These requirements are a part of our comprehensive Food Safety Plan Guide

What you need to know:

• A hazard analysis is the process of identifying all of the hazards present in your process that could potentially cause a customer injury.

• Creating a Hazard Analysis is the first step in developing a food safety or HACCP plan.

• You can read the requirements below or just use our self-guided hazard analysis template

Requirements for a Hazard Analysis:

1. You must conduct a hazard analysis for each type of food manufactured, processed, packed, or held at your facility.

2. Your hazard analysis must be written.

Steps in Creating a Hazard Analysis

1. Download our Hazard Analysis Template

It’s available for free here, and it will be much easier if you can follow along.

Example Process Flow - Each box corresponds to a process step.

2. Identify the steps in your process from start to finish.

It’s important that you have every step in your process identified so that you don’t miss anything in your hazard analysis. Often, it’s easiest to conduct a process flow diagram to identify all of the steps in your process.

3. Conduct a Hazard Identification:

In this step, you review all of your process steps and identify if there are any hazards present at each step. For each step, you will consider 3 types of hazards:

• Biological Hazards (bacteria, parasites, etc.)

• Chemical hazards (i.e. toxins, pesticides, food allergens)

• Physical hazards (i.e. stone, glass, metal fragments)

Your hazard identification should also include hazards that could be present in the food because:

• The hazard occurs naturally (i.e. toxins in fish)

• The hazard may be accidentally introduced (jewelry from employee falls into food)

• The hazard may be introduced intentionally for economic gain (i.e. sabotage by a competitor)

4. Conduct Hazard Evaluation

The hazard evaluation is the last step in creating your Hazard Analysis. Here, you must evaluate each hazard that you identified to assess the probability that it would occur if left unaddressed.

If the probability is high that this hazard would cause an injury if unaddressed, then you must implement a “preventive control”.

You also must consider the effects of these things in your hazard evaluation.

• Formulation of the food

• Condition and design of the facility

• Raw materials and other ingredients

• Transportation practices

• Processing procedures

• Packaging and labeling activities

• Storage and distribution

• Intended use of the product

• Sanitation, including employee hygiene

• Any other relevant factors (i.e. weather, natural toxins)

• Environmental pathogens whenever a ready-to-eat (RTE) food is exposed to the environment before packaging.

---

This Article is For You if…

∆ You manage a facility that makes, holds, or packs food.

∆ You are developing a food safety plan or HACCP plan.

∆ You are subject to Part 117 Subpart C (very small businesses are exempt from this requirement)

---

Resources

Hazard Analysis Template

---

More About Food Safety Plans

More Posts

---

References

This is a regulation summary For a more general guide to Food Safety Plans, start here

What You Need to Know:

This section outlines the pre-requisite for a food safety plan and associated operational and documentation requirements.

Summary of Subpart C: Hazard Analysis and Risk-Based Preventive Controls

Below is a summary of Subpart C so that you can get a quick sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.126 (a) (2) then just look up this same code in the CFR.

---

§117.126 Food Safety Plan

a. Requirement for a food safety plan:

1. You must have a written and implemented food safety plan

2. It must be prepared or overseen by a Preventive Controls Qualified Individual

b. Contents of a food safety plan

It must include the following, in writing:

1. A hazard analysis

2. Preventive controls (if you identified a hazard in your hazard analysis that you deem requires a preventive control)

3. Supply chain program

4. Recall plan

5. Procedures for monitoring your preventive controls

6. Corrective Action Procedures

7. Verification procedures

c. Records: The records generated are subject to regulations under Subpart F. (i.e. you must store them either in print or electronically)

§117.130 Hazard Analysis

a. Requirement for a hazard analysis:

1. You must conduct a hazard analysis for each type of food manufactured, processed, packed, or held at your facility.

2. The hazard analysis must be written.

b. Hazard Identification: This must consider

1. known or reasonable hazards, including:

i. Biological Hazards (bacteria, parasites, etc.)

ii. Chemical hazards (i.e. toxins, pesticides, food allergens)

iii. Physical hazards (i.e. stone, glass, metal fragments)

2. Hazards that could be present in the food because:

i. the hazard occurs naturally (i.e. toxins in fish)

ii. The hazard may be accidentally introduced (jewelry from employee falls into food)

iii. The hazard may be introduced intentionally for economic gain (i.e. sabotage by a competitor)

c. Hazard Evaluation: 

i. the hazard analysis must evaluate the hazards identified to assess the severity of illness or injury that would occur and the probability that it would occur if left unaddressed.

ii. The hazard evaluation must consider environmental pathogens whenever a ready-to-eat (RTE) food is exposed to the environment before packaging.

2. The hazard analysis must consider these effects on the food:

i. formulation of the food

ii. condition and design of the facility

iii. Raw materials and other ingredients

iv. Transportation practices

v. Processing procedures

vi. Packaging and labeling activities

vii. Storage and distribution

viii. intended use of the product

ix. Sanitation, including employee hygiene

x. any other relevant factors (i.e. weather, natural toxins)

§117.135 Preventive Controls

a.

