Food CGMP readiness: from daily conditions to defensible decisions

This guide addresses U.S. FDA human-food operations. It is not a drug CGMP guide or an assessment of USDA-regulated operations. Determine jurisdiction and applicable activities before adopting its workflow. Food covered by specific CGMP regulations is also subject to those regulations under § 117.1(c).

This is a routing check, not a complete exemption determination. Review all relevant conditions in §§ 117.5 and 117.7. For the wider regulatory structure, see the 21 CFR 117 overview; the sections below focus on daily operation rather than repeating that overview.

A duty to maintain sanitary conditions is not the same thing as a prescribed federal checklist. Treat the proposed readiness sheets, material balances and internal-audit records below as site practices unless they also document a specifically applicable record requirement. Calling a record a CGMP checklist does not make every field federally required—or remove requirements when it records a preventive control.

For records subject to § 117.305, retain actual monitoring values and observations, accurate and legible entries, concurrent recording, sufficient work history and the required identifying details. Do not replace a missing reading with a setpoint, an expected result or a later recollection. Existing records need not be duplicated if they contain the required information and satisfy Subpart F; § 117.330 also permits supplementation and linked record sets.

Section 117.4 requires individuals, including temporary and seasonal personnel, to be qualified for their duties and trained in food hygiene and food safety. Supervisory responsibility must be clearly assigned to appropriately qualified personnel. Section 117.10 addresses health conditions that could contaminate food and hygienic practices during work.

• Before assignment, confirm that the person understands the actual station: exposed cooked product, ingredient handling, cleaning chemicals or maintenance re-entry—not just a generic induction presentation.
• Provide a usable route for reporting illness, lesions or other relevant health conditions. Supervisors should address the contamination risk without putting unnecessary medical detail into a production packet.
• Observe handwashing at the point of work and after activities that could contaminate hands. Check garments, hair restraints and, where used, glove condition against the task. Gloves are not a substitute for clean hands.
• Check movement between raw-material handling, waste handling and exposed cooked product. Demonstration at the station can reveal gaps that a training signature misses.
• Record training separately from the proposed shift-readiness observation. Escalate an unqualified assignment or an unresolved hygiene condition to the supervisor before the affected work proceeds.

Sections 117.20 and 117.37 address plant conditions and sanitary facilities, including contamination prevention, safe water and plumbing protection. Section 117.35(c) requires effective pest exclusion. Section 117.40 addresses cleanable, maintained equipment and accurate, precise, adequately maintained instruments used to control microbial growth.

These observations are proposed operational checks, not a universal testing schedule. Where Subpart C verification applies, § 117.165 addresses calibration or accuracy checking and written methods and frequencies as appropriate to the control. Base the site's approach on the instrument's use, failure consequences, history and the applicable food safety plan.

Section 117.35(d) requires food-contact surfaces to be cleaned as frequently as necessary to protect against contamination and allergen cross-contact. It distinguishes low-moisture operations from wet processing. Low-moisture food-contact surfaces must be clean, dry and sanitary before use; after wet cleaning, they must, when necessary, be sanitized and thoroughly dried before subsequent use. In wet processing, the cleaning and sanitizing requirements address use, relevant interruptions and continuous operation as specified in § 117.35(d)(2).

Do not transfer a wet-room routine into a dry zone

As a site practice, define the sanitation boundary around dry ingredient dispensing. Select methods that avoid spreading dust, residue or moisture into adjacent operations. If wet cleaning is needed, assess the equipment and environment, protect nearby material and establish how the surface will be returned to the required dry, sanitary condition. A surface that looks dry from a distance is not a completed assessment of a concealed joint.

Make changeover a sequence with a decision point

1. Identify the outgoing run, incoming run, equipment and applicable cleaning instruction. Remove product, unused materials and packaging that do not belong to the next run.
2. Separate any permitted recovery material from cleaning waste before cleaning starts. Identify its status and destination; do not leave an unmarked tote beside the line.
3. Open or disassemble equipment as necessary for thorough cleaning. Section 117.80(c)(1) expressly addresses taking equipment apart insofar as necessary.
4. Perform the selected cleaning and, where applicable, sanitizing steps. Protect nearby food and packaging. Cleaning and sanitizing substances must be safe and adequate under their conditions of use under § 117.35(b)(1).
5. Inspect the actual difficult-to-clean locations and complete any further verification specified by the site's controls. A visual check addresses visible residue; it does not establish every microbial or allergen outcome.
6. Authorize equipment use only after the responsible person resolves failed observations and required evidence. Distinguish permission to use equipment from disposition of food already made.

For detailed allergen-program design, use the food allergen control readiness guide. Here, the operational question is narrower: was the applicable changeover performed on the equipment used, and what happened when it failed?

Section 117.80(b)(1) requires ingredients to be inspected and handled as necessary to establish suitability, protected during storage and cleaned when necessary. Section 117.80(b)(5) requires protective holding conditions and identification of material scheduled for rework; § 117.80(c)(5) requires protection of work-in-process and rework against contamination, allergen cross-contact and undesirable microbial growth.

• At issue and at use, match the material name, lot, container condition and status to the assigned run. A warehouse issue transaction does not prove that the operator charged the intended ingredient.
• Separate issued quantity, unused quantity returned to stock and quantity actually charged. Preserve identity and condition when assessing an unused return; do not silently relabel it as rework.
• For rework, identify the originating lot, quantity, handling history, compatible destination, permitted introduction point and approving person under the site's procedure. Check whether the process's demonstrated applicability covers the actual load and rework route.
• Do not move held or suspect material into another batch to eliminate an exception. Section 117.80(a)(6) requires adulterated food to be rejected or, if appropriate, treated or processed to eliminate contamination.
• Compare the assigned recipe revision, scale or meter identity, actual additions, sequence and process observations. A recipe assignment is an instruction; the execution record establishes what happened.

