FDA recall announcement, Spring & Mulberry voluntary recall expansion, May 8, 2026. Available at fda.gov/safety/recalls-market-withdrawals-safety-alerts.

Last updated: 2026-05-18