This article supports food producers answer the question, “What are GMPs?”

Introduction to GMPs

Good Manufacturing Practices (GMPs) are the set of production standards that have been embraced by regulators, retailers and consumers in the food and drug industries. 

GMPs provide a basic assurance that a product was produced under industry-standard conditions. Some of the areas addressed in GMPs include:

Contents

Introduction
Food vs. Drug GMPs
Understanding the GMP Certification Process GMP Requirements

• Building & facility conditions

• Equipment design and maintenance

• Employee practices

• Sanitation conditions

• Raw ingredient sourcing

• Maintaining strong production controls

• Records and reports

There are several sets of GMP standards which have been endorsed by different governments. Fortunately although they are nearly identical. Some versions of GMPs include:

• CGMP* (food) addresses the production of food for the US.

• CGMP* (drug) addresses the production of pharmaceutical drugs for the US

• EU-GMP addresses the production of pharmaceutical drugs for the European Union

• Guide 104 GMP addresses the production of pharmaceutical drugs for Canada
  

If you are considering aligning your business with GMPs, adopt the set of standards that reflects where your processing is located and where your product will be sold. If this includes more than one set of GMPs, you will want to make sure your operations are aligned with both. Again, they are nearly identical.

*CGMP stands for “Current Good Manufacturing Practices” and is regulated by the FDA.

Food vs. Drug GMPs

In the United States, the FDA defines two distinct sets of GMP standards — Food and Pharmaceutical (Drug).

Food CGMPs: These describe the “methods, equipment, facilities, and controls for producing processed food.” (FDA, 2004). These are meant to ensure that the food is safe to eat.

Drug CGMPs: These assure “the identity, strength, quality, and purity of drug products by requiring that manufacturers of medications adequately control manufacturing operations”. (FDA, 2018).

The sections below reflect the GMP requirements for food.

Understanding the GMP Certification Process

After a food manufacturer aligns their operations with GMPs, they may consider going through the certification process through a private auditing firm. This is how the certification process typically works:

1. A manufacturer adopts the GMP standards and makes the required adjustments to align with the standards. Depending on the preexisting practices and conditions, this could take 3-12 months.

2. The manufacturer chooses a private auditing firm (there are many) to conduct the GMP audit.

3. The auditing firm conducts the audit, which may include an inspection of the facility and a review of records. 

4. The manufacturer will correct any areas of non-compliance and, if they achieve a passing score, they will receive a certificate from the auditing firm.

5. The manufacturer can provide this certificate to prospective buyers as an indication of their alignment with industry standards.

Why You Should Align Your Operations with GMPs

Regardless of whether your business chooses to pursue certification, aligning your operations with GMPs will have the following benefits:

• Decrease in food safety risk to your customers

• Lower level of product defects

• When your buyers conduct supplier verification activities, they will want to want to know that your operations are GMP-aligned — even if you’re not certified

The Benefits of Achieving GMP Certification

• It will unlock access to the many buyers who require GMP certification from their suppliers.

• It will satisfy most supplier-verification requirements — meaning less back-and-forth between your team and the companies you sell to.

• You will have an advantage over competitors who haven’t been certified to this industry standard.

GMP Requirements

For a detailed set of FDA-aligned GMP requirements, see our comprehensive guide to GMPs

Or, you can learn about the individual good manufacturing practices by topic:

• Personnel

• Plants and Grounds

• Sanitary Operations

• Sanitary Facilities and Controls

• Equipment and Utensils

• Processes and Controls

• Warehousing and Distribution

• Holding and Distribution

---

More About Food Safety Plans

---

Introduction to the FSMA Produce Safety Rule

Contents

Introduction
Exemptions
Requirement Areas

• Agricultural Water
• Biological Soil Amendments
• Sprouts
• Domesticated and Wild Animals
• Worker Training, Health & Hygiene
• Equipment, Tools, & Buildings

Introduction

The produce safety rule is a section of FSMA which provides standards for the growing, harvesting, packing, and holding of fruits and vegetables. The regulation acknowledges that farms may not be currently implementing these practices and it aims to educate before strictly enforcing these provisions. 

It includes six requirement areas, which are described below:

• Agricultural Water

• Biological Soil Amendments

• Sprouts

• Domesticated and Wild Animals

• Working Traning and Health and Hygiene

• Equipment, Tools, and Buildings

Exemptions

For an overview of exemptions to the Produce Safety Rule see this flowchart

---

Requirement Areas

Agricultural Water:

The Produce Safety Rule regulates water based on how it will be used. There are several different uses for water in agricultural contexts — for example irrigation water versus water used in produce washing —  and each of them has specific requirements for quality and testing. There is no expectation that a farm achieve a perfect result in every test. Rather, the goal is to understand water quality over time and support farms in accessing viable long term water sources.

Requirements for Water used in Produce Processing 

This includes water used for produce washing, hand washing, and cleaning food contact surfaces. Any water used after harvesting that could reasonably contaminate produce product is held to this standard. The requirements are

• All water used for these purposes must be treated (e.g. you cannot use un-treated well-water) 

• There can be no detectable presence of E. coli in these water types.

• If any E. coli is detected, that water use must be immediately discontinued.
  

Requirements for Water used in Growing Produce

This refers to water which is directly applied to growing produce (e.g. irrigation water). There are two values that are used to determine whether this use of water achieves the requirement. Collectively, these two figures are referred to as “microbial water quality profile”: 

• Geometric Mean (GM) Test: There must be an average of fewer than 126 E. Coli CFU (a.k.a. colony forming units, which is how bacteria is commonly quantified) per 100ml of water. 

• Statistical Threshold Value (STV) Test: The maximum STV is 416 E. Coli CFU per 100ml of water. You can think of the STV as the level at which 90% of samples fall below this value.

What Happens When You Receive a Failing Result?

This section demonstrates the flexibility of the regulation. Corrective action is required “as soon as possible” and no later than the following year. Examples of corrective action that a farm may take after receiving a positive E Coli test result include,

• Treating the water supply

• Implementing a time interval between last irrigation and harvest (which allows bacteria that may have been present in irrigation water to die off)

• Using washing or other commercial activities to reduce microbe levels

Testing Water Supply

This section describes testing requirements based on water source.

Public Water: This is typically the safest source of water, insofar as it aligns with national water standards. There is no requirement to test agricultural water drawn from a public water supply.

Untreated Surface Water: This is considered the most vulnerable type of water supply. When untreated surface water is applied to growing produce, farm must order tests for GM and STV (see above) using the following timeframe:

1. Initial survey: twenty samples must be taken at a time that is as close to harvest as possible. These samples may be taken over the course of 2-4 years.

2. Annual surveys: five new samples must be taken annually to replace the oldest results.

Untreated Ground Water (For Direct Application to Growing Crops: When untreated water is applied to growing crops, the following testing procedure is required:

1. Initial survey: four samples must be taken at a time that is as close to harvest as possible. These samples must be taken during the growing season (i.e. in a single year)

2. Annual survey: one new sample must be taken annually to replace the oldest result.
   

Untreated ground Water Used in Food Processing (where there is a zero-tolerance threshold for E. coli), a different testing schedule applies. 

1. Initial survey: four samples must be taken at a time that is as close to harvest as possible. These samples must be taken during the growing season (i.e. in a single year)

2. Annual survey: If the initial survey results meet the “no detectable E. coli” standard, then only one annual sample is required. If the initial result does not meet the standard (or any subsequent result) then four samples must be tested the following year.

Biological Soil Amendments (e.g. Compost)

Use of Raw Manure:

While the FDA regulations are still being developed as of 2019, there are two general requirements:

1. Raw manure must be applied in a way that does not contact the produce when it is applied. 

2. The farmer minimizes the potential for contact between manure and produce.

In the absence of clearer regulation, the FDA recommendation is that farmers adopt the standards outlined in the USDA’s national Organic Program. These call for:

• 120 day interval between application of raw manure on crops that contact the soil (e.g. melon)

• 90 day interval between the application of raw manure on crops that do not contact the soil (e.g. tomatoes)

Stabilized Compost:

For compost which has been processed to reduce pathogens, there are specific threshold levels for soil-based pathogens. This section offers guidance for how a farm may choose a suitable method for treating their soil amendments

---

Sprouts

Sprouts are particularly vulnerable to the growth of dangerous microbes because of the conditions required to grow them — warm moist environments. The major requirements for farming sprouts includes:

• Treating seeds that will be used as sprouts (or sourcing pre-treated seeds)

• Re-collecting and testing the water which was used to irrigate sprouts. Sprouts may not legally enter commerce until negative results are achieved.

• Environmental testing for Listeria.

• Taking appropriate corrective action if any tests come back positive.

---

Domesticated and Wild Animals

This section acknowledges that farms may have animals onsite. At the same time, fecal contamination from livestock is a frequent source of produce contamination.  Although the rule does not mandate that animals be excluded from outdoor growing areas it does describes some requirements for managing animals reduce the contamination hazard. They describe:

• All farming areas and produce must be inspected for sources of contamination.

• When contamination has occurred (from either wild or domestic animal droppings), these areas should be marked and corrective action taken.

• Although it is not required, the FDA recommends that farms implement waiting periods between when land is grazed on and when produce is harvested from that land.

---

Worker Training, Health and Hygiene

This section outlines measures to prevent contamination of produce by sick employees. To reduce this risk, may exhibit the following programs (you can also read about them in our Personnel guidance)

• Using basic hygiene practices (e.g. hand washing)

• Implementing an employee health policy which requires sick food handlers to notify their employers if they may have a contagious disease which could contaminate food.

• Training farm workers to safely handle produce.

