FSMA Preventive Controls for Human Food: Complete Guide

What Is the Preventive Controls Rule?

The Preventive Controls for Human Food rule is one of the foundational rules of FSMA. It modernized the food safety framework by shifting from reactive response to proactive prevention. The rule requires food facilities to identify potential hazards, implement controls to prevent those hazards, monitor the effectiveness of controls, and take corrective actions when controls fail.

The rule became effective in September 2016 for large facilities, with staggered compliance dates for smaller businesses. As of today, all covered facilities must be in full compliance. For the official rule text, see 21 CFR Part 117 on eCFR.

Who Must Comply?

The Preventive Controls rule applies to facilities that are required to register with FDA under 21 CFR Part 1. This includes most domestic and foreign food manufacturing, processing, packing, and holding facilities.

Exemptions and Modified Requirements

• Very small businesses: Facilities with less than $1 million in annual food sales have modified requirements (must identify hazards and implement preventive controls but have simplified documentation requirements)
• Facilities subject to other FSMA rules: Farms subject to the Produce Safety rule, facilities subject to LACF regulations, and juice/seafood HACCP facilities have separate requirements
• Qualified facilities: Facilities with less than $1 million in food sales and that sell primarily to consumers or retailers within the same state have modified requirements
• Alcoholic beverage facilities: Certain exemptions apply to facilities that manufacture alcoholic beverages

The Food Safety Plan

The Food Safety Plan is the central document of your preventive controls program. It must include:

• Hazard analysis: Written analysis identifying known or reasonably foreseeable hazards
• Preventive controls: Controls to significantly minimize or prevent identified hazards
• Monitoring procedures: Written procedures for monitoring preventive controls
• Corrective actions: Written procedures for corrective actions when controls fail
• Verification procedures: Activities to verify that preventive controls are effective
• Recall plan: Written recall procedures for products that may be unsafe
• Supply chain program: Controls for hazards requiring supply chain oversight

Hazard Analysis

The hazard analysis identifies hazards that are known or reasonably foreseeable for each food type. It must consider:

• Biological hazards (pathogens, parasites, environmental organisms)
• Chemical hazards (allergens, drug residues, mycotoxins, radiological hazards)
• Physical hazards (foreign material contamination)
• Hazards introduced intentionally for purposes of economic gain (economically motivated adulteration)

For each identified hazard, evaluate the severity of the illness or injury and the probability of occurrence. Determine whether the hazard requires a preventive control.

Types of Preventive Controls

Supply Chain Controls

When you identify a hazard requiring a preventive control and that control is applied by your supplier rather than at your facility, you must implement a supply chain program that includes:

• Approved supplier program with documented approval procedures
• Written procedures for receiving raw materials and ingredients
• Verification activities for each supplier (audits, testing, or record review)
• Corrective action procedures when a supplier fails to meet requirements

Monitoring, Corrective Actions, and Verification

Monitoring

Each preventive control must have written monitoring procedures that specify what is monitored, how it is monitored, how frequently, and who is responsible.

Corrective Actions

Written corrective action procedures must address what to do when monitoring indicates a preventive control is not properly implemented, including product disposition, root cause analysis, and steps to prevent recurrence.

Verification

Verification activities confirm that preventive controls are consistently implemented and effective. This includes validation that controls are capable of controlling identified hazards, calibration of monitoring instruments, review of monitoring and corrective action records, and product testing where appropriate.

PCQI Requirements

A Preventive Controls Qualified Individual (PCQI) is a person who has successfully completed training equivalent to the FDA-recognized PCQI standardized curriculum, or who is otherwise qualified through job experience to develop and apply a food safety system. The PCQI must:

• Prepare or oversee the preparation of the Food Safety Plan
• Validate that preventive controls are adequate
• Review records to ensure the plan is properly implemented
• Reanalyze the Food Safety Plan at least every three years or when changes occur

Record-Keeping

Comprehensive records are required and must be maintained for at least two years:

• The written Food Safety Plan (including hazard analysis and preventive controls)
• Monitoring records for each preventive control
• Corrective action records
• Verification records (validation, calibration, record review)
• Supply chain program records
• Training records for the PCQI and other qualified individuals

How Assurentry Can Help

Assurentry provides comprehensive FSMA Preventive Controls compliance support:

• Food facility registration: Ensuring your FDA registration is current
• Food Safety Plan development: PCQI-certified experts develop plans tailored to your operations
• FSVP integration: Coordinating preventive controls with import compliance requirements
• Inspection readiness: Preparing your facility and documentation for FDA inspections