A food safety plan is the written document FDA's preventive-controls rule, 21 CFR Part 117 requires most registered food facilities to keep. It contains a hazard analysis, preventive controls, and written procedures for monitoring, corrective actions, and verification, plus a recall plan, all prepared or overseen by a preventive controls qualified individual.

This is a narrower thing than a "food safety system." The food safety plan is one specific regulated document with a defined table of contents set out in 21 CFR 117.126. If your facility is covered by the Preventive Controls for Human Food rule, an inspector can ask to see each of its required parts. This post walks those parts one by one, explains who has to build them, and draws the line between the plan and the wider management system it lives inside.

What is a food safety plan?

A food safety plan is the written record of how a facility identifies its food safety hazards and controls them, built to the structure FDA lays out in the Preventive Controls rule. It is the FSMA successor to a classic HACCP plan: same DNA, wider scope. Where HACCP organizes controls around critical control points, the food safety plan organizes them around preventive controls, a broader category that includes process controls (which cover CCP-style steps) plus food allergen controls, sanitation controls, and supply-chain controls.

The rule is specific about what "written" means. The plan is not a philosophy; it is a set of documents an inspector can read and a facility can be cited against. The core is the hazard analysis, and everything else, the controls and the procedures that manage them, flows from what that analysis finds.

What does a food safety plan have to include?

21 CFR 117.126 lists the required contents of a food safety plan explicitly. These are the parts an FDA investigator will look for by name, so treat the list as your table of contents, not a suggestion.

  1. The written hazard analysis. An analysis of the known or reasonably foreseeable biological, chemical (including radiological), and physical hazards for each type of food, and a decision on which require a preventive control.
  2. The written preventive controls. The process, food allergen, sanitation, supply-chain, and any other controls you determined are needed to significantly minimize or prevent the identified hazards.
  3. The written supply-chain program. Where a hazard is controlled by your supplier, the program that ensures approved suppliers and verification of the raw materials and ingredients you receive.
  4. The written recall plan. Required whenever the hazard analysis identifies a hazard requiring a preventive control, with the notification and disposal steps spelled out.
  5. The written monitoring procedures. What is measured for each preventive control, how, how often, and by whom, so you know the control is operating.
  6. The written corrective action procedures. What happens when a control is not properly implemented, including evaluating affected food, correcting the problem, and preventing recurrence.
  7. The written verification procedures. The activities, calibration, product testing, environmental monitoring, and records review, that confirm the controls are consistently implemented and effective.
The required written parts of a food safety plan What 21 CFR 117.126 requires in writing HAZARD ANALYSIS biological · chemical · physical PREVENTIVE CONTROLS process/allergen/sanitation SUPPLY-CHAIN program RECALL PLAN notify + dispose MONITORING what/how/how often/who CORRECTIVE ACTION evaluate + fix + prevent VERIFICATION calibrate/test/review PREPARED OR OVERSEEN BY A PCQI reanalyzed at least every 3 years Every box below the hazard analysis exists to control what the analysis found.
The food safety plan is a document with a defined table of contents. Each written part is something an FDA investigator can ask to see by name.

How is the hazard analysis done?

The hazard analysis is the engine of the plan, and every control downstream is only as good as it. You work through each type of food and each process step, identify the known or reasonably foreseeable biological, chemical, and physical hazards, and evaluate each hazard for severity and likelihood. A hazard that requires a preventive control is one that, without a control, is reasonably likely to cause illness or injury. Those become your preventive controls; the rest you document as considered and screened out.

This is also where the food safety plan reaches beyond HACCP. The analysis must consider hazards that may be present because a food is inherently susceptible, introduced by the process, or introduced intentionally for economic gain in some cases. Undeclared allergens get explicit attention, because they are the single most common cause of food recalls in the United States, and they usually get managed through a food allergen preventive control rather than a classic CCP.

What are preventive controls, and how are they managed?

A preventive control is a measure you put in place to significantly minimize or prevent a hazard the analysis flagged, and every preventive control carries the same management package: monitoring, corrective actions, and verification, applied as appropriate. That trio is what makes a control real instead of aspirational. You monitor to know it is working, you correct when it is not, and you verify, independently, that the whole arrangement holds up.

