FDA Food Safety Plan (FSMA Preventive Controls)
The written food-safety plan FSMA requires of covered facilities — what's in it, who needs it, and what it isn't.
Key Takeaways
- Required by FSMA's PCHF rule (21 CFR Part 117) for most registered food facilities.
- Core components — hazard analysis, preventive controls, supply-chain program, recall plan.
- Prepared or overseen by a PCQI — plus monitoring, corrective actions, verification.
- Reanalyzed at least every 3 years (and on significant changes) — it's a living document.
- Qualified facilities (<$1M/yr) have modified, lighter requirements (attestation).
- Not FSVP, not HACCP, not a food defense plan — those are separate.
What a Food Safety Plan Must Include
- Hazard analysis (117.130) — written evaluation of biological, chemical (incl. radiological & allergens), and physical hazards for each food; required even if no control is needed
- Preventive controls (117.135) — process, food allergen, sanitation, supply-chain, and other controls for the significant hazards
- Supply-chain program (Subpart G) — where a hazard requires a supplier-applied control
- Recall plan (117.139) — written, for any food with a hazard requiring a preventive control
- Monitoring, corrective actions & verification — procedures for each control
Covered Facilities & Exemptions
Generally, domestic and foreign facilities that manufacture, process, pack, or hold human food and must register with FDA need a Food Safety Plan — unless an exemption applies (21 CFR 117.5):
- Qualified facilities — very small businesses (avg <$1M/year) have modified requirements: attest they're implementing preventive controls or following applicable state/local food law, and notify FDA (every two years)
- Seafood (Part 123) & juice (Part 120) HACCP facilities — exempt for those products (they follow HACCP)
- Dietary supplement facilities under Part 111; low-acid canned food (Part 113) for microbiological hazards
- Farms (Produce Safety Rule, Part 112) and certain alcohol facilities (for the alcohol)
Who Writes It, and Keeping It Current
- A PCQI must prepare or oversee the plan — someone trained in risk-based preventive controls (the FDA-recognized FSPCA curriculum) or qualified by job experience; can be staff or an outside expert
- Reanalyze at least every 3 years — and whenever a significant change creates a new/increased hazard, new hazard information emerges, a control proves ineffective, or FDA requires it
- Keep records — of the plan and its monitoring/corrective actions/verification; FDA reviews them at inspection
- It's a living document — not a one-time write-up filed away
Food Safety Plan vs FSVP vs HACCP vs Food Defense
| Plan / program | What it is | Rule |
|---|---|---|
| Food Safety Plan | A facility's own preventive-controls plan for unintentional hazards | 21 CFR Part 117 (PCHF) |
| FSVP | A U.S. importer's program to verify a foreign supplier | 21 CFR Part 1, Subpart L |
| HACCP | Separate hazard-control systems for seafood & juice | 21 CFR Parts 123 & 120 |
| Food defense plan | Guards against intentional adulteration | 21 CFR Part 121 (IA rule) |
Develop Your Food Safety Plan
FDA Registration Assistance helps covered facilities develop and maintain a compliant Food Safety Plan — conducting the hazard analysis, designing the preventive controls (process, allergen, sanitation, supply-chain), writing the recall plan and monitoring/corrective-action/verification procedures, providing or coordinating a PCQI, and scheduling reanalysis. We also confirm whether you're covered or fall under an exemption (like a qualified facility) in the first place, and keep it distinct from FSVP and HACCP where those apply.
Contact us at info@fdaregistrationassistance.com or call +1 (928) 275-8333. An independent compliance firm serving 1,000+ companies across 135+ countries, with 15+ years of experience.
Frequently Asked Questions — Food Safety Plan
1. What is a Food Safety Plan?
A Food Safety Plan is the written plan required by FSMA's Preventive Controls for Human Food (PCHF) rule (21 CFR Part 117). Most food facilities that must register with FDA have to prepare and follow one. It includes a hazard analysis, risk-based preventive controls for the significant hazards, a supply-chain program (where needed), and a written recall plan, along with procedures for monitoring, corrective actions, and verification. It must be prepared or overseen by a Preventive Controls Qualified Individual (PCQI), and FDA reviews it during inspections.
2. Who has to have a Food Safety Plan?
Generally, domestic and foreign facilities that manufacture, process, pack, or hold human food and are required to register with FDA (under FD&C Act section 415) must comply with the PCHF rule and have a Food Safety Plan - unless an exemption applies (21 CFR 117.5). So being a registered food facility is the trigger. Note it's the facility's own plan - separate from FSVP (which is a U.S. importer's program for verifying foreign suppliers).
3. What must a Food Safety Plan include?
Under 21 CFR 117.126, the written plan must include: a hazard analysis (identifying biological, chemical - including radiological - and physical hazards for each food); preventive controls for the significant hazards (process, food allergen, sanitation, supply-chain, and other controls as needed); a supply-chain program (where a hazard requires a supplier-applied control); and a written recall plan (for any food with a hazard requiring a preventive control). Plus procedures for monitoring, corrective actions, and verification/validation.
4. What is a hazard analysis?
The hazard analysis is the foundation of the plan: a written evaluation of the known or reasonably foreseeable hazards for each type of food at your facility - biological (e.g., pathogens), chemical (including radiological and food allergens), and physical (e.g., glass, metal) - to determine which are "significant hazards" requiring a preventive control. A written hazard analysis is required even if it concludes no preventive control is needed. It drives everything else in the plan.