1. You must identify and implement preventive controls when required by your hazard analysis.

2. Preventive controls include: Critical Control Points and other controls.

b. Preventive controls must be written

c. Preventive controls include:

1. Process Controls: These are procedures and processes that are used to control parameters of processing (i.e. acidifying, refrigerating, cooking.) They must be written in a way that is specific to your process and they must include:

i. parameters associated with controlling the hazard (i.e. if you are using cooking as a process control, then you must include the required cook temperature and cook time)

ii. The maximum or minimum values required to control the hazard.

2. Food Allergen Controls include processes to control food allergens. These are implemented to:

i. Protect food from allergen cross contact

ii. Label food properly with allergens to ensure it isn't misbranded

3. Sanitation Controls: Practices to ensure the facility is kept clean and to minimize biological hazards. These relate to:

i. Cleanliness of food-contact surfaces (equipment, utensils, tables)

ii. Prevention of contamination of food from dirty sources (i.e. dirty people, dirty food, dirty packaging, dirty raw ingredients)

4. Supply Chain Controls: This is described fully in Part G

5. Recall Plan: You are required to have a recall plan (see below)

6. Other Controls: You may have other types of controls (i.e. hygiene training and current good manufacturing practices)

---

§117.136 Circumstances in which preventive controls are not required

a. Circumstances You aren't required to implement preventive controls if any of the following apply:

1. The food cannot be consumed without application of an appropriate control (i.e. coffee beans cannot be consumed without pouring boiling water on them, which would kill any bacteria on the bean)

2. You rely on your customer, who is subject to this subpart, to ensure that the hazard is mitigated. You must:

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that the customer is following the procedures you have provided, which will eliminate the hazard.

3. You rely on the customer who is not subject to this subpart to eliminate the hazard. You must:

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that the customer is following the procedures you have provided, which will eliminate the hazard.

4. You rely on the customer to provide assurance that the food will be processed to control the hazard by a subsequent entity in the supply chain

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that your customer will:

A. Disclose in documents accompanying the food that it is "not processed to control [identify hazard]"

B. Will only sell to another entity that agrees in writing that it will mitigate the hazard and obtain similar written assurance from subsequent customers.

5. You have established and implemented a system that ensures control of the hazards in your product, at the distribution step.

b. Records: You must document any circumstance (related to a., above) that applies to you, including written assurances from customers.

---

§117.139 Recall Plan

If your food has a hazard that requires a preventive control,

a. You  must establish a written recall plan.

b. The recall plan must include a procedure for a recall scenario and assign responsibility for taking those steps. It must address how to:

1. Directly notify recipients of the product being recalled and how to dispose of/return the food.

2. Notify the public about any hazard in the food, when this is required to protect public health.

3. Conduct effectiveness checks to verify the recall is carried out.

4. Dispose of recalled food.

---

§117.140 Preventive Control Management Components

a. You must conduct the following activities for each of your preventive controls:

1. monitoring activities

2. corrective actions

3. verification activities

b. You must conduct the following activities for your supply-chain program:

1. corrective actions, especially related to supplier non-conformance.

2. Review of records

3. Re-analysis of your supply chain program over time and as it changes.

c. You do not need to conduct the following activities for your recall plan: monitoring, corrective actions, verification activities.

---

§117.145 Monitoring

as appropriate to the nature of the preventive control, you must implement

a. Written Procedures: You must have written procedures for how and how often you will monitor preventive controls.

b. Monitoring: You must monitor preventive controls enough to ensure they are being peformed.

c. Records: 

1. You must document your monitoring actions and verify this (see §117.165)

2. Exception Records: You can use exception records (i.e. the record only shows when a deviation occured.) For example, a log monitoring refrigeration may only show records when the temperature is unacceptable

---

§117.159 Corrective Actions and Corrections

a. Corrective Action Procedures: 

1. You must establish and implement written corrective action procedures. They must address:

i. the presence of a pathogen in a ready-to-eat product

ii. the presence of an environmental pathogen detected.

2. Corrective Action Procedures must describe the steps to be taken to ensure that:

i. appropriate action is taken to correct a problem associated with a preventive control.

ii. Appropriate action is taken to reduce the likelihood that the problem will recur.

iii. All affected food is evaluated for safety

iv. All affected food is prevented from entering commerce.

b. Corrective Action in the Event of an unanticipated food safety problem:

1. You must follow the procedure in (b)(2) if

i. a preventive control fails and a corrective action hasn't been established.

ii. a preventive control is found to be ineffective

iii. Verification records are found to be incomplete or improper decisions were made about corrective action

2. If any of the circumstances above in (b) (1) apply, you must:

i. Take corrective action, Ensure it doesn't happen again, re-evaluate all food for safety.

ii. reanalyze your food safety plan to see if changes are required.

c. Corrections: You don't need to follow sections (a) and (b) above if

1. You take action to correct a minor and isolated problem, insofar as these are not related to allergen controls or sanitation controls.

