Record Control & Retention Guide Food Safety | GIFSQ

How to Control Records and Set Retention That Survives Scrutiny

The recall hits, and the first question is “show me the records” — the production records for the implicated lots, the supplier records, the testing, the distribution. The company that retrieves them in the hour responds decisively; the one that hunts through the disorganized archive for the week responds too late. Records are the food safety system’s memory, and the amnesiac company can’t defend itself.

Record control covers the full lifecycle: the creation (the right records, completed properly), the storage (the protected, organized), the retention (the long enough), and the retrieval (the fast when it matters). This guide builds it.

The record system’s quality is the food safety system’s honesty made visible. The complete, contemporaneous, retrievable records tell the auditor that the operation is what it claims to be; the backfilled, disorganized, missing records tell the opposite story. The record control investment is the credibility investment — it pays out in every audit, every incident, and every customer query.

Step 1: Define Which Records Matter

Not everything written down is a food safety record — but everything that evidences the system’s operation is. The record inventory lists them: the CCP monitoring records, the corrective action records, the verification records, the supplier approval records, the training records, the audit records, the calibration records, the traceability records, the management review records, the complaint and incident records.

The inventory — per process area, documented — is the control’s foundation. The record nobody inventoried is the record nobody protects, retains, or can retrieve. The auditor’s traceability exercise tests the inventory’s completeness: every link in the chain needs its record.

Step 2: Design Records for Completeness

The record’s design determines whether it gets completed properly. The good form: the every-field-necessary (no decorative fields), the clear identification (the product, lot, date, time, operator), the result fields with the units, the specification or limit shown for the comparison, the sign-off and the review signature, and the space for the deviations and comments. The form that makes the right completion easy gets completed right.

The electronic records need the design discipline too: the mandatory fields, the range checks, the automated timestamps, the user identification. The paper records need the physical practicality: the form that fits the clipboard, survives the production environment, and can be filled with the gloved hand.

Step 3: Enforce the Completion Discipline

The record completed properly means: filled in at the time of the activity (not the end of shift from memory), by the person who did it, legibly, completely, with errors corrected properly — a single line through, initial, and date, never obscured. The backfilled record — the week’s monitoring filled in on Friday — is the data integrity failure.

The supervision verifies the completion: the supervisor’s review signature means the records were actually reviewed — the anomalies questioned, the gaps addressed — not just signed. The review catches the patterns: the identical readings suggesting the fabrication, the missing entries, the uncorrected errors. The completion discipline is the culture, enforced daily.

Step 4: Set Retention Periods With Justification

The retention periods reflect the requirements: the regulatory minimums (which vary by jurisdiction and product — the one-year-past-shelf-life rules, the specific mandates), the customer requirements (often longer), the legal liability horizon, and the business need. The retention schedule lists every record type with its period and the justification.

The rule of thumb where no specific requirement exists: the shelf life plus one year, minimum. The short-shelf-life product’s records kept for two years; the multi-year ambient product’s for its life plus. The retention longer than the minimum is the cheap insurance — the storage costs little, the missing record in the incident costs enormously.

Step 5: Store for Protection and Organization

The records — paper and electronic — are stored to survive: the fire protection (the fireproof cabinets or the off-site backup), the environmental protection (the moisture, the pests, the deterioration), the security (the access controlled, the tampering prevented), and the organization (the indexed, the labeled, the findable).

The electronic storage needs the IT discipline: the backups (tested restores, not just the backup jobs), the access controls, the protection against the silent corruption, the migration planning for the format obsolescence. The paper archive needs the physical discipline: the indexed boxes, the location register, the retrieval procedure. The record that can’t be found might as well not exist.

Step 6: Ensure Rapid Retrieval

The retrieval is the record system’s test — and it’s tested by the incidents, not the audits. The target: the complete lot history retrievable within the hours (the recall’s timeline doesn’t wait for the archive hunt). The retrieval procedure — who retrieves, from where, how — is documented and periodically tested.

The indexing makes the retrieval possible: the records organized by the searchable keys — the lot number, the date, the product. The “filing” that’s actually the piling fails the retrieval test. The mock recall’s record retrieval timing is the system’s report card.

Step 7: Manage Corrections and Amendments

The record correction follows the discipline: the original entry preserved (the single line, not the obliteration), the correction initialed and dated, the reason noted where it’s not obvious. The correction pattern is monitored — the frequent corrections to the same record type suggest the form’s design flaw or the training gap, not the individual carelessness.

The retrospective amendment — the record changed after the event — gets the heightened control: the documented reason, the authorized approver, the audit trail (electronic) or the transparent correction (paper). The backdated amendment without the trail is the integrity failure the auditor is trained to find.