Section 117.80(c)(4) requires measures such as cooking and refrigeration to be adequate under the conditions of manufacture, handling and distribution. Where Subpart C applies, the written hazard analysis determines hazards requiring preventive controls; process controls under § 117.135(c)(1) include appropriate parameters and maximum or minimum values. Section 117.160 addresses validation as appropriate to the control and its role. Obtain the facility's applicable process instructions and supporting evidence; this guide supplies no cooking, cooling, holding or lethality parameters.

Fictional Millbank Soup Works, Plant 1, makes two runs of the same refrigerated lentil-tomato soup on 21 October 2026: A-21 and B-21. The exercise assumes a facility subject to Subparts B and C, with its own food safety plan, applicable process validation and instructions for cooking, cooling, sanitation and rework. The quantities below are scenario assumptions, not legal limits or processing recommendations. Process parameters are not reproduced.

Jo Reed (JR) leads production; Elena Ortiz (EO) leads sanitation; Sam Patel (SP) owns maintenance; Maya Chen (MC) owns QA disposition; Luis Vega (LV) is the PCQI. A-21 uses kettle K1 and filler F2. Filler F1 is considered for B-21 but remains unavailable because its post-maintenance cleaning evidence is incomplete. B-21 therefore uses F2 after an actual changeover.

RW-A21 is neither finished packaged stock nor a customer return. It is counted as an output of A and an input to B, then canceled when calculating the combined fresh-input balance. No held B material is designated for further rework.

The following entries belong to the same exercise. They show the relevant completed observations and decisions; they do not replace the underlying process measurements or chemical-use records. Each entry identifies Plant 1, the activity date, person and applicable equipment or run.

For applicable preventive controls, § 117.145 requires monitoring records. Section 117.305 requires actual values and observations in those records. At Millbank, B's operator initialed a cycle-complete status but left the required cook-monitoring checkpoint value and observation time blank. The gap was detected after packing: a failure of the site's intended pause-and-escalate practice, not an acceptable alternative workflow.

Section 117.80(c)(13) requires filling and packaging to protect food against contamination, allergen cross-contact and undesirable microbial growth. Section 117.93 requires protective storage and transportation conditions. As practical checks, compare the actual recipe and rework identity with the pack specification; inspect package condition and closure evidence; verify lot coding; and match dispatch quantity and status to the disposition decision.

A and B use different cooking cycles. The investigation found no evidence that F1 contacted either run or that B's missing entry represented a known instrument failure affecting A. MC documented that boundary rather than assuming it. If later evidence broadens the affected scope, revisit A's disposition and distribution assessment. A matching package label or a good finished-product test is not a replacement for the missing cooking observation.

Keep production conversion and finished-stock disposition as two related balances. Finished output is not added again to held and shipped quantities: those are destinations of that output. All figures below are kilograms of food, excluding packaging tare and cleaning water.

The full issue balance is 918 = 18 unused returns + 40 process loss + 4 samples + 856 finished output. Onsite finished stock is 456 kg: 66 available plus 390 held. Do not add the 856 kg finished-output subtotal to those destinations, or count the 12 kg recovery twice as new input.

Loss records distinguish measurement from calculation: A has 5 kg weighed discard and a 15 kg calculated residual; B has 6 kg weighed discard and a 14 kg calculated residual. The residual is labeled evaporation/unrecovered difference, not presented as independently measured evaporation. An unexpected residual warrants investigation rather than adjustment to make the sheet balance. Reconciliation can expose missing quantities; it cannot prove adequate cooking, sanitary handling or safe product.

Unused tomato returns retain T51 and T52 identity and return-to-stock decisions. They are not customer returns and are not recovered soup. For broader trace architecture, see lot genealogy; this exercise uses the links to support a specific operating decision.

Where applicable, § 117.150 requires corrective-action procedures addressing the problem, recurrence, evaluation of affected food and prevention of commerce when its safety cannot be ensured. It also addresses unanticipated problems, including incomplete records found during review. Applicable corrective actions—and corrections when appropriate—must be documented. Do not classify a missing safety-critical observation as harmless paperwork solely because the output looks normal.

For covered preventive-control records, § 117.165(a)(4) requires review by or under PCQI oversight. Monitoring and corrective-action records are reviewed within seven working days, or a reasonable longer timeframe supported by the specified written PCQI justification. That review allowance is not permission to ship product with an unresolved safety question. Millbank uses a stricter pre-dispatch site review for these runs.

Choose audit work by exposure and failure history

The internal audit below is a proposed site practice, not a universal Subpart B audit schedule. Start with exposed cooked product, maintenance re-entry, wet-cleaning boundaries, rework routes and unresolved process records. Select evidence across relevant shifts and exceptions; follow one selected record to the actual equipment and stock. Expand the examination when a failure suggests a shared form, instruction or workaround. Do not score readiness by the percentage of boxes completed.

A useful daily closeout names what may operate, what may ship, what remains blocked, who owns each decision and when the next review is due. Keep repair completion, cleaning authorization, product disposition and corrective-effectiveness closure as distinct decisions. Any proposed electronic workflow should preserve those distinctions and the underlying evidence; a screen status is not a compliance or release decision.