The four preventive-control categories cover more ground than CCPs alone. Process controls manage hazards at a step, cooking, cooling, pH, water activity, and behave like CCPs with critical limits. Food allergen controls prevent cross-contact and ensure correct labeling. Sanitation controls, backed by your SSOPs manage environmental pathogens and allergen cross-contact on the floor. Supply-chain controls handle hazards controlled before the ingredient reaches you. For ready-to-eat product exposed to the environment, an environmental monitoring program is the verification activity that proves your sanitation control is actually working.

The management components of every preventive control Every preventive control comes with the same three duties PREVENTIVE CONTROL MONITORING is it operating? CORRECTIVE ACTION what if it fails? VERIFICATION is it effective? All three generate records, the evidence the plan is actually being run.
A preventive control is not just a limit. It comes bundled with monitoring, corrective action, and verification, and each of those produces the records an auditor reads.

What has to be in the recall plan?

If the hazard analysis identifies any hazard requiring a preventive control, the facility must include a written recall plan, per 21 CFR 117.139. It has to lay out the procedures and assign responsibility to: directly notify the consignees who received the affected food, including how to return or dispose of it; notify the public when needed to protect health; conduct effectiveness checks to confirm the recall reached its targets; and appropriately dispose of the recalled product.

A recall plan is only worth the paper if it works under pressure, which is why plants pressure-test it with a mock recall and why fast, accurate traceability records make or break the effectiveness check. Our deeper guide to the food recall plan covers the mechanics; here it is enough to know the recall plan is a required element of the food safety plan itself, not a separate document you can defer.

By the numbers

Who has to prepare the food safety plan?

The food safety plan must be prepared, or its preparation overseen, by a preventive controls qualified individual. A plan without a PCQI behind it is not valid under the rule, full stop. The PCQI conducts or oversees the hazard analysis, determines the preventive controls, validates them where required, and oversees the reanalysis. They can be an employee or an outside consultant, and larger operations usually train more than one so the role is not a single point of failure.

The PCQI is the human accountability the document needs. Our full breakdown of the PCQI role covers the training routes and the seven duties the rule ties to it. The short version: the plan is a legal document, and the PCQI is the person who signs off that it is complete, validated, and current.

How is a food safety plan different from an FSMS?

A food safety plan is the specific FSMA document; a food safety management system is the broader structure that owns and sustains it. This distinction trips people up constantly, so be precise. The food safety plan is the hazard analysis plus the controls plus the written monitoring, corrective-action, and verification procedures and the recall plan, one regulated artifact defined in 117.126. The FSMS wraps that plan in a food safety policy, the prerequisite programs its assumptions rely on, document control, internal audit, and management review.

The relationship is nested, not parallel. Your food safety plan lives inside your FSMS the way an engine lives inside a car. You can hand an inspector the plan on demand; you cannot hand them the system, because the system only exists in whether the plan is actually run, its records reviewed, and its failures closed. Build the plan to 117.126, then make sure the management system around it, the part covered in our FSMS guide is real enough to keep the plan alive.

How often must the food safety plan be reanalyzed?

At least once every three years, and sooner whenever a significant change in activities, a new hazard, new information about a hazard or control, an unanticipated food safety problem, or evidence that a control is ineffective, warrants it. Reanalysis is not a rewrite; it is a structured recheck that the plan still fits the operation. A new product, a new supplier, a line reconfiguration, or a recall in your category are all triggers, and the PCQI conducts or oversees the work.

In practice, reanalysis is only as painless as your records are complete. If monitoring, verification, and corrective-action data are captured cleanly as work happens, the PCQI can see whether controls are holding and reanalyze on evidence rather than on memory. Digitizing that capture at the station, the way CLS did with Harmony for production and quality records, turns the three-year reanalysis, and the audit that follows, into a review of live data instead of a scramble through binders. No rip-and-replace: the same records the rule already requires just become searchable.