Food safety plan requirements come from the FDA’s Preventive Controls for Human Food rule at 21 CFR Part 117, and they apply to every domestic facility that has to register with the FDA to manufacture, process, pack, or hold human food. The plan is a written, facility-specific document that identifies biological, chemical, and physical hazards and sets out the controls that keep those hazards out of finished product. A qualified individual has to build it, the facility has to follow it, and inspectors will ask to see it along with the records it generates.
Which Facilities Have to Have One
The rule reaches any facility required to register with the FDA under Section 415 of the Federal Food, Drug, and Cosmetic Act.1eCFR. 21 CFR 117.126 – Food Safety Plan Several categories sit outside it. Facilities that exclusively handle juice or seafood follow separate HACCP regulations. Retail establishments like grocery stores and restaurants are exempt from these manufacturing-level rules. Farms doing only traditional harvesting and packing generally fall outside Part 117, though the separate Produce Safety Rule may still apply.
Qualified Facility Relief
Smaller operations may qualify for a lighter compliance path. Under 21 CFR 117.3, a “qualified facility” is either a very small business averaging less than $1 million (inflation-adjusted) per year in combined food sales and market value, or a facility where most of the food sold goes directly to consumers or local retailers and total annual food sales average under $500,000 (also inflation-adjusted).2eCFR. 21 CFR 117.3 – Definitions The FDA publishes updated cutoffs each year; for 2024 the very small business threshold stood at roughly $1.37 million.3U.S. Food and Drug Administration. FSMA Inflation-Adjusted Cut-offs Qualified facilities still have food safety obligations, but they submit modified requirements rather than a full preventive controls plan.
Who Can Write the Plan
The regulations require that a Preventive Controls Qualified Individual (PCQI) develop or oversee development of the plan. A PCQI must have successfully completed training in risk-based preventive controls through a standardized curriculum recognized by the FDA, or hold equivalent knowledge through job experience.4eCFR. 21 CFR 117.180 – Requirements Applicable to a Preventive Controls Qualified Individual and a Qualified Auditor The FDA-recognized standardized curriculum is the course developed by the Food Safety Preventive Controls Alliance.5Food Safety Preventive Controls Alliance. PCHF PCQI V2.0
The PCQI does not have to be an employee. Hiring an outside consultant is common, especially at smaller operations. Beyond drafting, the PCQI oversees validation of preventive controls, reviews monitoring and corrective action records, and conducts reanalysis when changes or new hazards arise. Training used to qualify as a PCQI has to be documented with the date, type of training, and the individual’s name.
What the Plan Must Contain
The plan is built around a hazard analysis and the specific controls designed to address whatever that analysis turns up. Each component is a written document; regulators expect to see it on paper or in an equivalent electronic system, not practiced informally on the floor.
Hazard Analysis
The starting point is evaluating every known or reasonably foreseeable hazard that could affect the food being produced. This covers biological threats like Salmonella and Listeria, chemical risks such as pesticide residues and undeclared allergens, and physical hazards like metal fragments or glass. Each hazard gets assessed for both severity and likelihood of occurring without targeted controls. The written analysis is required even if the facility concludes that no hazards need a preventive control. The reasoning itself must be documented.
Preventive Controls
When the hazard analysis identifies risks that need managing, the facility must establish preventive controls tailored to those specific hazards. The regulations break these into several categories.6eCFR. 21 CFR 117.135 – Preventive Controls
- Process controls set parameters like cooking temperatures, cooling times, and acidification levels that must hit specific values to eliminate or reduce hazards. A facility cooking poultry products, for example, would set a minimum internal temperature of 165°F based on pathogen inactivation data. These values must be grounded in scientific data or regulatory standards.7U.S. Food and Drug Administration. Draft Guidance for Industry: Bacterial Pathogen Growth and Inactivation (Appendix 3)
- Food allergen controls prevent cross-contact and ensure accurate labeling. The nine major allergens are milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soybeans, and sesame. Equipment cleaning between batches and label verification are the backbone.8U.S. Food and Drug Administration. The FASTER Act: Sesame Is the Ninth Major Food Allergen
- Sanitation controls cover cleaning of food-contact surfaces and the surrounding environment to prevent contamination from environmental pathogens.
- Supply-chain controls verify that raw material suppliers are handling ingredients safely before they reach your facility.
- A recall plan is required for any food where the hazard analysis identified a hazard needing a preventive control. It must cover direct notification of consignees, public notification when needed to protect health, effectiveness checks, and proper disposal of recalled food.9eCFR. 21 CFR 117.139 – Recall Plan
Environmental Monitoring
Facilities producing ready-to-eat foods where Listeria contamination is a hazard requiring a preventive control face an additional obligation. Environmental monitoring means systematically swabbing food-contact surfaces, drains, and other production areas to verify sanitation controls are actually working. The FDA has stated that robust monitoring programs will occasionally detect pathogens; that is the point. The goal is to find contamination early, trace its source, and eliminate it before it reaches finished product.10U.S. Food and Drug Administration. Environmental Sampling A facility that skips this step when its hazard analysis calls for it is likely to draw FDA attention during inspection.
Monitoring, Corrective Actions, and Records
Every preventive control must have written monitoring procedures describing what gets checked, when, with what instrument, and by whom. Calibrated thermometers, pH meters, and similar tools need to be specified. These records create a continuous compliance history for every batch and shift.
