The sesame batch came off the line at 2 PM. The next run, a garlic sauce with no sesame anywhere in the formula, started at 3. In between, somebody broke down the fill head, ran the CIP cycle, wiped down the hopper, and swapped the hoses. The line was clean.
Now prove it.
Not to yourself. You watched it happen. Prove it to a customer's quality team six weeks from now, or to an inspector standing at the end of the line, or to your own recall workup when a sesame complaint comes in on a jar of the garlic sauce. Every one of those people asks the same question, and none of them will take "I remember cleaning it" for an answer. They want the record. If the record is blank, then as far as the file is concerned, the changeover never happened, and a garlic sauce that ran right behind sesame is now a garlic sauce with an undeclared allergen risk you cannot rule out.
The cleaning is not the hard part. Operators clean allergen lines every shift. The hard part is that the cleaning and the proof of cleaning are two different things, and the second one is the one that keeps slipping.
01 · The changeover is a control, not a chore
On a shared line, the cleaning between an allergen batch and the next batch is not a formality. It is the thing standing between a labeled allergen and a product that does not declare it. The regulation treats it that way. Food allergen controls have to ensure "protection of food from allergen cross-contact, including during storage, handling, and use" (21 CFR 117.135(c)(2)(i)), and sanitation controls have to cover "prevention of allergen cross-contact" (117.135(c)(3)(ii)). The cleaning rule is more specific still: food-contact surfaces "must be cleaned as frequently as necessary to protect against allergen cross-contact," and wet-processing surfaces must be "cleaned and sanitized before use and after any interruption" (117.35(d), (d)(2)).
Read that as an operator and it says something plain. The changeover clean is not housekeeping you do when there's time at the end. It is one of the controls that makes the next batch legal to sell. Treat it like a critical step, because on paper, it is one.
02 · "Cleaned" is a claim. The log is the evidence.
Doing the control and proving the control are separate obligations, and the regulation requires both. This is where small producers get caught.
When cleaning between allergens is one of your preventive controls, the monitoring of it has to be written down. You "must document the monitoring of preventive controls ... in records that are subject to verification ... and records review" (21 CFR 117.145(c)(1)), and those monitoring records have to be maintained on file (117.190(a)(2)). There is no version of this where the cleaning counts but the record is optional. An unrecorded changeover is, to everyone who reviews it later, an unverified one.
This is the whole difference between a clean line and an audit-ready line. A clean line is a fact that lives for about an hour and then only in the memory of whoever ran the cycle. An audit-ready line is a clean line with a timestamp, a name, and a note about what ran before it, sitting in a record you can pull months later. The auditor cannot see the fact. They can only see the record. If the record is not there, the fact does not exist for their purposes.
03 · What the changeover record actually has to carry
A changeover log that proves anything answers four questions, and most binder templates only answer two.
Start with what ran before, and what allergen it carried. "Cleaned the line" means nothing without the batch it was cleaning up after. The record has to connect this changeover to the specific allergen-bearing batch that preceded it, or you cannot show later which runs were protected and which were not.
Then what was cleaned, and how. Which line, which equipment, which method. The rule distinguishes food-contact surfaces from non-food-contact ones and holds them to different cleaning frequencies (117.35(d) versus (e)); a record that just says "cleaned" does not show you met the right standard for the right surface.
Then when, relative to the next run. The wet-surface rule is "before use and after any interruption" (117.35(d)(2)). A changeover logged an hour after the next batch already started does not demonstrate the sequence the rule is asking for. The timestamp is not paperwork. It is the evidence that the clean came first.
And who verified it. A name closes the record. It is also how you answer the question every changeover eventually raises, which is whether the last shift actually did it or just left the box blank for the next person to inherit.
04 · The end-of-shift reconstruction is where records go missing
You know how this fails, because you have watched it fail. Nobody logs the changeover in the moment. The line is down, the next batch is waiting, and stopping to fill out a form feels like the least urgent thing in the room. So the cleaning gets done and the log gets left for later.
Later is the end of a ten-hour shift, standing at a clipboard, reconstructing three changeovers from memory. Which line did the sesame batch run on? Was that before or after the almond run? What time did the CIP finish? The answers are guesses dressed up as records, and a guessed record is worse than no record, because it looks complete right up until someone cross-checks it against a batch time and the story falls apart.
A spreadsheet does not fix this. It moves the same end-of-shift reconstruction onto a laptop and adds a login. The changeover log that actually holds up is the one filled in at the line, at the moment the cleaning happens, by the person who did it, before the next batch starts. Every hour you put between the work and the record is an hour of accuracy you are trading away.
05 · Where FourFoxes comes in
In FourFoxes, you set the allergen changeover up as a CCP. That is the whole move. The cleaning stops being a chore somebody remembers to do and becomes a defined critical control point with its own monitoring step and its own record, the same way you already treat a cook temp or a metal-detector check. Configure it once, and every shared line that runs an allergen batch carries the changeover check after it, by rule instead of by memory.
Then the record lands where the work happens: on a phone, at the line, tied to the batch that just ran. When the sesame batch closes out, the changeover CCP is right there to log, with the timestamp and the name attached instead of reconstructed later. The allergen that ran before is not something you look up in a separate binder. It is already on the record, because the record is connected to the batch.
And because a CCP check is either done or it is not, you can see the open ones. No hunting through a binder to find the shift that forgot. The blank changeover is visible while the line is still in front of you, which is the only time it is cheap to fix.
That is the difference between a clean line and a line you can prove was clean. One of them survives the audit. One of them is a story you are telling from memory.
Your next changeover is coming. Log it while you're standing there.
References
- 21 CFR 117.35, Sanitation operations. (d) Food-contact surfaces cleaned as frequently as necessary to protect against allergen cross-contact; (d)(2) wet-processing surfaces cleaned and sanitized before use and after any interruption; (e) non-food-contact surfaces.
- 21 CFR 117.135(c)(2)(i), Food allergen controls: ensuring protection of food from allergen cross-contact during storage, handling, and use.
- 21 CFR 117.135(c)(3)(i) and (ii), Sanitation controls: cleanliness of food-contact surfaces; prevention of allergen cross-contact and cross-contamination.
- 21 CFR 117.145(a), (c)(1), Monitoring of preventive controls must follow written procedures and be documented in records subject to verification and records review.
- 21 CFR 117.190(a)(2), Records documenting the monitoring of preventive controls must be established and maintained.