Salmonella Controls That Prevent FDA Dairy Recalls

Stoltzfus Family Dairy of Vernon Center, NY recently issued a voluntary recall of Sour Cream & Onion cheese curds due to potential Salmonella contamination — and if you make dairy products, the more important question isn't what went wrong there, but what controls make this outcome preventable at your facility.

A recall notice is the end of a story that started earlier, usually in a food safety plan gap, an untested ingredient, or an environmental monitoring program that never quite got off the ground. The good news is that each of those gaps has a regulatory solution, and most of them have been required under federal law since 2017.

The Regulatory Foundation: What FSMA Actually Requires

The Food Safety Modernization Act shifted FDA's posture from reaction to prevention. For food manufacturers including dairy operations, the governing rule is the Preventive Controls for Human Food rule, codified at 21 CFR Part 117. Compliance deadlines have passed for all but the smallest operations:

• Large businesses (500+ employees): required since September 19, 2016
• Small businesses (fewer than 500 employees): required since September 18, 2017
• Very small businesses (less than $1M in annual sales plus inventory value): required since January 1, 2018

Under 21 CFR Part 117, covered facilities must conduct a written hazard analysis identifying biological, chemical, physical, and radiological hazards that are reasonably likely to occur; implement preventive controls for any hazard that requires one; establish monitoring and corrective action procedures; and maintain a documented food safety plan that ties all of it together.

For a dairy operation making flavored cheese curds, Salmonella is a required entry in the hazard analysis. It is a well-documented biological hazard in dairy environments, a recognized risk in dry seasoning ingredients, and FDA has seen it in this product category before. If the hazard is not documented, that is a compliance problem. If it is documented but lacks effective controls, that is the more common version of the same problem.

The Ingredient Control That Dairies Most Often Skip

Cheese curds are simple — milk, cultures, rennet, drain. But "Sour Cream & Onion" is not simple. That label likely represents sour cream powder, onion powder, salt, citric acid, and flavor enhancers, each from a separate supplier with its own risk profile.

Dry seasoning ingredients are one of the most underappreciated Salmonella vectors in the food industry. Onion powder has been implicated in multiple Salmonella outbreaks. Cumin, paprika, pepper — the list of dry spice recalls over the past decade is longer than most small manufacturers realize, and FDA's enforcement history on this point is consistent.

Under 21 CFR Part 117 Subpart G — Supply Chain Program — if your hazard analysis identifies a biological hazard in an ingredient that is controlled by your supplier rather than by your own process, you are required to:

• Establish documented criteria for approving suppliers
• Conduct supplier verification activities (audit, COA review, or product testing)
• Document those activities and review them on a defined schedule

A Certificate of Analysis on file is not a supplier verification program. That distinction matters during an FDA inspection, and it matters a great deal when a contaminated seasoning batch reaches finished product.

Environmental Monitoring: The Test Most Small Dairies Underinvest In

An environmental monitoring program (EMP) involves regular sampling of manufacturing surfaces, equipment, drains, and facility areas for indicator organisms and pathogens. Under FSMA, an EMP is required when the hazard analysis identifies a pathogen that could be introduced through the processing environment and that pathogen is not fully controlled by a process step.

For a fresh dairy operation, that requirement almost certainly applies. The CDC estimates Salmonella causes approximately 1.35 million infections, 26,500 hospitalizations, and 420 deaths in the United States each year — making it one of FDA's highest-priority biological hazards. Fresh cheese products, which have minimal processing steps after pasteurization, carry a direct exposure pathway if environmental contamination is present.

A zone-based EMP would sample across four areas:

• Zone 1 (food-contact surfaces): highest priority, most frequent testing
• Zone 2 (near-product, non-contact surfaces): moderate frequency
• Zone 3 (non-food-contact equipment): quarterly or as-needed
• Zone 4 (general facility areas and drains): periodic

The critical part is not the sampling — it is what happens when a result comes back elevated. An EMP without defined corrective action thresholds and response procedures gives you data with nowhere to go. That is not a monitoring program; it is an audit liability.

Pasteurization Does Not Cover Everything

Pasteurization eliminates Salmonella in raw milk. The process is well-established, the science is solid, and when it is properly validated and monitored, it works reliably. But pasteurization is the first line of defense, not the complete story.

Post-pasteurization contamination is a documented phenomenon in dairy manufacturing. Once pasteurized curd enters the production environment, it is exposed to equipment surfaces, personnel, and ingredients. If Salmonella-positive seasoning is added after pasteurization, the thermal kill step becomes irrelevant — the contamination entered downstream of it.

