Most recall plans fail the same way. They are written to satisfy an auditor, filed, and never tested, so the first time anyone reads the document properly is the day it is needed, when it turns out to name three people who have left and a phone number that no longer works.
A usable recall plan is short, specific, and rehearsed. This is the structure we see work, followed by a checklist for the first 72 hours.
Section 1: Trigger and classification
Define what constitutes a recall event, and who is authorised to declare one. Ambiguity here is the single most common cause of delay, because nobody wants to be the person who escalated unnecessarily.
- The signal sources you monitor: consumer complaints, warranty claims, field failure data, supplier notifications, regulator alerts, and social listening.
- The threshold that converts a signal into an investigation, expressed in numbers rather than judgement.
- Who can declare a recall, and who deputises when that person is unavailable. Name a role and a person, and review it quarterly.
- Your classification framework and what each class obliges you to do. For medical devices and food this maps to the FDA Class I, II, and III scheme, where Class I means a reasonable probability of serious harm or death.
Section 2: The recall team
Name roles, not departments. A department cannot be phoned at midnight.
- Recall lead, with authority to spend and to stop shipments.
- Regulatory contact, who owns the relationship with each authority in scope.
- Quality and engineering, who own the defect analysis and the affected-product list.
- Communications, who own the press release, the holding statement, and the consumer-facing copy.
- Legal, who sign off on wording and on what is admitted.
- Operations and logistics, who own parts, replacements, returns, and the warehouse.
- Customer contact, who own the contact centre and its scripts.
- Digital, who own the recall website and the data coming out of it. This role is the one most often missing from plans written before the recall.
For each role record a name, a deputy, a mobile number, and an out-of-hours escalation path. Review it on a fixed schedule.
Section 3: Traceability and the affected-product list
The single most valuable thing you can do before an incident is confirm that you can produce a structured affected-product list quickly. Not a PDF. A queryable dataset.
- Which identifier scheme applies to each product line: VIN, serial, model, SKU, batch, lot, or date code.
- How a defect maps to that identifier. If a supplier component fault maps to a production window rather than a serial range, your list is a date-range query and your lookup has to support that.
- How long it takes to produce the list today. Time it. If the honest answer is days, that is your critical path and it is worth fixing before you need it.
- How much of the affected population you can contact directly, from registration, warranty, loyalty, or dealer records.
Section 4: Notification
Pre-write as much as you can. Under time pressure, editing a draft is far faster and far safer than starting from a blank page.
- Regulator notification templates for each authority in scope, with the reporting deadline recorded next to each.
- A holding statement for the first hours, before full scope is known.
- The consumer notice: direct mail, email, and SMS variants.
- The press release, and the point-of-sale notice for retailers.
- Retailer and distributor notifications, including instructions to stop sale and quarantine stock.
- Internal briefing and contact centre scripts, including what staff must not say.
Every one of these should point to the same place: the recall website. Consistency across channels is what stops consumers guessing at URLs and landing on lookalike domains.
Section 5: The consumer-facing website
This section is missing from most plans, which is why it is usually the thing that delays the announcement. Decide these in advance.
- The domain. Use your own, or a dedicated recall subdomain of it. Confirm now who controls DNS and how quickly they can act out of hours.
- Which identifier the lookup uses, and what happens when a consumer cannot find their code.
- What the three outcomes say: affected, not affected, and cannot determine.
- What the registration form collects, and which fields are legally required in each market.
- Whether the remedy involves reimbursement, and therefore whether you need receipt capture and payment details.
- Data residency: if the recall covers the EU, whether you need a separate EU deployment.
- Who builds and hosts it, and how fast they can move. This is a decision to make before the incident, not during it.
We build recall portals as a specialism and deploy them fully live on the client domain in under 24 hours once content and affected-product data are supplied. If the build partner is the open question in your plan, that is what this page covers.
Section 6: Remedy and logistics
Decide the remedy options your product lines could plausibly need, and what each one requires operationally: parts availability, replacement stock, refund authority and limits, return label and carrier arrangements, collection booking, and disposal or destruction certification where the product cannot be returned.
Record the approval limits now. A recall stalls quickly when every refund above a threshold needs a signature from someone who is in a different timezone.
Section 7: Effectiveness and closure
Define what you will measure, how often you will report it, and what completion rate constitutes success for each class of recall. Effectiveness checks are what allow a recall to be closed, and they depend on data captured while the programme runs rather than reconstructed afterwards.
- Response rate: what proportion of the affected population has come forward.
- Completion rate: what proportion has actually received the remedy.
- Reporting cadence per regulator.
- The criteria for closing the recall, and who signs it off.
Section 8: Mock recalls
A mock recall is a rehearsal. A traceability exercise is a narrower test of whether you can follow a batch forwards and backwards through your records. They are related but not the same thing, and a plan that only ever tests traceability has not tested the plan.
Run at least one mock recall a year. Time it end to end and record the honest numbers.
- How long to produce the structured affected-product list.
- How long to reach every named person on the recall team.
- How long to produce approved consumer-facing copy.
- How long to get a working lookup in front of consumers.
- What proportion of the affected population you could contact directly.
The first 72 hours: checklist
Hours 0 to 12, contain and confirm:
- Convene the recall team and confirm the lead.
- Stop shipment and quarantine stock in the channel.
- Confirm the defect, the harm, and the conditions under which it occurs.
- Produce the structured affected-product list.
- Determine markets, regulators, and reporting deadlines.
- Decide the remedy.
- Issue the internal briefing and a holding statement.
Hours 12 to 36, build and notify:
- File regulator notifications inside the deadline.
- Brief the recall portal build with content, affected-product data, and DNS access.
- Draft and approve the consumer notice, press release, and contact centre scripts.
- Brief the contact centre and staff the expected volume.
- Notify retailers and distributors with stop-sale instructions.
- Confirm remedy logistics: parts, stock, labels, carriers.
Hours 36 to 72, announce and operate:
- Take the recall website live on your domain and verify the lookup against known-affected and known-unaffected identifiers.
- Confirm rate limiting, WAF, and monitoring are armed before the announcement.
- Announce, with every channel pointing at the same URL.
- Watch the first-hour traffic and error rates in real time.
- Begin direct notification to contactable owners.
- Start daily reporting on lookups, registrations, and completions.
Once you are past 72 hours the programme becomes a queue to work down, an expansion to prepare for, and an effectiveness number to move. The plan’s job is to get you to that point without improvising.
Related reading: how to handle a product recall and product recall portal development.