Mycotoxin Control in Food

Mycotoxin control is the set of sourcing, storage, sampling, and testing practices that keep mold-produced toxins, aflatoxins, ochratoxin, deoxynivalenol, and fumonisins, out of finished food. Because these toxins survive cooking, control happens before and around the process, not on the line.

Mycotoxins are the quiet chemical hazard in any plant that handles grains, nuts, spices, dried fruit, coffee, or corn. They do not smell, they do not change color you can see, and they do not cook out. A lot can pass a visual check, clear receiving, and still carry aflatoxin at three times the FDA action level. This guide walks the four mycotoxins a U.S. food plant actually manages, the numbers the FDA enforces, and the supplier, sampling, and storage controls that keep contaminated product from ever reaching your line.

What are mycotoxins?

Mycotoxins are toxic compounds produced by molds that grow on crops in the field or in storage. A handful of mold genera, Aspergillus Fusarium and Penicillium make the toxins that matter to food safety, and each favors different crops and conditions. Two facts drive every control decision. First, mold growth and toxin production are two separate events: a crop can carry the mold without the toxin, then produce toxin later if it gets warm and damp in storage. Second, the toxins are heat-stable. Roasting, baking, extrusion, and pasteurization knock down mold and pathogens but leave most mycotoxin behind. That is why pasteurization and log reduction do nothing for this hazard, you cannot process your way out of a contaminated lot.

Because the toxin rides in with the raw material or forms during bad storage, mycotoxins are handled as a supplier and prerequisite-program hazard inside your HACCP-based food safety plan not usually as a critical control point on the line.

What are the FDA action and advisory levels for mycotoxins?

The FDA controls mycotoxins with a mix of enforceable action levels and non-binding advisory or guidance levels, and the distinction matters for how you write a specification. An action level is the concentration at or above which the FDA may treat a food as adulterated and take enforcement action. An advisory or guidance level is the number the FDA recommends but has not codified as a hard limit. The headline figures:

• Total aflatoxins: 20 ppb action level in food for humans; aflatoxin M1 in fluid milk carries a separate 0.5 ppb action level.
• Deoxynivalenol (DON, or vomitoxin): 1 ppm advisory level in finished wheat products for human consumption.
• Fumonisins: 2-4 ppm guidance levels in dry-milled corn products for humans, depending on how the corn is processed (2 ppm for degermed products, up to 4 ppm for whole or partially degermed).
• Patulin: 50 ppb action level in apple juice (a mold toxin from Penicillium on damaged apples, managed the same way).
• Ochratoxin A: the FDA has not set a U.S. action level, but the EU and other markets enforce limits, so exporters set internal specs anyway.

Two traps live in these numbers. The first is units: aflatoxin is regulated in parts per billion, DON and fumonisins in parts per million, a 1,000-fold difference, and mixing them up on a spec sheet is a real error. The second is that the animal-feed levels are different and, for several toxins, higher; a co-product stream you sell as feed follows a separate set of numbers.

Where do mycotoxins come from?

Mycotoxins enter along two roads, and a good program blocks both. The first is field contamination: drought stress, insect damage, and warm humid weather before harvest let field molds like Fusarium and Aspergillus colonize the crop and produce toxin while it is still growing. You cannot control the weather on a farm three states away, but you can control who you buy from and how their crop is documented. The second road is storage growth: a clean-at-harvest lot that gets binned wet, or sits in a warm silo with condensation, will grow mold and make toxin in your own warehouse. This second road is entirely inside your walls, which makes it the one auditors expect you to own outright.

The practical read: aflatoxin and ochratoxin are heavily storage-driven, so moisture control is the front line. DON and fumonisins are more field-driven, so supplier selection and incoming testing carry more of the load. Most plants need both.

How does storage moisture control mold growth?

Molds need water to grow, and the usable measure is water activity (aw), the free water available to microbes, not total moisture. Keep water activity low enough and toxin-producing molds simply cannot grow, no matter how long the product sits. As a working rule, storage molds are held in check when grain moisture stays at or below roughly 13-14% and water activity below about 0.70; the toxigenic Aspergillus species that make aflatoxin generally need water activity above about 0.80 to grow well. The safe target is to store dry and stay dry.