5. What are preventive controls?
Preventive controls are the measures you put in place to significantly minimize or prevent the significant hazards found in your hazard analysis (21 CFR 117.135). They include process controls (like cooking or refrigeration parameters), food allergen controls, sanitation controls, supply-chain controls, and "other" controls as appropriate. For each you also set monitoring, corrective actions, and verification. Not every facility needs every type - the hazard analysis determines which controls apply.
6. What is a PCQI, and do I need one?
A Preventive Controls Qualified Individual (PCQI) is the person who must prepare or oversee your Food Safety Plan (21 CFR 117.135(c)(2)). To be a PCQI, a person must have completed training in developing and applying risk-based preventive controls - at least equivalent to the FDA-recognized (FSPCA) standardized curriculum - or be otherwise qualified through job experience. Yes: a covered facility's plan must be prepared or overseen by a PCQI. The PCQI can be an employee or an outside expert.
7. What is the supply-chain program?
If your hazard analysis identifies a hazard that must be controlled by your supplier (rather than at your facility), you need a supply-chain program (21 CFR Part 117, Subpart G) - approving suppliers and conducting supplier verification (such as audits, testing, or reviewing records) appropriate to the hazard and risk. Not every facility needs one; it applies only when a hazard requires a supplier-applied control. It's related to, but distinct from, the importer's FSVP program.
8. Do I need a recall plan in my Food Safety Plan?
Yes - if your hazard analysis identifies any hazard requiring a preventive control, you must have a written recall plan (21 CFR 117.139). It describes the steps to perform a recall and assigns responsibility - notifying consignees, telling them how to return or dispose of the affected food, conducting effectiveness checks, and disposing of the recalled food. The recall plan is a required part of the Food Safety Plan for facilities with a hazard requiring a preventive control.
9. How often must the plan be reanalyzed?
At least once every three years - and also whenever there's a significant change at the facility that could create a new hazard or increase an existing one, when new information about potential hazards emerges, when a preventive control or the plan is found ineffective, or when FDA determines a reanalysis is necessary. A PCQI must perform or oversee the reanalysis. So the Food Safety Plan is a living document, not a one-time write-up.
10. Is a Food Safety Plan the same as FSVP?
No - they're different, though related. A Food Safety Plan is a facility's own preventive-controls plan under 21 CFR Part 117. FSVP (Foreign Supplier Verification Program, 21 CFR Part 1 Subpart L) is a separate obligation on the U.S. importer to verify that a foreign supplier produces food meeting U.S. standards. A domestic manufacturer has a Food Safety Plan; a U.S. importer of foreign food has an FSVP. One facility could be involved with both. See our FSVP page.
11. Is a Food Safety Plan the same as HACCP?
They're similar in spirit but different rules. The preventive-controls Food Safety Plan (Part 117) is FSMA's general framework for most human food. Seafood (21 CFR Part 123) and juice (Part 120) have their own, separate HACCP rules - and facilities operating under those HACCP systems are exempt from the Part 117 preventive-controls requirements for those products. So if you're a seafood or juice processor, you follow HACCP, not the Part 117 Food Safety Plan, for that product.
12. Is a Food Safety Plan the same as a food defense plan?
No. A Food Safety Plan (Part 117) addresses unintentional hazards - contamination, allergens, etc. A food defense plan addresses intentional adulteration intended to cause wide-scale public health harm, under a separate FSMA rule (the Intentional Adulteration rule, 21 CFR Part 121). They're different plans under different rules. A large facility may need both, but don't confuse them - a Food Safety Plan won't satisfy the food-defense requirement, and vice versa.
13. What's the "qualified facility" exemption?
Very small businesses - broadly, those averaging less than $1 million per year in annual sales of food plus the market value of food held without sale (adjusted for inflation) - are "qualified facilities" (21 CFR 117.5(a) / 117.201). They're exempt from the full hazard analysis and preventive controls requirements, but have modified requirements: they must attest that they're either implementing preventive controls or complying with applicable state/local food safety law, and submit that attestation to FDA (renewed every two years). It's a lighter path, not a total pass - and still requires action.
14. Who else is exempt from the Food Safety Plan requirement?
Under 21 CFR 117.5, exemptions include facilities under seafood HACCP (Part 123) or juice HACCP (Part 120) for those products; dietary supplement facilities complying with Part 111; low-acid canned food facilities (Part 113) for microbiological hazards; activities subject to the Produce Safety Rule (Part 112); farms; and certain alcohol-related facilities (for the alcohol). Being exempt from the Part 117 Food Safety Plan doesn't mean exempt from all FDA rules - you follow the framework that applies to you. We help confirm which one that is.
15. Does having a Food Safety Plan mean FDA-approved?
No. A Food Safety Plan is a required compliance document you prepare and maintain - FDA doesn't "approve" it. FDA reviews it during inspections to confirm it's adequate and being followed, and can cite deficiencies. So having a plan means you meet the requirement (if it's done correctly), not that FDA has "approved" your product or facility. FDA also offers a free Food Safety Plan Builder tool to help create one.
16. How does FDA Registration Assistance help with a Food Safety Plan?
We help covered facilities develop and maintain a compliant Food Safety Plan: conducting the hazard analysis, designing the preventive controls (process, allergen, sanitation, supply-chain), writing the recall plan and monitoring/corrective-action/verification procedures, providing or coordinating a PCQI, and scheduling reanalysis - and we confirm whether you're covered or fall under an exemption (like a qualified facility) in the first place. We keep it distinct from FSVP and HACCP where those apply. We're an independent compliance firm serving 1,000+ companies across 135+ countries with 15+ years of experience. Contact info@fdaregistrationassistance.com or +1 (928) 275-8333.
