Process, allergen, and sanitation controls in practice
How to actually run the three non-CCP preventive controls the rule expects — a process parameter with a limit, allergen cross-contact plus the label, and sanitation you can prove — each with its own monitoring, records, and the reason allergen and sanitation controls get verified rather than validated.
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can take each preventive control your hazard analysis called for and actually run it: write a process control as a parameter and a limit, split your allergen control into keeping allergen off the line and getting it onto the label, and turn sanitation into a cleaning you can prove — each with the monitoring and the record an inspector will ask to see.
Controls that live away from the critical control point
The previous lesson named the categories the Preventive Controls rule adds on top of a classic HACCP plan. This lesson is about running them day to day.
The mental shift is in 21 CFR 117.135(a). Your preventive controls include controls at critical control points, if you have any — but the rule says in the same breath that they also include controls other than at critical control points that are appropriate for food safety. So the allergen program and the sanitation program are not prerequisite programs sitting beside the plan anymore. When your hazard analysis calls for them, they are preventive controls inside the plan, and each one carries the same four-part burden a critical control point does:
Write it down.Section 117.135(b) is one sentence: preventive controls must be written.
Monitor it, on a schedule, and document that you did.
Fix it when it slips — either a full corrective action or, in defined cases, a lighter correction.
Prove it works — by validation for some controls, by verification for the rest.
The three sections that follow are process, allergen, and sanitation controls, each worked through that spine. Supply-chain controls are the fourth category, and they get their own lesson next.
Process controls: a parameter and its limit
A process control is the one that feels most like a critical control point, because it usually is one. Section 117.135(c)(1) describes controls over parameters during operations such as heat processing, acidifying, irradiating, and refrigerating — and it names the two things every process control must carry:
1
The parameter tied to the hazard
The measurable thing that keeps the hazard in check — a cook temperature, a hold time, a finished pH, a refrigeration temperature.
2
The value it must hit
The maximum or minimum value, or the combination of values, the parameter has to be held to. The rule spells out that this applies to any biological, chemical, or physical parameter. A cook that has to reach at least a set temperature for at least a set time is a minimum; a metal-detector reject is a physical parameter with its own pass line.
Monitoring is 21 CFR 117.145: a written procedure that says how often you check the parameter, checking it with enough frequency to be sure it is consistently met, and a record that you did. If you already run a cook or cool step and log it as a CCP, that log is exactly the shape a process control's monitoring record takes.
The process control is the one you validate
under 21 CFR 117.160 applies to process controls: your preventive controls qualified individual has to confirm, with scientific evidence, that the cook you chose really kills what it is supposed to. Hold that thought — the allergen and sanitation controls below are handled differently, and the difference is the point of this lesson.
Allergen controls: keep it out, and put it on the label
The allergen control has two distinct halves, and 21 CFR 117.135(c)(2) names both. Miss either one and the control is incomplete.
The first half is keeping allergen out of food that should not contain it. That means preventing during storage, handling, and use: dedicated scoops, segregated storage, sequencing runs so the allergen-free product goes first, and cleaning between products that share equipment.
The second half is the label. The rule requires you to label the finished food correctly so it is not misbranded under section 403(w) of the Federal Food, Drug, and Cosmetic Act — the allergen-labeling law. There are nine major food allergens, not eight: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and — since the FASTER Act took effect — sesame. Sesame became the ninth major allergen effective January 1, 2023, so any label or allergen review written before that date is out of date. Each allergen must be declared, either in parentheses after the ingredient or in a "Contains" statement next to the ingredient list.
A labeling miss is not a 'correction'
The rule lets you handle some slips as a lighter instead of a full corrective action. But read 117.150(c) closely: that carve-out reaches an allergen cross-contact slip and a sanitation lapse — it points only at 117.135(c)(2)(i), the keeping-it-out half. It does not cover the labeling half. A finished product missing an allergen declaration is misbranded, so it gets the full corrective action: fix the process, evaluate all affected product for safety, and keep affected product out of commerce until it is cleared. That is the moment a QA hold earns its keep.