---

Equipment, Tools, & Buildings

This section of the rule describes the standards for equipment, tools and buildings. This may cover areas such as greenhouses, germination areas, and also toilet/hand washing facilities and outlines specific requirements for

• Design and construction requirements

• Recommendations for toilet and hand washing facilities

• Pest control

• Maintenance of sewage systems

• Plumbing requirements

• Waste disposal requirements 

To access those requirements in detail, consider the guidance document for this chapter.

---

More About Food Safety Plans

---

To learn more about Foreign Supplier Verification Programs overall, see our introduction article

How Do I Develop a Foreign Supplier Verification Program?

Contents

How Do I Develop a FSVP?

1. Determine Your Qualified Individual
2. Decide How Your Program Works
3. Conduct Your Verification Activities
4. Approve Your Suppliers and Maintain Your Program

Keeping Records of Your FSVP
Taking Corrective Actions
Re-evaluating Suppliers

If you import products for consumption into the US, you likely are required to develop a foreign supplier verification program (FSVP).

Below is a step by step guide to developing and implementing an FSVP.

---

1. Determine your Qualified Individual

First, The FSVP must be prepared by a "qualified individual" who has the education, training or experience necessary to perform the activity. If this person is a 3rd party or consultant, that's fine. However, note that supplier verification is an ongoing process and it must always be completed by a qualified individual. For most companies, the easiest solution is to have someone on staff undergo a 2 day training course on developing a Foreign Supplier Verification Program.

Source 21 CFR 1.503

---

2. Decide How Your Program Works

Before you begin approving suppliers, you must establish the procedures you will use to approve suppliers. The goal is to provide assurance that hazards in the food you import are being prevented.

You can rely on a 3rd party to conduct your supplier verification if you review and assess the documentation yourself and document your review and assessment of the materials.

Examples of appropriate verification activities:

• Onsite audit by a qualified individual

• Sampling & testing

• Review of foreign suppliers food safety records

• Other appropriate supplier verification activities

---

3. Conduct Your Verification Activities

This step is the bulk of the process: collecting information from your suppliers, reviewing it, and documenting your review process.

You may rely on a 3rd party to conduct supplier verification activities (i.e. a 3rd party audit) if you assess their documentation with appropriate frequency. You must document your review and assessment of the activities and document that the activities were performed by a qualified individual.

The following are common verification methods for approving suppliers:

Hazard Analysis

You are required to review a hazard analysis for each type of food you import. Hopefully, each of your foreign suppliers has completed one and can provide this to you. If not, then you must conduct a hazard analysis to determine whether there are any hazards requiring a control. This hazard analysis must be written and contain an evaluation of environmental hazards.

Some key points about the hazard analysis:

• You must either conduct a hazard analysis for each type of food you import OR use a supplier hazard analysis.

• If you are importing Raw Agricultural Commodities (RACs) then no biological hazards need be considered in the Hazard analysis.

• If you are reviewing a hazard analysis supplied by the supplier or a 3rd party, then you must document your review of the hazard analysis and confirm that it was conducted by a qualified individual.

• If no hazards are identified which require a preventive control, then no verification is required for those products. Still you must have a hazard analysis on file to show that this has been determined. This provision does not apply to produce.

Subpart L  - FSVP for Food Importers

Onsite Audit

Certain importers may wish to independently conduct onsite audits of the foreign supplier. Or, they may simply review the audit results conducted by a reputable 3rd party auditor.

An audit is required as part of the supplier verification process when there is "reasonable probability that exposure to the hazard will result in serious adverse health consequences or death" you must conduct or obtain documentation of an onsite audit at least annually. (1.506 (d) (ii) (2)

In this case, an audit may be replaced by written inspection results by the FDA, USDA, or a food safety authority of a country whose food safety system is equivalent to that of the US.

Sampling & Testing of Food

If you choose to use product testing and sampling as part of your verification, you must retain documentation of the following:

• The number and type of samples tested

• identification of the food tested (lot numbers)

• tests conducted and the methods of the testing

• Any corrective action taken into detection of hazards

• Information identifying the lab

• Documentation that the tests were performed by a qualified individual.
  

Review of Foreign Supplier's Food Safety Records

The most common method of supplier verification is the review of a foreign supplier's food safety records.

If you choose to use your foreign supplier's food safety records as part of your verification, you must retain the following information:

• The records reviewed

• Dates of review

• General nature of the records reviewed

• Conclusions of review

• Any corrective actions taken in response to significant deficiencies identified.

• Documentation that the review was conducted by a qualified individual.

You may not allow on the foreign supplier to conduct supplier verification activities for their own business.

Final Considerations:

Hazards Not Controlled by the Foreign Supplier

Does a 3rd party control one of the hazards on behalf of your supplier (i.e. your overseas milk supplier has their pasteurization completed offsite by another company.) If so, you must collect this verification data from the 3rd party or have your supplier send it to you.

Supplier Performance & History

It is perfectly acceptable to take into consideration your supplier's history, procedures, practices, storage, transportation, etc as part of your verification activities.

Document Your Verification Activities

Remember, it's not enough to simply collect these documents from your foreign suppliers -- you have to assess them and document that assessment.

For example, let's say I'm an importer of Ned's Italian Tomato Sauce and they send me their most recent audit result. Beyond having that audit result on file, I need to record that I reviewed that audit, that it showed me they controlling the hazards in their process, and that my review occurred on such-and-such date.

The Whole Picture

For fear of stating the obvious, you must approve your foreign suppliers on the basis of your evaluation. In other words, you must consider all the information you gather in your approval process and cannot discount any piece of information simply because it is contrary to the result that you're looking for.

This doesn't mean that one failed audit in your supplier's history means you cannot approve them. However, you must acknowledge this information if it is revealed in your verification activities or outside of them.

Source 21 CFR -- 1.504

---

4. Approve your Suppliers and Maintain the Program

Once you have completed your verification activities, you may add the relevant supplier's to your approved supplier list and begin sourcing product from them. At that point, the program should require only occasional ongoing maintenance

Keeping Records of Your Foreign Supplier Verification Program (FSVP)

Your records should comply with the following provisions:

• They must be originals, photocopies or digital records

• You must keep them for 2 years unless otherwise specified

• They must be available for review by the FDA

• You do not need to have a specific copy of each record for the FDA (e.g. you can have one copy of a record to satisfy both a state requirement and a federal requirement)

Source 21 CFR §1.510

There are several exemptions to Foreign Supplier Verification Requirements. This section applies to:

Taking Corrective Actions

You must take corrective actions if you determine that the food you are receiving is not meeting the requirements of the FDA regulations. Simply put, if the food you receive could cause harm to a consumer or is unsafe, then you must take some type of corrective action. This determination could be based on customer complaints or verification activities that you conduct (i.e. records review or viewing an inspection result.)

The appropriate corrective action to take could include discontinuing your use of that supplier until the hazards have been addressed.

If this determination occurs outside of the scope of your supplier verification activities, then it may reveal that your verification activities are not comprehensive. Simply put -- you didn't catch the mistake in your normal supplier verification practices therefore something is inherently wrong with your process. In this case you are obligated to update your plan so that you are able to adequately verify your suppliers.

Source 21 CFR §1.508

Re-evaluating Suppliers

You must re-evaluate your foreign suppliers (and document it),

• Every 3 years, at minimum

• When you learn anything new or when anything has changed that would warrant a re-evaluation.

You may use a 3rd party foreign supplier review as your re-evaluation, insofar as you document your assessment of that evaluation. The evaluation must be performed by a qualified individual.

Source 21 CFR -- 1.504

This article applies to you if…

∆ You are a food importer

∆ The products you import are regulated by the FDA

∆ You do not qualify for a small-food-importer exemption (<$10mm/yr imported)

∆ You need to build a foreign supplier verification plan

More About Supply Chain

---

More Posts

---

ConsultinG Services

It’s not always clear where  the FDA has jurisdiction when it comes to food businesses. This table provides an overview of FDA Jurisdiction. Specific examples are provided below.

Regulated By the FDA	Not Regulated By the FDA
Foods that enter interstate commerce	Food Service Establishments
Most packaged foods	Restaurants
Most foods solid online	Restaurant Chain
Human and animal food	Food Truck
Imported Foods	Caterer
Farms (if they grow and process food)	Grocery Stores
	Food Bank
	Cafeterias / Institutions
	Markets
	Home-Food Processor
	Alcoholic Beverages
	Butcher Shop
	Slaughterhouses (USDA)
	Farms (if they only grow food)

:

*Note: Domestic food processors of any kind must still register as a Food Facility even if their products do not enter interstate commerce. This is free and purely for record keeping purposes (it will not subject a business to FDA inspections or oversight)

---

Examples of FDA Jurisdiction Businesses

FDA Jurisdiction	Examples
Food products that enter interstate commerce (i.e. businesses whose foods leave the state)	Most foods sold online
	Most non-meat products that are made and sold in a package
	A central kitchen that prepares and distributes foods to locations in multiple states
	A transporter that distributes food nationwide
	Any business that processes, packs, transports, distributes, receives, or holds food which crosses state lines.
Imported Foods	Food distributor that imports foods and sells it
	Food importer that warehouses food

:

Businesses Not Under FDA Jurisdiction

Not FDA Jurisdiction	Example	Who typically regulates
Restaurant (Individual)	Fast Food Restaurant	Local/State health dept.
Restaurant (Chain)	Chain of frozen yogurt restaurants	Each would be regulated individually by its respective local or state health department
Restaurant (Delivery only)	Meals are ordered via app/web and delivered hot to the consumer	Local/State health dept.*
Food Truck	Korean food truck	Local/State health dept. *
Caterer	Facility where a caterer prepares food for immediate service	Local/State health dept.*
Grocery Store	Grocery store that also serves some hot food or includes a deli	Local/State health dept.
Food Bank	Food bank that accepts food donations and distributes that food locally	Local/State health dept.
Cafeteria / Institution	Hospital cafeteria, School lunch cafeteria	Local/State health dept.
Farmers Market	Weekly market that offers various prepared foods and ingredients for sale	Local / State Health Dept
Seafood Market	Retail market that supplies seafood products to consumers	Local / State Health Dept
Alcoholic Beverage Producer, Importer, Distributor, Wholesaler	Winery, Brewery, Distillery	State Health Dept / TTB (Note that alcoholic beverages <7% ABC are subjected to FDA labeling standards)
Butcher Shop	Retail market that butchers and retails meat for consumers	Local/State Health Dept. OR USDA. (This depends on what level of processing is being done to the meat before it is sold)
Home Food Processor	Business conducted from the home that involves making food	Local / State – Note that many cities and states prohibit or specifically regulate home processing
Meat Product Processor	Frozen meat pies, Bone broth, High-quality cuts of steak delivered via mail	USDA
Poultry Product Processor	Frozen buffalo wings, Roast Chickens	USDA
Processed Egg Products	Frozen omelets, Egg whites	USDA

:

*If you serve or prepare food in multiple areas you may have to license with the local health department for each of those jurisdictions. If the food is crossing state lines, then FDA regulation would apply.

