Tell the four food-safety terms apart — the clean-operation baseline, the hazard-control method, the federal rule, and the written plan it requires — and know which stack applies to what you make.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can hear "GMP," "HACCP," "FSMA Preventive Controls," and "Food Safety Plan" in a sentence and say exactly what each one names, why they are not synonyms, and which of them your operation actually has to answer to. That one piece of vocabulary is what keeps you from building the wrong document — or building nothing because the words never sorted themselves out.
Walk any food forum and you will find the same knot: someone asks whether their HACCP plan counts as their Food Safety Plan, whether GMPs are "part of HACCP," or whether they are "FSMA certified." The terms get traded as if they mean the same thing. They do not. They sit at different layers, and each answers a different question:
They stack rather than compete. Get the layers straight and the rest of this course — building a HACCP plan, understanding Preventive Controls, choosing a certification — stops feeling like four overlapping copies of one thing.
are the floor. They are not about a specific hazard in a specific product; they are about running a sanitary operation at all: how the building is kept, how equipment is cleaned, how people wash and dress, how you keep pests and allergen residue and glass out of the food.
For FDA-regulated human food, GMPs live in 21 CFR Part 117, Subpart B (on eCFR). If you have heard old-timers cite "Part 110," that is the same idea one address ago — FDA modernized the longstanding cGMP regulation and moved it into Part 117 when the Preventive Controls rule was finalized in 2015. The "c" you sometimes see, as in cGMP, just stands for current: the practices are expected to keep up with current understanding.
GMPs come first because everything else assumes them. A hazard plan that skips basic sanitation is a plan built on sand — which is exactly why a later lesson treats GMPs and other prerequisite programs as the foundation a HACCP plan sits on, not an afterthought.
is not a law and not a document you buy. It is a method — a disciplined way of thinking about your process. The framework used across the industry is the one from the National Advisory Committee on Microbiological Criteria for Foods (NACMCF), adopted August 14, 1997 and published in FDA's HACCP Principles and Application Guidelines.
It has five preliminary steps (assemble a team, describe the food, describe its intended use, draw the process flow, and confirm the flow on the floor) followed by seven principles:
1 — Conduct a hazard analysis
Go step by step through your process and identify the biological, chemical (allergens included), and physical hazards that could make someone sick.
2 — Determine the critical control points
Find the steps where control is essential to prevent, eliminate, or reduce a hazard to a safe level.
3 — Establish critical limits
Set the measurable boundary at each of those points — a temperature, a time, a pH.
4 — Establish monitoring procedures
Decide how and how often you check that each limit is being met.
5 — Establish corrective actions
Decide in advance what you do when a limit is missed.
6 — Establish verification procedures
Confirm, separately from monitoring, that the whole system is working.
7 — Establish recordkeeping
Keep the records that prove all of the above actually happened.
A is the term that trips people, so pin it down now: it is a HACCP concept, born in Principle 2. Remember it, because the next framework has a term that sounds like it but is not it.
HACCP by itself is voluntary — until a specific regulation makes it mandatory for a specific kind of food. That is where the frameworks start to layer.
FSMA is the Food Safety Modernization Act, the 2011 law that reshaped US food safety. FSMA is a whole statute with several rules underneath it — the Food Traceability Rule (FSMA 204) is one, and the one this course cares about is another: the Preventive Controls for Human Food rule, finalized in September 2015 and codified in 21 CFR Part 117, Subpart C. Saying you are "under FSMA" is like saying you are "under the tax code" — true, but you have to name which rule.
The Preventive Controls rule is HACCP's ideas turned into a federal requirement, with more added on. Because it uses hazard analysis and risk-based preventive controls, people call it HARPC — . Where HACCP talks about CCPs, this rule talks about , and the category is deliberately wider. Under 21 CFR 117.135, preventive controls include process controls, food allergen controls, sanitation controls, supply-chain controls, and a recall plan.
