21 CFR Part 110 vs 117: Preventive Controls, PCQI, and Recall Plan

The comparison between 21 CFR Part 110 and Part 117 is really a before-and-after: Part 110 was revoked and replaced by Part 117, which kept the old sanitation and hygiene rules intact but layered a mandatory, written food safety plan on top. Every registered human-food facility that used to operate under Part 110 now has to meet Part 117, and unless a specific exemption applies, that means a hazard analysis, preventive controls, supply-chain oversight, a recall plan, and records that prove the system is working.

What Carried Over and What Is New

Part 110 set minimum sanitary standards: keep the facility clean, control pests, train employees on basic hygiene. Those rules didn’t require a facility to think systematically about what could go wrong with its specific products. Part 117 keeps that sanitation baseline in Subpart B, essentially the modernized Part 110, and then adds Subparts C and G, which require written food safety plans, formal hazard analyses, documented preventive controls, and supplier verification.

The full title of the new regulation signals the shift: “Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.” The old framework reacted to contamination. The new one is designed to prevent it.

When Part 110 Went Away

The Food Safety Modernization Act, signed into law in 2011, directed the FDA to rewrite its approach. The agency finalized the preventive controls rule on September 17, 2015, and formally withdrew Part 110’s remaining provisions effective September 12, 2018.¹ Part 110 no longer exists as a live regulation. If a supplier contract, an internal SOP, or a certificate still references Part 110, the substance has moved to Part 117.

Who Has to Comply

Any domestic or foreign facility required to register with the FDA under Section 415 of the Federal Food, Drug, and Cosmetic Act must comply with Part 117.² Several categories are exempt from the preventive controls requirements in Subparts C and G, though not from the Subpart B sanitation rules:

Qualified facilities, meaning very small businesses averaging less than $1 million in annual sales of human food (adjusted for inflation, calculated over the preceding three years) that meet the other criteria. These facilities follow modified requirements under Section 117.201.³⁴
Activities already covered by the seafood HACCP rule (Part 123), the juice HACCP rule (Part 120), or the low-acid canned food regulation (Part 113).⁴
Dietary supplement manufacturers in compliance with Part 111.
Activities subject to Section 419 of the FD&C Act (produce safety standards).
Certain low-risk on-farm packing, holding, and manufacturing activities by small or very small businesses.

Exemption from Subparts C and G doesn’t excuse a facility from Subpart B. The sanitation baseline still applies to everyone.

The Written Food Safety Plan

This is the obligation Part 110 never imposed. Subpart C requires every covered facility to prepare and implement a written food safety plan with seven components:⁵

A written hazard analysis
Written preventive controls
A written supply-chain program, when applicable
A written recall plan
Written monitoring procedures for the preventive controls
Written corrective action procedures
Written verification procedures

The plan must be prepared or overseen by a Preventive Controls Qualified Individual and kept onsite at all times. Unlike other records, which can be stored offsite as long as they are available within 24 hours, the food safety plan itself cannot leave the facility except during a prolonged closure, and even then it must be returned within 24 hours if the FDA requests it.⁶

Hazard Analysis and Preventive Controls

For each type of food a facility handles, the hazard analysis must identify and evaluate known or reasonably foreseeable hazards based on experience, illness data, scientific reports, and other relevant information. The written analysis is required whether or not it identifies any hazards that need a control.⁷

The rule groups hazards into three categories: biological (including parasites and environmental pathogens), chemical (including radiological hazards, pesticide residues, natural toxins, and food allergens), and physical (such as stones, glass, and metal fragments). The analysis must also consider whether hazards could be present naturally, through unintentional introduction, or through intentional introduction for economic gain, such as food fraud.

When the analysis identifies hazards that require control, the facility must implement written preventive controls in four categories:⁸

Process controls, which govern parameters like heat, acidification, irradiation, and refrigeration, and must specify the maximum or minimum values needed to control each hazard.
Food allergen controls, which protect against allergen cross-contact and ensure accurate finished product labeling.
Sanitation controls, which address environmental pathogens, employee handling, and allergen cross-contact.
Supply-chain controls, governed by the separate supply-chain program in Subpart G.

Supply-Chain Program

When the hazard analysis identifies a hazard that will be controlled by a supplier rather than in-house, Subpart G requires a written, risk-based supply-chain program. Suppliers must be approved before ingredients are received, and the receiving facility has to verify that the supplier is actually controlling the identified hazards.⁹

Acceptable verification activities include onsite audits, sampling and testing of ingredients, review of the supplier’s food safety records, and other appropriate activities. A supplier cannot verify itself. The receiving facility cannot rely on the supplier’s own audit, the supplier’s own record review, or the supplier’s determination of what verification is appropriate. That responsibility rests with the buyer.

The Preventive Controls Qualified Individual

Part 117 introduces a role Part 110 never contemplated: the Preventive Controls Qualified Individual, or PCQI. A PCQI is someone who has completed standardized training in developing and applying risk-based preventive controls, or who has equivalent job experience.⁵ The PCQI prepares or oversees the food safety plan, oversees validation of preventive controls, and must be involved whenever the plan is reanalyzed.¹⁰

The FDA has not published specific criteria for what qualifies as equivalent job experience. In practice, when someone claims PCQI status through experience alone, the FDA evaluates the food safety plan itself rather than the resume. A weak plan signals that the PCQI needs further training. Existing HACCP or GFSI-benchmarked certifications do not automatically satisfy the PCQI requirement. The individual can be an employee or an outside consultant, but the facility remains responsible for having one who is genuinely qualified.

