Glossary: Food Safety Fundamentals

The core food-safety vocabulary — GMPs, HACCP, preventive controls, hazards, allergens, and who the rules cover — defined in plain language and traced to its source.

~6 min

This is the core vocabulary of a food-safety program — the terms that land on every plan, every audit finding, and every corrective action you sign. Each one is defined here in plain language, at the altitude of someone running the floor, with the regulatory terms traced back to the rule they come from.

The rules and the frameworks

GMP / cGMP — Current Good Manufacturing Practice: the baseline sanitary and hygiene rules a plant runs on before any hazard plan sits on top — clean people, clean equipment, pest control, sanitation. FDA's live in 21 CFR Part 117, subpart B; the c means current, so the bar rises as the industry does.
HACCP — Hazard Analysis and Critical Control Points: the method for finding where in your process a hazard must be controlled and proving you control it there. FDA's version is seven principles — hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification, and recordkeeping — worked after five setup steps. It stays voluntary until a rule for a specific food (seafood, juice, meat) makes it mandatory.
HARPC — Industry shorthand for Hazard Analysis and Risk-based Preventive Controls, the FSMA requirement in 21 CFR Part 117, subpart C. It reads like HACCP with a wider net. Worth knowing: FDA itself never uses the word "HARPC" — it just calls the result preventive controls.
Preventive Controls — Under the FSMA rule at 21 CFR 117.135, the risk-based steps a facility takes to significantly minimize or prevent each hazard it found: process, food-allergen, sanitation, and supply-chain controls, plus a recall plan. A CCP is one kind of preventive control, not the whole set.
Food Safety Plan — The written document 21 CFR 117.126 requires a covered FDA facility to keep: the hazard analysis, the preventive controls, the supply-chain program, the recall plan, and the monitoring, corrective-action, and verification procedures behind them — prepared or overseen by a PCQI. Your HACCP plan is most of its core, not a substitute for it.

The building blocks of a plan

Hazard Analysis — The first move in any plan: at each process step, list every biological, chemical, and physical hazard reasonably likely to occur, and decide which ones need a control. Everything else in the plan hangs off what this step finds.
CCP (critical control point) — The step in your process where a control is both applied and genuinely essential — the point at which a hazard is actually caught, killed, or brought down to a safe level. Lose control here and unsafe product can reach the customer, so this is where you set a limit and watch it.
Critical Limit — The measurable line a CCP has to stay inside: a minimum or maximum value for something like temperature, time, pH, or water activity. Cross it and you have a deviation, which triggers a corrective action.
Monitoring — The planned sequence of checks or measurements that tells you, in real time, whether a control is holding — the cook temperature read every batch, the metal detector challenged every shift. No monitoring, no proof the control worked.
Corrective Action — What you do, decided in advance, when monitoring shows a limit was missed: get the affected product under control, fix the cause, and write down both. A deviation with no corrective action is an open hole in the plan.
Verification — The activities that confirm the system is actually working as designed — calibrating instruments, reviewing records, testing product. Monitoring watches the control; verification checks that the control and its monitoring are themselves sound.
Validation — The up-front proof, from scientific and technical evidence, that a control would eliminate or reduce the hazard if followed — that the cook step you picked truly kills the pathogen. Validation asks will this work; verification asks is it working.

Hazards and allergens

Biological, chemical, and physical hazard — The three families every hazard falls into. Biological is the living stuff — pathogens like Salmonella and Listeria. Chemical covers toxins, cleaning-agent residues, allergens, and (folded in here by the rules) radiological contamination. Physical is anything hard or sharp that should not be there — glass, metal, bone, plastic.
Allergen / the Big 9 — The nine major food allergens U.S. law makes you declare on a label: milk, egg, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and — since January 1, 2023 under the FASTER Act — sesame. It is nine now, not eight (verified July 2026).
Cross-contact — The unintentional transfer of an allergen into a food that is not meant to contain it — a shared scoop, an unwashed line, airborne flour. Different from microbial cross-contamination: you control it with scheduling, cleaning, and separation, not with cooking.

