Office of Foods and Veterinary Medicine

1/6

Office of Foods and Veterinary Medicine

1/4

Key Facts about Preventive Controls for Human Food

Preventive controls are steps that you, a domestic or foreign food facility, must 

take to reduce or eliminate food safety hazards. The rule on Preventive Controls 

for Human Food is mandated by the 2011 FDA Food Safety Modernization Act. 

The rule also incorporates the Current Good Manufacturing Practice (CGMP) 

requirements, which have been updated.

DO THE REQUIREMENTS FOR PREVENTIVE CONTROLS FOR HUMAN FOOD APPLY TO ME?

DO THE REQUIREMENTS FOR CURRENT GOOD MANUFACTURING PRACTICES (CGMPS) APPLY TO ME?

WHEN DO I HAVE TO BE IN COMPLIANCE WITH THE RULE?

WHAT CURRENT GOOD MANUFACTURING PRACTICES WERE UPDATED UNDER THIS RULE?

WHAT ARE THE REQUIREMENTS REGARDING FOOD SAFETY PLANS?

WHAT DO I DO IF A HAZARD COULD FIT UNDER DIFFERENT PREVENTIVE CONTROLS?

WHAT IS THE FOOD SAFETY PLAN BUILDER? HOW DO I USE IT?

ARE THERE ANY OTHER RESOURCES TO HELP ME FOLLOW THIS RULE?

DO THE REQUIREMENTS FOR PREVENTIVE CONTROLS FOR HUMAN FOOD 

APPLY TO ME?

In general, the requirements apply to you if you manufacture, process, pack, or 

hold human food for consumption in the United States, whether your facility is 

domestic or foreign. The requirements apply to you if you are required to register 

with FDA under section 415 of the Federal Food, Drug, and Cosmetic (FD&C) Act. 

Entities defined as “farms,” retail food establishments, and restaurants are some 

of the entities that are not subject to the preventive control requirements because 

they are not required to register. In addition, there are several exemptions or 

modified requirements that may apply.

DO THE REQUIREMENTS FOR CURRENT GOOD MANUFACTURING PRACTICES 

(CGMPS) APPLY TO ME?

In general, the requirements apply to you if you manufacture, process, pack 

or hold human food. As with the preventive controls requirements, there are 

exemptions and modified requirements, but they are not identical.

WHEN DO I HAVE TO BE IN COMPLIANCE WITH THE RULE?

September 18, 2017: Small businesses (businesses with fewer than 500 full-time 

equivalent employees)
Office of Foods and Veterinary Medicine

2/6

Key Facts about Preventive Controls for Human Food

September 17, 2018: Very small businesses (averaging less than $1 million per 

year (adjusted for inflation) in annual sales of human food plus the market value 

of human food manufactured, processed, packed, or held without sale)

September 17, 2018: Facilities subject to the Pasteurized Milk Ordinance (PMO) 

(for their Grade “A” milk and milk products); compliance date was extended 

to allow time for changes to the PMO to incorporate the requirements of this 

preventive controls rule) 

* All other businesses (also known as “large” businesses) were required to be in

compliance on September 19, 2016. Note that compliance dates for some facilities

and activities have been extended.

SEE ALL FSMA COMPLIANCE DATES 

https://www.fda.gov/food/guidanceregulation/fsma/ucm540944.htm

WHAT CURRENT GOOD MANUFACTURING PRACTICES (CGMPS) WERE 

UPDATED UNDER THIS RULE?

Now you are required to be in compliance with some provisions that were 

optional before. 

¢ Training: Management is required to ensure that all employees who 

manufacture, process, pack or hold food are qualified to perform their 

assigned duties. The employees must be trained in the principles of food 

hygiene and food safety, including the importance of employee health and 

hygiene as appropriate to the food, the facility, and the individual’s assigned 

duties. Records of training must be maintained.

¢ Allergen cross-contact: FDA’s longstanding position that CGMPs address 

allergen cross-contact is now explicit in the regulatory text. You are required to 

employ practices and procedures to control allergen cross-contact. 

¢ Human food by-products used for animal foods: The updated CGMPs contain 

provisions for holding and distributing human food by-products that are used 

for animal food.