Monitoring, Corrective Actions, and Verification

Preventive controls have to be watched, not just written down. The food safety plan must include written monitoring procedures that confirm each control is being applied as designed. For process controls, that means tracking whatever critical parameters the hazard demands, whether time, temperature, pH, or something else.

When monitoring shows a control wasn’t properly implemented, written corrective action procedures must ensure the problem is identified and corrected, that steps are taken to reduce the likelihood of recurrence, that all affected food is evaluated for safety, and that no adulterated or misbranded food enters commerce.¹¹ Two situations specifically trigger corrective action: detection of a pathogen or indicator organism in ready-to-eat product testing, and detection of an environmental pathogen through environmental monitoring.

Verification confirms the food safety system is working as intended. Validation is a specific type of verification requiring scientific or technical evidence that the preventive controls will effectively control the identified hazards when properly implemented. Validation must be performed or overseen by the PCQI before the food safety plan goes into effect, or within 90 calendar days after production begins with a written justification for the delay.¹⁰ Food allergen controls, sanitation controls, the recall plan, and the supply-chain program don’t require formal validation, though they still need monitoring and verification through other means.

Recall Plan

Any food for which the hazard analysis identifies a hazard requiring a preventive control must have a written recall plan. The plan has to assign responsibility for each step and cover how the facility will notify direct consignees, notify the public when necessary, conduct effectiveness checks, and dispose of recalled food appropriately.¹² A plan that has never been rehearsed rarely performs well under either an actual recall or an FDA inspection.

Recordkeeping

Every element of the food safety plan has to be documented. Records must be legible, accurate, and include the date and the signature or initials of the person who performed the activity. They must be retained at the facility for at least two years from the date they were prepared. Records that establish the general adequacy of equipment or processes, such as validation studies, must be kept for at least two years after their use is discontinued.⁶

Offsite storage is allowed for most records as long as they can be retrieved and made available onsite within 24 hours of an FDA request. Electronic records count as onsite if they are accessible from an onsite location. The food safety plan itself is the one exception, and it stays put.

Enforcement

The FDA’s enforcement authority under Part 117 is broader than what existed under Part 110. The statute behind the rule requires facility owners and operators to evaluate hazards, implement preventive controls, monitor performance, and maintain records of that monitoring.¹³

The most severe tool is registration suspension. If the FDA determines that food from a registered facility has a reasonable probability of causing serious health consequences or death, it can suspend the facility’s registration. A suspended facility cannot manufacture, process, pack, or distribute food in interstate or intrastate commerce, and it cannot import or export food. Suspension applies when the facility created or was responsible for the hazard, or when it knew or should have known about the risk and still packed, received, or held the food.¹⁴

FSMA also gave the FDA mandatory recall authority for the first time. When the agency finds a reasonable probability that a food is adulterated or misbranded in a way that could cause serious harm or death, it must first give the responsible party a chance to recall voluntarily. If the company refuses or delays, the FDA can order an immediate cease-distribution and notify everyone in the distribution chain. An informal hearing must occur within two days of the order, after which the FDA can require a full recall with a specific timetable and periodic progress reports.¹⁵

Where the Deadlines Stand

All compliance deadlines have passed. Large businesses had to comply by September 19, 2016. Small businesses had until September 18, 2017. Very small businesses had until September 17, 2018.¹⁶ Extended deadlines applied to a handful of edge cases, such as facilities engaged solely in packing or holding produce and facilities that would qualify as farms except for their ownership structure, but even those extensions expired no later than early 2020.

A facility still operating on a Part 110 mindset is out of compliance today. The written food safety plan is the piece the old rule never asked for, and it is the piece an FDA inspector will ask to see first.

1
Federal Register. Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
2
U.S. Food and Drug Administration. FSMA Final Rule for Preventive Controls for Human Food
3
eCFR. 21 CFR Part 117 – Definitions
4
eCFR. 21 CFR 117.5 – Exemptions
5
eCFR. 21 CFR 117.126 – Food Safety Plan
6
eCFR. 21 CFR 117.315 – Requirements for Record Retention
7
eCFR. 21 CFR 117.130 – Hazard Analysis
8
eCFR. 21 CFR 117.135 – Preventive Controls
9
eCFR. 21 CFR Part 117 Subpart G – Supply-Chain Program
10
eCFR. 21 CFR 117.160 – Validation
11
eCFR. 21 CFR 117.150 – Corrective Actions and Corrections
12
eCFR. 21 CFR 117.139 – Recall Plan
13
Office of the Law Revision Counsel. 21 USC 350g – Hazard Analysis and Risk-Based Preventive Controls
14
U.S. Food and Drug Administration. Registration of Food Facilities and Other Submissions
15
Office of the Law Revision Counsel. 21 USC 350l – Mandatory Recall Authority
16
U.S. Food and Drug Administration. FSMA Compliance Dates