Guide
FSMA Preventive Controls: A Food Safety Plan That Actually Holds Up
The FSMA Preventive Controls for Human Food rule (21 CFR Part 117) has been in force since 2016, and inspections in 2025 and 2026 are finally treating it as a mature regulation rather than a transition rule. The bar for a defensible food safety plan is higher than ever: a real hazard analysis, identified preventive controls with monitoring and verification, a documented supply-chain programme, a recall plan that has been tested, and a Preventive Controls Qualified Individual who can sign all of it. This guide breaks the rule into the artefacts an FDA investigator actually pulls during an inspection and lays out a practical path to readiness. It is written for food safety managers, plant managers, QA directors and PCQIs at FDA-registered food facilities.
Start free trial Free trial, no credit card, onboard in days, not months.
Scope: who has to do this
Subpart C of Part 117 applies to almost every facility required to register under section 415 of the FD&C Act — meaning anyone who manufactures, processes, packs, or holds human food in the United States or for import into it. There are narrow exemptions for very small businesses (under $1 million in annual food sales, adjusted for inflation), qualified facilities, certain on-farm activities, and facilities solely engaged in storage of unexposed packaged food. If you don't fit one of those exemptions cleanly, assume Subpart C applies in full — partial exemptions are rare and easy to lose. The financial threshold is recalculated annually and the qualified-facility attestation has to be re-submitted; a one-time exemption isn't permanent.
The food safety plan: the core deliverable
§117.126 requires a written food safety plan prepared by or under the oversight of a PCQI. The plan must include: a hazard analysis, preventive controls, supply-chain programme (where applicable), recall plan, procedures for monitoring the controls, corrective action procedures, and verification procedures. The plan is reviewed and updated at least every three years or when a significant change occurs. The most common inspection finding is not the absence of a plan — it's a plan that exists on paper but isn't being executed: monitoring forms not filled in for two weeks, corrective actions logged without root cause, verification activities scheduled but not signed off. The plan only protects you if the records prove it's alive.
Hazard analysis and the 'known or reasonably foreseeable' standard
§117.130 requires a written hazard analysis identifying biological, chemical (including radiological), and physical hazards that are known or reasonably foreseeable for each type of food. The standard is broader than HACCP's traditional 'reasonably likely to occur' — it forces you to consider hazards that have occurred elsewhere in your sector, not just your facility. For each hazard, evaluate severity and probability, decide whether a preventive control is required, and document the rationale. Recurring failure modes: not citing the source for 'known' hazards (FDA recall data, sector outbreaks, supplier issues), not re-running the analysis when a new ingredient or process is introduced, and writing 'not a hazard' without a documented rationale.
Process, allergen, sanitation, and supply-chain controls
When the hazard analysis identifies a hazard requiring a preventive control, §117.135 to §117.140 require you to apply the right type. Process controls cover steps like cook, cool, pasteurise, acidify, with critical parameters and corrective actions. Allergen controls cover labelling and cross-contact prevention. Sanitation controls cover environmental pathogen contamination and cross-contact via shared equipment. Supply-chain controls apply when the hazard is controlled before your facility receives the ingredient (the supplier's process is your control). Each control needs monitoring (frequency and method documented), corrective action when monitoring shows a deviation, verification (e.g. calibration, observation, records review), and validation that the control actually works for the hazard it addresses.
The supply-chain programme
§117 Subpart G requires a written supply-chain programme when an ingredient's hazard is controlled before receipt. You must approve suppliers, conduct supplier verification activities appropriate to the hazard (audit, sampling and testing, records review), and document the rationale for the verification frequency and method. For a serious hazard, on-site audit annually is the expected baseline; for lower-risk hazards, supplier records review at receipt may suffice. The two recurring inspection findings are: an Approved Supplier List that hasn't been re-evaluated in two years, and supplier verification activities documented at the corporate level but never connected to the actual ingredient lots received in the plant.
Recall plan: written, tested, time-bound
§117.139 requires a written recall plan for any food with a hazard requiring a preventive control. The plan must describe procedures to notify direct consignees, notify the public, conduct effectiveness checks, and dispose of recalled product. The 'written plan' part is easy; the 'tested' part is where most facilities lose points. A mock recall once a year — pulling a real lot and tracing forward to every consignee — is the minimum credible bar in 2026. Time the exercise, capture the gaps, fix the data quality issues, and run it again. With FSMA 204 traceability for FTL foods stacking on top in January 2026, the recall plan also has to interlock with the 24-hour sortable spreadsheet capability.
The PCQI: scope of duties and signing authority
A Preventive Controls Qualified Individual must oversee or perform: preparation of the food safety plan, validation of preventive controls, records review for monitoring and corrective actions, and reanalysis of the plan. The PCQI need not be on the payroll — a qualified consultant can serve — but the duties and the signing authority must be unambiguous. Common gaps: the PCQI named in the plan no longer works at the facility, the records-review duty is delegated to a non-PCQI without documented oversight, or reanalysis happens reactively after an FDA inspection rather than after a significant change. Treat the PCQI signing authority like a controlled document — when the person changes, the plan changes, training records change, and the signed records change too.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Food safety
Live food safety plan with hazard analysis, controls, monitoring and verification.
Deviations & CAPA
Monitoring deviations routed to the PCQI with structured corrective action.
Supplier portal
Risk-tiered ASL with supplier verification evidence tied to inbound lots.
Recall management
Scheduled mock recalls, timed and logged — one drill, both 117 and 204.
Traceability
Forward and backward genealogy that interlocks with FSMA 204 KDEs.
Document control
PCQI-signed food safety plan, training records and verification packages.
Industries this hits hardest
Frequently asked
How does Preventive Controls relate to HACCP?
HACCP is the methodological ancestor; Preventive Controls is the FDA-mandated successor with a broader scope. PC requires the same hazard-monitoring-corrective-action structure plus supply-chain controls, sanitation controls (where they address hazards), and an updated standard for what counts as a hazard. A facility with a strong HACCP plan is most of the way to a Preventive Controls plan, but the gap is real and worth a formal assessment.
Do we need a separate PCQI for every facility?
Yes — Part 117 requires a PCQI to oversee or perform the regulated duties at each facility. One PCQI can cover multiple facilities, but they must have the working knowledge and the documented training (a recognised PCQI course or equivalent job experience plus training) for each one. Inspectors verify training records on entry.
What's the relationship between Subpart B and Subpart C?
Subpart B is the current Good Manufacturing Practice (CGMP) baseline — facilities, sanitation, personnel, controls in general terms. Subpart C is the Preventive Controls overlay that adds the food safety plan, hazard analysis and supply-chain programme. Both apply, and inspectors evaluate them together; a clean PC plan with weak CGMP records still gets you a 483.
Does FSMA 204 replace Part 117?
No — they stack. Part 117 covers preventive controls for hazards; FSMA 204 covers traceability records for foods on the Food Traceability List. A facility making FTL foods needs both, and the smart move is to design the food safety plan and the traceability records on shared master data so a CTE in 204 also satisfies a monitoring record in 117.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.