Allergen Testing for Food Manufacturers: ELISA, PCR, and What FSMA's Preventive Controls Rule Actually Demands

Undeclared allergens account for roughly 40% of all FDA Class I food recalls in any given year — and that percentage hasn’t meaningfully dropped since FSMA’s Preventive Controls for Human Food rule went into full effect. The regulation is clear. The enforcement record is real. And yet, allergen cross-contact events keep making headlines, keep pulling products from retail shelves, and keep landing manufacturers in front of FDA Form 483 observations.

The gap is rarely malicious. More often it comes down to an allergen testing program that looks complete on paper but doesn’t hold up when an auditor — or a sick consumer — starts asking hard questions. The testing frequency is arbitrary. The method choice isn’t documented. The matrix validation was never actually done. And somewhere upstream, a supplier COA was treated as gospel when it should have been a starting point.

This post covers what FSMA actually demands for allergen controls, how to choose the right testing technology for each use case in your production environment, and what your food safety testing laboratory should be able to demonstrate before you trust them with compliance-critical data.

What 21 CFR Part 117 Actually Requires — and Where Programs Fall Short

Under the Preventive Controls for Human Food rule, allergen controls are explicitly required as a type of preventive control (§ 117.135(c)(2)) — not optional, not advisory. If your facility handles any of the nine major food allergens (milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame — the ninth added under the FASTER Act effective January 1, 2023), your Food Safety Plan must address them with documented procedures, practices, and processes.

The requirement covers two distinct risks: allergen labeling accuracy and allergen cross-contact. Cross-contact — the unintentional transfer of allergenic protein from one food to another through shared equipment, air, or surfaces — is different from cross-contamination in the pathogen sense. It demands different controls and different testing. A HACCP plan built around pathogen management doesn’t automatically address allergen cross-contact, which is a mistake many manufacturers only discover during their first post-FSMA audit.

Where things get technically demanding is the verification requirement under § 117.165. You must verify that your allergen preventive controls are actually working — and for allergen controls, that verification must include laboratory testing of product, environmental samples, or both. “We do a visual inspection and wipe down the line” is not a compliant verification procedure, regardless of how many years it’s been standard practice.

Separate from verification is validation under § 117.160 — the requirement that you have scientific or technical evidence your controls will work before you rely on them. For allergen controls, that typically means documented cleaning validation studies showing that your sanitation procedure reduces allergenic protein to below your action threshold in your specific production environment. It also means confirming that your test method can reliably detect that threshold in your actual food matrix. That last piece is where a startling number of programs quietly fail.

ELISA, PCR, and Lateral Flow: Three Different Questions, Three Different Tools

There’s no single best allergen testing method. The right choice depends on what question you’re asking, at what point in production, and in what food matrix. Using the wrong tool for the job doesn’t just produce bad data — it produces confidently wrong data, which is considerably more dangerous.

ELISA (Enzyme-Linked Immunosorbent Assay) is the workhorse of quantitative allergen testing for finished product compliance. Sandwich ELISA kits can typically detect allergenic proteins at 1–5 ppm, well below the threshold levels that clinical studies suggest trigger reactions in most sensitized individuals. Kits validated under AOAC’s Performance Tested Methods (PTM) program have documented specificity, recovery, and sensitivity data — which makes your compliance results substantially more defensible than data from a non-certified kit.

The critical caveat is matrix effects. ELISA kits are validated for specific food matrices, and the difference between matrices is not trivial. A gluten ELISA validated in a flour-based pasta system can significantly underreport gluten contamination in a high-fat extruded snack coating. Protein extraction efficiency varies with fat content, processing conditions, pH, and the presence of other interfering proteins. If your laboratory isn’t running your samples through a kit validated in your specific matrix — or performing documented spike-and-recovery studies to characterize percent recovery — your quantitative results carry an uncertainty that doesn’t appear on your COA.

PCR (Polymerase Chain Reaction) detects allergen-coding DNA rather than allergenic protein. That distinction matters enormously in food systems. Heat processing and high-pressure processing can degrade DNA, producing false negatives even when intact allergenic protein is present. More fundamentally, a positive PCR result tells you that allergen-origin DNA was detected — it tells you nothing about protein concentration, which is the actual determinant of clinical risk. PCR has genuine applications in allergen programs: species identification for incoming ingredient verification, confirming the absence of undeclared botanicals in complex formulations, and situations where severe processing makes ELISA results difficult to interpret. But in a compliant allergen testing program, PCR functions as a complement to ELISA, not a replacement for it.

Lateral flow devices (LFDs) are rapid immunoassay tests that deliver a qualitative positive or negative result in 5–15 minutes. They’re not designed for quantitative compliance determinations and shouldn’t be used as such. Where they’re genuinely useful is line clearance verification — a rapid pre-production check to confirm that cleaning was effective before you run an allergen-containing SKU. A documented negative LFD result on a freshly sanitized line, with a timestamp and operator signature, is reasonable contemporaneous evidence that a cross-contact check was performed. Just don’t submit that data as your finished-product compliance result for a “peanut-free” label claim.