Step 8: Dispose Securely at End of Life

When the retention expires, the records are disposed — but the disposal is controlled: the authorization (the records past retention, confirmed), the method (the shredding for the confidential, the secure deletion for the electronic), and the record of the destruction (what was destroyed, when, authorized by whom). The uncontrolled disposal — the records vanished without the trace — is the gap the destruction log prevents.

The legal hold overrides the schedule: the litigation, the regulatory investigation, the incident — the relevant records preserved regardless of the retention expiry. The disposal procedure checks for the holds before destroying. The destroyed-during-investigation record is the obstruction, not the housekeeping.

Practical tips

Inventory everything. Build the per-area record list — the foundation that no record escapes. The unlisted record is the unprotected one.

Design for completion. The necessary fields, the clear identification, the practical format — the form that actually gets filled in right, with the gloved hand, on the production floor.

Retain past the need. Shelf life plus one year minimum — the cheap insurance against the expensive gap. The storage costs little; the missing record in the incident costs enormously.

Retrieve in hours. The indexed, tested retrieval — the incident timeline met, not missed. The mock recall’s retrieval timing is the system’s report card.

Correct transparently. The single line through, the initial, the date — the integrity visible in every correction. The transparent correction builds the auditor’s trust.

Audit-floor lessons

The recall retrieval. When the incident hit, the lot history was retrieved within the hour — and the response was decisive because the records were there. The system was vindicated; the investment repaid itself in the crisis. The retrieval test passed at the moment it mattered.

The backfill finding. An auditor found a week’s records in identical handwriting, all dated Friday — the integrity finding. The discipline got rebuilt from scratch: the at-the-time completion enforced, the supervision reviewing for real. The backfilled record is the finding that keeps echoing.

The missing archive. The 2024 records were requested — and unfindable. The gap was indefensible, and the indexing got implemented afterward, with the retrieval tested. The archive hunt is the lesson nobody wants to learn during the incident.

The correction culture. An auditor noted the transparent corrections across the records — the single lines, the initials, the dates — and the trust was built on the visible honesty. The discipline demonstrates the integrity; the hidden correction destroys it.

The flood test. A burst pipe threatened the paper archive — and the fireproof, waterproof storage held. The records stayed intact. The protection was proven by the disaster that didn’t destroy them. Design the storage for the worst day, not the average one.

Field notes

Memory of the system. Complete, protected, retained, retrievable — the records that defend the company.

Integrity in every entry. At-the-time, transparent, reviewed — the discipline the auditor reads in the records.

Retrieval is the test. Hours, not weeks — the system proven in the mock recall, trusted in the real one.

Common mistakes

The uninventoried record. The evidence nobody listed — unprotected, unretrievable, and forgotten until the incident demands it. Inventory per area, and keep the inventory current. The record that was never listed is the record that can’t be found.

Backfilled records. The week’s monitoring filled in on Friday from memory — the data integrity failure, and the auditor is trained to spot it (the identical handwriting, the too-perfect readings). Enforce the at-the-time completion: filled in when the activity happens, by the person who did it. The backfilled record is the fiction, not the evidence.

Short retention. The records destroyed before the incident that needed them — the defenseless position. Justify every retention period against the regulatory minimums, the customer requirements, and the liability horizon, and err long where no specific requirement exists. The retention longer than the minimum is the cheap insurance.

The archive hunt. The unindexed piling that fails the retrieval test — the lot history unfindable while the recall timeline runs. Index, organize, and test the retrieval: the records organized by the searchable keys, the procedure documented, the mock recall timing the proof. The record that can’t be found might as well not exist.

Silent disposal. The records vanished without a trace — no authorization, no destruction log — and the gap is indefensible. Control the disposal: the authorization confirmed, the method secure, the destruction logged, and the legal holds checked before anything is destroyed. The destroyed-during-investigation record is the obstruction, not the housekeeping.

Checklist

• [ ] Record inventory complete per process area; every system evidence listed
• [ ] Records designed for completeness: necessary fields, identification, limits, sign-offs, practical format
• [ ] Completion discipline: at-the-time, by the doer, legible, proper corrections; supervisor review genuine
• [ ] Retention schedule with justified periods (regulatory, customer, legal, business); shelf life + 1 year minimum rule
• [ ] Storage: fire/environmental/security protection; electronic backups tested; paper archive indexed
• [ ] Retrieval procedure documented and tested; lot history retrievable within hours
• [ ] Correction/amendment discipline; retrospective changes controlled with authorization and trail
• [ ] Disposal authorized and logged; legal holds override the schedule