Learn what prerequisite programs are, why a hazard they already control does not need to become a CCP, and why a weak one is what most often sinks a first audit.
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can walk your own floor and name the prerequisite programs an auditor expects to already be running before a HACCP plan means anything — sanitation, pest control, allergen control, training, maintenance, supplier control — and explain the two things about them that trip up most first-timers: a hazard your prerequisite programs already control does not have to become a critical control point, and a prerequisite program that is weak or undocumented is one of the most common reasons a first audit goes badly.
A is not part of your hazard plan. It is the ground the plan stands on. The industry's foundational HACCP document — the NACMCF HACCP Principles and Application Guidelines that FDA publishes — is blunt about this: a working HACCP system has to be built on a solid base of prerequisite programs, because those programs supply the basic environmental and operating conditions a facility needs to make safe, wholesome food at all.
Two things follow from that, and both are in the NACMCF guidance. Prerequisite programs are managed separately from the HACCP plan — they run across your whole operation, not at one process step. And they should be written down and audited on their own, not folded into the plan and forgotten.
The core prerequisite program is your GMPs. are where "run a clean operation" becomes a written expectation. For FDA-regulated human food they live in 21 CFR Part 117, Subpart B — nine sections covering personnel, plant and grounds, sanitary operations, sanitary facilities and controls, equipment and utensils, processes and controls, warehousing and distribution, human food by-products, and defect action levels. If you sorted the frameworks apart in the first lesson of this course, this is where GMPs sit: the floor everything else assumes.
Every credible standard works from roughly the same list. NACMCF's own examples name facilities and sanitary design, supplier control, written specifications, production equipment with preventive maintenance and calibration, cleaning and sanitation, personal hygiene, training, chemical control, receiving and storage and shipping, traceability and recall, and pest control. Modern schemes add allergen control as its own program. Put in the terms you actually use on the floor:
That last one is its own deep topic, and a mock recall is how you find out whether the program actually works rather than assuming it does.
Here is the payoff that makes prerequisite programs worth getting right, and the part that confuses people building their first plan. When you run the hazard analysis, you list each hazard and the control measure that handles it. A control measure can be a , or it can be a prerequisite program running in the background.
A hazard that a prerequisite program already controls, across the whole operation, does not have to be pinned to a CCP. CCPs are reserved for the specific process steps where control is essential and not otherwise assured — a cook step that kills a pathogen, a metal detector at the end of a line. If your sanitation and hygiene programs control an environmental pathogen, or your supplier and receiving programs control a chemical hazard in an incoming ingredient, the hazard analysis records the control and moves on; it does not manufacture a CCP for it. That is by design: NACMCF keeps prerequisite programs separate from the plan precisely so the plan can stay narrow. Strong prerequisite programs are what let your HACCP plan carry a short, defensible list of CCPs instead of a long one. Weak ones push more hazards onto the plan than it should ever have to hold.
Now the naming trap this course exists to untangle. Sanitation, allergen control, and supplier control are classic prerequisite programs. Under the FSMA Preventive Controls rule, the same three can become something with a different name and a heavier burden.
When a facility's hazard analysis identifies a hazard that needs one of them, the rule turns it into a . 21 CFR 117.135 names food allergen controls and sanitation controls as preventive-control categories in their own right, alongside process controls. And supplier control, run as a prerequisite program in a HACCP-only shop, becomes a under Subpart G.
The work on the floor is the same — you still clean, still segregate allergens, still qualify suppliers. What changes is the label and the discipline attached to it: a preventive control carries the plan's monitoring, corrective-action, verification, and recordkeeping requirements, where a prerequisite program is held to its own written procedures. This is the same line the Food Safety Plan lesson drew between a CCP and a preventive control: a preventive control is the wider FDA bucket, and some of what it holds used to be filed under prerequisite programs.
Ask anyone who has failed a first certification audit and the finding is rarely an exotic CCP. It is an undocumented sanitation schedule, a pest program with no records, a training log nobody kept. An auditor for a GFSI-recognized scheme expects your prerequisite programs to be documented and running before your HACCP plan means anything at all.
Take SQF, one of the schemes GFSI benchmarks (GFSI sets the benchmark; it does not itself certify anyone). Under SQF Edition 9, Good Manufacturing Practices are a mandatory element that must be documented and implemented, with the detailed requirements — site and premises, sanitation, pest prevention, personnel hygiene, water and waste — filling an entire module of the code. And the scheme scores a not only for a breakdown at a CCP but for a breakdown at a prerequisite program. Read plainly: a failing pest program or a missing sanitation record can cost you the certificate as surely as a blown critical limit. The prerequisite programs are not the warm-up before the real audit. For most operations, they are the audit.
Whether you are legally required to run these programs, and how heavy the documentation has to be, depends on which rules apply to what you make — the FDA Preventive Controls rule, USDA's HACCP rule for meat and poultry, or the modified load some small facilities carry as a "qualified facility." Those categories turn on dollar thresholds that adjust for inflation, so this lesson quotes no figure; working out exactly which rules apply to you is its own question, and the next one worth settling before you build a plan.
Two cautions carry over from the earlier lessons. An exemption from FDA is not an exemption from a customer: a retailer or a scheme like SQF can require full, documented prerequisite programs no matter what the federal rule lets you skip. And the strictest requirement that applies to you — federal or contractual — is the one you actually build to.
The list is stable; who it applies to is not
The prerequisite programs above are a settled part of every credible standard. What moves is which rules make them mandatory for you and at what depth — exemption categories and the qualified-facility dollar thresholds change over time. Treat this lesson as the map: when you decide which programs you are required to document, confirm it against the live regulation on eCFR and FDA's current guidance, and write down the date you checked.
Do this in your operation