Tell whether your HACCP plan and your FSMA Food Safety Plan are one document or two — what each requires, where they overlap, and which one the rules actually make you keep.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can answer the exact question first-timers post to the food-safety forums — is my Food Safety Plan my HACCP plan? — for your own operation. You will know what each document is, where they overlap, what the Food Safety Plan requires that a HACCP plan never had to, and which one the rules make you keep.
Someone building their first plan opens a standard, sees "Food Safety Plan" and "HACCP plan" used as if they were one thing, and cannot tell whether that means writing one document or two. It is one of the most common questions on the forums, and the honest answer is related, but not the same.
A HACCP plan is the output of a method. A FSMA Food Safety Plan is a document a federal rule requires — and that document contains a hazard analysis and controls that look a great deal like HACCP, plus several things a classic HACCP plan never had to include. So your HACCP work is not wasted: it is most of the core of a Food Safety Plan. But "I have a HACCP plan" is not the same sentence as "I have the Food Safety Plan that 21 CFR Part 117 requires." This lesson draws the exact line, and it assumes you can already tell GMPs, HACCP, and FSMA Preventive Controls apart — the previous lesson sorted those into layers.
A is what you produce when you run the HACCP method on your process. You do the five preliminary steps, then the seven principles: analyze the hazards, find the points where control is essential, set a measurable limit at each, monitor it, decide the corrective action in advance, verify the system works, and keep the records that prove it. The document that captures all of that is the HACCP plan.
It is built around the . Hold onto that word. HACCP by itself is voluntary — until a specific regulation makes it mandatory for a specific food (seafood, juice, meat, and poultry each have one). What it is not, on its own, is a document the FDA Preventive Controls rule will accept as compliance. That is the other document.
A is not a generic phrase, even though it sounds like one. Under FSMA it is a defined deliverable. Worth noticing: there is no "Food safety plan means…" line in the rule's definitions at 21 CFR 117.3. The rule defines the plan by telling you what it must contain, at 21 CFR 117.126. A covered facility must "prepare, or have prepared, and implement a written food safety plan," and that plan must include, in the rule's own list:
And it must be prepared, or its preparation overseen, by one or more . The plan itself is a record you have to keep and produce.
The overlap is real and it is the expensive part: the hazard analysis and the process controls. The hazard analysis you did for HACCP is the hazard analysis the Food Safety Plan requires. Your CCPs carry straight in. Here is the precise mechanism, because this is where the vocabulary earns its keep.
Under the Preventive Controls rule, the thing you build is a . The rule at 21 CFR 117.135 says preventive controls include "controls at critical control points (CCPs), if there are any CCPs," and "controls, other than those at CCPs, that are also appropriate for food safety." Read that twice. A CCP is one kind of preventive control — a subset. The rule even hedges with "if there are any," which is its way of admitting a Food Safety Plan can carry preventive controls and no CCP at all.
So a CCP is not the same as a preventive control, and a preventive control is not always a CCP. Your HACCP CCPs become the process controls inside the Food Safety Plan. That work transfers. What the plan asks for on top of it is where the two documents part ways.
Take your HACCP plan and hold it against the rule's content list. Four things a classic HACCP plan does not require on its face, but the Food Safety Plan does:
If you are under the Preventive Controls rule, those four are the elements your existing HACCP plan is most likely missing. They are the difference between the two documents, stated concretely.
There are cases where a mandatory HACCP plan means you do not owe a Part 117 Food Safety Plan at all. 21 CFR 117.5 exempts facilities already subject to certain HACCP and processing rules from subparts C and G — the preventive-controls and supply-chain requirements:
Meat and poultry sit outside this entirely. Those establishments run mandatory HACCP under USDA's Food Safety and Inspection Service at 9 CFR Part 417 — a different agency, a different rule, and no Part 117 "Food Safety Plan" language at all. Which agency governs you turns on what you make, and it is worth settling before you build either document.
Outside those exemptions, a covered FDA facility owes a Food Safety Plan, and having a HACCP plan does not excuse it. FDA does not accept a HACCP plan as a substitute for the Part 117 document — it accepts the HACCP plan as the core of it, and then looks for the rest.
Now the trap that causes the deepest confusion: "Food Safety Plan" does not mean the same thing everywhere, so two people can both say it and be describing different documents.
Under FDA's FSMA rule, a Food Safety Plan is the Part 117 deliverable above — broader than your HACCP plan. Under SQF, one of the certification schemes GFSI benchmarks (GFSI benchmarks schemes; it does not certify anyone), the phrase points the other way. SQF Edition 9 clause 2.4.3.1 requires a "food safety plan" prepared in accordance with the twelve steps of the Codex Alimentarius HACCP guidelines — a HACCP-based plan, and those twelve Codex steps are the same five preliminary steps and seven principles counted as one sequence. So under SQF, your "food safety plan" essentially is your HACCP plan. Same two words; opposite relationship to the HACCP plan depending on whose framework you are standing in.
The lesson is not to memorize which is which. It is to always ask whose food safety plan someone means — the FDA rule's, or a certification scheme's — before you assume you know what document they are asking for.
Work it in this order:
Name your agency and product
Meat or poultry means USDA and a HACCP plan under 9 CFR 417 — no Part 117 Food Safety Plan. Seafood, juice, or low-acid canned foods means your own HACCP rule already covers you, and Part 117's subparts C and G do not apply.
Otherwise, assume the Preventive Controls rule
A covered FDA facility that is none of the above owes a Part 117 Food Safety Plan: the seven required contents, prepared or overseen by a PCQI. Your HACCP plan is the core; you add the supply-chain program, the recall plan, the named allergen and sanitation controls, and the PCQI sign-off.
Check for modified requirements — at the source
Some small facilities carry a lighter load as a "qualified facility." The dollar thresholds that decide that category are adjusted for inflation, so never work from a number you remember — a later lesson walks your status against the live regulation.
Ask your customers what they require anyway
An exemption from FDA is not an exemption from a buyer. A retailer, a foodservice account, or a scheme like SQF can require a full HACCP-based food safety plan no matter what the federal rule lets you skip.
The strictest requirement that applies to you — federal or contractual — is the one you actually build to. Settle which document that is, and the next question is what has to be in place underneath it before any plan holds up: the prerequisite programs an auditor expects before a HACCP plan even makes sense.
Verify your status at the source, and date it
The relationship between the two documents is stable. The numbers and lists that decide who they apply to are not — exemption categories and the qualified-facility dollar thresholds move over time. Treat this lesson as the map: when you decide which document is yours, confirm it against the live regulation on eCFR and FDA's current guidance, and write down the date you checked.
Do this in your operation