Still Unsure Whether Your Business is Regulated by the FDA?

Ask a question in the comments and I’ll answer it

Try using this dichotomous key

What’s Next?

Understand about Registering a Food Facility with the FDA

More Posts

For step-by-step instructions, see Guide to Developing an FSVP

What You Need to Know about FSVP

Contents

What You Need to Know
Applicability and Exemptions
Very Small Importer Exemption
Foreign Suppliers Requiring No Verification
Foods Subject To Special Foreign Supplier Verification Regulations
FAQ

• Nearly all food imported into the US must be produced in alignment FDA Regulations

• Foreign Supplier Verification Program (FSVP) is a major component of FSMA which requires US businesses to only import food products from suppliers they have vetted and approved.

• Most businesses which import food products for consumption inside the US must verify that the food is produced in alignment with FDA regulations. This is done through the implementation of a Foreign Supplier Verification Program (FSVP). When a certain type of food (i.e. seafood) is subject to specific regulation, a foreign supplier must also comply with those specific standards.

• The verification process may include, among other methods: an assessment of the supplier's food safety records, a review of an audit report, or a site visit.

---

Applicability and Exemptions

Generally, foreign supplier verification is required for most importers, for most imported foods, and for most foreign suppliers. To better understand what types of businesses and products may not be regulated under Subpart L (Foreign Supplier Verification Program), see the exemptions below:

Very Small Importer Exemption

A "Very Small Importer" is a company that imports $<1mm year in product value for imported human food (or <$2.5mm year in value for imported animal food)

Modified requirements for "Very Small Importers"

• A very small importer must document that they meet the qualification for this exemption (i.e. be able to prove they are doing less than $1 million in imports)

• Receive a written assurance from each foreign suppliers, prior to importing any food. The written assurance must be obtained every 2 years and include the following

1. A brief description of the preventive controls being applied to control hazards in the food. This must be provided for each food that is imported.

2. A statement that the foreign supplier is compliant with FDA regulations or (when equivalent) the relevant laws of their own country

• You must take corrective action (such as suspending your import of this food) if you determine that the supplier is not producing food consistent with their assurance.

• You must keep signed and dated records of these activities for > 2 years.

Foreign Suppliers Requiring No Verification

An importer is not required to conduct verification activities for certain foreign suppliers, including

• Qualified Facilities, or

• farms that grow produce and are not covered under part 112, or

• A shell egg producer that has fewer than 3,000 laying hens.

• Suppliers operating in countries with an officially recognized or equivalent food safety system

If you are importing products from a foreign supplier that is exempt, the modified requirements are as follows:

• You must obtain a written assurance of their exemption type (i.e. farm or qualified facility or small shell egg producer)

• You must initially evaluate your foreign supplier's performance history as it relates to compliance with FDA regulations. You must re-evaluate this if you become aware of any relevant changes or information or ever 3 years at minimum.

• You must take corrective action (such as suspending your import of this food) if you determine that the supplier is not producing food consistent with their assurance.

• You must keep signed and dated records of all verification activities for > 2 years.

• You must approve your foreign suppliers based on the activities described above.

• You must establish written procedures to ensure that you are using only approved foreign suppliers. You may import from unapproved suppliers on a temporary basis, if you have other, adequate verification prior to import.

Source 21 CFR §1.512

Countries with Officially Recognized or Equivalent Food Safety Systems

If you are importing from a country with a recognized equivalent food system, you may be free from the following the majority of FSVP requirements (§1.504-§1.508). As of 2018, the only countries who have achieved this are: Australia, Canada, and New Zealand.

However, your program still must be developed by a qualified individual, your company must be identified upon food import, and you must maintain your FSVP records in compliance with §1.510.

Source 21 CFR §1.513   

Foods Subject to Special Foreign Supplier Verification Regulations:

Certain foods are exempt from Subpart L (the requirements for Foreign Supplier Verification Programs outlined in this article) and are subject to different requirements.

Imported Seafood Products (aka Fish / Fishery Products)

Since seafood products are subject to specific FDA regulations found in Part 123, importers of seafood products are required to verify that the overseas manufacturer is aligned with Part 123. You can read about the specific requirements for verifying a foreign seafood supplier here

Imported Juice Products

Juice products are subject to specific FDA regulations found in Part 120, importers of seafood products are required to verify that the overseas manufacturer is aligned with Part 120 (specifically, that they have and follow a HACCP plan).

Meat Products

The Foreign Supplier Verification Program does not apply to meat products that, at the time of import, are under USDA jurisdiction.

Food that cannot be consumed without the hazards being controlled

You aren’t required to conduct an evaluation or foreign supplier verification when:

• The food can’t be consumed without controlling for the hazard

• You rely on the customer (who must be subject to 117C) to control the hazards. In this case you must disclose this to the customer and obtain annual assurance that they are controlling for the hazard

• You rely on a subsequent entity in the supply chain (further downstream from you and the customer) to control for the hazard.

Source 21 CFR §1.507

---

FSVP FAQ

How must the importer be identified at entry?

You must identify your firm as the importer and include your FDA identification (DUNS) number and email address when filing for entry. The foreign owner or consignee of the food oversees must designate a US representative as the importer as the food.

Source 21 CFR §1.509

What are some consequences of failing to comply with the requirements of this subpart?

• The food may be inadmissible for import.

• The importer may be found in violation of federal law.

Source 21 CFR §1.514

What FSVP must I have if I am importing a food subject to certain requirements in the dietary supplement current good manufacturing practice regulation?

Source 21 CFR Section 1.511

More About Supply Chain

---

Consulting Services

---

These requirements are a part of the Current Good Manufacturing Practices that relates to Processes and Controls. You can see the full guide to cGMPs here

Requirements For Processes and Controls

Below are the processes and controls requirements for FDA regulated food businesses.

General Requirements

1. All operations involving food must align with sanitation principles.

2. Quality control must be used to ensure food and packaging is safe.

3. One or more competent individuals must be responsible for sanitation

4. You must protect your food from allergens and contamination.

5. Testing must be used to identify sanitation failures or possible product contamination.

6. Any contaminated food must be discarded or treated to eliminate the contamination.

Raw Materials & Ingredients

1. Ingredients must be inspected for cleanliness and stored safely. If necessary, raw materials should be washed using clean water.

2. Ingredients must be safe for consumption or treated to make them safe (i.e. washed or cooked).

3. Ingredients susceptible to toxins must comply with FDA regulations.

4. Ingredients that are contaminated must comply with FDA regulations if they are to be used.

5. Ingredients must be held in containers that prevent contamination and at an acceptable temperature and humidity level.

6. Frozen ingredients must be kept frozen.

7. Ingredients stored in bulk must be safe from contamination.

8. Ingredients that contain allergens must be identified and held in a way that prevents cross-contact.

Manufacturing Operations:

1. Equipment must be maintained in clean condition.

2. All operations should be controlled to minimize growth of bacteria, contamination and spoilage.

3. Food requiring refrigeration must be refrigerated throughout the operation.

4. Measures used to prevent bacteria growth (i.e. cooking, sterilizing, refrigerating) must be adequate.

5. Re-work must prevent contamination and bacteria growth.

6. When ingredients are unprotected they must not be handled in a way that could cause contamination. Food on conveyor belts must be protected.

7. Equipment, containers, and utensils must be constructed and used in a way that doesn’t contaminate food.

8. You must take measures to protect your product from metal or foreign objects.

9. Contaminated food must:

i. Be disposed of OR

ii. Re-worked and re-examined,

10. Food that is being processed must be protected from contamination.

11. Heat blanching --if used-- must be performed properly

12. Foods that are used repeatedly (i.e. dipping sauces, breading) must be protected from contamination and bacteria growth

13. Filling, assembling, and packaging processes must not contaminate food.

14. Dry foods that rely on low moisture for safety must be sufficiently dry.

15. Acidified foods that rely on acid for safety must be sufficiently acidic (pH≤4.6)

16. Ice that touches food must be food quality.

---

Exemptions

This section applies to most traditional food processors that fall under FDA jurisdiction. However, there are some notable exceptions.

• Farms

• Fishing Vessels

• Establishments who solely hold and transport agricultural products

• Establishments who only raw process (i.e. shell or dry) nuts.

• Mixed-Type farm facilities (defined in §1.227)

This Article is For You if…

∆ Your business is regulated by the FDA

∆ Your business makes, packs, or holds food.

---

More About Operating Requirements

More Posts

---

References

Guide to Current Good Manufacturing Practices (117 Subpart B)

---

Introduction

Great! You have already confirmed that your business is regulated somehow by the FDA. 

The easiest way to understand what regulations apply to your business is to identify what kind of food you make.

Some foods are subject to special requirements. If your business produces one of the food types below, click the link to learn about their special requirements. Otherwise, keep reading

Do you make one of these specially regulated foods?