The programs and people around a plan

Prerequisite Program (PRP) — The foundational sanitation and operating programs a plant needs in place before a HACCP plan makes sense — pest control, cleaning schedules, supplier approval, employee hygiene. They handle the everyday conditions so the CCPs can stay focused on the few genuinely critical steps.
PCQI (preventive controls qualified individual) — The person who prepares or oversees a Food Safety Plan, qualified either by completing the FDA-recognized preventive-controls training (the FSPCA standardized curriculum) or by equivalent job experience. Every covered facility has to be able to name one.
SSOP — Sanitation Standard Operating Procedures: the written, step-by-step sanitation instructions — what gets cleaned, how, how often, by whom, and how it is checked. Required by name in USDA meat and poultry and FDA seafood rules, and the backbone of the sanitation controls every plant keeps.
Environmental Monitoring — A program of swabbing the plant environment — floors, drains, equipment surfaces — and testing for pathogens or indicator organisms, to catch a problem in the room before it reaches the product. Standard practice for ready-to-eat foods exposed to the plant after any kill step.
Supply-Chain Program — Required by subpart G of Part 117 whenever you rely on a supplier to control a hazard in an incoming ingredient you are not controlling yourself. It is how you approve suppliers and verify — often by audit or certificate — that the hazard was handled before the material reached your dock.

Who the rules apply to

Qualified Facility — A small facility the Preventive Controls rule (21 CFR 117.5) gives lighter, modified requirements instead of a full Food Safety Plan. You qualify either as a very small business, or by selling more than half your food, by value, straight to nearby end users while staying under a separate sales cap (a $500,000 baseline, also inflation-adjusted). Confirm both figures at FDA's current cut-offs before you rely on the status — checked July 2026.
Very Small Business — Under the human-food Preventive Controls rule (21 CFR 117.3), a business averaging less than $1 million a year — food sales plus the market value of food it makes, packs, or holds — over the previous three years. That $1 million is a 2011 baseline FDA adjusts for inflation every year, so the figure that actually applies is higher; pull it live from FDA's inflation-adjusted cut-offs rather than from memory (checked July 2026).

Was this helpful?

Real help from real food people

Chef Diego runs a real food plant. If this page didn't get you there, tell us — a person reads every message.

The rules and the frameworks

GMP / cGMP — Current Good Manufacturing Practice: the baseline sanitary and hygiene rules a plant runs on before any hazard plan sits on top — clean people, clean equipment, pest control, sanitation. FDA's live in 21 CFR Part 117, subpart B; the c means current, so the bar rises as the industry does.

HACCP — Hazard Analysis and Critical Control Points: the method for finding where in your process a hazard must be controlled and proving you control it there. FDA's version is seven principles — hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification, and recordkeeping — worked after five setup steps. It stays voluntary until a rule for a specific food (seafood, juice, meat) makes it mandatory.

HARPC — Industry shorthand for Hazard Analysis and Risk-based Preventive Controls, the FSMA requirement in 21 CFR Part 117, subpart C. It reads like HACCP with a wider net. Worth knowing: FDA itself never uses the word "HARPC" — it just calls the result preventive controls.

Preventive Controls — Under the FSMA rule at 21 CFR 117.135, the risk-based steps a facility takes to significantly minimize or prevent each hazard it found: process, food-allergen, sanitation, and supply-chain controls, plus a recall plan. A CCP is one kind of preventive control, not the whole set.

Food Safety Plan — The written document 21 CFR 117.126 requires a covered FDA facility to keep: the hazard analysis, the preventive controls, the supply-chain program, the recall plan, and the monitoring, corrective-action, and verification procedures behind them — prepared or overseen by a PCQI. Your HACCP plan is most of its core, not a substitute for it.

The building blocks of a plan

Hazard Analysis — The first move in any plan: at each process step, list every biological, chemical, and physical hazard reasonably likely to occur, and decide which ones need a control. Everything else in the plan hangs off what this step finds.

