Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls

The FDA Food Safety Modernization Act (FSMA) fundamentally changed the U.S. approach to food safety, shifting the focus from responding to contamination to preventing it. A major milestone in this shift is the FSMA Final Rule for Preventive Controls for Human Food, which became final in September 2015. This rule applies to both domestic and foreign food facilities that must register with the FDA under Section 415 of the Federal Food, Drug, and Cosmetic Act—unless an exemption applies.

Key Takeaway: Even if a facility is not required to register, it may still be subject to Current Good Manufacturing Practices (cGMPs) under this rule.

What the Rule Requires

All covered facilities must have a written food safety plan that identifies potential hazards and outlines preventive controls to address them. The goal is to ensure food is manufactured, processed, packed, and held in a way that makes it safe for consumers.

Compliance Dates Based on Business Size

• Large businesses: In compliance by September 19, 2016
• Small businesses (fewer than 500 full-time equivalent employees): September 18, 2017
• Very small businesses (under $1 million in annual human food sales, including product value): September 17, 2018
• Facilities subject to the Pasteurized Milk Ordinance (PMO): September 17, 2018

Major Requirements of the Rule

1. Modernized Current Good Manufacturing Practices (cGMPs)

• Training is now mandatory:
  • All employees involved in food handling must be qualified through education, training, or experience.
  • They must also be trained in food hygiene and safety—including personal health and hygiene practices relevant to their specific roles.
• Allergen control is explicitly included in cGMPs to reduce the risk of cross-contact.
• By-products intended for animal food must be held and distributed under specific conditions to prevent contamination.

2. Food Safety Plan Requirements

If you’re a covered facility, your food safety plan must include the following components:

Hazard Analysis

• Identify known or reasonably foreseeable hazards—biological, chemical (including radiological), and physical.
• Hazards may be:
  • Naturally occurring
  • Unintentionally introduced (e.g., from the environment or equipment)
  • Intentionally introduced for economic gain (if they impact safety)

If the analysis reveals hazards that require control, preventive controls must be written, implemented, and maintained.

Preventive Controls

Facilities have flexibility to apply controls suited to their specific processes and products. These include:

• Process Controls
  Examples: Cooking, chilling, acidifying. These must have defined parameters (e.g., critical limits) and monitoring procedures.
• Food Allergen Controls
  Written procedures to prevent allergen cross-contact and ensure correct labeling.
• Sanitation Controls
  Procedures that ensure the facility is kept in a sanitary state to prevent contamination from the environment or personnel.
• Other Controls
  Any other necessary controls not categorized above but essential to prevent or minimize a hazard.

3. Oversight and Management of Preventive Controls

Facilities must actively manage and verify the effectiveness of their preventive controls through:

• Monitoring
  Ensures controls are applied consistently (e.g., checking and recording temperatures during heat processing).
• Corrections
  Quick fixes for minor, isolated issues that don’t pose a significant safety risk.
• Corrective Actions
  Required when a preventive control fails:
  • Identify and fix the root cause
  • Prevent recurrence
  • Evaluate the safety of affected food
  • Prevent unsafe food from reaching the market
    All corrective actions must be documented.
• Verification
  Confirms that controls are working as intended. This can include:
  • Scientific validation of controls
  • Instrument calibration (e.g., thermometers)
  • Record reviews
  • Environmental monitoring (mandatory if a ready-to-eat food could be contaminated by environmental pathogens)
  • Product testing (if appropriate)

4. Supply Chain Program

If a hazard requiring a preventive control is managed before or after your facility (i.e., in the supply chain), you must:

• Use only approved suppliers for raw materials/ingredients that require supply-chain-applied controls.
• If using temporary, unapproved suppliers, conduct verification activities before accepting their materials.
• Document supplier verification and review records—even if conducted by a broker or distributor.

5. Recall Plan

If your hazard analysis identifies a hazard needing a preventive control, you must have a written recall plan. This plan must include procedures to:

• Notify consignees and the public (if necessary)
• Conduct effectiveness checks
• Properly dispose of or reprocess recalled products

Source: United States Food and Drug Administration (FDA)

Reach out to Fresh Group Food Safety And Quality Consulting for any inquiries related to food quality and safety.