• Dietary Supplements

• Fish / Fishery Products (Seafood)

• Juice

• Animal Food (Includes pet treats)

• Infant Formula

• Bottled Water

If you make one of these foods, check out our section on Specially Regulated Foods 
Otherwise, your product likely falls under Part 117 (See Below)

---

Part 117 Overview

If you are producing human food, then you are most likely governed under Title 21 -- Chapter 1 -- Subchapter B -- Part 117.  This section contains the majority of requirements for typical food producers.

What You Need To Know To Be FDA Compliant:

Everything a food producer needs to know is located in Subpart B. To find exactly what you're looking for, read the sections below:

Subpart B -- Current Good Manufacturing Practices: This contains Requirements for Facilities, Employees, and Sanitation.
     Guide to Subpart B

Subpart C -- Hazard Analysis and Risk Based Preventive Controls: This section outlines the requirements for a Food Safety Plan and other requirements related to the implementation of preventive controls.
    Guide to Subpart C

Subpart F -- Requirements Relating to Records that Must Be Established and Maintained: This section dictates the record keeping requirements for food businesses. 
     Guide to Subpart F

Subpart G -- Supply-Chain Program: This section outlines the requirement for verifying supplier partners and documenting this process.
Guide to Subpart G

Other Parts of 117:

These sections relate to a minority of food processors. In case you are interested, I have linked them below:

Subpart A -- General Provisions:This section contains definitions, exemptions, and the training requirements for employees working in a food production space.
Source Text: Title 21 -- Chapter 1 -- Subchapter B -- Part 117 -- Subpart A: General Provisions

Subpart D -- Modified Requirements: This section describes modified requirements that apply to Qualified Facilities and Storage Facilities.
Source Text: Title 21 -- Chapter 1 -- Subchapter B -- Part 117 -- Subpart D: Modified Requirements

 Subpart E -- Withdrawal of  a Qualified Facility Exemption: This section describes how a business would transition from being exempt to provisions of the code to non-exempt status. This only applies to businesses who previously but no-longer apply for the Very Small Business Exemption
Source Text: Title 21 -- Chapter 1 -- Subchapter B -- Part 117 -- Subpart E: Withdrawal of a Qualified Facility Exemption

This Article is For You if…

∆ You make or pack food that is consumed in the US.

∆ Your food product enters interstate commerce

More About Operating Requirements

More Posts

---

References

FDA Human Food Regulation (Part 117)

As incubator kitchens (commonly known as "shared-kitchens" or "commissary kitchens") pop up at an unprecedented rate, little attention has been paid to the regulation of these multiple tenant food processing facilities.

In this presentation to the Central Atlantic States Association of Food and Drug Officials, Ned Klein explains the regulatory landscape surrounding this business model and how food businesses and shared kitchen operators alike can protect themselves.

Bottom Line: FSMA has a severe impact on shared kitchens operate. For more about FSMA and food businesses, check out our detailed FSMA Guide

More Posts

Contents

If You Warehouse and Distribute Only Packaged Foods

If You Import Foods

If You Transport Food Yourself or Hire a Carrier

If you warehouse and distribute only enclosed, packaged foods...

Then you are exempt from two major components of FSMA :

• 117 Subpart C which requires you to have a hazard analysis and a food safety plan, and

• 117 Subpart G, which requires you to have a Supply Chain Program.
  

This means you don't need a food safety plan, a recall plan, or a supplier verification plan.

What You Need To To:

Control Food Temperature

If you warehouse/distribute food that is kept refrigerated or frozen, then you must have systems to ensure that proper temperature is being kept at all times. Specifically, you must:

• Establish temperature controls. This means outlining what are safe temperatures for refrigerated and frozen foods in your space and having this information written.

• Regularly monitor temperatures of all of your refrigerated spaces (including vehicles) either manually with a log or through an automatic temperature monitoring system.

• Take corrective action. If there is a temperature deviation that impacts the product, then you must take a corrective action. This means producing a written record showing that you corrected the problem, evaluated the product, and reduced the likelihood that it will recur.

• Verify your temperature controls. You must calibrate your thermometers or check them for accuracy to make sure you're recording information accurately.

• Verify your records. This means a supervisor must review the temperature logs (from your trucks or walk-ins) to make sure there was no deviation from the acceptable temperature ranges. You must also review corrective action records within 7 working days and calibration records within reasonable time.

• Keep Records. You must be able to show that you have records of temperatures records, any corrective actions, and that they have been verified.

---

If you Import Foods From other Countries…

You are most likely required to implement a Foreign Supplier Verification Program (FSVP). Check out our guide to FSVP.

---

If you transport food yourself or hire a carrier to transport it for you…

If you are in any way involved in the transportation of food, then you are subject to the Sanitary Transportation of Human & Animal Food. We let you know exactly what you need to do to comply with that in our guide to Sanitary Transport

This article is for you if…

∆ You are an FDA-regulated food distributor

∆ You are an FDA-regulated food business and you distribute food yourself

∆ You are unsure about what FSMA requirements apply to you.

Find the Right Tools

More About FSMA

---

More Posts

---

Businesses involved in the transportation of food in the US must follow 'Sanitary Transport' rules to ensure the food does not become unsafe during travel.

Contents

Applicability
Exemptions
General Requirements
Specific Requirements
Requirements for Shippers
  Requirements for Loaders
  Requirements for Receivers
  Requirements for Carriers

Applicability

The "Sanitary Transport Rule" applies to nearly every businesses involved the transportation cycle.

To understand the requirements for your business, assess what role(s) your business plays in the transportation process and review the requirements below.

You can click  to see the requirements for that specific role

Carrier: A person who physically moves food by rail or motor vehicle in commerce within the US (excluding parcel delivery services).

Shipper: A person who arranges for the transportation of the food by carriers.

Loader: A person who loads food onto a motor or rail vehicle as part of the transportation operation.

Receiver: a person who receives food in the US, regardless of whether it is the final destination of that food.

Source

---

Exemptions:

The following is a list of exemptions to the Sanitary Transport of Human Food regulations:

Non-Covered Businesses:

Certain small businesses are exempt from this rule. There are two ways to achieve the "non-covered business" exemption:

1. A business that is not a motor vehicle carrier (i.e. doesn't physically transport food themselves) and employs fewer than 500 full time employees.

2. A motor vehicle carrier that is not a shipper (i.e. doesn't arrange for shipping of food by other carriers) and has <$27.5 million in annual receipts.

Other Exemptions

The following operations are exempt from this rule:

• Transportation activities performed by a farm.

• Food that is merely passing through the US on its way to another country.

• The transportation of food that is regulated entirely by the USDA.

• Transportation of the following products:

  • Food gases

  • Food contact substances.

  • Food that is completely enclosed by a container and does not require a temperature control for safety (i.e. a refrigerated food).

  • Live animals, excluding shellfish (they are not exempt)

  • food byproducts that will be used for animal food without further processing.

Waivers

A company may apply for a waiver to waive a specific requirement in this subpart. You can learn more about waivers in 21 CFR §1.914

---

What are the Requirements for Sanitary Transport?

The goal of this regulation is to ensure that food does not become unsafe during transportation. In order to protect food, all parties involved in transportation must adhere to the following general rules. Additionally, there are rules specific to shippers, carriers, loaders and receives, listed below.

General Requirements:

Protect food from contamination from other items in the same load. It's important that food doesn't get contaminated from other food (i.e. raw fish in the same truckload) or non-food (chemicals that are being shipped in the same truckload). Some ways to do this include:

• Segregation - physically separate items that could contaminate one another

• Use of packaging - Use packaging to protect food from contamination

Protect food that is transported in bulk-vehicles or not completely enclosed by a container. For example, if you are shipping a tanker full of milk (bulk-vehicle) or an open truck bed full of corn (no enclosed container) then it must be protected from contamination.

Control the temperature of food that requires it. If a food requires refrigeration or freezing, then this must be maintained during transportation.

If the food is exposed to temperatures that render the food unsafe (i.e. the refrigerator in a truck fails during transport), then the food may not be sold or distributed. However, If a qualified individual (someone with adequate training) determines that the food was not rendered unsafe by this deviation, then the food may be sold and distributed.

Consider the type of food and the stage of production. It's important to understand whether the nature of the food (human food or pet food) when determining how you will keep it safe. Additionally, you should understand the production stage: is the food going to be further processed or is it on it's way to a supermarket?

Food that is going to undergo additional inspections and processing may not need to be transported under as strict conditions than if it is being transported directly to the consumer. For example, The carrier may assess that a truck full of corn can be exposed to a certain amount of dirt during transportation because it is being shipped to a cannery that has agreed to wash it prior to further processing.

Source: CFR §1.908

Specific Requirements:

There are specific requirements for the actors involved in transportation. Note that an entity subject to these requirements may re-assign them in writing to another party.

For example, let's say the shipper is a meal-kit service that delivers meals in individual refrigerated coolers loaded with dry ice. In turn, the shipper doesn't have to pay the expensive cost of refrigerated transportation, since each package is itself refrigerated. Instead, they can ship via a carrier who operates un-refrigerated trucks. Whereas the requirement in this section states that the carrier is responsible for maintaining the proper temperature of the food, they may assign this responsibility to the shipper, who is clearly responsible for making sure each product is packaged with enough ice and in the right container to arrive sufficiently cold.

---

Requirements for Shippers:

A shipper is the person who arranges for the transportation of food by a carrier (who physically transports the food on trucks/rail). The shipper must do the following:

• Inform the carrier of all necessary sanitary specifications required to keep the food safe during transportation. This may be a specific design requirement for a carrier's vehicle or a cleaning procedure required to keep the food safe.

• Inform the carrier of the temperature requirement for the food during transportation. This must be written.