Human Food By-Products for Use as Animal Food 

(Guidance for Industry - Draft)

https://www.fda.gov/downloads/AnimalVeterinary/GuidanceComplianceEnforcement/

GuidanceforIndustry/UCM499201.pdfhttps:/www.fda.gov/downloads/AnimalVeterinary/

GuidanceComplianceEnforcement/GuidanceforIndustry/UCM499201.pdf

WHAT ARE THE REQUIREMENTS REGARDING FOOD SAFETY PLANS?

You, a domestic or foreign food facility, must (1) have and implement a written 

food safety plan that identifies food safety hazards that require a preventive 

control and (2) implement preventive controls to significantly minimize or prevent 

the hazard. The plan is required to include the following:
Office of Foods and Veterinary Medicine

3/6

Key Facts about Preventive Controls for Human Food

1

HAZARD 

ANALYSIS

2

PREVENTIVE

CONTROLS

3

RISK-BASED 

SUPPLY CHAIN 

PROGRAM

4

RECALL 

PLAN

1 HAZARD ANALYSIS: You are required to identify any known or reasonably 

foreseeable (i.e., potential) biological, chemical, and physical hazards, and 

determine if any of those hazards require a preventive control. 

Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based 

Preventive Controls for Human Food

https://www.federalregister.gov/documents/2015/09/17/2015-21920/current-good-manufacturingpractice-hazard-analysis-and-risk-based-preventive-controls-for-human 

Hazard Analysis and Risk-Based Preventive Controls for Human Food

https://www.federalregister.gov/documents/2017/08/31/2017-18464/hazard-analysis-and-riskbased-preventive-controls-for-human-food-guidance-for-industry-availability

Hazard analysis and risk-based preventive controls for human food 

[Draft Guidance for Industry] 

https://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM517394.pdfhttps:/www.fda.

gov/downloads/Food/GuidanceRegulation/FSMA/UCM517394.pdf 

2 PREVENTIVE CONTROLS: If the hazard analysis identifies a hazard that 

requires a preventive control, you are required to develop and implement a 

control to significantly minimize or prevent the hazard. 

THEN YOU MUST HAVE 

AND IMPLEMENT WRITTEN

PREVENTIVE CONTROLS, 

INCLUDING PROCEDURES, 

PRACTICES, AND PROCESSES

IF THE HAZARD ANALYSIS 

IDENTIFIES A HAZARD 

REQUIRING A PREVENTIVE 

CONTROL

The rule outlines preventive controls and associated requirements that 

could include: 

¢ process controls

¢ food allergen controls

¢ sanitation controls

¢ other controls
Office of Foods and Veterinary Medicine

4/6

Key Facts about Preventive Controls for Human Food

¢ Process controls: procedures, practices, and processes to control parameters 

during operations. Examples of process controls are cooking and refrigeration, 

and product formulation. 

• Associated requirements for process controls include, as appropriate,

parameters (and minimum or maximum values) associated with the control

of the hazard, monitoring, corrective actions, verification including validation

as necessary, records

¢ Food allergen controls: procedures, practices, and processes to control 

allergen cross-contact within a facility and procedures to ensure all food 

allergens are correctly labeled.

• Associated requirements for food allergen controls include, as appropriate,

monitoring, corrective actions, verification, and records

¢ Sanitation Controls: procedures, practices, and processes to make sure 

the facility is maintained in a sanitary manner to control hazards such 

as environmental pathogens. Environmental monitoring is required if 

contamination of a ready-to-eat food with an environmental pathogen such as 

Listeria monocytogenes is a hazard requiring a preventive control. 

• Associated requirements for sanitation controls include, as appropriate,

monitoring, corrective actions, verification (including environmental

monitoring for an environmental pathogen or appropriate indicator organism

as necessary), and records

See Control of Listeria monocytogenes in Ready-to-Eat Foods 

(Draft Guidance for Industry)

https://www.fda.gov/RegulatoryInformation/Guidances/ucm073110.htm 

¢ Other Controls: preventive control procedures that are not process, food 

allergen, or sanitation controls, but are necessary to ensure that a hazard 

requiring a preventive control will be significantly minimized or prevented. 

• Associated requirements for other controls include, as appropriate,

monitoring, corrective actions, verification, and records

Explaining the Oversight and Management of Preventive 

Controls: Once a facility has identified a preventive control for a 

hazard, the facility must make sure that the controls are being 

met using the following actions:

¢ MONITORING: These procedures are designed to provide assurance that 

preventive controls are consistently performed. Monitoring is conducted 

as appropriate to the preventive control. For example, monitoring of a heat 

process to kill pathogens would include recording temperature values. 