2. You take action in a timely manner to correct a minor and isolated problem insofar as it doesn't directly impact product safety

d. Records: All corrective actions taken in this section must be documented. Corrective actions must also be verified according to §117.155

---

§117.155 Verification

Note: The Verification process is one that verifies various other parts of the plans have been undertaken as specified. This can take the form of a supervisor regularly reviewing records and verifying them with a signature.

a. Verification Activities: As it relates to a preventive control, you must verify

1. That the preventive control is valid

2. that monitoring is being conducted as required.

3. that appropriate decisions are being made in relation to corrective action.

4. that the preventive control is implemented and effective.

5. the reanalysis of your preventive controls (as your process changes or at minimum every 3 years)

b. Documentation: All verification activities must be documented in records.

§117.160 Validation

a. You must validate that the preventive controls implemented actually work.

b. Your validation must:

1. Be performed by a Preventive Controls Qualified Individual (PCQI)

i. Within 90 days of beginning production or there must be written justification for why if  >90 days after production begins.

ii. Whenever a change is made that could impact how a hazard is controlled.

iii. Whenever the food safety plan is reanalyzed.

2. Must include scientific and technical evidence (or conducting your own studies) to determine whether preventive controls will control the hazards.

c. You do not need to validate:

1. Food allergen controls

2. Sanitation controls

3. Recall plan

4. Supply chain program

5. Other preventive controls if the PCQI prepares the written justification that a validation is not applicable based the nature of the hazard and the preventive control.

---

§117.165 Verification of Implementation and Effectiveness

a. Verification Activities: You must verify that preventive controls are consistently implemented and effective. This includes doing the following:

1. Calibrating instruments for accuracy

2. Product testing

3. Environmental monitoring

4. Review of records to ensure they are complete and activities were performed according to the plan

i. Records of monitoring and corrective action must occur within 7 days (or provide a written justification for why not)

ii. Other records (calibration, supplier, product testing) must occur in a reasonable amount of time.

b. Written Procedures: The following activities must be written:

1. The method and frequency of calibrating tools

2. Product testing. These procedures must be scientifically valid, they must identify the tests conducted, the methods used, the pathogens, the laboratory conducting the testing, and the corrective action procedures.

3. Environmental monitoring must be: scientifically valid, identify the locations and sites to be tested, the timing and frequency of these samplings, the tests conducted and methods used, the laboratory, and the corrective action procedures.

---

§117.170 Reanalysis

a. You must reanalyze your food safety plan every 3 years.

b. You must reanalyze your plan whenever:

1. A change creates a new hazard or increases an existing hazard

2. Whenever you become aware of a new hazard

3. Whenever appropriate after an unanticipated food safety problem.

4. When you find a part of your plan or a preventive control is ineffective

c. You must complete the reanalysis

1. before any changes in activities OR

2. Within 90 days of the beginning of production for a new product (or >90 days if written justification is provided)

d.  You must also document the basis for the conclusion that no revisions are required.

e. A preventive controls qualified individual must oversee this reanalysis.

f. You must conduct a reanalysis when the FDA determines necessary and when there are new developments in scientific understandings.

---

§117.180 Requirements Applicable to a Preventive Control Qualified Individual and a Qualified Auditor

a. One or more PQCI must do or oversee the following:

1. preparation of the food safety plan

2. validation of the preventive controls

3. written justification for >90 day time frame for validation

4. Determination that validation is not necessary.

5. Review of records

6. Written justification for exceeding 7 day time frame for reviewing records.

7. reanalysis of food safety plan

8. determination that reanalysis can be completed in a time frame that >90 days of the production of the new food being produced.

b. A qualified auditor must consult an onsite audit:

c. 

1. To be a PCQI, one must have completed training equivalent to that developed by the FDA or be qualified through job experience. This individual may or may not be an employee of the facility.

2. To be a qualified auditor requires technical expertise achieved through training, education, or experience.

d. All training in the development and applications of preventive controls must be documented in records.

---

§117.190 Implementation Records Required for this Subpart

a. You must establish records regarding the implementation of a food safety plan, including:

1. Documentation for not establishing a preventive control (you can do this in the hazard analysis using our template)

2. Records documenting the monitoring of preventive controls

3. Records documenting corrective actions

4. Records that document verification, as related to

i. Validation

ii. Verification of monitoring

iii. Verification of corrective actions

iv. Calibration of process monitoring and verification instruments

v. Product testing

vi. Environmental monitoring

vii. Records review

5. Records documenting the supply chain program

6. Records documenting training for the Preventive Conrols Qualified Individual and qualified auditor.

b. These records are subject to requirements in subpart F.

---

This Article Is For You If…

∆ You manage a facility that makes, holds, or packs food.

∆ You are subject to Part 117 Subpart C (very small businesses are exempt from this requirement)

More About Food Safety Plans

More Posts

Resources

FDA Regulation Title 21 — Part 117 — Subpart C Hazard Analysis and Risk-Based Preventive Controls