• Implement written procedures that prevent the food from becoming unsafe during transportation. Although the shipper must develop these procedures, they may be enacted by another party during the transportation process (i.e. the carrier), and this must be agreed upon in writing. For example, if the shipper requires the temperature of their product to be taken and recorded every 24 hours throughout transportation, then the carrier and the receiver may complete this task.

• If food is being shipped in bulk (i.e. a tanker full of milk), then the shipper must develop written procedures to make sure the previous cargo doesn't make the food unsafe.

• If the food requires temperature control (i.e. refrigeration) then the shipper must have written procedures to ensure the food is transported under adequate temperature.

Source 21 CFR -- 1.908(b) Requirements applicable to shippers

Record keeping Requirements for Shippers:

Shippers must maintain the following records and provide them to officials upon request. These records (digital or paper) should be kept for at least 12 months beyond their applicability (i.e. 12 months the end of the contract or the discontinuation of a particular activity).

• Records that the shipper provides specifications and operating temps to carriers

• All written procedures and policies

• The assignment of any responsibility to another party

Source 21 CFR -- 1.912

---

Requirements for Loaders:

• Before loading food that isn't enclosed in a container, the loader must determine that the vehicle is appropriate to transport the food safely. This could be a visual inspection to ensure the truck doesn't have pest infestation or filth that would make the food unsafe.

• Before loading the food that requires temperature control, the loader must confirm that the refrigerated area is properly cooled and sufficiently clean to transport the food safely.

  Source 21 CFR -- 1.908(c) Requirements applicable to loaders

Record Keeping Requirements for Loaders:

Loaders must maintain records of any written agreements that assigns tasks required by this regulation. These records (digital or paper) should be kept for at least 12 months beyond their applicability (i.e. 12 months the end of the contract or the discontinuation of a particular activity). These records must be provided to officials upon request.

Requirements for Receivers:

Upon receipt of food requiring temperature controls, the receiver must assess whether the food was subject to temperature abuse (i.e. a safe temperature was not maintained during transport.) This could be achieved by one of the following measures.

• Taking the temperature of the product upon arrival

• Taking the temperature of the vehicle's refrigerated space upon arrival.

• Visually inspecting the food - consider how easy it is to tell if ice cream has melted and been re-frozen.

• Smelling it - products subject to temperature abuse may produce foul odors.

Source 21 CFR -- 1.908(d) Requirements applicable to receivers

Record Keeping Requirements for Receivers:

Receivers must maintain records of any written agreements that assigns tasks required by this regulation. These records (digital or paper) should be kept for at least 12 months beyond their applicability (i.e. 12 months the end of the contract or the discontinuation of a particular activity). These records must be provided to officials upon request.

---

Requirements for Carriers:

• The carrier's equipment/vehicles must meet the shippers specifications for keeping food safe.

• The carrier must demonstrate to the receiver that they maintained the agreed upon temperature conditions during transportation. This could be the product's temperature at loading, unloading and at various intervals during transportation.

• The carrier must pre-cool any refrigerated vehicle before transporting food.

Source 21 CFR -- 1.908(e) Requirements applicable to carriers

Requirements for Carriers who use bulk-vehicles

A bulk-vehicle means food is stored openly in a bulk container, such as a tanker full of milk or a truck bed full of loose ears of corn

• The carrier must be able to provide information to the shipper about the identity of the previous cargo.

• The carrier must be able to provide information to the shipper describing the most recent cleaning of the bulk-vehicle.

Training Records for Carriers

• When a carrier is responsible for sanitary conditions during transportation, they must train their staff to be aware of and address potential problems that may arise.

• Carriers must have records documenting the training that includes: the date of the training, type of training, the persons trained.

Source -- 21 CFR 1.910

Record Keeping Requirements for Carriers:

Carriers must maintain the following records and provide them to officials upon request. These records (digital or paper) should be kept for at least 12 months beyond their applicability (i.e. 12 months the end of the contract or the discontinuation of a particular activity).

• The written procedures for cleaning, sanitizing, and (if applicable) inspecting their equipment/vehicles

• The written procedures for maintaining temperature control.

• The written procedures for maintaining bulk-vehicles.

• Training Records

• Any other written agreements that assigns tasks required by this regulation.

Source -- 21 CFR 1.912

More About Distribution

---

What is FSMA?

The Food Safety Modernization Act was a piece of legislation that went into effect in 2016. It shifted the focus of food safety from responding to foodborne illness outbreaks towards preventing foodborne illness outbreaks. FSMA updates the requirements for many food businesses who fall under FDA Jurisdiction. FSMA has six major sections:

1. Preventive Controls for Human Food (Part 117) - Requires processors of human food to develop risk-based systems focused on food safety through prevention. This includes,

   • Current Good Manufacturing Practices

   • Hazard Analysis and Risk Based Preventive Controls

   • Record Keeping Requirements

   • Supply Chain Program
     

2. Foreign Supplier Verification - Ensures imported food is produced to FDA standards.
   

3. Sanitary Transportation Aims to protect food in transportation
   

4. Intentional Adulteration (Part 121) - Aims to protect from terrorist acts of contaminating the nation's food supply by establishing "Food Defense" requirements.
   

5. Preventive Controls for Animal Food (Part 507) - Requires processors of animal food to develop risk-based systems focused on food safety through prevention.
   

6. Produce Safety (Part 112) - Increases the standards of processing produce.
   

---

What Businesses Does FSMA apply to?

• Human food processors

• Animal food processors

• Food transporters /shippers

• Farms

• Food Importers

• Food Warehouses / Food Storage facilities

When Does FSMA Take Effect?

FSMA is being rolled out over the course of several years. Smaller businesses have been given longer timeframes for compliance. See the image below for compliance dates.

Timeline of FSMA Compliance Dates

Selected FSMA Implementation Dates

Deadline for Preventive Controls for Human Food

• Very Small Businesses (<$1mm sales/Yr) - 9/17/2018

• Small Business (<500 employees) - 9/18/2017

• Large Business (>$1mm sales/yr and >500 employees) - 9/19/2016

Deadline for Intentional Adulteration (Human food):

• Very Small Businesses - July 26, 2021

• Small Businesses - July 27, 2020

• Large Businesses - July 26, 2019

FAQ

What are the FSMA requirements for my business?

All content on this website is FSMA-aligned and all articles have been updated to reflect FSMA provisions. You can learn about the major provisions of FSMA by reading this summary or browse by category to understand the specific requirements for your business.

The requirements imposed by FSMA have also been integrated into the FDA regulations, so feel free to dive into the Code of Federal Regulations and find your answers.

What is the difference between FSMA and the FDA Regulation?

FSMA is a law that was passed by congress. This updated the FDA regulation, which is a set of rules put forth by the FDA. If your business practices are aligned with the latest version of the FDA regulations, then your business is also FSMA aligned

This website is FSMA-aligned so you don't have to worry about additional FDA requirements.

What are the record keeping requirements for FSMA?

The record keeping requirements for FSMA are outlined in our summary of Part 117 Subpart F

What is a PCQI?

A PCQI is a preventive-controls-qualified-individual. This is someone who has been trained in the risk-based practices required by FSMA. There are many PCQI courses available in-person and online.

All businesses except those exempt from Part 117 Subpart C - Hazard Analysis and Risk Based Preventive Controls are required to have a PCQI to do the following:

• Prepare the food safety plan and review as necessary

• Supervise daily production on site.

The PCQI can be a permanent employee for the food processor but is not required to be.

More about FSMA

---

More Posts

What You Need To Know

Contents

What You Need to Know
What You Need to Do
What You Need to Have on File
Summary of Subpart G

• Subpart G describes the requirements for a Supply Chain Program.

• A Supply Chain Program demonstrates that your suppliers are producing their products (typically ingredients and packaging) in a safe manner.

• You must have a Supply Chain Program if your hazard analysis revealed a hazard requiring a supply-chain control.

• You have considerable leeway in how you verify your suppliers but there are some specific requirements (see below).

• You are obligated to document and take prompt action if you learn a supplier is not controlling a hazard as required.

---

Applicability & Exemptions

This section applies to any business whose hazard analysis reveals a hazard requiring a supply-chain-applied control. This means you can't complete your Supply Chain Program until you have completed your hazard analysis.

For Example - Let's say that Ned's Raw Cookies uses pasteurized eggs as an ingredient in their product. Since Ned's Raw Cookies are sold and consumed raw, the company is not controlling for the salmonella hazard that is present in eggs.

In this case, Ned's Raw Cookies would likely rely on a supply-chain-applied control to minimize the salmonella hazard in their product. Ned's Raw Cookies would request documentation from their egg supplier to prove that the supplier is controlling the risk of salmonella. This documentation may be an audit result, a copy of supplier's food safety plan, or sufficient food safety records to show that that hazard has been controlled.

Exemptions:

You are not required to apply a supply-chain-applied-control in the following scenarios:

1. No hazards requiring a supply chain applied control exist

2. Your business (the receiving facility) is able to use a process control to eliminate/minimize the hazard.

3. Your customer provides a written assurance that they must control the hazard.

4. The food produced is not consumed by the public (i.e. it's only for research purposes within the company)

5. The supplier is a "very small business"

---

What You Need to Do:

1. Review your hazard analysis to determine whether there is a hazard which requires a supply-chain-applied control.

2. Determine how you will approve the suppliers of those ingredients/packaging.

3. Request documents from your suppliers (i.e. a recent inspection report or their food safety plan) to demonstrate that they are controlling for that hazard. You may also verify your supplier's product yourself by conducting tests.

4. Review your suppliers' documents and document that you have reviewed them.

5. Only use approved suppliers

---

What You Need to Have on File:

Your supply chain program must be written and contain the following:

• An explanation of how you approve suppliers

• A list of approved suppliers

• A procedure for receiving products (i.e. a receiving SOP)

• Each of the following documents for each supplier (if their ingredient has a hazard which requires a supply-chain control)

  • Documentation of having reviewed the supplier's food safety records.

