Foreign material control: hazard decisions, checks and disposition

This guide addresses FDA human-food operations under 21 CFR Part 117. Its operating principles can inform food-processing, bakery and meat-sector teams, but it does not state USDA, drug, dietary-supplement or animal-food requirements.

Before applying the Subpart C duties below, document applicability for the facility and activity. Identify any exemption being relied on, its conditions, and the requirements that remain applicable. Section 117.3 recognizes a qualified-facility exemption by reference to §117.5(a); this guide does not determine eligibility. Establish Subpart G applicability separately rather than assuming that every ingredient or receiving operation has the same supply-chain duties.

Under §117.5(a), qualified facilities are exempt from Subparts C and G, subject to withdrawal under Subpart E, and must follow the modified requirements in §117.201. They must attest to FDA to qualified-facility status and either hazard identification, preventive controls and monitoring, or compliance with applicable non-Federal food safety law, and retain supporting records. Status must be determined and documented annually by July 1; after the initial submission, attestations are submitted every two years during October 1–December 31. Where §117.201(e) applies, consumers must receive the manufacturing or processing facility’s name and complete business address on the required label or through the specified point-of-purchase notification. This is not a blanket Part 117 waiver or an eligibility determination. The worked scenario assumes Subparts C and G apply.

For an operation subject to §117.130, the written hazard analysis must identify and evaluate known or reasonably foreseeable hazards for each food type, including physical hazards such as stones, glass and metal fragments. The evaluation considers injury severity and the probability of occurrence in the absence of preventive controls, together with equipment, ingredients, processing, packaging, intended use and the intended consumer. The analysis must be written even when it identifies no hazard requiring a preventive control.

Foreign material is not automatically a hazard requiring a preventive control. Section 117.3 defines a hazard by its potential to cause illness or injury; the further decision to establish a preventive control follows the hazard analysis. A soft liner fragment, a sharp wire and a stone should not receive an identical assessment merely because all are foreign material. Document the material, plausible fragment characteristics, route into food, exposure and injury potential.

A conclusion that a particular physical hazard does not require a preventive control needs a defensible written rationale. Do not reason that metal is unlikely simply because a detector will remove it: the probability assessment is made in the absence of preventive controls. Nor does a no-preventive-control conclusion remove applicable contamination obligations. Section 117.80(c)(8) requires adequate measures against metal or other extraneous material; §117.40(a)(2) addresses equipment design, construction and use to avoid contamination, including metal fragments.

Where a hazard requires a preventive control, §117.135 requires written controls that significantly minimize or prevent it. Those controls can be at a critical control point or elsewhere. The provision sets a control outcome; it does not prescribe a metal detector for every line. The site must select the control, establish relevant parameters and support its capability for the actual food and process.

Walk the product path from bag opening to the final closure. Record both the source and its position relative to the last effective control. An ingredient sifter cannot address a fragment introduced later by a blender, transfer screw or packer.

These are investigation prompts, not a universal list of hazards requiring preventive controls. Add sector-specific sources to the same map. Bakery handling may introduce material after flour sifting; another FDA-covered food process may add inclusions or use different packaging after its main separation step.

Choose the sequence from the hazard locations. An upstream separator can reduce incoming contamination while a downstream inspection step addresses later introduction. Several devices with overlapping blind spots do not necessarily provide effective control. No numeric sensitivity, screen aperture or magnet-strength target in this guide is a regulatory specification.

For applicable preventive controls, §117.160 requires validation as appropriate to the control and its role. Validation includes scientific and technical evidence—or studies when that evidence is unavailable or inadequate—and must be performed or overseen by a PCQI. The section permits a PCQI-prepared or overseen written justification that validation is not applicable for certain other preventive controls. Do not treat a supplier brochure or a routine successful challenge as proof of capability for every possible contaminant.

FDA CPG Sec. 555.425 addresses hard or sharp foreign objects. Its direct-reference seizure and import-detention criteria combine two conditions: the product contains a hard or sharp foreign object measuring 7 mm to 25 mm in length, and the product is ready-to-eat or requires only minimal preparation that would not eliminate, invalidate or neutralize the hazard before consumption. The CPG gives heating as an example of such minimal preparation.

The background states that objects less than 7 mm in maximum dimension rarely cause trauma or serious injury except in special risk groups, including infants, surgery patients and the elderly. That is not a declaration that smaller objects are safe.

• For a 7–25 mm object where additional preparation or processing may affect its presence in the finished food, the CPG calls for that processing to be described in the recommendation for legal action. It specifically notes that sifting may or may not remove an object, depending on its measurements and the mesh aperture.
• Objects less than 7 mm in length where a special-risk group is among the intended consumers, and objects over 25 mm in length, are also addressed through recommendations for legal action and CFSAN health-hazard review.
• For those additional-review categories, the CPG describes adulteration under 21 U.S.C. 342(a)(1) if CFSAN review establishes a health hazard. It also provides a separate unfit-for-food consideration for certain cases where no health hazard is found.

Section 117.3 defines monitoring as a planned sequence of observations or measurements assessing whether controls operate as intended. Verification goes beyond monitoring to evaluate operation and the validity of the food safety plan. Label the activity by its purpose in the plan—not simply because the form is called a verification sheet.

