Preventive Controls and the Written Food Safety Plan
The plan is the regulated object. An inspector does not begin with the equipment; the inspector begins with the written hazard analysis and works outward to the records that show each control was monitored, corrected when it failed, and verified by someone competent to do it.
The rule in short
A facility required to register as a food facility must prepare and implement a written food safety plan containing a hazard analysis, preventive controls, a supply-chain program where required, a recall plan, and procedures for monitoring, corrective action and verification. The plan is prepared by or under the oversight of a preventive controls qualified individual, reanalyzed at least every three years, and supported by records retained for two years.
The preventive controls rule applies to facilities required to register as food facilities. That registration duty, not the size of the operation or the kind of food, is the trigger. A registered facility must have a written food safety plan, and the plan is what the agency inspects — the equipment and the sanitation are examined against what the plan says should be happening.
Registration, farms and the exemptions
Registration reaches domestic and foreign facilities that manufacture, process, pack or hold food for consumption in the United States. Farms are excluded from the registration requirement and are covered instead by the produce rule, so the farm definition operates as the boundary between the two regimes; the coverage analysis on that side is described in the produce safety coverage rules.
Several exemptions apply within the registered population. Facilities subject to the seafood or juice hazard analysis regulations are exempt for the covered activities. Facilities engaged only in storage of unexposed packaged food have modified requirements. Certain low-risk on-farm activities conducted by small and very small businesses on specified foods are exempt. And qualified facilities are exempt from the hazard analysis and controls requirements in favor of an attestation, subject to the agency's authority to withdraw the exemption.
The analysis that everything else rests on
The hazard analysis identifies known or reasonably foreseeable hazards for each type of food manufactured, processed, packed or held. Hazards fall into three categories: biological, including microbiological; chemical, including radiological and food allergens; and physical. The analysis considers hazards occurring naturally, unintentionally introduced, and intentionally introduced for economic gain — the last category being the one most facilities overlook.
For each hazard the analysis evaluates severity and probability, considering the formulation, the condition and design of the facility and equipment, raw materials and ingredients, transportation practices, processing procedures, packaging, storage, intended use, sanitation and employee hygiene. It then concludes whether the hazard requires a preventive control.
The written analysis must be kept even where the conclusion is that no control is required. An analysis that lists only the hazards for which controls exist gives no evidence that the others were considered.
Records of monitoring and of corrective actions must be reviewed by a preventive controls qualified individual within seven working days after the record is created, or within a reasonable time thereafter where the facility documents the justification. Verification records of calibration, testing and supplier verification are reviewed within a reasonable time. Facilities routinely batch record review monthly, which fails the requirement on its face and is trivially provable from the review signatures and their dates.
The four control types and how they differ
| Control | What it addresses | Typical monitoring | Verification activity |
|---|---|---|---|
| Process control | Parameters that eliminate or reduce a hazard, such as cook, refrigeration or pH | Continuous or scheduled measurement against a defined parameter and value | Validation of the parameter, calibration, records review |
| Food allergen control | Cross-contact during handling, and correct declaration on the label | Line changeover checks, label reconciliation at packaging | Label review, observation, records review |
| Sanitation control | Environmental pathogens and cross-contact from surfaces and personnel | Pre-operational inspection, cleaning verification | Environmental monitoring where a ready-to-eat food is exposed |
| Supply-chain control | Hazards controlled before receipt, by the supplier | Receiving procedures confirming approved supplier and documentation | Onsite audit, sampling and testing, or review of supplier records |
| Recall plan | Removal of product where a hazard requiring a control is identified | Not monitored; maintained as a written procedure | Reviewed during reanalysis |
The supply-chain program has the strictest verification rule. Where a hazard requiring a supply-chain control could cause serious adverse health consequences or death, the appropriate verification activity is an onsite audit of the supplier conducted before first use and at least annually thereafter, unless the facility documents an adequate written justification for a different activity. Substituting a certificate of analysis for the audit without that written justification is a common finding.
Monitoring, corrective action and verification
Each control needs the management components that make it real. Monitoring procedures state what is measured, how, how often and by whom, and produce records. Corrective action procedures state what happens when a parameter is not met — identifying and correcting the problem, reducing the likelihood of recurrence, evaluating the affected food for safety, and preventing adulterated food from entering commerce.
Verification confirms that the system is working. It includes validation that the control is capable of controlling the hazard, verification that monitoring is being conducted, verification that corrective actions are appropriate, calibration of instruments, product testing and environmental monitoring where appropriate, and the review of records within the stated periods.
Corrective action records are the ones that matter most in an investigation. A facility with no corrective action records over a long period is claiming that no control ever deviated, which is rarely true and is easy to test against the monitoring records themselves.