  • A written inspection report of the supplier by the state, FDA, city, or other agency

• Any records of supplier non-conformance and your response to that (could be a corrective action).

Summary of §117 Subpart G

Below is a summary of Subpart G so that you can get a quick sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.405 (a) (2) then just look up this same code in the CFR.

117.405 Requirement to Establish and Implement a Supply-Chain Program

a. 

1. A facility must establish a risk-based supply-chain program for the ingredients and raw materials that have a hazard requiring a supply-chain-applied control.

2. Importers who conduct foreign-supplier-verification programs don't need to conduct supply-chain-applied controls for those materials whose hazards have been mitigated.

3. Requirements in this part don't apply to food whose use is research or testing. However this food,

i. May not be sold or given to the public

ii. Must be labeled "food for research or evaluation use"

iii. Is supplied in small quantity and disposed of.

iv. Is accompanied with documents stating the food is for research and not for public consumption.

b. The supply-chain program must be written.

c. If the supply-chain-applied control is applied by a 3rd party (i.e. not the receiving facility and not the produce supplier -- let's say it's a 3rd party that washes produce on behalf of a farm who sells it to a food processor), then the receiving facility must:

1. verify the control themselves

2. obtain documentation to verify that the control was applied.

§117.410 General Requirements Applicable to a Supply-Chain Program:

a. The supply-chain program must include:

1. Using approved suppliers (i.e. an approved supplier list)

2. The determination of appropriate supplier verification activities

3. Conducting supplier verification activities

4. Documenting supplier verification activities

5. When applicable, verifying that a supply-chain-applied control was applied by a 3rd party.

b. The following are appropriate supplier verification activities for raw materials and other ingredients:

1. Onsite audits

2. Product sampling

3. Review of suppliers food safety records

c. The supply chain program must provide assurance that a hazard requiring a supply-chain-applied control is minimized or prevented.

d. 

1. In approving suppliers and determining verification activities, you must consider:

i. The nature of the hazard

ii. Who will be applying the controls on behalf of your supplier

iii. Supplier performance, including their history, audit results, test results, etc.

iv. Storage and transportation practices

2. If you are considering the suppliers history, this may be limited if they are a small business, a farm, or a facility that is exempt from some FDA provisions.

e. If you learn that a supplier is not controlling a hazard that you identified must be controlled by the supplier, then you are obligated to document this and take prompt action.

117.415 Responsibilities of the Receiving Facility

a. 

1. the receiving facility must approve suppliers

2. The receiving facility must conduct all supplier verification activities.

3. A 3rd party may do the following on behalf of the receiving party:

i. establish procedures for receiving raw ingredients

ii. Document that written procedures for receiving raw materials are being followed

iii. Determine and conduct supplier verification activities

4. The supplier may conduct product testing themselves and provide this to the facility conducting the supplier verification.

b. A receiving facility may not accept any of the following as a supplier verification activity:

1. Determination by the supplier of appropriate supplier verification activities.

2. An audit conducted by the supplier

3. A review of records by the supplier of the supplier.

c. The receiving facility may accept a 3rd party audit result provided by the supplier.

§117.420 Using Approved Suppliers

a. Approval of Suppliers The receiving facility must approve suppliers and document it before receiving ingredients from them.

b. Written procedures for receiving raw materials and other ingredients 

1. You must write and implement procedures for receiving products (i.e. a receiving SOP)

2. Your written procedures must ensure that ingredients are only received from approved suppliers

3. The use of these written procedures must be documented (i.e. you must have a receiving log to show that you are following your written receiving procedure)

§117.430 Conducting Supplier Verification Activities for Raw Materials and Other Ingredients

a. You must conduct supplier verification activities before using the supplier.

b.

1. When a hazard in a raw material will be controlled by the supplier and the outcome of exposure to the hazard results in a serious injury or death, then:

i. the appropriate supplier verification activity is an onsite audit

ii. the audit must be conducted before that raw material is supplied and at least annually thereafter.

2. The requirements above (b) (1) don't apply if other verification activities can provide assurance that this hazard is controlled.

c. If the supplier is a qualified facility, the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the quality facility exemption for their supplier.

2. The receiving facility must get written assurance every 2 years that the supplier is compliant with FDA regulations or the equivalent. This must include

i. description of the preventive controls in place used to control hazards.

ii. Statement that the facility is in compliance with all applicable laws.

d. If the supplier is a farm that grows produce not covered under 112 (FDA produce standards), the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the supplier's exemption from part 112 for their supplier.

2. Obtains written assurance that acknowledges that the food is subject to FDA regulations

e. If the supplier is a shell egg producer not subject to requirements of part 118 (FDA Shell Egg Standards) because they have fewer than 3,000 laying hens, the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the exemption from part 118 for their supplier, because the supplier has fewer than 3000 laying hens.

2. Obtains written assurance that acknowledges that the food is subject to FDA regulations

f. There must not be any financial conflicts of interests related to verification (i.e. payments to a company performing supplier verification cannot be related to the results of the activity).

§117.435 Onsite Audit

a. An onsite audit must be performed by a qualified auditor

b. The auditor must consider all regulations to which a supplier is subject. The audit must include a review of food safety plan/HACCP plan.

c.

1. The following may be substituted for an onsite audit:

i. Inspection results from the FDA, State, or local agency.

ii. Inspection results from an overseas FDA equivalent.

2. If the inspection is from a foreign authority recognized as equivalent to the FDA, then the food produced by the supplier must fall within the scope of that recognized authority.

§117.475 Records Documenting the Supply Chain Program

a. Records related to supply-chain program are subject to requirements of Subpart F

b. The receiving facility must review the supplier records below in part (c) in the same manner that they would complete their own record verification (as defined in §117.465)

c. The facility must document the following records in their supply-chain program

1. Written supply chain program

2. Documentation that an importer is in compliance with the supply chain verification program requirements.

3. Documentation of the approval of that supplier

4. Written procedures for receiving raw materials and ingredients.

5. Documentation demonstrating the use of written procedures for receiving raw ingredients (This could be a receiving log)

6. Documentation of the approval of the supplier

7. Documentation of an onsite audit, including:

i. the name of the supplier being audited

ii. documentation of audit procedures

iii. dates of the audit

iv. conclusion of the audit

v. corrective actions to be taken in response to deficiencies found in the audit.

vi. documentation that the audit was conductected by a qualified auditor

8. Documentation of sampling and testing (if conducted as part of supplier verification) 

i. Identification of ingredient tested, number of samples tested.

ii. Identification of test conducted including the analytical methods.

iii. Dates of the tests

iv. Test results

v. Corrective actions taken in response to the testing

vi. Information identifying the lab conducting testing

9. Documentation of the review of the supplier's relevant food safety records.

i. The name of the supplier

ii. Dates of the record review

iii. General nature of the records review

iv. Conclusions of the review

v. Corrective actions taken in response to deficiencies found.

10. Documentation of other supplier verification activities conducted.

11. Documentation of the determination that verification activities conducted in lieu of an onsite audit are sufficient in the case that the hazard controlled by the supplier is one that could cause serious health consequences or death. You must provide adequate assurance that the supplier is controlling those hazards.

12. Documentation of an alternative verification activity if the supplier is a qualified facility.

13. Documentation of an alternative verification activity if the supplier is a farm.

14. Documentation of an alternative verification activity if the supplier is a shell egg producer.

15. The written results of an inspection of the supplier

16. Documentation of actions taken with respect to non conformance.

17. Documentation of mitigation of a hazard, if that control is applied by a 3rd party.

18. When applicable, documentation about the 3rd party and their verification activities.

This article is for you if…

∆ You are an FDA-regulated food business

∆ You purchase packaging/ingredients from one or more suppliers

∆ You are not defined as a very small business

---

---

Resources

FDA Regulation: Part 117 Subpart G - Supply Chain

---

More Regulation Guides

---

More Posts

---

What You Need to Know

• Records can be electronic or paper.

• They must have:

  • Plant name / address

  • The date/time

  • Product name

  • Signature/initials

  • Actual information/observations not summaries

• You must store records onsite for at least 2 years

• You must be able to retrieve records within 24 hours.

• All records must be made available upon request
  

All of our food safety plan templates are aligned with this section.

Summary of Subpart F: Record Keeping

Below is a summary of Subpart F so that you can get a deeper sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.305 (f) (2) then just look up this same code in the CFR.

§117.301 Records Subject to the Requirements of this Subpart

This section quickly states two points, neither of which are terribly important:

1. Only the food safety plan must be dated and signed when created and updated.

2. If a business is applying for a small business exemption (aka "Qualified Facility exemption") the standards for those records is less than what is described in this section.

§117.305 General Requirements Applying to Record

Records must:

a. Be kept as originals, true copies (i.e. scans, photocopies) or electronic records.

b. Contain the actual values and observations, not summaries.

c. Be accurate, unchangeable and legible

d. be created in real-time with the activity being documented.

e. Be as detailed as necessary

f. Include:

1. information about the plant identity

2. The date (and time, if necessary)

3. Signature or initials of the observer

4. Product name and lot code, if applicable

g. Electronic records required by other regulations may be subject to the requirements in Part 11 (This is the FDA section about electronic records, it unlikely applies to your business if you are following this statute)

§117.310 Additional Requirements Applying to the Food Safety Plan

The owner or operator of the plant must sign and date the food safety plan when it is first authored and whenever it is modified.

§117.315 Requirements for Record Retention:

a.

