FSMA 204 is here. Most cold chains still can't prove a sanitation log.

The FDA's Food Traceability Rule — FSMA 204 — moves the burden of proof onto operators. It's no longer enough to do the work; you have to be able to show it, quickly, in a form an inspector trusts. For facilities still running on binders, spreadsheets, and photos buried in group chats, that's a problem hiding in plain sight.

What the rule actually asks for

At its core, FSMA 204 requires that you maintain Key Data Elements for Critical Tracking Events and produce them — in many cases within 24 hours of a request. For facility services, the practical translation is simple but unforgiving: every sanitation, maintenance, and pest-control task needs a record that ties what was done to when, where, and by whom, and that record has to be retrievable on demand.

Three things trip teams up:

• Retrievability. The data may exist, but if it takes three days to assemble from four systems, you've already failed the spirit of the rule.
• Integrity. A photo with no timestamp, geolocation, or signature is an assertion, not evidence. Inspectors increasingly know the difference.
• Completeness. One missing signature on one shift can unravel an otherwise clean record set.

Why the group-chat approach fails

The most common "system" we see in the field is a messaging thread: a tech snaps a before/after photo and posts it. It feels like proof. It isn't. There's no enforced link between the photo and the specific task and SOP it satisfies, no tamper-evidence, and no way to assemble a defensible record for a date range without manual archaeology. When the inspector arrives, the week before is spent reconstructing a paper trail from memory and screenshots.

What "audit-ready" looks like instead

Audit-ready means the record is born complete and sealed at the moment of work — not reconstructed afterward. Each task is captured against its SOP, with required photos and readings enforced, signed by the technician, and written to an append-only ledger with a hash, a timestamp, and a location. When a request comes in, you select a window and a site and export a sealed pack. Minutes, not days.

A practical checklist

• Can you produce every sanitation record for a single site, last 30 days, in under an hour?
• Does each record prove who performed it and against which SOP?
• Can you demonstrate that a record hasn't been altered since it was created?
• Are out-of-spec events flagged with the corrective action attached?

If any answer is "not quickly," the gap isn't your team's diligence — it's the absence of a proof layer. FSMA 204 didn't create the work; it made the evidence of the work non-optional.