Building a Testing Frequency That Holds Up to FDA Scrutiny

One of the most consistent deficiencies we see when manufacturers come to us following an FDA audit: there’s a testing program, but no documented logic connecting testing frequency to actual risk. Auditors look for both the data and the rationale behind when you chose to collect it.

Frequency should be risk-based, and the relevant risk factors are well defined. For finished product testing, a statistically meaningful sampling plan is non-negotiable for products carrying “free from” or “contains no” label claims. Testing one unit per production run isn’t a sampling plan — it’s a single data point. Industry resources from the Food Allergy Research & Resource Program (FARRP) at the University of Nebraska and AOAC method guidance both provide frameworks for defensible sampling frequencies tied to lot size, allergen hazard severity, and claim type.

For environmental allergen monitoring, surface swabs from food contact surfaces, non-contact zones, and air handling areas can reveal persistent residues that never appear in finished product testing because they’re present at sub-detectable levels in any individual unit. Environmental allergen monitoring is increasingly expected by GFSI-benchmarked schemes including SQF Edition 9 and BRC Issue 9, and FDA 483 observations from recent FSMA inspections have cited its absence in high-risk allergen environments.

For incoming ingredient testing, a supplier’s certificate of analysis is a starting point, not a conclusion. We routinely see finished products testing positive for undeclared allergens when every COA on file was clean. Allergen cross-contact can occur post-COA issuance — during ingredient storage, transit repackaging, or at a co-manufacturer with looser allergen controls than your primary supplier. A quarterly or semi-annual verification test of high-risk incoming ingredients, run by a qualified independent laboratory, is reasonable risk management that can also strengthen your supplier qualification documentation.

The documentation linking your frequency decisions to your risk assessment is what gets reviewed in an audit. “We test when there’s a concern” is a finding waiting to happen. “We test allergens X and Y in finished product on every third lot per the following risk-tiering logic, with environmental monitoring quarterly in Zones 1 and 2” is a defensible program.

What to Look for in a Food Safety Testing Laboratory

Choosing a food safety testing laboratory for allergen work isn’t just about which analytes appear on their menu. A few things matter considerably more than the capabilities list.

ISO 17025 accreditation is the baseline expectation. ISO 17025 requires laboratories to demonstrate technical competence, documented method validation, measurement traceability, and ongoing quality management — verified not once at certification but through regular surveillance audits by an accreditation body such as A2LA or Perry Johnson Laboratory Accreditation (PJLA). If your laboratory isn’t ISO 17025 accredited for the specific allergen methods you’re using, your compliance data lacks the third-party validation that FDA, GFSI auditors, and major retail customers now routinely expect.

Accreditation scope is the detail that trips people up. Ask your laboratory to share their scope of accreditation and confirm it explicitly covers the allergen analytes, specific test methods (for example, an AOAC-PTM certified gluten kit or an AOAC Official Method for a specific allergen), and food matrix types relevant to your products. A lab holding ISO 17025 accreditation for chemical testing in supplements but running an unaccredited ELISA for shellfish in your seafood product is not providing ISO 17025 allergen data — and that distinction will matter if results are ever challenged.

Matrix-matched method validation should be something your laboratory can discuss fluently. Ask about spike-and-recovery experiments in your product matrix. Ask what percent recovery they achieve and what the associated uncertainty is. If those questions generate a blank look, treat it as meaningful information about the quality of your data.

Turnaround time is a practical constraint that affects whether your program is actually functional. A 10-business-day turnaround for finished product allergen results doesn’t work operationally if your shelf life is 60 days and you’re releasing inventory on day 7. A well-structured food safety testing laboratory will have published turnaround commitments and a defined protocol for expedited testing when production schedules are tight.

At Qalitex, our allergen testing services for food manufacturers are ISO 17025 accredited and built around AOAC-validated or AOAC-PTM certified methods, with documented matrix validation available for review. When new clients come to us after an FDA audit, the first thing we examine is their testing method documentation — because that’s almost always where the gap is, even before we run the first sample.

A Note on Sesame — The Allergen Programs Frequently Miss

Sesame became the ninth major food allergen under U.S. law on January 1, 2023, following enactment of the FASTER Act in April 2021. Most food manufacturers updated their label declarations in time. Fewer updated every layer of their allergen program: the written risk assessment, the preventive controls documentation, the cleaning validation studies, and — critically — the testing schedule.

Validated detection methods for sesame in processed food matrices are less mature than those for the legacy Big 8 allergens. Commercial sesame ELISA kits exist, but comparative validation data across complex food matrices is still more limited than for peanut or gluten. That means the method validation piece is especially important, and especially likely to be underdocumented.

If sesame isn’t explicitly named in your Food Safety Plan’s allergen controls section, your written verification and validation procedures, and your testing frequency table, it’s worth correcting that before your next FDA inspection or GFSI audit does it for you.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• FSMA Compliance and FDA Audit Readiness Consulting — Aurora TIC provides regulatory consulting for food and supplement manufacturers navigating FSMA, FDA facility inspections, and quality system documentation.
• Raw Material Supplier Qualification and COA Verification — Ayah Labs supports ingredient-level testing and supplier qualification programs for food and supplement manufacturers sourcing globally.