FSMA preventive controls: a food safety plan your team can run
A food safety plan is only as good as the records behind it. Here is what the rule asks for, section by section, and who signs what.
In Short
- The plan is written, based on a hazard analysis, and overseen by a PCQI.
- Controls go beyond CCPs: allergens, sanitation and suppliers too.
- Reanalyse at least every three years, sooner when things change.
The Food Processing Operations Guide
Safe changeovers. Right labels. Every lot traceable.
- The rules and the plan
- Supplier to filled tray
- Allergen changeovers and pack checks
- Trace, recall and record review
Plus Evidence map and four worksheets.
Get the food processing guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Food Processing Operations Guide
Safe changeovers. Right labels. Every lot traceable.
The Preventive Controls for Human Food rule is in 21 CFR Part 117, Subpart C. It is law, enforced by FDA for most facilities that must register as food facilities. It asks for a written food safety plan based on a hazard analysis, with preventive controls, monitoring, corrective actions and verification, prepared or overseen by a preventive controls qualified individual (PCQI). Sections were checked against the eCFR on 2 Oct 2026. Exemptions and modified requirements apply to some businesses, such as qualified facilities; check Subpart A before starting.
What the food safety plan contains
Section 117.126 requires a written food safety plan that includes the hazard analysis, the preventive controls, the supply-chain program, the recall plan, and written procedures for monitoring, corrective actions and verification. The plan must be prepared, or its preparation overseen, by one or more PCQIs, and it is a record under Subpart F.
Food safety plan contents (117.126)
Hazard Analysis
Under 117.130, the facility identifies known or reasonably foreseeable biological, chemical (including radiological) and physical hazards for each type of food, and evaluates them for severity and probability in the absence of controls. Hazards that need a preventive control are carried into the plan.
More on hazard Analysis
The analysis is written, even if it concludes that no preventive controls are needed.
The Four Kinds of Control
Section 117.135 describes process controls, food allergen controls, sanitation controls and supply-chain controls, plus a recall plan and other controls as needed. Process controls include parameters with limits; allergen controls cover cross-contact and labeling; sanitation controls cover cleanliness of food-contact surfaces and prevention of cross-contamination; supply-chain controls apply where a hazard is controlled before receipt.
Which control type is it?
- Parameters with limits, monitored and recorded.
More on the Four Kinds of Control
Monitoring, corrective actions and verification are scaled to the control and its role in food safety.
Supply-Chain Program and Recall Plan
Subpart G requires a written supply-chain program when the receiving facility's hazard analysis identifies a hazard that a supplier controls. It covers supplier approval and verification activities, such as onsite audits, sampling and testing, or record review, chosen by the receiving facility.
More on supply-Chain Program and Recall Plan
Section 117.139 requires a written recall plan when a hazard requires a preventive control, with procedures for notifying consignees and the public, effectiveness checks and disposition.
What the PCQI does
Section 117.180 lists what one or more PCQIs must do or oversee: preparing the food safety plan, validating preventive controls, determining that validation is not required, reviewing records, reanalysing the plan, and written justifications where the rule allows longer timeframes. A PCQI is qualified by completing training under a standardised curriculum recognised by FDA, or by job experience.
What the PCQI does or oversees (117.180)
| Task | Rule reference |
|---|---|
| Prepare the food safety plan | 117.126(a)(2) |
| Validate preventive controls | 117.160(b)(1) |
| Decide validation is not required | 117.160(c)(5) |
| Review records | 117.165(a)(4) |
| Reanalyse the plan | 117.170(d) |
- Prepare the food safety plan
- Rule reference
- 117.126(a)(2)
- Validate preventive controls
- Rule reference
- 117.160(b)(1)
- Decide validation is not required
- Rule reference
- 117.160(c)(5)
- Review records
- Rule reference
- 117.165(a)(4)
- Reanalyse the plan
- Rule reference
- 117.170(d)
Also relevant: Food Safety Control & Traceability Buyer Guide (14-page PDF, on the Food Safety page).
Questions
Who has to have a food safety plan?
Facilities that must register with FDA under section 415 of the FD&C Act, unless exempt or subject to modified requirements. Qualified facilities, for example, have modified requirements. Check 21 CFR 117 Subpart A for your situation.
What does a PCQI have to do?
Under 21 CFR 117.180, one or more PCQIs do or oversee preparation of the food safety plan, validation of preventive controls, record review, reanalysis and certain written justifications.
How often must the food safety plan be reanalysed?
At least once every three years, and sooner when there is a significant change that creates a new or significantly increased hazard, new information about hazards, an unanticipated food safety problem or an ineffective control (21 CFR 117.170).
Is HACCP the same as a food safety plan?
They share principles, but the preventive controls rule is broader: controls are not limited to critical control points, and it includes allergen, sanitation and supply-chain controls and a recall plan.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
Food CGMP Readiness: Daily Checks and Evidence
EU Acrylamide Regulation 2017/2158: Mitigation, Sampling and Benchmark Levels
BRCGS Food Safety Issue 9 Guide: Culture, HACCP, Traceability and Audits
Cronobacter in Powdered Infant Formula: Part 106 Testing and FDA's Prevention Actions
21 CFR 106 Infant Formula CGMP Guide: Release, Testing and Traceability- Food Allergen Control: US Labeling and Bakery Readiness