Cooking Will Not Fix It: The Staph aureus Cheese Recall and Your Preventive Control Plan

In September 2026, the Canadian Food Inspection Agency recalled a specialty cheese sold in Ontario and Quebec because it was contaminated with Staphylococcus aureus. For many food businesses, the instinct on reading a recall like this is reassuring and wrong: surely cooking, or the pasteurization already built into the process, would have handled it. With Staphylococcus aureus, that instinct fails. The organism itself is easy to kill with heat. The toxin it leaves behind is not.

That single fact, that the hazard is a heat-stable toxin rather than a live bacterium, is why Staphylococcus aureus deserves its own line in your preventive control plan. This article explains what happened in the recall, why a kill step does not protect you, how the toxin forms, and exactly what your preventive control plan under the Safe Food for Canadians Regulations must control to keep it from happening in your facility.

Executive Summary

Staphylococcus aureus causes illness through a preformed toxin, so the usual controls behave differently. Here is the short version.

The toxin is the hazard. Staphylococcus aureus produces an enterotoxin in food, and it is the toxin, not the live bacterium, that makes people sick.
The toxin is heat-stable. It survives normal cooking and pasteurization, so a kill step that destroys the bacteria does not destroy the toxin already formed.
Prevention is about growth, not killing. The only reliable control is to stop the bacteria from multiplying in the first place, through temperature control, hygiene and limited handling.
People are the main source. Staphylococcus aureus is commonly carried on human skin and in the nose, so employee hygiene and health policies are a food safety control, not just good manners.
Your PCP must prove it. Under the Safe Food for Canadians Regulations, temperature limits, monitoring, corrective actions and records are what demonstrate the hazard is controlled.

What Happened: The Yotvata Cheese Recall

On 18 September 2026, the CFIA published a recall of Yotvata brand Caciotta Peperoncino Cheese due to Staphylococcus aureus. The recall notice lists it as a Class 2 recall, recalled by Altra Foods Inc., with distribution in Ontario and Quebec. Industry was told not to use, sell, serve or distribute the affected product. A Class 2 recall signals a situation where using the product may cause a temporary or medically reversible health consequence, or where the probability of a serious consequence is considered remote.

A Class 2 recall sits in the middle of the CFIA's three recall classes, which run from Class 1, the most serious, to Class 3, the least. The class a recall receives drives how fast and how far you must act, so make sure your team understands the difference before an incident forces the question.

Why Staphylococcus aureus Is Different From Other Recalls

What it is: Staphylococcus aureus is a bacterium that can produce a heat-stable enterotoxin in food. Why it matters: the illness comes from the toxin, which cooking cannot remove, so controls designed to kill bacteria give a false sense of safety. What to do: shift your controls from killing the organism to preventing it from ever growing enough to make toxin.

The toxin, not the bacteria, is the hazard

Staphylococcal food poisoning is caused by an enterotoxin the bacteria release as they grow in food, not by an infection you catch from swallowing live cells. This is a different mechanism from a recall driven by an indicator organism. Compare it with a generic E. coli cheese recall, where the finding often flags a process control gap rather than a toxin already in the food. With Staphylococcus aureus, once the toxin is present, the product is unsafe and no downstream processing step will make it safe again.

The toxin is heat-stable

Staphylococcal enterotoxins are heat-stable and resist the temperatures used in normal cooking and pasteurization, as the FDA describes in its Bad Bug Book. The bacteria are readily destroyed by heat, but the toxin can remain active even after the cells that made it are dead. That is why a cheese, a cream-filled pastry or a cooked meat that was temperature abused before or after a heat step can still cause illness, and why a validated kill step is not the answer to this hazard.

How the Toxin Forms in Food

Staphylococcus aureus is commonly carried by healthy people on the skin and in the nose and throat, so contamination often enters food through handling. The bacteria then need time and a favourable temperature to multiply to the levels that produce enough toxin to cause illness. Public health guidance, including from the BC Centre for Disease Control, links staphylococcal food poisoning to foods that are handled and then held at improper temperatures. High-salt or high-sugar foods such as certain cheeses, cured meats and cream fillings are notable, because Staphylococcus aureus tolerates conditions that suppress many competing organisms.

The practical trigger is almost always temperature abuse: product left in the danger zone long enough for the organism to grow. Symptoms of staphylococcal food poisoning appear quickly, often within 30 minutes to a few hours of eating the food, and typically include nausea, vomiting and abdominal cramps. The rapid onset is a clue that a preformed toxin, not a slow infection, is at work.

Why Your Kill Step Does Not Protect You

What it is: a kill step is a process, such as cooking or pasteurization, validated to destroy vegetative pathogens. Why it matters: a kill step destroys the bacteria but not the heat-stable toxin they already made, so it cannot fix a product that was temperature abused first. What to do: control growth before, during and after any heat step. This is the same logic that governs low-acid and acidified foods and Clostridium botulinum, another hazard where preventing toxin formation matters more than a single kill step.

Hazard	Killed by cooking?	Is the toxin heat-stable?	What actually controls it
Staphylococcus aureus	The bacteria, yes	Yes, the enterotoxin survives normal cooking	Prevent growth: temperature and time control, hygiene, limited handling
Salmonella	Yes	No preformed toxin	Validated kill step plus recontamination controls
Generic E. coli (as an indicator)	Yes	Not the issue	Process control and sanitation; the finding flags a gap
Clostridium botulinum	Spores survive; toxin is heat-labile	Toxin is destroyed by boiling, but formation must be prevented	Formulation, temperature and, for low-acid canned foods, a validated thermal process

What Your Preventive Control Plan Must Control

What it is: a preventive control plan, or PCP, is the written system the Safe Food for Canadians Regulations require many food businesses to keep, documenting hazards and how they are controlled. Why it matters: for Staphylococcus aureus, the CFIA expects your PCP to control growth, not just describe a kill step. What to do: build the controls below into your plan and, following the CFIA guide for preparing a preventive control plan, set critical limits, monitor them, define corrective actions and keep records.

