Controlling Salmonella in Low-Moisture Foods

This reference addresses US FDA human-food operations under 21 CFR Part 117. Apply the Subpart C preventive-control duties below only where those duties apply to the operation. For supplier reliance, establish Subpart G applicability and the ingredient-specific trigger in §117.405; purchasing an ingredient does not by itself establish that trigger.

Section 117.3 recognizes a qualified-facility exemption by reference to §117.5(a). Have the regulatory lead establish the actual exemption or modified-requirement pathway before assigning this workflow. Do not decide qualified-facility status from headcount alone, or treat it as a blanket waiver of Part 117. The definition of a receiving facility used here expressly concerns a facility subject to Subparts C and G that manufactures/processes a received raw material or ingredient.

Under §117.5(a), qualified facilities are exempt from Subparts C and G, subject to withdrawal under Subpart E, and must follow the modified requirements in §117.201. They must attest to FDA to qualified-facility status and either hazard identification, preventive controls and monitoring, or compliance with applicable non-Federal food safety law, and retain supporting records. Status must be determined and documented annually by July 1; after the initial submission, attestations are submitted every two years during October 1–December 31. Where §117.201(e) applies, consumers must receive the manufacturing or processing facility’s name and complete business address on the required label or through the specified point-of-purchase notification. This is not a blanket Part 117 waiver or an eligibility determination. The worked scenario assumes Subparts C and G apply.

Use this site hazard-analysis premise: low water activity may limit growth without demonstrating that Salmonella already present has lost viability. Plan for possible survival through dry storage and blending unless the site has evidence of effective control. This is a conservative planning basis, not a claimed survival duration, thermal resistance value or universal moisture threshold.

Section 117.130 requires a written hazard analysis regardless of its outcome. Evaluate severity and probability in the absence of preventive controls. An existing supplier treatment is a proposed control—not a reason to omit the ingredient hazard from that evaluation.

• For flour and powdered mixes, establish intended and reasonably foreseeable use. A customer specification that mentions baking does not settle whether uncooked consumption is foreseeable.
• For spice and seasoning blends, assess each ingredient and the exposure created by opening, conveying, blending and packing it. One treated ingredient does not confer a treatment on the rest of the formulation.
• For cocoa/milk-powder blends, assess uses such as cold reconstitution or addition to foods that receive no further effective treatment. Do not assign RTE status from the product name alone.
• Document the ingredient evidence, formulation, equipment condition, sanitation, packaging, storage and use assumptions that support the conclusion. Mark missing evidence as unresolved rather than treating absence of a reported positive as proof of control.

Under §117.3, RTE includes food reasonably foreseeable to be eaten without further processing that would significantly minimize biological hazards. Section 117.130(c)(1)(ii) requires evaluation of environmental pathogens when RTE food is exposed before packaging and the packaged food receives no treatment or other control that would significantly minimize the pathogen. That evaluation is not limited to plants with an on-site lethal step.

If Salmonella is a hazard requiring a preventive control, §117.135 requires written controls that provide assurance the hazard will be significantly minimized or prevented. The analysis must identify where those controls operate; a list of test results is not a control-location decision.

Where the plant has a lethal step

A treatment used as a process preventive control needs defined hazard-control parameters and their maximum or minimum values, as appropriate under §117.135(c)(1). The site chooses the operating limits from evidence applicable to its food and process—not from a generic dry-food temperature or log-reduction target. As a site practice, define the validated operating envelope, monitoring locations, deviation response and conditions that require technical reassessment. Blending, screening and packing are not treated as lethal steps in this guide.

Where control occurs before receipt

Section 117.405 requires a written, risk-based supply-chain program when a receiving facility identifies an ingredient hazard requiring a supply-chain-applied control, subject to that section's exceptions. Section 117.410 requires approved suppliers, determination of appropriate verification activities and frequency, performance of those activities and documentation. It lists onsite audits, ingredient sampling and testing, review of relevant supplier food-safety records and other appropriate activities.

Supplier approval and verification decisions must consider the hazard, who applies the control, supplier performance and other appropriate factors such as storage and transportation. For a heat-treated spice, a useful receiving review connects the supplied material to the approved control and verification evidence. A distributor's commercial name or an isolated certificate of analysis should not be the site's entire explanation of who controlled Salmonella.

Section 117.430 constrains that choice. When a supplier controls a hazard for which there is a reasonable probability of serious adverse health consequences or death to humans, the default is an onsite supplier audit before using the ingredient and at least annually thereafter. Under §117.430(b)(2), a written determination may instead establish that other verification activities and/or less frequent onsite audits adequately assure control. Relevant §117.430(c)–(e) exceptions for qualified facilities, specified farms and small shell-egg producers have their own conditions and written assurances. This is not an annual-audit rule for every supplier, and customer-assurance enforcement discretion does not waive these supplier provisions.

A site with no lethal step still needs an accepted control route for every ingredient hazard requiring control. Keep an untreated lot out of an RTE formulation when its proposed control route is unresolved. If the receiving facility determines that a supplier is not controlling a hazard identified as requiring a supply-chain-applied control, §117.410(e) requires prompt, documented action under §117.150.

