FSMA Preventive Controls Readiness

A run-through of the Food Safety Plan a preventive-controls inspection expects under 21 CFR 117 — tick each item only when you can put your hand on the record that proves it.

Work this list before an FDA preventive-controls inspection, or before a customer or GFSI assessment that expects a Food Safety Plan built to 21 CFR 117 subpart C. Read each item with your plan open in front of you and tick it only when you can put your hand on the record that proves it; the ones you cannot tick are your prep list. It backs up the lesson on running your process, allergen, and sanitation controls day to day, which shows how each control earns its monitoring and its record.

Confirm this rule actually governs your product

The preventive-controls requirements in subpart C, and the subpart G supply-chain program, apply to a facility that has to register with FDA — unless you are a qualified facility, which is exempt from both and instead files the modified attestations in 21 CFR 117.201. The dollar thresholds that decide whether you qualify are adjusted for inflation, so read 21 CFR 117.5 and the definitions in 117.3 for the current figures rather than a number you remember. Seafood, juice, and meat or poultry run on their own HACCP rules elsewhere. Confirm which rule governs your product at the source before you rely on this list. Verified July 2026.

Do this in your operation

Hazard analysis is written and complete. Confirm you hold a written hazard analysis that evaluates the known and reasonably foreseeable biological, chemical — including food allergen and radiological — and physical hazards for each product, and decides which of them needs a preventive control. The rule requires it in writing whatever the outcome, so even a "no control needed" call has to be on paper. Record: the hazard analysis worksheet, one per product or process.
The Food Safety Plan is written and carries all seven parts. Confirm your Food Safety Plan is written and holds the seven pieces the rule names: the hazard analysis, the written preventive controls, the supply-chain program, the recall plan, and the written monitoring, corrective-action, and verification procedures. A missing part is the quickest finding an inspector can write. Record: the plan itself, current and complete.
A PCQI prepared or oversaw the plan, and you can show they qualify. Confirm a preventive controls qualified individual prepared the Food Safety Plan or oversaw its preparation, and that you can produce their basis — either a certificate from training built on the FDA-recognized standardized curriculum, or documented job experience that gave them equivalent knowledge. The PCQI does not have to be your employee. Record: the PCQI's sign-off on the plan plus their training certificate or experience record.
Allergen controls are written, and split into off-the-line and onto-the-label. Where your hazard analysis called for an allergen preventive control, confirm it is written and does both jobs: keeping food from allergen cross-contact during storage, handling, and use; and labeling the finished food so it is not misbranded. Check every label against the nine major US allergens — milk, egg, fish, crustacean shellfish, tree nuts, wheat, peanuts, soybeans, and sesame, the ninth since January 1, 2023. Record: the written allergen control and a label-to-recipe cross-check.
Sanitation controls are written and their cleanings are logged. Where sanitation is a preventive control, confirm the written procedures cover cleanliness of food-contact surfaces and the prevention of allergen cross-contact and cross-contamination from insanitary objects — and that the cleanings actually got recorded. The allergen changeover clean is where these two controls meet. Record: sanitation monitoring records, signed and dated by whoever did the work.
The supply-chain program is written and its suppliers are approved. Where a hazard is controlled before the material reaches you — by your supplier rather than in your plant — confirm you run a written, risk-based supply-chain program, receive those raw materials only from approved suppliers, and hold the verification the risk calls for: an onsite audit, sampling and testing, or a review of the supplier's records. Record: the approved-supplier list and the verification record behind each hazard-bearing ingredient.
The recall plan is written and names every step. For any food with a hazard requiring a preventive control, confirm a written recall plan that spells out how you notify your direct consignees, notify the public when it takes that to protect health, run effectiveness checks to confirm the recall reached its depth, and dispose of the recalled food. The rule sets no clock on the trace — what it asks for is a plan complete enough to run under pressure. Record: the recall plan with current names, roles, and contact details.
Every control carries monitoring, corrective actions, and verification. Confirm each preventive control has the management components the rule expects, written and sized to the control: monitoring on a schedule, a corrective action for when it slips, and verification that it is working. A control with no monitoring behind it is a claim, not a control. Record: the procedures plus the records each one throws off.
Process controls that need validation are validated — and you know which controls do not. Confirm each process control has documented validation that its parameter and limit truly control the hazard — a study, a regulatory standard, or a scientific reference. Know the boundary: allergen controls, sanitation controls, the supply-chain program, and the recall plan are verified, not validated, so do not go hunting for a validation study the rule never asks of them. Record: validation for each process control.
A PCQI has reviewed the records on time. Confirm the monitoring and corrective-action records were reviewed by, or under the oversight of, a PCQI within seven working days of being made — or within a longer window a PCQI justified in writing — and that each review is signed and dated. Record: the records-review sign-offs.
The plan has been reanalyzed on schedule. Confirm the whole Food Safety Plan has been reanalyzed within the last three years, and again after any change that raised a new hazard or brought new information about an old one — a new ingredient, a new line, a new process. Record: the dated reanalysis and who ran it.
The implementation records are legible, signed, dated, and quick to pull. Confirm the records that prove the plan ran — monitoring, corrective actions, verification, supplier verification, and PCQI training — are complete, legible, signed and dated, and retrievable the moment an inspector asks. This record set is what turns the plan from a binder on a shelf into evidence the plan is real.

Mark this page complete