This is precisely why 21 CFR Part 117 requires a hazard analysis that covers every process step, not just the heat treatment. A HACCP-aligned food safety plan that identifies the seasoning addition as a potential biological hazard point — and addresses it with a corresponding preventive control — is exactly what the regulation was designed to produce.

Under the Pasteurized Milk Ordinance (PMO), Grade A dairy operations have additional sanitation requirements administered at the state level. Most small cheesemakers are subject to both the PMO and FSMA simultaneously. The frameworks overlap, but neither creates an exception for the other.

What Lot Hold and Release Programs Actually Do

A finished-product hold and release program keeps product from reaching consumers until testing confirms it meets safety specifications. The economics feel tight for a perishable product with a short shelf life — but the cost comparison deserves a direct look.

The average cost of a food recall in the United States exceeds $10 million for large companies, and that figure dramatically understates the impact for small manufacturers where a single recall event can mean permanent closure. A lot hold program that catches contamination before distribution is, by comparison, a manageable operating cost.

Here is what the spectrum of control looks like in practice:

Where Small Dairy Operations Most Commonly Have Gaps

I have worked with enough small food manufacturers to have a clear sense of where documentation typically ends and assumption begins. The gaps are not usually the result of carelessness — they come from compressing a large-company food safety program into a small team's capacity, and some pieces do not survive that compression.

The most common gaps I find in small dairy operations:

Hazard analysis that stops at pasteurization. The process control for raw milk is documented and validated. The seasoning addition step, the packaging environment, and the finished product hold are underdocumented or missing entirely from the hazard analysis.

Supplier verification in name only. COAs are collected. The verification schedule, approval criteria, and out-of-spec response procedure do not exist on paper — which means they do not exist from a regulatory standpoint either.

Environmental monitoring with no corrective action protocol. Swabs go out, results come back, and elevated indicator counts get noted in a log rather than triggering a defined response. FDA expects to see both the data and the documented response procedure.

No written food safety plan. Under 21 CFR Part 117, this has been required since 2017 for most facilities. It continues to surface as a finding in FDA inspections of small manufacturers.

Mock recalls that have never been run. A written recall plan satisfies the regulatory requirement. Actually running a mock recall to verify that your lot traceability links ingredients to finished product — that is what tells you whether the system would work. Most small operations have the plan; very few have tested it.

A Practical Starting Point

In my view, the single most valuable thing a small dairy can do this year is commission a formal gap assessment against 21 CFR Part 117. The assessment reviews the current food safety plan against the regulatory requirements, identifies where controls are missing or insufficient, and produces a remediation plan that a small team can realistically execute.

For flavored dairy products specifically, the supply chain program is typically the highest-risk gap. Getting seasoning suppliers on a verification schedule, ensuring COAs are reviewed against your own specification rather than simply filed, and adding periodic independent ingredient testing — these are changes that significantly reduce exposure and do not require capital investment to implement.

A manufacturer with an effective food safety plan, a functioning supplier verification program, and an active environmental monitoring program is very unlikely to experience a Salmonella recall — not because the hazard disappears, but because the controls are designed to catch it before it reaches product.

At Certify Consulting, I have helped over 200 food manufacturers — including small dairy operations navigating both PMO and FSMA requirements simultaneously — develop programs that hold up under FDA inspection. If you are assessing your food safety program or preparing for an upcoming audit, our FDA compliance consulting services at certify.consulting are a practical starting point.

For a broader look at how quality management systems integrate with FSMA requirements, our quality systems consulting resources cover the full scope of what FDA expects from a covered facility.

Compliance Checklist: Salmonella Prevention for Dairy Manufacturers

If you manufacture dairy products subject to 21 CFR Part 117, here is where to start your self-assessment:

• [ ] Written food safety plan exists and is current (21 CFR Part 117 Subpart C)
• [ ] Hazard analysis covers all process steps, not only pasteurization
• [ ] Biological hazards documented for each ingredient, including dry seasonings
• [ ] Supplier verification program documented and operational for ingredients with biological hazard risk (21 CFR Part 117 Subpart G)
• [ ] Environmental monitoring program in place with defined zones, sampling frequency, and corrective action thresholds
• [ ] Finished product lot hold and release procedure documented and followed
• [ ] Mock recall conducted and documented within the last 12 months
• [ ] Corrective action records maintained, reviewed, and tied to root cause

According to a recent FDA recall notice, Stoltzfus Family Dairy of Vernon Center, NY issued a voluntary recall of Sour Cream & Onion cheese curds due to potential Salmonella contamination, with heightened risk for young children, the elderly, and immunocompromised individuals.

Last updated: 2026-06-01