Set check frequency around the failure modes and the amount of product the site can reliably contain. Consider startup, changeover, interventions, operating checks and end-of-run checks when designing the schedule. These are site decisions, not a universal interval supplied by the cited provisions. A long interval can create a large uncertain product window.

A useful detector-check record identifies the line, product, package, approved configuration, test pieces, challenge method, time, operator, detection result and reject or stop response. Where installed, include the relevant reject-bin, confirmation and interlock checks. A challenge that alarms but fails to remove the test product is not a successful end-to-end check.

For a sifter, record the screen identity, inspection coverage, mesh and perimeter condition, seals, bypass observations and retained material. For a magnet, distinguish a condition and cleaning inspection from evidence of capture capability. Use explicit pass, fail and not-established results; a blank field is not a pass.

Section 117.190 requires applicable food-safety-plan implementation records for monitoring, corrective actions and verification, including validation, calibration and records review where applicable. These records are subject to Subpart F. A standalone tool register, maintenance photo file or foreign-material trend chart is not named as a universal Subpart C form. Such operational records may be optional additions, but evidence used to document a required activity is not optional merely because it sits in a maintenance system.

Treat a production reject and a failed control check as different events. A reject may show that a functioning control removed suspect product; a failed challenge or damaged screen calls the control’s performance into question. Secure rejected material, identify its product and time window, and investigate it without returning it to production by default. A second pass with no alarm does not explain the first reject.

An end-of-shift torn-screen finding means the failure time is unknown unless other evidence establishes it. The investigation therefore asks what passed through since the last demonstrably good inspection—not just what was running when the tear was discovered. An inadequate earlier check, mixed downstream inventory or retained material can require a wider scope. A clean magnet or a quiet detector log narrows the investigation only to the extent that its capability and operating evidence support that conclusion.

Where §117.150 applies, corrective-action procedures must address identifying and correcting the problem, reducing recurrence when necessary, evaluating all affected food for safety, and preventing affected food from entering commerce if its non-adulterated status cannot be ensured. Corrective actions, and corrections when appropriate, must be documented. An unanticipated ineffective control can also require reanalysis of the food safety plan when appropriate. The exception for a timely correction of a minor, isolated problem does not fit a screen failure with unresolved product-safety implications.

What supports product evaluation?

• Characterize recovered material: composition, hardness, sharpness, dimensions, shape and likely source. Preserve the failed part and compare it with recovered pieces; one matching wire does not account for all missing material.
• Establish exposure: check times and reliability, equipment location, product movement, carryover and all affected inventory. Record uncertainty instead of assigning a convenient failure time.
• Assess remaining controls: determine whether they were capable of controlling this material in its possible shapes and orientations, and whether records show effective operation during the affected interval.
• Evaluate a proposed reconditioning method for this contamination. A clean sample or a successful rerun is not, by itself, evidence that sparse fragments have been removed from the entire lot.
• Separate the food decision from the repair decision. Record the disposition basis, quantity, authorizing role and any unresolved evidence. Assign PCQI involvement where the applicable validation and review provisions require it.

Section 117.80(a)(6) requires food contaminated to the point of adulteration to be rejected or, if appropriate, treated or processed to eliminate contamination. Section 117.80(c)(9) addresses protective disposal and, where adulterated food can be reconditioned, either an appropriate method proven effective or appropriate reconditioning followed by reexamination and a finding that the food is not adulterated before incorporation into other food. Rescreening is therefore a method to evaluate—not an automatic release authorization.

Fictional scenario: the times, quantities, checks and role assignments below are site assumptions, not regulatory limits. A dry-mix line runs from bag dumping to blending, discharge sifting, a magnet, packaging and final metal detection. Its food safety plan identifies sharp screen wire as a hazard requiring a preventive control. The product requires cooking, but the site has no basis to claim that cooking removes wire.

At 12:00, a documented empty-line inspection finds the discharge screen, perimeter and seals intact. Three lots then pass through the line. At the 16:00 end-of-shift inspection, the operator finds torn mesh and missing wire. No evidence establishes when the damage began. The site includes every lot produced after the 12:00 check in the affected population.

The initial containment is 2,990 kg in the main product hold plus 10 kg already secured as detector rejects. The trial uses all 1,000 kg of DM-201 and the 995 kg non-rejected portion of DM-202. It retains 2 kg from DM-201 and 3 kg from DM-202, including the recovered wire and associated product. For this scenario, weights reconcile with no other withdrawals or losses.

The final inventory balance is 3,000 kg = 1,990 kg rescreened and held + 995 kg unprocessed and held + 15 kg segregated rejects + 0 kg released. The 15 kg comprises the original 10 kg detector rejects and 5 kg trial retains. Rescreen input is an activity total, not another inventory category. All 3,000 kg remain contained: 2,985 kg in product hold and 15 kg in reject storage, with no destruction or shipment yet recorded.

Screen replacement, installation checks and restart acceptance are tracked separately. The corrective-action record also asks whether the inspection method and interval should change, whether similar screens need examination, and whether the food safety plan needs reanalysis. Closing the maintenance work order does not close the food disposition.