The gap between a classic HACCP plan and the written Food Safety Plan the Preventive Controls rule requires — the allergen, sanitation, and supply-chain controls, the recall plan, and the qualified individual who has to sign it off.
Do these first
Real help from real food people
Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.
After this lesson you can hold your HACCP plan up against the Food Safety Plan that FDA's Preventive Controls rule requires and name exactly what is missing — the allergen and sanitation controls written as controls, the supply-chain program, the written recall plan, and the qualified individual who has to sign the whole thing off.
Most operators build a HACCP plan first, then hit a customer or an inspector who asks for a "Food Safety Plan" and assume it is the same document with a new cover page. It is not. They come from two different places.
is the seven-principle system the National Advisory Committee on Microbiological Criteria for Foods laid out in its 1997 guidelines. Its center of gravity is the critical control point: you find the steps where a measured limit is the thing keeping a hazard in check, and you control, monitor, and document those steps.
The Preventive Controls rule is federal law, not a voluntary framework. It came out of the FDA Food Safety Modernization Act and lives at 21 CFR Part 117, whose full name is "Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food." The industry shorthand for the hazard-analysis half of it is . HARPC is a nickname operators and consultants use; it is not a term the regulation itself defines, so when you write to an auditor, name the rule, not the nickname.
The difference that matters is not the acronym. HACCP asks you to control hazards, mostly at critical control points. Part 117 asks for that and more: a wider set of controls, several documents a HACCP plan never demanded, and a specifically qualified person to prepare it. The rest of this lesson is that "and more," part by part.
Whether the rule reaches you is a separate question
Part 117 applies to facilities that have to register with FDA as food facilities, and it carries exemptions — a "qualified facility," for one, has modified requirements. The dollar figures that define those exemptions are adjusted for inflation, so never carry one from memory. Whether the full rule reaches your operation is its own question, worked in the food-safety vocabulary course; this lesson assumes it does and shows what it adds.
Under HACCP, "the plan" is whatever your HACCP team writes. Under Part 117 the plan is a defined thing with a required table of contents.
A is required in writing by 21 CFR 117.126. The rule does not leave its contents to you. Section 117.126(b) names seven pieces the written plan must contain:
Read that list against a typical HACCP plan and the additions jump out: the supply-chain program and the recall plan are documents most HACCP plans never carried. Worth knowing too — "food safety plan" is not defined in the rule's definitions section. It is defined entirely by what 117.126 says it must contain, which is why treating your HACCP plan as your Food Safety Plan tends to leave holes exactly where the two lists differ.
Here is the conceptual jump. In HACCP, the sharp end is the critical control point. Part 117 keeps that idea but stops treating the critical control point as the only place a control can live.
21 CFR 117.135 tells you to identify and implement preventive controls that significantly minimize or prevent the hazards your analysis found, and it names the categories those controls fall into:
Process controls — 117.135(c)(1)
The category that lines up most closely with a classic critical control point: parameters you hold during operations like heat processing, acidifying, and refrigerating, each with the maximum or minimum value a hazard must be controlled to. If you already run cook and cool steps as CCPs, this is familiar ground.
Food allergen controls — 117.135(c)(2)
Procedures to protect food from allergen cross-contact during storage, handling, and use, and to label the finished food correctly. Allergens are managed as a preventive control in their own right, not left to a prerequisite program. There are nine major food allergens after the FASTER Act added sesame effective January 1, 2023, so a label check written before that date is out of date.
Sanitation controls — 117.135(c)(3)
Procedures to keep the facility in a sanitary condition adequate to control hazards such as environmental pathogens, biological hazards from employee handling, and allergen hazards. Sanitation, like allergens, is pulled up into the plan as a control the plan is accountable for.
Supply-chain controls — 117.135(c)(4)
Where a hazard is controlled before the ingredient ever reaches you, the control is your supplier's — and the rule makes you responsible for verifying it through a program of its own, covered next.
The move to see is that allergens and sanitation, which many HACCP plans handled as prerequisite programs sitting alongside the plan, become preventive controls inside it whenever the hazard analysis calls for them — each carrying its own monitoring, corrective actions, and verification.
This is the piece with no real equivalent in a classic HACCP plan, and it gets its own subpart — subpart G, starting at 21 CFR 117.405.
When your hazard analysis finds a , you cannot just trust the ingredient. The rule makes the receiving facility establish and implement a risk-based supply-chain program: approve your suppliers and verify that the control they are responsible for actually happens — with the verification activity matched to how serious the hazard is.
The shift is one of accountability. HACCP largely stops at your own four walls; the supply-chain program says a hazard someone upstream is supposed to control is still yours to verify. This lesson only plants the idea — building the program, from approving suppliers to choosing verification activities, is its own lesson later in this course.
A recall plan is easy to treat as something you will figure out if the day ever comes. Part 117 does not allow that.
Under 21 CFR 117.139, when your hazard analysis identifies a hazard requiring a preventive control, you must have a written for that food. The rule spells out what the plan describes and who is responsible for each part:
HACCP's guidelines never asked for this document. A written recall plan is only worth the paper if it works under pressure, which is why the discipline that proves it — running a mock recall — is worth doing long before an inspector or a real recall tests the plan for you.
The back half of a HACCP plan — monitoring, corrective actions, verification — survives into Part 117 almost intact. What changes is that each gets a specific section with specific expectations, so "we sort of do that" is no longer enough.
The rule adds a word HACCP did not: corrections
Part 117 distinguishes a full corrective action from a . A corrective action is the heavier procedure for a control that failed; a correction is fixing a minor problem before it reaches product. Knowing which one a situation calls for keeps you from either over-documenting a spill or under-documenting a real failure.
There is one more thing HACCP never required, and it is a person, not a document. Part 117 does not let just anyone write the plan.
Section 117.126(a)(2) says the Food Safety Plan must be prepared, or its preparation overseen, by a . The definitions section, 21 CFR 117.3, sets the bar two ways: someone who has completed training in developing and applying risk-based preventive controls at least equivalent to a standardized curriculum FDA recognizes, or who is otherwise qualified through job experience to build and run a food safety system. Section 117.180 then lists what only that person may do or oversee — preparing the plan, validating controls, reviewing records, reanalyzing the plan.
That qualified individual is the gatekeeper the whole rule leans on, and it raises the obvious question: who fills that role, whether your own owner can be it, and what the training actually involves. That is exactly where this course goes next.
Do this in your operation