Food Safety Plan Workflow

21 CFR Part 117 Subpart C  |  FSMA Section 103  |  Hazard Analysis and Risk-Based Preventive Controls
21 CFR 117.126  ·  117.130  ·  117.135
21 CFR 117.165  ·  117.170  ·  FSMA Section 103
The written hazard analysis determines which
preventive controls the facility must implement
Phase 1 - Hazard Analysis
Phase 2 - Preventive Control Development
Phase 3 - Plan Documentation and Validation
Phase 4 - Verification and Reanalysis
Decision point
GMPify Procedural Map Series
🥗

Food Safety Plan - Building a Written, Risk-Based Preventive Controls System

Under the FDA Food Safety Modernization Act, a registered food facility must prepare and implement a written food safety plan that begins with a hazard analysis and ends with a set of preventive controls matched to every hazard that requires one. The plan must be prepared, or its preparation overseen, by a Preventive Controls Qualified Individual (PCQI), and it must be validated, verified, and reanalyzed over time. This map details the pathway from hazard analysis through control development, documentation, and ongoing verification.

21 CFR Part 117 Subpart C  ·  FSMA Section 103  ·  PCQI
21 CFR 117 Subpart C
FSMA Section 103
PCQI Oversight

Process Controls

Procedures such as cooking, chilling, and acidification that reduce or prevent a hazard in the product during processing.

Basis: Parameters and values

Food Allergen Controls

Procedures that prevent allergen cross-contact and ensure the product is labeled correctly for its allergen content.

Basis: Cross-contact and labeling

Sanitation Controls

Procedures that keep the facility and food contact surfaces clean enough to prevent contamination from the environment.

Basis: Environment and hygiene

Supply-Chain Controls

Procedures that control hazards in raw materials and ingredients that are controlled by the supplier rather than the facility.

Basis: Supplier verification
Phase 1
Hazard Analysis
1Assemble the food safety team and designate the PCQI
Cross-functional team assembled with a Preventive Controls Qualified Individual designated to prepare or oversee the plan.
21 CFR 117.180
↓
2Describe the food, intended use, and process flow
Product, ingredients, packaging, intended consumers, and a flow diagram of the process documented as the foundation for analysis.
21 CFR 117.130
↓
3Identify known or reasonably foreseeable hazards
Biological, chemical, and physical hazards identified at each step, including those occurring naturally or introduced unintentionally.
21 CFR 117.130(b)
↓
4Evaluate each hazard for severity and probability
Each hazard evaluated for the severity of the illness or injury and the probability it will occur without a preventive control.
21 CFR 117.130(c)
Phase 2
Preventive Control Development
Does the hazard require a preventive control?
YES → Assign a control type NO → Document the rationale
↓
5Establish preventive controls for each significant hazard
Process, allergen, sanitation, or supply-chain controls assigned to every hazard that requires one.
21 CFR 117.135
↓
6Set parameters and minimum or maximum values
Measurable parameters, such as time, temperature, or pH, defined for controls where they apply, with values that control the hazard.
21 CFR 117.135(c)
↓
7Establish monitoring, corrective actions, and verification
Management components defined for each control, so deviations are detected, corrected, and confirmed effective.
21 CFR 117.140
Phase 3
Plan Documentation and Validation
8Write the food safety plan
Hazard analysis, preventive controls, supply-chain program, recall plan, and procedures compiled into one written plan.
21 CFR 117.126
↓
9Validate the preventive controls
Scientific and technical evidence gathered showing the controls, as designed, are capable of controlling the identified hazard.
21 CFR 117.160
↓
10Implement the plan and keep records
Controls put into operation with monitoring, corrective action, and verification records created, signed, and dated.
21 CFR 117.190
Phase 4
Verification and Reanalysis
11Verify implementation and effectiveness
Verification activities, including calibration, record review, and product or environmental testing, confirm the controls work in practice.
21 CFR 117.165
↓
12Review monitoring and corrective action records
Records reviewed within 7 working days of creation, or within a documented reasonable period, with deviations followed up.
21 CFR 117.165(a)(4)
↓
13Reanalyze the food safety plan
Plan reanalyzed at least once every 3 years, and sooner when a significant change, new hazard information, or a control failure occurs.
21 CFR 117.170
Hazard Categories (Overview)

Biological Hazards

Bacteria, viruses, and parasites, such as Salmonella, Listeria monocytogenes, and norovirus, that can cause foodborne illness.

21 CFR 117.3

Chemical Hazards

Includes undeclared allergens, pesticide residues, natural toxins, food additives, and radiological hazards.

21 CFR 117.3

Physical Hazards

Foreign objects such as glass, metal fragments, and hard plastic that can cause injury when consumed.

21 CFR 117.3

Hazard Evaluation Criteria (Overview)

Severity of illness or injury How serious the harm would be if the hazard reached the consumer, from mild illness to hospitalization or death.
Probability of occurrence How likely the hazard is to occur in the absence of a preventive control, based on the process and the product.
Evidence considered Facility experience, illness data, scientific reports, and information from FDA and industry inform the evaluation.
Significance drives the control A hazard that is significant on severity and probability requires a preventive control, and the reasoning must be documented.

Key Food Safety Plan Outputs (Overview)

Written hazard analysis Documented identification and evaluation of every hazard, including the rationale where no control is required.
Written preventive controls Controls with their parameters, values, and management components documented for each significant hazard.
Implementation records Monitoring, corrective action, and verification records showing the plan is operating as written.
Reanalysis record Documented review of the plan, confirming it remains adequate or recording the changes made.

Food Safety Plan Quality Elements

PCQI Qualification Plan prepared or overseen by an individual with the training or experience the regulation requires.
Complete Hazard Identification Every biological, chemical, and physical hazard considered at every process step and for every ingredient.
Documented Hazard Evaluation Severity and probability reasoning recorded so the decision to control or not control a hazard can be defended.
Control Parameter Clarity Measurable parameters and values defined so operators know exactly what a controlled process looks like.
Monitoring Practicality Monitoring procedures, frequency, and responsible roles are realistic for the line and consistently performed.
Corrective Action Readiness Written responses ready for deviations, covering product disposition, root cause, and prevention of recurrence.
Validation Evidence Scientific or technical evidence retained showing each control can achieve the hazard reduction claimed.
Reanalysis Discipline Three-year review scheduled, with defined triggers for earlier reanalysis after changes or failures.

Never do this

Write the plan without a qualified individual's preparation or oversight. Copy a generic hazard analysis without considering your own product and process. Rely on a preventive control that has never been validated. Wait for the three-year cycle to reanalyze after a significant process change or control failure.

Food safety plan vs HACCP plan

A HACCP plan is built on seven principles, with critical control points and critical limits. A FSMA food safety plan is broader, adding allergen, sanitation, and supply-chain controls, a written recall plan, and PCQI oversight, and it does not require every control to be a critical control point.

Corrections vs corrective actions

A correction is a timely step to address a minor, isolated issue that does not directly affect product safety, such as cleaning a surface. A corrective action responds to a preventive control not being implemented or a deviation from a parameter, and requires product evaluation and root cause review.

Key regulations

21 CFR 117 Subpart C - hazard analysis and risk-based preventive controls. FSMA Section 103 - statutory basis for preventive controls. 21 CFR 117.126 to 117.170 - requirements for the plan, controls, validation, verification, and reanalysis. 21 CFR 117.180 - PCQI requirements.

GMPify Training  ·  Food Safety Plan Workflow  ·  Built from 21 CFR Part 117 Subpart C and FSMA Section 103  ·  gmpify.com
GMPify Procedural Map Series
Food Safety Series
© 2026 GMPify Training