The storage controls that follow from this are unglamorous and effective: dry incoming lots to spec before binning, monitor moisture and temperature through the storage period, aerate to prevent condensation and hot spots, rotate stock first-in-first-out, and keep the warehouse clean of spilled, spoiling residue that seeds the next lot. These sit inside your GMP and sanitation programs, and they are where a storage-driven toxin problem is won or lost.

How do supplier controls prevent mycotoxin contamination?

For field-driven toxins, your best control is upstream, in who you buy from and what they prove. A supplier mycotoxin program has a few moving parts. You approve suppliers of high-risk commodities, corn, peanuts, tree nuts, wheat, coffee, spices, and make mycotoxin results part of the approval. You require a certificate of analysis (CoA) for each incoming lot of high-risk material, stating the toxin tested, the method, and the result against your spec. And you verify, rather than trust: you test a defined share of incoming lots in your own lab or a contract lab, and you treat a supplier whose CoAs never match your verification as a supplier problem. This is ordinary supplier quality management pointed at a hazard that will not announce itself.

The verification piece is where mycotoxin control gets its own discipline, because the toxin is not evenly spread through a lot, which changes how you have to sample.

Why is mycotoxin sampling so difficult?

Mycotoxin contamination is famously heterogeneous: in a rail car of corn or a tote of peanuts, the toxin concentrates in a small number of moldy kernels while the rest of the lot is clean. Pull one small grab sample and you can easily miss the hot pocket, or hit it and condemn a fine lot. The FDA and USDA address this with sampling plans that pull many small increments from across the whole lot, combine them into a large aggregate sample, grind it fine, and subsample from that. For aflatoxin in shelled peanuts, official plans use aggregate samples measured in pounds, not grams, precisely because a small sample is statistically unreliable. The takeaway for a plant: how you sample matters as much as how you test, and a certificate based on a single unrepresentative grab is close to meaningless.

How do you build a mycotoxin control program?

A mycotoxin program is a repeatable loop, not a one-time risk assessment. Run it in order:

1. Map your exposure. List every incoming ingredient that carries mycotoxin risk, grains, corn, nuts, seeds, spices, dried fruit, coffee, cocoa, and match each to the toxins it can carry.
2. Set the spec. For each material, write an acceptance limit tied to the FDA action or advisory level, or a tighter number if a customer or export market demands it. State the units.
3. Qualify suppliers. Approve suppliers of high-risk commodities on the strength of their mycotoxin controls and require a lot-level CoA with method and result.
4. Sample representatively. Use multi-increment sampling across the lot for verification testing, following an FDA or USDA sampling plan rather than a convenient grab.
5. Test on a risk basis. Verify a defined share of incoming high-risk lots, more for new suppliers and high-risk commodities, less for a long-clean supplier under audit.
6. Control storage. Dry to spec, monitor moisture and temperature, aerate, rotate stock, and keep storage clean so no clean lot turns hot on your watch.
7. Act on a failure. Reject or divert an out-of-spec lot, trace it forward and back, and reassess the supplier, the same one-up, one-back discipline covered in one-up, one-back traceability.

The numbers worth pinning

Mycotoxin levels are updated by the FDA over time, so cite the source, not the memory. Current primary-source references:

• The FDA collects enforceable and advisory mycotoxin limits in its Mycotoxins page and its action levels guidance.
• Total aflatoxins: 20 ppb action level in human food; aflatoxin M1 in milk 0.5 ppb.
• DON: 1 ppm advisory level in finished wheat products, per FDA's DON advisory levels guidance.
• Fumonisins: 2-4 ppm guidance in corn products, per FDA's fumonisin levels guidance.

The through-line: mycotoxins are controlled upstream and in storage, and the proof lives in records, CoAs, sampling logs, moisture readings, and verification results. Plants that keep those on paper spend audit week hunting binders and cannot answer “show me every lot from that supplier” without a reconstruction. Plants that capture them at the point of work turn a mycotoxin question into a query. That is the digitize-the-paper move Harmony runs for quality and receiving records (see how CLS did it), and it ties straight into your HACCP plan and the traceability you would lean on in a recall.