Section 117.160 requires validation appropriate to the preventive control and its role. Validation must obtain and evaluate scientific and technical evidence; where that evidence is unavailable or inadequate, studies are required. For a dry-food lethal process, the site's technical assessment should address whether the evidence covers its formulation, product condition, equipment, loading and operating range. Those are study-design decisions, not universal numerical limits supplied by Part 117.

Validation must be performed or overseen by a preventive controls qualified individual. The timing rule is prior to implementation of the food safety plan, or—when necessary to demonstrate that controls can be implemented as designed—within 90 calendar days after production of the applicable food first begins. A longer reasonable timeframe requires a written justification prepared or overseen by the PCQI. This is not an unconditional 90-day permission to operate without an effective control.

Validation is also required when a control change could affect its ability to control the hazard, and when reanalysis reveals the need. As a site decision, refer changes in recipe, ingredient condition, equipment or loading to the technical owner rather than assuming the existing evidence covers them.

Section 117.80(c)(14) requires foods that rely principally on water-activity control to be processed to and maintained at a safe moisture level. Section 117.80(c)(10) also requires protection from contaminants that may drip, drain or be drawn into food. Where sanitation is a preventive control, §117.135(c)(3) addresses sanitary conditions, food-contact cleanliness and prevention of cross-contamination. It does not prescribe the wet-clean authorization procedure below; the site must design it.

• Use suitable dry-cleaning methods as the normal site approach in designated dry areas. Select tools and methods that do not spread residues into exposed product or adjacent equipment.
• For an exceptional wet clean, have the sanitation lead define the reason, affected equipment, food removal or protection, water containment, disassembly, drying checks and restart authority before work begins.
• Check concealed locations as well as visible surfaces. A dry exterior is not the site's evidence that a hollow support, guard interface or other inaccessible location is dry.
• Treat condensation and roof leaks as contamination investigations, not just maintenance tickets. Protect or remove exposed food, identify the affected interval and area, and assess routes through equipment, tools, footwear and packaging.
• Have the designated food-safety decision-maker accept the completed sanitation and drying evidence before restart. Evaluate affected product separately; permission to restart is not permission to release earlier lots.

A practical water-event record identifies where water reached, what food was exposed or potentially exposed, the repair or cleaning performed, unresolved locations and who accepted restart. Its format is a site choice. If it documents a required sanitation-control activity or corrective action, retain it as that required evidence rather than treating it as an optional maintenance note.

For RTE food exposed after a lethal step, evaluate the opportunity for recontamination before packaging. The legal monitoring trigger is more precise than 'post-kill area': §117.165(a)(3) requires environmental monitoring when contamination of an RTE food with an environmental pathogen is a hazard requiring a preventive control. The same trigger can apply to an RTE blending plant that relies on supplier treatment and has no on-site lethal step.

Where required, environmental-monitoring procedures must be established and implemented in writing, be scientifically valid and identify the organism, sampling locations and number of sites, timing and frequency, tests and analytical methods, laboratory and corrective-action procedures. Locations, numbers and frequency must be adequate to determine whether controls are effective. The site must justify these choices; this guide supplies no universal weekly schedule or fixed swab count.

These zone names are common practice, not numbered categories prescribed by Part 117. Map them to actual transfer routes. Section 117.3's food-contact-surface definition includes drainage or other transfer that ordinarily occurs during normal operations; calling such a surface Zone 2 would not change its function.

As a site practice, trend findings by location, organism, equipment condition and water-event history. Keep routine verification distinct from investigative sampling after a finding. Neither a clean-looking surface nor a set of negative follow-up swabs should silently close an unresolved product-safety assessment.

Section 117.150 requires written corrective-action procedures, as appropriate, for pathogen or indicator findings in RTE product and through required environmental monitoring. Those procedures must address the problem, reduce recurrence when necessary, evaluate all affected food and prevent affected food from entering commerce if its non-adulterated status cannot be ensured.

For unanticipated problems covered by §117.150(b), take appropriate corrective action to identify and correct the problem, reduce recurrence, evaluate affected food and, as necessary, prevent it from entering commerce. When appropriate, reanalyze the food safety plan under §117.170 to determine whether modification is required. This applies to the specified failures of implementation, effectiveness or records review; it is not an automatic reanalysis rule for every observation.

1. Contain the event. As a site response, stop implicated exposed handling where warranted, protect the area and prevent use or shipment of potentially affected food while the scope is assessed.
2. Define the affected scope. Use production timing, exposed operations, water movement, equipment condition and personnel or tool routes. Record why each included or excluded lot falls inside or outside that scope.
3. Investigate and correct. Identify the source or plausible routes, repair the physical or procedural failure, and check whether the same failure could recur elsewhere. Record an unknown source as unknown.
4. Evaluate product separately from the environment. A non-food-contact positive is not, by itself, a product result; it is evidence requiring a reasoned assessment. A product positive is not closed by cleaning the room or obtaining a later negative sample.
5. Document disposition and its basis. The site's designated decision-maker authorizes continued hold, release, rejection or an appropriate treatment route. Do not release merely because a shipment deadline has arrived.