1. All records must be retained onsite for 2 years

2. A qualified facility must retain records attesting to their exempt status.

a. Small businesses operating under a Qualified Facility exemption must retain records to support that they apply for the exemption (typically 3 years of records)

b. Records that relate to equipment or processes that are no longer used must be retained for 2 years after their discontinuation.

c. You may store records offsite (not food safety plan) if you can retrieve them within 24 hours.

d. You can store a food safety plan offsite if the plant is closed

§117.320 Requirements for Official Review

All records must be made available upon request

§117.325 Public Disclosure

Your records may be disclosed by the FDA in accordance with Chapter 20 of the CFR

§117.330 Use of Existing Records

a. Existing records used for other purposes don't have to be duplicated to satisfy these requirements.

b. The records don't have to be kept in one set.

§117.335 Special Requirements Applicable to a Written Assurance

Any written assurance (which is required by other parts of the code) must contain the date and the names/signatures of the officials making the attestation.

Part 117 -- Subpart F: Requirements Applying to Records That Must Be Established and Maintained

Resources

FDA Regulations: Part 117 -- Subpart F (Record Keeping)

More About Food Safety Plans

---

More Posts

This is a regulation summary For a more general guide to Food Safety Plans, start here

What You Need to Know:

This section outlines the pre-requisite for a food safety plan and associated operational and documentation requirements.

Summary of Subpart C: Hazard Analysis and Risk-Based Preventive Controls

Below is a summary of Subpart C so that you can get a quick sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.126 (a) (2) then just look up this same code in the CFR.

---

§117.126 Food Safety Plan

a. Requirement for a food safety plan:

1. You must have a written and implemented food safety plan

2. It must be prepared or overseen by a Preventive Controls Qualified Individual

b. Contents of a food safety plan

It must include the following, in writing:

1. A hazard analysis

2. Preventive controls (if you identified a hazard in your hazard analysis that you deem requires a preventive control)

3. Supply chain program

4. Recall plan

5. Procedures for monitoring your preventive controls

6. Corrective Action Procedures

7. Verification procedures

c. Records: The records generated are subject to regulations under Subpart F. (i.e. you must store them either in print or electronically)

§117.130 Hazard Analysis

a. Requirement for a hazard analysis:

1. You must conduct a hazard analysis for each type of food manufactured, processed, packed, or held at your facility.

2. The hazard analysis must be written.

b. Hazard Identification: This must consider

1. known or reasonable hazards, including:

i. Biological Hazards (bacteria, parasites, etc.)

ii. Chemical hazards (i.e. toxins, pesticides, food allergens)

iii. Physical hazards (i.e. stone, glass, metal fragments)

2. Hazards that could be present in the food because:

i. the hazard occurs naturally (i.e. toxins in fish)

ii. The hazard may be accidentally introduced (jewelry from employee falls into food)

iii. The hazard may be introduced intentionally for economic gain (i.e. sabotage by a competitor)

c. Hazard Evaluation: 

i. the hazard analysis must evaluate the hazards identified to assess the severity of illness or injury that would occur and the probability that it would occur if left unaddressed.

ii. The hazard evaluation must consider environmental pathogens whenever a ready-to-eat (RTE) food is exposed to the environment before packaging.

2. The hazard analysis must consider these effects on the food:

i. formulation of the food

ii. condition and design of the facility

iii. Raw materials and other ingredients

iv. Transportation practices

v. Processing procedures

vi. Packaging and labeling activities

vii. Storage and distribution

viii. intended use of the product

ix. Sanitation, including employee hygiene

x. any other relevant factors (i.e. weather, natural toxins)

§117.135 Preventive Controls

a.

1. You must identify and implement preventive controls when required by your hazard analysis.

2. Preventive controls include: Critical Control Points and other controls.

b. Preventive controls must be written

c. Preventive controls include:

1. Process Controls: These are procedures and processes that are used to control parameters of processing (i.e. acidifying, refrigerating, cooking.) They must be written in a way that is specific to your process and they must include:

i. parameters associated with controlling the hazard (i.e. if you are using cooking as a process control, then you must include the required cook temperature and cook time)

ii. The maximum or minimum values required to control the hazard.

2. Food Allergen Controls include processes to control food allergens. These are implemented to:

i. Protect food from allergen cross contact

ii. Label food properly with allergens to ensure it isn't misbranded

3. Sanitation Controls: Practices to ensure the facility is kept clean and to minimize biological hazards. These relate to:

i. Cleanliness of food-contact surfaces (equipment, utensils, tables)

ii. Prevention of contamination of food from dirty sources (i.e. dirty people, dirty food, dirty packaging, dirty raw ingredients)

4. Supply Chain Controls: This is described fully in Part G

5. Recall Plan: You are required to have a recall plan (see below)

6. Other Controls: You may have other types of controls (i.e. hygiene training and current good manufacturing practices)

---

§117.136 Circumstances in which preventive controls are not required

a. Circumstances You aren't required to implement preventive controls if any of the following apply:

1. The food cannot be consumed without application of an appropriate control (i.e. coffee beans cannot be consumed without pouring boiling water on them, which would kill any bacteria on the bean)

2. You rely on your customer, who is subject to this subpart, to ensure that the hazard is mitigated. You must:

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that the customer is following the procedures you have provided, which will eliminate the hazard.

3. You rely on the customer who is not subject to this subpart to eliminate the hazard. You must:

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that the customer is following the procedures you have provided, which will eliminate the hazard.

4. You rely on the customer to provide assurance that the food will be processed to control the hazard by a subsequent entity in the supply chain

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that your customer will:

A. Disclose in documents accompanying the food that it is "not processed to control [identify hazard]"

B. Will only sell to another entity that agrees in writing that it will mitigate the hazard and obtain similar written assurance from subsequent customers.

5. You have established and implemented a system that ensures control of the hazards in your product, at the distribution step.

b. Records: You must document any circumstance (related to a., above) that applies to you, including written assurances from customers.

---

§117.139 Recall Plan

If your food has a hazard that requires a preventive control,

a. You  must establish a written recall plan.

b. The recall plan must include a procedure for a recall scenario and assign responsibility for taking those steps. It must address how to:

1. Directly notify recipients of the product being recalled and how to dispose of/return the food.

2. Notify the public about any hazard in the food, when this is required to protect public health.

3. Conduct effectiveness checks to verify the recall is carried out.

4. Dispose of recalled food.

---

§117.140 Preventive Control Management Components

a. You must conduct the following activities for each of your preventive controls:

1. monitoring activities

2. corrective actions

3. verification activities

b. You must conduct the following activities for your supply-chain program:

1. corrective actions, especially related to supplier non-conformance.

2. Review of records

3. Re-analysis of your supply chain program over time and as it changes.

c. You do not need to conduct the following activities for your recall plan: monitoring, corrective actions, verification activities.

---

§117.145 Monitoring

as appropriate to the nature of the preventive control, you must implement

a. Written Procedures: You must have written procedures for how and how often you will monitor preventive controls.

b. Monitoring: You must monitor preventive controls enough to ensure they are being peformed.

c. Records: 

1. You must document your monitoring actions and verify this (see §117.165)

2. Exception Records: You can use exception records (i.e. the record only shows when a deviation occured.) For example, a log monitoring refrigeration may only show records when the temperature is unacceptable

---

§117.159 Corrective Actions and Corrections

a. Corrective Action Procedures: 

1. You must establish and implement written corrective action procedures. They must address:

i. the presence of a pathogen in a ready-to-eat product

ii. the presence of an environmental pathogen detected.

2. Corrective Action Procedures must describe the steps to be taken to ensure that:

i. appropriate action is taken to correct a problem associated with a preventive control.

ii. Appropriate action is taken to reduce the likelihood that the problem will recur.

iii. All affected food is evaluated for safety

iv. All affected food is prevented from entering commerce.

b. Corrective Action in the Event of an unanticipated food safety problem:

1. You must follow the procedure in (b)(2) if

i. a preventive control fails and a corrective action hasn't been established.

ii. a preventive control is found to be ineffective

iii. Verification records are found to be incomplete or improper decisions were made about corrective action

2. If any of the circumstances above in (b) (1) apply, you must:

i. Take corrective action, Ensure it doesn't happen again, re-evaluate all food for safety.

ii. reanalyze your food safety plan to see if changes are required.

c. Corrections: You don't need to follow sections (a) and (b) above if

1. You take action to correct a minor and isolated problem, insofar as these are not related to allergen controls or sanitation controls.

2. You take action in a timely manner to correct a minor and isolated problem insofar as it doesn't directly impact product safety

d. Records: All corrective actions taken in this section must be documented. Corrective actions must also be verified according to §117.155

---

§117.155 Verification

Note: The Verification process is one that verifies various other parts of the plans have been undertaken as specified. This can take the form of a supervisor regularly reviewing records and verifying them with a signature.

a. Verification Activities: As it relates to a preventive control, you must verify

1. That the preventive control is valid

2. that monitoring is being conducted as required.

3. that appropriate decisions are being made in relation to corrective action.

4. that the preventive control is implemented and effective.

5. the reanalysis of your preventive controls (as your process changes or at minimum every 3 years)

b. Documentation: All verification activities must be documented in records.

§117.160 Validation

a. You must validate that the preventive controls implemented actually work.

b. Your validation must:

1. Be performed by a Preventive Controls Qualified Individual (PCQI)

i. Within 90 days of beginning production or there must be written justification for why if  >90 days after production begins.

ii. Whenever a change is made that could impact how a hazard is controlled.

iii. Whenever the food safety plan is reanalyzed.

2. Must include scientific and technical evidence (or conducting your own studies) to determine whether preventive controls will control the hazards.

c. You do not need to validate:

1. Food allergen controls

2. Sanitation controls

3. Recall plan

4. Supply chain program

5. Other preventive controls if the PCQI prepares the written justification that a validation is not applicable based the nature of the hazard and the preventive control.

