21 CFR 117 Subpart C - Hazard Analysis and Risk-Based Preventive Controls

What it says

Subpart C requires a covered facility to have a written food safety plan, prepared or overseen by a preventive controls qualified individual and built on a hazard analysis. Where the analysis finds a hazard requiring a preventive control, the facility must implement controls such as process controls, food allergen controls, sanitation controls and a supply-chain program where applicable, and must have a recall plan. The controls are managed through monitoring, corrective actions and verification, and the plan is reanalyzed and supported by records.

Paraphrased for plain-language clarity. Always verify against the current published regulation text.

What it means in practice

• The hazard analysis looks at biological, chemical and physical hazards, including hazards that may be introduced for economic gain, and the food safety plan records which hazards need controls and why.
• Preventive controls are managed through monitoring, corrective actions and corrections, and verification, each with its own requirements and records.
• The plan is not a one-time document. It has to be reanalyzed when circumstances change and at least periodically, and the records show that it is being carried out.

What FDA inspectors look for

• Whether the food safety plan exists, is complete and was prepared or overseen by a qualified individual.
• Whether each hazard identified as needing control has a matching preventive control, and whether the reasoning for hazards judged not to need one is documented.
• Whether monitoring, corrective action and verification records show the controls working as written.

Related regulations