Food Processing Readiness: One Spine From FSMA and HACCP to GFSI, EMP and Retailer Programmes

Layer 1 — federal/national law: FSMA preventive controls (21 CFR 117) including the Food Safety Plan, hazard analysis, preventive controls, supply-chain program and recall plan; FSMA 204 (21 CFR 1.1300) traceability with Critical Tracking Events and Key Data Elements for foods on the Food Traceability List, effective 20 January 2026; USDA FSIS HACCP for meat, poultry, egg products; EU 178/2002 + 852/2004 + 2073/2005 in Europe. Layer 2 — GFSI processor scheme: SQF Edition 9, BRCGS Issue 9, FSSC 22000 v6, or IFS Food v8 — pick the one the customer requires. Layer 3 — retailer programme: SQEP for Walmart, KQA for Kroger, GAP-led Whole Foods Quality Standards, Tesco/Sainsbury's/M&S/Morrisons private-label programmes in the UK. Layer 4 — technical disciplines that audit findings actually live in: allergen control, environmental monitoring (EMP), food fraud (VACCP/TACCP), sanitary equipment design (3-A/EHEDG), and foreign material control (metal detection, X-ray, glass/brittle plastic).

21 CFR 117 Subpart C requires every covered facility to maintain a written Food Safety Plan signed by a Preventive Controls Qualified Individual (PCQI). The plan contains a hazard analysis (biological, chemical including allergens, radiological, physical), preventive controls for any hazard requiring one (process, allergen, sanitation, supply-chain), a recall plan, and the verification and validation records that prove the controls work. Every GFSI scheme rebuilds on the same skeleton — SQF Edition 9 module 2.4 and BRCGS Issue 9 Section 2 both essentially demand the FSMA Food Safety Plan with extra scope. So the cleanest path is to build FSMA-compliant once and reuse it for every scheme.

FDA's Food Traceability Rule (21 CFR 1.1300–1.1495) takes effect 20 January 2026 and requires firms that manufacture, process, pack or hold foods on the Food Traceability List (leafy greens, soft cheeses, shell eggs, nut butters, fresh herbs, listed fruits/vegetables, finfish, crustaceans, molluscan shellfish, RTE deli salads) to maintain Critical Tracking Event (CTE) records — receiving, transformation, creation, shipping — with specific Key Data Elements (KDEs) — Traceability Lot Code, dates, locations, quantities — and to provide a sortable electronic spreadsheet to FDA within 24 hours of request. Retailers are pulling readiness evidence forward; expect the ask in 2026 contract negotiations.

Allergen control: the Big 9 (milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soya, sesame — FALCPA + 2023 FASTER Act) plus regional additions, declared on label, controlled by scheduling, cleaning validation, line clearance and changeover verification. Environmental monitoring (EMP): Zone 1–4 swab programme for Listeria monocytogenes and Salmonella, vector swabbing on positives, root-cause investigations — the #1 driver of FDA 483s in RTE food. Food fraud (VACCP) and food defense (TACCP): GFSI requires both — vulnerability assessment for economically motivated adulteration, threat assessment for intentional contamination. Sanitary equipment design: 3-A Sanitary Standards (dairy/beverage) and EHEDG (general food) cleanability principles applied to equipment selection and modification. Foreign material control: metal detection / X-ray CCP validation and verification, magnet inspection, glass/brittle plastic policy, sieve and filter integrity.

All four are GFSI-recognised. SQF Edition 9 dominates US private-label and is the default for sites supplying Walmart, Kroger, Costco, Whole Foods, Target. BRCGS Issue 9 dominates UK retail and is required by Tesco, Sainsbury's, M&S, Morrisons, Asda — with eleven Fundamental clauses where a single major NC blocks certification. FSSC 22000 v6 (ISO 22000-based) dominates ingredient supply chains and large multinational manufacturers. IFS Food v8 dominates Franco-German retail. Customers dictate the scheme; many manufacturers hold two or three. The Food Safety Plan, HACCP study, supplier programme and EMP are identical underneath — the differences are in clause structure, grading and audit length.

Days 1–15: gap assessment against FSMA (21 CFR 117 + 21 CFR 1.1300) and the contracted GFSI scheme; identify any 483-class gap in allergens, EMP or Subpart C. Days 16–40: refresh the Food Safety Plan with PCQI sign-off; refresh HACCP; close the highest-risk allergen and EMP gaps. Days 41–60: FSMA 204 CTE/KDE wiring; supplier programme refresh including VACCP vulnerability assessments; sanitary design register on changed equipment. Days 61–80: internal audit covering FSMA, GFSI scheme Fundamentals/KO clauses, retailer programme requirements. Days 81–90: management review, mock unannounced audit (SQF Option 2 / BRCGS Option 2), recall and traceability mock pull with the 24-hour FDA spreadsheet.