CCP (critical control point) — The step in your process where a control is both applied and genuinely essential — the point at which a hazard is actually caught, killed, or brought down to a safe level. Lose control here and unsafe product can reach the customer, so this is where you set a limit and watch it.

Critical Limit — The measurable line a CCP has to stay inside: a minimum or maximum value for something like temperature, time, pH, or water activity. Cross it and you have a deviation, which triggers a corrective action.

Monitoring — The planned sequence of checks or measurements that tells you, in real time, whether a control is holding — the cook temperature read every batch, the metal detector challenged every shift. No monitoring, no proof the control worked.

Corrective Action — What you do, decided in advance, when monitoring shows a limit was missed: get the affected product under control, fix the cause, and write down both. A deviation with no corrective action is an open hole in the plan.

Verification — The activities that confirm the system is actually working as designed — calibrating instruments, reviewing records, testing product. Monitoring watches the control; verification checks that the control and its monitoring are themselves sound.

Validation — The up-front proof, from scientific and technical evidence, that a control would eliminate or reduce the hazard if followed — that the cook step you picked truly kills the pathogen. Validation asks will this work; verification asks is it working.

Hazards and allergens

Biological, chemical, and physical hazard — The three families every hazard falls into. Biological is the living stuff — pathogens like Salmonella and Listeria. Chemical covers toxins, cleaning-agent residues, allergens, and (folded in here by the rules) radiological contamination. Physical is anything hard or sharp that should not be there — glass, metal, bone, plastic.

Allergen / the Big 9 — The nine major food allergens U.S. law makes you declare on a label: milk, egg, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans, and — since January 1, 2023 under the FASTER Act — sesame. It is nine now, not eight (verified July 2026).

Cross-contact — The unintentional transfer of an allergen into a food that is not meant to contain it — a shared scoop, an unwashed line, airborne flour. Different from microbial cross-contamination: you control it with scheduling, cleaning, and separation, not with cooking.

The programs and people around a plan

Prerequisite Program (PRP) — The foundational sanitation and operating programs a plant needs in place before a HACCP plan makes sense — pest control, cleaning schedules, supplier approval, employee hygiene. They handle the everyday conditions so the CCPs can stay focused on the few genuinely critical steps.

PCQI (preventive controls qualified individual) — The person who prepares or oversees a Food Safety Plan, qualified either by completing the FDA-recognized preventive-controls training (the FSPCA standardized curriculum) or by equivalent job experience. Every covered facility has to be able to name one.

SSOP — Sanitation Standard Operating Procedures: the written, step-by-step sanitation instructions — what gets cleaned, how, how often, by whom, and how it is checked. Required by name in USDA meat and poultry and FDA seafood rules, and the backbone of the sanitation controls every plant keeps.

Environmental Monitoring — A program of swabbing the plant environment — floors, drains, equipment surfaces — and testing for pathogens or indicator organisms, to catch a problem in the room before it reaches the product. Standard practice for ready-to-eat foods exposed to the plant after any kill step.

Supply-Chain Program — Required by subpart G of Part 117 whenever you rely on a supplier to control a hazard in an incoming ingredient you are not controlling yourself. It is how you approve suppliers and verify — often by audit or certificate — that the hazard was handled before the material reached your dock.

Who the rules apply to

Qualified Facility — A small facility the Preventive Controls rule (21 CFR 117.5) gives lighter, modified requirements instead of a full Food Safety Plan. You qualify either as a very small business, or by selling more than half your food, by value, straight to nearby end users while staying under a separate sales cap (a $500,000 baseline, also inflation-adjusted). Confirm both figures at FDA's current cut-offs before you rely on the status — checked July 2026.

Very Small Business — Under the human-food Preventive Controls rule (21 CFR 117.3), a business averaging less than $1 million a year — food sales plus the market value of food it makes, packs, or holds — over the previous three years. That $1 million is a 2011 baseline FDA adjusts for inflation every year, so the figure that actually applies is higher; pull it live from FDA's inflation-adjusted cut-offs rather than from memory (checked July 2026).