Reanalysis, retention and where the plan is kept
The plan must be reanalyzed as a whole at least once every three years. It must also be reanalyzed whenever a significant change in the activities creates a reasonable potential for a new hazard or a significant increase in a previously identified one, whenever new information about potential hazards emerges, whenever a preventive control is found ineffective, whenever the food safety system as a whole is found ineffective, and when the agency requires it.
Records must be kept as originals, true copies or electronic records, must be accurate and legible, must be created contemporaneously, and must include the name and location of the facility, the date and time of the activity, the signature or initials of the person performing it, and the identity of the product and lot where applicable. Retention is two years from creation. Records other than the food safety plan may be kept offsite if they can be retrieved and provided within twenty-four hours; the plan itself must be available at the facility.
Labels are part of the allergen control, so packaging changes are food safety changes rather than only marketing ones, and the mandatory elements are governed by the label content rules. Claims added to a package raise a separate set of requirements under the claim categories and their evidence standards. A facility handling certified organic product also carries the recordkeeping and commingling controls in the organic certification rules, which its food safety plan should not contradict.
Points to carry away
- The plan must be prepared by or under the oversight of a preventive controls qualified individual.
- The hazard analysis considers biological, chemical including radiological, and physical hazards.
- Preventive controls include process, food allergen, sanitation and supply-chain controls, plus a recall plan.
- Monitoring and corrective action records must be reviewed within seven working days of creation.
- The plan must be reanalyzed at least once every three years and whenever a significant change occurs.
- Records are retained for two years and the food safety plan must remain available at the facility.
Questions readers ask
What makes someone a preventive controls qualified individual?
A person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to a standardized curriculum recognized by the agency, or who is otherwise qualified through job experience to develop and apply a food safety system. Experience alone can qualify a person, but the facility must be able to document it. The role is defined by function rather than by title: the qualified individual prepares or oversees the plan, validates controls, reviews records and reanalyzes the plan.
Does a facility with a HACCP plan need a separate food safety plan?
It depends on which HACCP requirement applies. Facilities subject to the seafood or juice regulations are exempt from the preventive controls requirements for the activities those regulations cover. A voluntary HACCP plan adopted for customer or export reasons is not an exemption, though the analysis and records overlap heavily and much of the existing documentation can be reused. The gap is usually in allergen controls, supply-chain verification and the recall plan, which HACCP systems often do not address.
What is a qualified facility and what does it owe instead?
A qualified facility is a very small business, or a facility whose average annual food sales are below the threshold with the majority sold to qualified end-users. It is exempt from the hazard analysis and preventive controls requirements and instead submits an attestation to the agency on the required cycle, and either attests that it has identified potential hazards and is implementing controls, or that it complies with applicable state and local law. Records supporting the status must be kept.
Sources
- eCFR — 21 CFR Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive ControlsThe plan contents, the control categories, verification, the supply-chain program and records.
- Cornell Legal Information Institute — 21 U.S.C. 350g, Hazard Analysis and Risk-Based Preventive ControlsThe statutory requirement for the plan, its reanalysis and the qualified facility exemption.
- eCFR — 21 CFR Part 1, Subpart H, Registration of Food FacilitiesWho must register, which determines who is subject to the preventive controls rule.
- Food and Drug Administration — FSMA Final Rule for Preventive Controls for Human FoodThe agency's summary of the requirements, exemptions and the qualified individual role.
- Food and Drug Administration — Guidance and Regulation of Food and Dietary SupplementsThe guidance framework supporting the hazard analysis and control validation.
- eCFR — 21 CFR Part 112, Standards for ProduceThe parallel rule for farms, which marks the boundary of the facility definition.
Lawwise is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Agricultural & Food Law
Commodity Checkoff Assessments and When a Refund Is Available
Commodity research and promotion programs impose an assessment collected by the first purchaser or handler and remitted to a board that funds generic promotion, research and information. Funds may not be used to influence legislation or to disparage another commodity, and board budgets require departmental approval. Refund rights exist only where the enabling statute creates them. A producer or handler dealing solely in certified organic products may obtain an exemption.
Produce Safety: Covered Farms, Exemptions and Water Testing
A farm is covered by the produce safety rule if its average annual produce sales exceed the monetary threshold. A farm below a higher food sales threshold that sells the majority of its food directly to qualified end-users has a qualified exemption with modified requirements. Produce rarely consumed raw, produce for personal consumption, and produce receiving commercial processing that adequately reduces pathogens are excluded. Agricultural water requirements differ before and after harvest.
Organic Certification and Who Is Excluded From It
An operation that produces or handles agricultural products sold as organic must be certified by a USDA-accredited certifying agent unless an exclusion applies. Certification requires an organic system plan, an on-site inspection, and annual update and inspection thereafter. Land must have had no prohibited substance applied for three years before harvest. Four labeling categories exist, with the seal available to the top two. Records are retained for five years.