Temperature and time control

Keeping product out of the temperature range where Staphylococcus aureus grows is the single most important control. In practice that means holding cold product at or below 4 degrees Celsius, holding hot product at or above 60 degrees Celsius, and limiting the total time product spends between those points during processing, ripening, packaging and storage. For a product like cheese, the fermentation and ripening stages deserve particular attention, because that is where handling, temperature and time all combine. Define specific time and temperature limits for each step, and treat any excursion as a deviation that must be assessed.

People: hygiene and health

Because Staphylococcus aureus lives on people, employee hygiene is a genuine food safety control. Your PCP should require hand hygiene, gloves where appropriate, and the exclusion or reassignment of workers with skin infections, cuts, boils or respiratory symptoms from handling exposed product. Minimising bare-hand contact with ready-to-eat product reduces the chance of contamination at the exact stage where the product will not see another control. Document these expectations, train to them and verify they are followed.

Monitoring, verification and records

A control you cannot show is a control the CFIA cannot credit. Monitor your temperature and time limits with recorded checks, define corrective actions for deviations, including how you assess whether affected product must be held or destroyed, and verify the whole system through reviews, calibration of thermometers and, where warranted, product or environmental testing. Keep the records, because at inspection or during a recall investigation they are the evidence that your plan works.

Staphylococcus aureus at a glance	Detail
Cause of illness	A preformed, heat-stable enterotoxin produced in food
Typical onset	Rapid, often 30 minutes to a few hours after eating
Common symptoms	Nausea, vomiting, abdominal cramps
Common sources	Foods handled by people and then held at improper temperatures, including some cheeses, cured meats and cream fillings
Primary control	Prevent bacterial growth through temperature, time, hygiene and limited handling

Compliance Checklist: Controlling Staphylococcus aureus

Use this checklist to test whether your preventive control plan actually addresses this hazard.

Confirm your hazard analysis lists Staphylococcus aureus and its enterotoxin, not just generic bacteria.
State clearly that the control is preventing growth, not a kill step.
Set time and temperature limits for every step where product can warm up, including ripening and packaging.
Hold cold product at or below 4 degrees Celsius and hot product at or above 60 degrees Celsius.
Require hand hygiene, gloves where appropriate and exclusion of workers with skin infections or symptoms.
Minimise bare-hand contact with ready-to-eat product.
Monitor temperature and time with recorded, verifiable checks.
Define corrective actions for temperature deviations, including how affected product is assessed.
Verify the plan through reviews, thermometer calibration and, where warranted, testing.
Keep complete records so the control is demonstrable at inspection and during a recall.
Run a mock recall to confirm you could locate and remove affected lots quickly.

Common Mistakes Food Businesses Make

Relying on a kill step. Assuming cooking or pasteurization handles Staphylococcus aureus ignores the heat-stable toxin.
Treating hygiene as housekeeping. For this hazard, handler health and hand hygiene are formal controls that belong in the PCP.
Ignoring the ripening and holding steps. Time at warm temperatures during ripening or display is where the toxin has a chance to form.
Monitoring without recording. A temperature that no one wrote down cannot prove control after the fact.
No plan for a deviation. Without a defined corrective action, a warm-room excursion becomes an argument instead of a decision.

Frequently Asked Questions

Does cooking kill Staphylococcus aureus?

Cooking kills the bacteria, but it does not destroy the heat-stable enterotoxin they may have already produced. If the food was temperature abused and toxin formed before cooking, the food can still cause illness after it is cooked.

What does a Class 2 recall mean?

A Class 2 recall in Canada indicates a situation where use of the product may cause a temporary or medically reversible adverse health consequence, or where the probability of a serious consequence is remote. It is less severe than a Class 1 recall but still requires prompt action.

How does Staphylococcus aureus get into food?

It is commonly carried on human skin and in the nose, so it usually enters food through handling. It then needs time at a favourable temperature to grow to the levels that produce toxin, which is why temperature control and hygiene are the key defences.

How fast do symptoms appear?

Staphylococcal food poisoning typically causes nausea, vomiting and cramps within about 30 minutes to a few hours of eating the contaminated food. The rapid onset is characteristic of a preformed toxin.

Does my preventive control plan need to address Staphylococcus aureus specifically?

If your product supports the growth of Staphylococcus aureus, then yes. Your hazard analysis should identify it, and your controls should focus on preventing growth through temperature, time, hygiene and handling, with monitoring and records to prove it.

Is testing the finished product enough to control this hazard?

No. Testing alone cannot assure safety, because contamination and toxin are rarely uniform across a lot. Testing supports verification, but the real control is a process that prevents the bacteria from growing in the first place.

How MFLRC Can Help

MFLRC helps food businesses build preventive control plans that hold up under CFIA scrutiny. We conduct PCP gap assessments, write and review hazard analyses and SOPs, design temperature and hygiene controls, and run mock recall simulations so you can prove your program works before an inspector or a recall tests it. With the CFIA increasing food facility inspections, a plan that clearly controls hazards like Staphylococcus aureus is the difference between a smooth inspection and a costly finding.

Book a PCP Gap Assessment

Conclusion

The Yotvata cheese recall is a small event with a big lesson. When the hazard is a heat-stable toxin, the usual reflex of trusting the cook step or the pasteurizer is exactly wrong. Staphylococcus aureus is controlled by never letting it grow, which means temperature, time, hygiene and handling, all documented in a preventive control plan you can defend. Review your hazard analysis with that lens, and make sure your plan controls the toxin you cannot cook away.