FSMA Preventive Controls: What Small Manufacturers Need to Know

The FDA Food Safety Modernization Act — FSMA — represents the most significant overhaul of federal food safety law in decades. At its core is a shift from responding to foodborne illness outbreaks to preventing them. For food manufacturers, the most directly applicable component is the Preventive Controls for Human Food rule, codified at 21 CFR Part 117.

If you are a small or very small manufacturer trying to understand what is actually required of your operation, here is a practical overview.

Who Is Covered?

Most facilities that are required to register with the FDA and that manufacture, process, pack, or hold food for human consumption in the United States are subject to Part 117. However, the rule distinguishes between different business sizes, which affects both compliance deadlines (now long past) and the specific requirements that apply.

•        Very small businesses (less than $1 million in total annual sales of human food) are subject to modified requirements under the rule's qualified facility exemption provisions.

•        Small businesses (fewer than 500 full-time equivalent employees) had extended compliance deadlines but are now fully subject to the rule.

•        Farms, restaurants, and retail food establishments have different regulatory frameworks and are generally not subject to Part 117 in the same way.

If you are uncertain whether your facility is covered or whether a qualified facility exemption applies to you, that determination is worth making explicitly and documenting.

What the Rule Requires

For covered facilities, Part 117 requires the development and implementation of a written food safety plan that includes:

•        A hazard analysis identifying known or reasonably foreseeable biological, chemical, and physical hazards

•        Preventive controls for hazards that require one — including process controls, allergen controls, sanitation controls, and a supply-chain program where applicable

•        A recall plan

•        Monitoring procedures for each preventive control

•        Corrective action procedures

•        Verification activities, including validation of preventive controls and review of records

•        Recordkeeping procedures

The food safety plan must be prepared or its preparation overseen by a PCQI — a Preventive Controls Qualified Individual.

How Is This Different From HACCP?

HACCP and Preventive Controls share the same foundational logic — identify hazards, put controls in place, monitor them, verify they are working. But Preventive Controls is broader in scope. Traditional HACCP focuses on process controls at critical control points. Part 117 explicitly adds allergen controls, sanitation controls, and supply-chain controls as categories of preventive controls, recognizing that not all food safety hazards are controlled at a process step.

For facilities already operating under HACCP — particularly USDA/FSIS-regulated establishments — the transition to a Preventive Controls framework involves expanding the existing system rather than starting from scratch.

Common Gaps in Small Manufacturer Compliance

Based on experience working with smaller operations, the most common gaps tend to be:

•        No written food safety plan, or a plan that was developed once and never updated

•        Allergen controls that are informal or undocumented

•        No formal supply-chain program or supplier verification activities

•        Recall plans that exist on paper but have never been tested or reviewed

•        No designated PCQI, or a PCQI who has not completed recognized training

Practical tip: If your facility has never had a formal gap assessment against Part 117 requirements, that is a reasonable place to start. It gives you a clear picture of where you stand before an inspection or audit does.

Bottom Line

FSMA compliance is not optional, and the compliance deadlines have passed for businesses of all sizes. But compliance does not have to be overwhelming. A well-structured food safety plan, supported by trained personnel and maintained documentation, puts your facility in a defensible position — and, more importantly, in a position to actually prevent food safety problems.

Have questions about your facility's compliance needs? I offer a free initial consultation. Reach out at jeremycarter@woypc.com or visit the Contact page to get started.