Sanitation controls: clean surfaces and no cross-contact
Sanitation is pulled into the plan the same way allergens are. Section 117.135(c)(3) requires the facility to be kept sanitary enough to significantly minimize or prevent hazards — it names environmental pathogens, biological hazards from how employees handle food, and allergen hazards — and it lists two things a sanitation control must cover:
1
Cleanliness of food-contact surfaces
The surfaces that touch food, including the food-contact surfaces of utensils and equipment. This is your cleaning and sanitizing program, held to the standard of a preventive control rather than a background routine.
2
Prevention of cross-contact and cross-contamination
Keeping allergens and contamination from moving where they should not — from insanitary objects and from personnel onto food, packaging, and other contact surfaces, and from raw product onto processed product. Traffic flow, hand-washing, and the raw-to-ready separation all live here.
Sanitation controls get monitored and documented under the same 117.145 discipline as everything else: a written frequency, checks against it, and a record. What they do not get is validation — and that is deliberate.
Validated, or verified — know which one you owe
Here is the distinction that trips up first-time Food Safety Plans. Process controls are validated. Allergen controls and sanitation controls are not — 117.160(c) says in plain terms that you do not need to validate the food allergen controls or the sanitation controls. The recall plan and the supply-chain program are on that same no-validation list.
That does not mean you get to skip proving they work. It means you prove it a different way: through under 21 CFR 117.165, not through an up-front validation study. So when an auditor asks how you know your allergen cleaning works, the answer is not "we validated it as a process control." The answer is your verification evidence — and for a shared line, that evidence is worth building on purpose.
The shared line: changeover cleaning you can prove
Most small manufacturers run more than one product on the same equipment, and the between an allergen-containing product and an allergen-free one is where cross-contact actually happens. The cleaning at that changeover is your control, so you need evidence it removes allergen — not just that the line looks clean.
That evidence is often called an allergen cleaning validation on the floor, even though, as above, the rule files this kind of proof under verification rather than validation. The name matters less than the substance: before you rely on a changeover clean, gather evidence it does its job.
1
Write the changeover procedure
Exactly how the line is broken down, cleaned, and put back — for the specific product-to-product switch, since a wet clean and a dry clean are different animals.
2
Show it removes the allergen
Run the cleaning, then check the result — a visual inspection plus an allergen-specific test (a swab or lateral-flow test for the protein you are worried about), not a generic "looks clean." That test result is the evidence.
3
Verify it keeps working
Once you trust the procedure, your ongoing job is to confirm it is followed and still effective — the routine allergen swabs and record reviews that make up verification.
Environmental monitoring, if you make a ready-to-eat food
There is one verification activity the rule can make mandatory, and it turns on a single question: do you make a ready-to-eat food? A that could be contaminated after its kill step is the scenario the rule watches most closely.
Section 117.165(a)(3) requires for an when contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control. If that describes your product, environmental monitoring is not optional. If you make a shelf-stable or cook-before-eating product, it may not apply to you at all — which is exactly why the rule ties it to the ready-to-eat condition rather than to everyone.
Two things travel with it. Product testing is a sibling verification activity in 117.165(a)(2). And you cannot improvise the response to a positive result: 117.150(a)(1) requires your corrective action procedures to address, in advance, a pathogen found through product testing or an environmental pathogen found through environmental monitoring. Decide before you swab what a positive triggers — where you re-clean, where you re-swab, and what happens to product.
What gets recorded, and what comes next
Run the spine back across all three controls and the records fall out of it. Every monitoring check is documented under 117.145. Every corrective action, and every correction where a record is warranted, is documented under 117.150. Every verification activity — the record reviews, the calibrations, the swabs — is documented under 117.165. Those are the records a preventive controls qualified individual reviews, and the records an inspector reads first.
The one line to carry out of this lesson: validate your process controls; verify your allergen and sanitation controls; write down all of it. The controls in this lesson are the ones that live inside your four walls. The last category — hazards a supplier controls before an ingredient ever reaches you — is the supply-chain program, and building it is where this course goes next.