When a measurement falls outside the established parameters, the facility follows its pre-written corrective action procedures. Those procedures lay out how to identify the affected food, evaluate whether it is safe, and decide whether to reprocess or destroy it. The key is that they exist before a problem occurs. Writing a corrective action plan during an actual failure defeats the purpose and leaves the facility exposed during inspection.
How Long Records Must Be Kept
All records required under Part 117 must be kept at the facility for at least two years after they were created. Records supporting a facility’s status as a qualified facility must be kept as long as that status is claimed. Scientific studies or process evaluations the facility relies on must be retained for at least two years after the facility stops using them. The food safety plan itself must remain onsite at all times. Other records can be stored offsite, but only if they can be retrieved and provided within 24 hours of an official request.11eCFR. 21 CFR 117.315 – Requirements for Record Retention Facilities keeping records digitally rather than on paper also have to comply with 21 CFR Part 11, which sets FDA standards for electronic records and signatures.12eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
Verification, Validation, and Reanalysis
Writing the plan and following it are two different things. Verification activities have to confirm that monitoring and corrective actions are actually being performed as written. A critical piece is record review: a PCQI, or someone under the PCQI’s oversight, must review monitoring and corrective action records within seven working days of their creation. The regulation allows a longer timeframe if the PCQI prepares a written justification for the delay.13eCFR. 21 CFR 117.165 – Verification of Implementation and Effectiveness
Validation Is a Higher Bar
Validation requires the facility to demonstrate with scientific or technical evidence that its preventive controls can actually control the identified hazards when properly implemented. A thermal processing step, for example, must be shown to consistently reach the temperature needed to achieve the target pathogen reduction. Not every control type requires this. Allergen controls, sanitation controls, the recall plan, and supply-chain programs are exempt from the validation requirement. Other controls can also be exempted if a PCQI prepares a written justification explaining why validation is not applicable given the nature of the hazard and the control.14eCFR. 21 CFR 117.160 – Validation
When to Reanalyze
The entire plan must be reanalyzed at least once every three years.15eCFR. 21 CFR 117.170 – Reanalysis Certain events trigger reanalysis sooner:
- Significant facility changes. Any change in activities, whether new equipment, new product lines, or altered processes, that creates a reasonable potential for a new hazard or increases a previously identified one. The reanalysis has to be complete before the change becomes operative.
- Preventive control failures, or an unanticipated food safety problem.
- FDA direction, when new hazards emerge or scientific understanding evolves.
After reanalysis, the facility must either revise the plan or document why no revision is necessary. Inspectors look for both the reanalysis record and the documented conclusion. Saying “we reviewed it” is not enough without showing the reasoning.
Training for Everyone Who Handles Food
Everyone who handles food at a registered facility, including temporary and seasonal workers, must receive training in food hygiene principles, food safety basics, and the importance of personal health and hygiene. The training has to be appropriate to the food being produced, the facility itself, and the specific duties each person performs.16eCFR. 21 CFR 117.4 – Qualifications of Individuals Who Manufacture, Process, Pack, or Hold Food Beyond formal training, each individual must be “qualified” for their role, meaning they have the education, training, or experience needed to do the job safely.
Training records must be established and maintained. At a minimum, capture the date of training, the topics covered, and the names of those trained. Gaps in training documentation are among the most common Form 483 observations.
What Happens if the Plan Falls Short
The FDA inspects domestic food facilities on a risk-based schedule. High-risk facilities must be inspected at least once every three years, and non-high-risk facilities at least once every five years. Infant formula facilities face annual inspections. These are minimums; the FDA can inspect more often when it sees a reason to.17U.S. Food and Drug Administration. How Does FDA Prioritize Domestic Human Food Facility Inspections
When an inspection uncovers problems, the inspector issues a Form 483 listing the observations. The FDA recommends responding within 15 business days of the date the form was issued. For complex observations that cannot be fully resolved that quickly, the agency expects at least a corrective action plan with a proposed timeline within those 15 days. Later responses may not prevent the FDA from escalating to a warning letter.18U.S. Food and Drug Administration. Responding to FDA Form 483 Observations
Enforcement escalates from there. The agency can administratively detain food believed to be adulterated or misbranded for up to 20 days, extendable to 30, while it pursues seizure or injunction proceedings.19Office of the Law Revision Counsel. 21 USC 334 – Seizure Where food from a facility has a reasonable probability of causing serious health consequences or death, the FDA can suspend the facility’s registration entirely, halting interstate and intrastate commerce until a corrective action plan is submitted and the registration is reinstated.20Office of the Law Revision Counsel. 21 USC 350d – Registration of Food Facilities Criminal prosecution is available as well, with penalties that increase for repeat offenses or violations involving intent to defraud or mislead.21Office of the Law Revision Counsel. 21 USC 333 – Penalties
Food Defense Is a Separate Plan
The food safety plan does not cover deliberate contamination. The FDA’s Intentional Adulteration rule under 21 CFR Part 121 requires certain registered facilities to maintain a separate written food defense plan with a vulnerability assessment, mitigation strategies, and their own monitoring, corrective action, and verification procedures. Very small businesses averaging less than $10 million (inflation-adjusted) per year in food sales and market value are exempt from Part 121.22eCFR. 21 CFR Part 121 – Mitigation Strategies to Protect Food Against Intentional Adulteration Facilities subject to both rules need to keep the two plans as separate, current documents; each is examined during FDA inspections.