---

§117.165 Verification of Implementation and Effectiveness

a. Verification Activities: You must verify that preventive controls are consistently implemented and effective. This includes doing the following:

1. Calibrating instruments for accuracy

2. Product testing

3. Environmental monitoring

4. Review of records to ensure they are complete and activities were performed according to the plan

i. Records of monitoring and corrective action must occur within 7 days (or provide a written justification for why not)

ii. Other records (calibration, supplier, product testing) must occur in a reasonable amount of time.

b. Written Procedures: The following activities must be written:

1. The method and frequency of calibrating tools

2. Product testing. These procedures must be scientifically valid, they must identify the tests conducted, the methods used, the pathogens, the laboratory conducting the testing, and the corrective action procedures.

3. Environmental monitoring must be: scientifically valid, identify the locations and sites to be tested, the timing and frequency of these samplings, the tests conducted and methods used, the laboratory, and the corrective action procedures.

---

§117.170 Reanalysis

a. You must reanalyze your food safety plan every 3 years.

b. You must reanalyze your plan whenever:

1. A change creates a new hazard or increases an existing hazard

2. Whenever you become aware of a new hazard

3. Whenever appropriate after an unanticipated food safety problem.

4. When you find a part of your plan or a preventive control is ineffective

c. You must complete the reanalysis

1. before any changes in activities OR

2. Within 90 days of the beginning of production for a new product (or >90 days if written justification is provided)

d.  You must also document the basis for the conclusion that no revisions are required.

e. A preventive controls qualified individual must oversee this reanalysis.

f. You must conduct a reanalysis when the FDA determines necessary and when there are new developments in scientific understandings.

---

§117.180 Requirements Applicable to a Preventive Control Qualified Individual and a Qualified Auditor

a. One or more PQCI must do or oversee the following:

1. preparation of the food safety plan

2. validation of the preventive controls

3. written justification for >90 day time frame for validation

4. Determination that validation is not necessary.

5. Review of records

6. Written justification for exceeding 7 day time frame for reviewing records.

7. reanalysis of food safety plan

8. determination that reanalysis can be completed in a time frame that >90 days of the production of the new food being produced.

b. A qualified auditor must consult an onsite audit:

c. 

1. To be a PCQI, one must have completed training equivalent to that developed by the FDA or be qualified through job experience. This individual may or may not be an employee of the facility.

2. To be a qualified auditor requires technical expertise achieved through training, education, or experience.

d. All training in the development and applications of preventive controls must be documented in records.

---

§117.190 Implementation Records Required for this Subpart

a. You must establish records regarding the implementation of a food safety plan, including:

1. Documentation for not establishing a preventive control (you can do this in the hazard analysis using our template)

2. Records documenting the monitoring of preventive controls

3. Records documenting corrective actions

4. Records that document verification, as related to

i. Validation

ii. Verification of monitoring

iii. Verification of corrective actions

iv. Calibration of process monitoring and verification instruments

v. Product testing

vi. Environmental monitoring

vii. Records review

5. Records documenting the supply chain program

6. Records documenting training for the Preventive Conrols Qualified Individual and qualified auditor.

b. These records are subject to requirements in subpart F.

---

This Article Is For You If…

∆ You manage a facility that makes, holds, or packs food.

∆ You are subject to Part 117 Subpart C (very small businesses are exempt from this requirement)

More About Food Safety Plans

More Posts

Resources

FDA Regulation Title 21 — Part 117 — Subpart C Hazard Analysis and Risk-Based Preventive Controls

What You Need to Know:

• "Intentional Adulteration" refers to the risk of someone deliberately contaminating a food product with aim of causing harm.

• The Intentional Adulteration Rule was implemented to address bio-terrorism threats committed against food companies to contaminate the US food supply.

• It applies to some, but not all food businesses (see "Applicability" below)

• You can fulfill the requirements for a Food Defense Plan using our template

Applicability:

Does the Final Rule on Intentional Adulteration Apply to you?

If you are a business under FDA regulation with >$10m/year in sales, then you most likely are required to comply with the Intentional Adulteration Rule.

Check the exemptions below and, if they do not apply to your businesses, see "What You Need to Do?"

Exemptions from the Intentional Adulteration Rule:

See if one of the following exemptions applies to your business or check out the applicability flowchart below

---

Does the Intentional Adulteration Rule Apply to My Business?

• Food businesses that are not regulated by the FDA and aren't required to register as a food facility.

• Small food businesses that produce, distribute, or hold less than $10 million dollars in product retail value per year, averaged over the last 3 years.

• Food businesses that exclusively produce one of the following:

  • Licensed alcoholic beverage producers

  • Animal-food producers

  • Food which is packed, re-packed, or re-labeled food in a way that the container around the food remains intact.

  • Food businesses that only hold food, such as a distributor (unless the food is held in large liquid storage tanks).

  • Certain foods packaged on farms (See 21 CFR 121.5)

The FDA offers a flow chart to determine if the Rule on Intentional Adulteration applies to your food business.

Compliance Timeline:

View fullsize

Large Businesses (>500 Employees): July 26th, 2019

Small Businesses (< 500 employees): July 27th, 2020

---

What You Need To Do:

Access our Free Food Defense Plan Template

If you are required to follow the Intentional Adulteration Rule, then you must develop a Food Defense Plan. This plan documents that you have developed and implemented the following activities:

1. Conduct a "vulnerability assessment" to identify where your business is vulnerable

2. Develop "mitigation strategies" for addressing food defense threats.

3. Monitor your mitigation activities to make sure they're working

4. Develop corrective actions for when things go wrong

5. Conduct verification checks

6. Maintain records

7. Re-analyze your food defense as necessary

1. Conduct A Vulnerability Assessment

This is a written assessment of what areas your facility and product might be at risk to a threat of intentional adulteration. You should evaluate the following:

• The potential impact if your product was contaminated

• The degree of access available to your product

• The ability of an attacker to contaminate your product

• The possibility of an inside attacker.

The easiest way to conduct a vulnerability assessment, is to use our Food Defense Plan Template and modify it to suit your business' needs.

Source 21 CFR 121.130

2. Develop Mitigation Strategies

If you identify a vulnerability in your business, then you must address it. Your mitigation strategies could include:

• Upgrading security around your facility (i.e. adding fencing, upgrading locks, reducing access)

• Developing a way to record and manage visitors in your facility.

• Minimizing access to sensitive areas to only the people who require that access.

• Changing how you store in-process product

• Upgrading your packaging to minimize opportunity for contamination.

This section must include a written explanation of how your strategy specifically minimizes the risk(s) that you identified in your vulnerability assessment.

3. Monitor Your Mitigation Strategies

You must monitor your food defense efforts to verify that they're effective.

Some of your mitigation strategies may be a simple structural fix (i.e. fencing the facility grounds) while others may require ongoing management (implementing a visitor-access policy).

The strategies that require ongoing maintenance should be monitored to ensure that they are effective. For example, if you implement a visitor-access policy for your facility, then a supervisor should occasionally monitor that guests are wearing the required badge and that the sign-in document that you developed is actually being used.

How often must I monitor my mitigation strategies?

This is your choice. You should monitor your practices which support food defense enough to ensure that they're being performed effectively.

Do I need to keep records of my monitoring?

Yes. All of your monitoring efforts should be recorded. You can do this by keeping "exception records" where the only records kept are to document when the strategy is not working.

4. Develop Corrective Actions For When Things Go Wrong

You must have written corrective action procedures that will guide you in what to do if one of your mitigation strategies fails.

For example, let's pretend your visitor-access policy requires all guests to be checked-in and wear a badge in the processing space. When you develop that food defense strategy, you should also create a corrective-action to answer the question "What do we do if there is an unauthorized person in the production space?". Your corrective action could be registering the visitor and reviewing security footage prior to releasing the product that was being processed.

If something goes wrong in your food defense procedures, you must document that a corrective action was taken and how the problem was solved. Store this in your records.

Additionally, if take a corrective action to address a failure then you must also take action to ensure that the same failure does not recur.

5. Conduct Verification Checks

You must conduct verification activities to confirm that your mitigation strategies are being carried out effectively. This is a "double check" to make sure everything is happening according to plan.

Specifically, you must verify that monitoring is effective and that your corrective actions were taken appropriately. This verification can take the form of a manager reviewing the records that were taken during a given time-period and signing off on them.

A manager may conduct verification on the facility's visitor-access policy by reviewing the visitor registration sheet each week to ensure that it is being used.

How often must I conduct verification checks?

This is up to you. Verification should occur often enough that you can make adjustments if something is found to be wrong. For example, records are typically verified before the relevant product leaves the facility. This way, the product can be inspected or reconsidered if the verification reveals something improper occurred.

Do verification activities need to be written?

Yes. However, it does not need to be a separate form. A manager can verify a document by signature and date showing that the document was reviewed and that verification occurred.

6. Keep Records

Your Food Defense Plan must be written and on file. Additionally, you should keep records of the following for at least 2 years:

• Monitoring records

• Corrective Action records

• Verification Records

• Any documents related to the food defense plan

• When your food defense plan was changed or updated

Your records should meet the requirements outlined in Part 117 Subpart F: Record keeping

7. Reanalyze Your Food Defense As Necessary

You must reanalyze your food safety plan:

• Every 3 years at minimum

• Whenever a change is made that might expose a new vulnerability or increase your risk of intentional adulteration.

• If the FDA identifies new vulnerabilities that they deem relevant to your business.

If your business makes a change that requires an adjustment to your food safety plan, you have 90 days to update your plan and implement the new strategies.

---

This article applies to you if…

∆ Your business produces, packs, or holds food under FDA regulation.

∆ Your business conducts >$10mm sales per year.

---

Table of Contents

What You Need to Know

Does the Intentional Adulteration Rule Apply to Me?

What You Need to Do

---

Resources

FDA Regulation: Mitigation Strategies to Prevent Food Against Intentional Adulteration"

More About FSMA

---

More Posts

---