Under §117.80(a)(6), food contaminated to the extent that it is adulterated must be rejected or, if appropriate, treated or processed to eliminate contamination. Section 117.80(c)(9) further governs disposal and appropriate reconditioning of adulterated material. Diluting an implicated lot into another blend is not an accepted corrective route in this guide.

The minor-and-isolated-problem exception in §117.150(c)(2) requires that the problem not directly impact product safety. Do not use that label to bypass an unresolved safety assessment. Corrective actions, and corrections when appropriate, must be documented under §117.150(d).

This fictional dry seasoning-blend site makes an RTE topping, has no on-site lethal step and is subject to Subparts C and G. Its hazard analysis identifies ingredient-borne Salmonella and environmental contamination as hazards requiring controls. All quantities and timing below are scenario assumptions, not prescribed sampling, process or release criteria.

Paprika lot P-41 was heat-treated by its approved supplier; receiving QA has accepted the applicable supplier-verification and lot-identity evidence. Cumin lot U-18 arrived untreated and remains segregated because no acceptable control route has been established. It is never added to the blend. Finished lots B-71 and B-72 contain P-41 and other previously accepted, controlled ingredients.

Day 4 quantity balance

The ledger counts each physical quantity once. Only the unused P-41 balance appears as an ingredient; paprika already consumed is included within finished-product weights. Held means disposition remains undecided. Rejected means the decision is not to use the material, even while it remains segregated awaiting controlled return. Removed laboratory samples are no longer included in held stock.

Supplier control before receipt and proposed control by a downstream customer are different decisions. Section 117.190(a)(1) requires documentation of the basis for not establishing a preventive control under §117.136(a). It does not make a customer purchase specification the documented basis by itself.

Section 117.136 provides distinct pathways; customer means a commercial customer, not a consumer. Under (a)(1), determine and document that the food type cannot be consumed without an appropriate control. Under (a)(2), reliance is on a customer subject to Subpart C that controls the identified hazard; under (a)(3), it is on a customer not subject to Subpart C that manufactures, processes or prepares the food under applicable food safety requirements. Under (a)(4), a later entity controls the hazard through the specified chain of customer commitments. Under (a)(5), establish, document and implement a system ensuring hazard control at a subsequent distribution step, and document its implementation. Section 117.136(b) requires documentation of the applicable circumstance.

For (a)(2)–(4), documents accompanying the food must disclose, in accordance with trade practice, that it is not processed to control the identified hazard. The codified rule separately requires annual written customer assurances: the (a)(2) customer identifies and follows hazard-control procedures; the (a)(3) customer assures compliance with applicable food safety requirements; the (a)(4) customer passes on the disclosure and sells only into the specified written-commitment chain. A purchase specification or consumer cooking instruction is not the same as these pathways.

FDA’s final January 2018 enforcement-policy guidance, section III.B (pages 15–17), describes enforcement discretion for the customer written-assurance requirements until completion of rulemaking, while expressly retaining necessary disclosures. Its March 2022 final guidance, section II.B.2 (page 7), reiterates that policy for §117.136(a)(2)(ii), (3)(ii) and (4)(ii). These are nonbinding enforcement policies, not repeal of the codified annual-assurance text. Do not extend this customer policy to §117.430 supplier assurances or infer clearance of a separate FSVP obligation. Establish the actual downstream route and required disclosure before accepting reliance; the worked site still has no accepted route and no finished-lot release.

For operations subject to Subpart C, §117.190 requires implementation records for preventive-control monitoring, corrective actions and verification. Verification records include, as applicable, validation, verification of monitoring and corrective actions, calibration, product testing, environmental monitoring, records review and reanalysis. The section also includes supply-chain-program records, the applicable §117.136 basis and applicable PCQI and qualified-auditor training records. These records are subject to Subpart F.

Section 117.165(a)(4) requires PCQI performance or oversight of the specified records review. Monitoring and corrective-action records are reviewed within seven working days after creation, or within a reasonable longer timeframe supported by a written justification prepared or overseen by the PCQI. Calibration, testing, supplier/supply-chain verification and other verification records are reviewed within a reasonable time after the records are created. These review periods are not permissions to release unresolved product.

• Required evidence: preserve the actual result, deviation, corrective action and review decision, including incomplete checks and pending reports. Do not replace a failed record with a clean retrospective version.
• Site-selected formats: a wet-clean permit, photograph set, zone map or quantity ledger is not a universally prescribed named form in these cited provisions. Where it records a required activity, its evidence is not optional merely because the format is locally designed.
• Decision authority: name the person who may release or reject stock and the person who may authorize restart. PCQI validation and records-review duties apply where specified; this guide assigns lot disposition to the site's food safety manager rather than treating PCQI status as an automatic release authority.