Guides
FSMA preventive controls for small specialty food manufacturers: a plain-English checklist
FSMA preventive controls small manufacturers face under 21 CFR 117, explained plainly: who needs a food safety plan, who signs it, and what happens if you skip it.
What to take away
- The FSMA preventive controls rule reaches small manufacturers too: if you register your facility with the FDA under 21 CFR 117, you must have a written food safety plan prepared or overseen by a preventive controls qualified individual (PCQI).
- The plan needs a hazard analysis, preventive controls, monitoring, corrective actions, verification and a recall plan. Records must be kept.
- Very small businesses get a longer compliance timeline and modified requirements, but the plan itself does not disappear.
- Skipping it is not a paperwork problem. FDA can suspend your facility registration, which stops you shipping interstate until it is reinstated.
- Your state health department inspects too, and a state inspector can flag the same gaps.
Who has jurisdiction
The FDA sets the rule. 21 CFR 117 is the code that carries it, and the agency's own summary of the FSMA final rule on preventive controls for human food explains the scope. A facility that manufactures, processes, packs or holds food for US consumption generally must register with FDA and operate under these controls.
Registration is not the same as a license. It is a listing, and it is the trigger for the whole rule. Filings go through FDA's Unified Registration Listing System (FURLS). If you batch jam in a rented commercial kitchen and sell across state lines, you are likely in scope. Our guide to FDA facility registration walks through the filing step by step.
States run their own inspections under contract with FDA. So a California or Texas inspector may ask for the same plan, and a state finding can escalate to the federal agency. Cottage food operations selling only in-state are the usual exception, and the California cottage food rules show how one state draws that line.
The preventive controls checklist
Under 21 CFR 117, a food safety plan is built in a fixed order. Work down this list, and keep the record that backs up each item.
1. Hazard analysis
- Identify every known or reasonably foreseeable biological, chemical (including radiological) and physical hazard for each ingredient, each process step and the finished food
- Evaluate each hazard, and decide whether it needs a preventive control
2. Preventive controls
The plan must include a written recall plan. It must also include the specific controls the hazard analysis calls for:
- Process controlsthe step that controls the hazard, with its critical limits (a thermal process, or a limit on water activity or pH)
- Allergen controlsprocedures that prevent cross-contact and make sure allergens are declared correctly on the label
- Sanitation controlscleaning and sanitizing of food-contact surfaces, and the steps that stop cross-contamination
- Supply-chain programapproving your suppliers and verifying that the controls they apply are working
3. Monitoring
- Written monitoring procedures for each preventive controlwhat you check, how, how often, and who does it
- A signed, dated record of every check
4. Corrective actions
- What you do when monitoring shows a deviationcorrect the problem, evaluate the affected food, and keep it out of commerce when needed
- A record of the action and of its cause
5. Verification and validation
- Validationevidence that the controls, as designed and run, will control the hazard
- Verificationcalibration, product testing, record review, and confirmation that suppliers are doing their part
- Reanalysis of the plan whenever a recipe, a supplier or a process changes
6. Records
- The written plan and the hazard analysis
- Monitoring, corrective action and verification records
- The PCQI's training records
- All of it kept at the facility, dated and signed
7. Steps to get there
- Register the facility with FDA, and name a PCQI
- Run the hazard analysis, then write the plan around it
- Put monitoring and corrective actions into the daily routine
- Verify, validate and sign off
- Reanalyze when anything changes, and on the cycle the rule requires
What a home operation may and may not do
Cottage food laws are state law, not FDA law. They typically allow low-risk, non-potentially-hazardous items sold direct to consumers, often with a cap on annual sales. They do not cover interstate sales.
Once you cross a state line, or move into a category the state excludes, you need a registered facility and a food safety plan. Acidified foods carry their own layer: 21 CFR 114 requires a scheduled process and filing for those products.
A home kitchen generally cannot be a registered commercial facility. The practical test is whether the space is used for residential purposes. If it is, you are outside the rule's allowance, whatever your local inspector tolerates.
What a compliant label carries
Labeling is separate from the safety plan and is checked at retail. A compliant US label for a packaged food carries the statement of identity, net quantity of contents, ingredient list, allergen declaration, name and place of business, and nutrition information where required.
- Statement of identity in the required format
- Net quantity in both metric and US customary units
- Ingredients in descending order by weight
- Allergens declared per the major eight
- Name and place of business of the manufacturer or distributor
The FDA's food labeling and nutrition pages are the primary source for each element. Allergen and nutrition specifics are covered in more depth in our piece on nutrition labelling and allergen rules.
The preventive controls qualified individual
Someone must prepare or oversee the plan, and that person must be a PCQI. The FDA describes the training expectations on its FSMA training page. The course most small makers take is the FSPCA Preventive Controls for Human Food course from the Food Safety Preventive Controls Alliance; it is the standardized curriculum, and it typically runs two to three days.
You do not need a degree. You need documented training or equivalent job experience. Many small makers send one employee and keep the certificate on file. The PCQI signs off on the hazard analysis and on the corrective actions when something drifts.
The plan is a living document. If you change a recipe, a supplier or a process, the hazard analysis may need to change with it.
Records to keep
Monitoring records, corrective action records, verification records and calibration records are all part of the file. Under 21 CFR 117.315, required records stay at the facility for at least two years after they are prepared, and the food safety plan itself stays on file for two years after it is no longer in use.
A small maker can keep this in a binder. What matters is that the records are real, dated and signed. An inspector who finds blank monitoring logs treats that as a serious finding, not a clerical one.
What happens if you skip it
The concrete consequence is registration suspension. Under FSMA, FDA can suspend a facility's registration when it determines food manufactured there is adulterated or misbranded and could cause serious harm. A suspended registration means the facility may not introduce food into interstate commerce.
In practice that stops shipments. Distributors will not take product from a suspended facility, and retailers will pull it. A recall tied to an outbreak, which the FDA tracks on its outbreak page, can cost far more than the plan would have.
State inspectors can also issue stop-sale orders. Either path shuts the business down until the gap is fixed and verified.