That is the distinction to carry out of this lesson: a CCP is not the same as a preventive control. A CCP is one HACCP-flavored idea — a process control at a critical step, with a critical limit. A preventive control is the bigger FDA bucket that also holds allergen, sanitation, and supply-chain controls, none of which are CCPs. The rule even says its process controls apply "at critical control points, if there are any" — an acknowledgment that a preventive control can exist where no CCP does.
One more piece of vocabulary the rule invents: the . The rule requires that a PCQI prepare, or oversee the preparation of, your plan. There is no equivalent named, credentialed role baked into classic HACCP — it is a FSMA addition.
Here is the term that causes the most confusion, because it sounds generic. Under FSMA it is not generic at all. A is a defined deliverable with a defined content list.
21 CFR 117.126 says a covered facility must "prepare, or have prepared, and implement a written food safety plan," and spells out what it contains: the hazard analysis, the preventive controls, the supply-chain program, the recall plan, and the written monitoring, corrective-action, and verification procedures.
Notice what is on that list that a classic HACCP plan does not require on its face: a supply-chain program, a recall plan, and PCQI sign-off. That is why the honest short answer to "is my Food Safety Plan the same as my HACCP plan?" is related, but no — a HACCP plan is a method's output, and a FSMA Food Safety Plan is a rule's deliverable that contains a hazard analysis and more. Untangling those two documents in detail is the next lesson's whole job.
Everything above is the FDA world. If you make meat or poultry products, you are largely in the USDA world instead — a different agency, a different rule, and a place the "which framework" question has a different answer.
For establishments under USDA's Food Safety and Inspection Service (FSIS), HACCP is mandatory, and it lives in 9 CFR Part 417 (on eCFR), titled "Hazard Analysis and Critical Control Point (HACCP) Systems." An FSIS establishment builds and runs an actual HACCP plan under §417.2 — it is not the FSMA Preventive Controls rule, and it does not use the FSMA "Food Safety Plan" language. Which agency and which rule govern you turns on what you make; sorting FDA from USDA is its own question worth settling before you build anything, and one an earlier lesson on which agency regulates your product takes head-on.
The last word people misuse is "GFSI." You will hear a buyer say they want a "GFSI-certified" supplier, and it is worth knowing that phrase is slightly wrong. The does not audit or certify facilities. It benchmarks certification programs and recognizes the ones that meet its bar, so a certificate from any of them travels — "once certified, recognized everywhere."
You do not get "GFSI certified." You get certified to one of the programs GFSI recognizes — SQF, BRCGS, FSSC 22000, IFS, and others. Those programs sit on top of everything below: they expect your GMPs, your HACCP or Preventive Controls plan, and a stack of prerequisite programs to already be in place, and then they audit the whole thing against their code. Whether you need one at all, and which to pick, is the last course in this track.
Put the layers in order and the vocabulary resolves:
So the practical question is not "which framework is best," it is "which of these apply to me?" That depends on what you make, who regulates it, and who you sell to. Two cautions to carry into the lessons that answer it. First, the FDA Preventive Controls rule has exemptions and modified requirements — a "qualified facility" and a "very small business" carry a lighter load — but the dollar cutoffs that decide those categories are adjusted for inflation, so never work from a figure you remember; pull the current number from 21 CFR 117.5 and FDA's own guidance when you check your status. Second, an exemption from FDA is not an exemption from your customer: a retail or foodservice buyer can require a full Food Safety Plan, or a GFSI certificate, no matter what the federal rule lets you skip. The strictest requirement that applies to you — federal, or contractual — is the one you actually build to.
Verify your own status at the source, and date it
The frameworks above are stable, but the numbers that decide who they apply to move. Compliance dates shift and the qualified-facility dollar thresholds inflation-adjust. Treat this lesson as the map, not the coordinates: when you decide which stack is yours, confirm it against the live regulation on eCFR and FDA's current guidance, and write down the date you checked.
Do this in your operation