Monitoring must be documented.

¢ CORRECTIONS: These are steps taken, in a timely manner, to identify and 

correct a minor, isolated problem that occurs during food production.

(continued)
Office of Foods and Veterinary Medicine

5/6

Key Facts about Preventive Controls for Human Food

(continued)

¢ CORRECTIVE ACTIONS: These include actions to identify and correct a problem 

implementing a preventive control, reduce the likelihood the problem will recur, 

evaluate affected food for safety, and prevent that food from entering commerce 

if you cannot ensure that the affected food is not adulterated. Corrective actions 

must be documented with records.

¢ VERIFICATION: These activities are required to ensure that preventive controls 

are consistently implemented and effective in minimizing hazards. Examples of 

verification activities include scientifically validating process preventive controls 

to ensure that the control measure is capable of effectively controlling an 

identified hazard and calibrating (or checking the accuracy of) process monitoring 

and verification instruments such as thermometers. Verification activities also 

include reviewing records to ensure that monitoring and corrective actions (if 

necessary) are being conducted. Verification activities must be documented.

¢ Product testing and environmental monitoring are also possible verification 

activities, required as appropriate to the food, facility, nature of the preventive 

control, and the role of that control in the facility’s food safety system. 

Environmental monitoring is required if the contamination of a ready-to-eat food 

with an environmental pathogen is a hazard the facility identified as requiring a 

preventive control.

3 Risk-Based Supply Chain Program: If you are a manufacturer and identify a 

hazard related to ingredients you receive from a supplier and will depend on the 

supplier to control that hazard, you must have and implement a supply- chain 

program with appropriate verification activities. 

THENYOU MUST

HAVE AND IMPLEMENT 

A WRITTEN 

SUPPLY-CHAIN 

PROGRAM

IF THE HAZARD ANALYSIS 

IDENTIFIES A HAZARD THAT:

1. REQUIRES A PREVENTIVE 

CONTROL AND

2. YOU WILL RELY ON THE SUPLIER 

TO CONTROL THE HAZARD

Supply chain program must include:

¢ Using approved suppliers

¢ Determining appropriate supplier verification activities and frequency of those 

activities. They may include:

• On-site audit

• Sampling and testing of raw material

• Review of suppliers’ relevant food safety records

• Other appropriate verification activities

¢ Conducting supplier verification activities

¢ Documenting supplier verification activities
Office of Foods and Veterinary Medicine

6/6

Key Facts about Preventive Controls for Human Food

When do I NOT need a supply-chain program?

¢ If you control the hazard at your own facility OR

¢ If the hazard will be controlled by a subsequent entity (such as another 

processor). Certain requirements are specific to this situation. 

4 Recall Plan: If the hazard analysis identifies a hazard that requires a 

preventive control, you must have a written recall plan that includes the 

procedures that describe the steps to perform the recall and at minimum 

assigns responsibility for: 

¢ Notifying the direct consignees of the food being recalled, including how to 

return or dispose of the affected food;

¢ Notifying the public about hazards in the food;

¢ Conducting effectiveness checks; and 

¢ Appropriately disposing of the recalled product. 

WHAT IS THE FOOD SAFETY PLAN BUILDER? HOW DO I USE IT?

The Food Safety Plan Builder is a software program that can help you develop a 

customized food safety plan for your facility. The program can be downloaded for free. 

¢ Food Safety Plan Builder Resources:

Download the Food Safety Plan Builder 

https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm539791.htm 

Read the User Guide

https://www.accessdata.fda.gov/scripts/foodSafetyPlanBuilder/FoodSafetyPlanBuilderUserGuide_v1.0.pdf 

How to use the Food Safety Plan Builder (videos)

https://www.youtube.com/playlist?list=PLey4Qe-Uxcxb9AGNwFj-oGlquHDZ-tkqo 

ARE THERE ANY OTHER RESOURCES TO HELP ME FOLLOW THIS RULE?

The Technical Assistance Network (TAN) is a central source of information for 

questions related to the FSMA rules, programs, and implementation strategies. 

https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm459719.htm 

You can also use the FSMA TAN Popular Topics

https://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM551983.pdf 

FSMA Rules & Guidance for Industry

https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm253380.htm 

Training & Materials on Preventive Controls for Human Food (FSPCA)

https://www.ifsh.iit.edu/fspca/fspca-preventive-controls-human-food