21 CFR 117Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food

21 CFR Part 117 is the FDA rule that implements two pillars of the Food Safety Modernization Act (FSMA) for human food: updated Current Good Manufacturing Practice (replacing 21 CFR Part 110), and Hazard Analysis and Risk-Based Preventive Controls (HARPC). It applies to any facility required to register under section 415 of the FD&C Act that manufactures, processes, packs or holds human food — domestic or foreign — with a few specific exemptions (very small businesses, qualified facilities, low-acid canned foods under Part 113, juice under Part 120, seafood under Part 123).

Part 117 was published in 2015 and phased in by company size. It is the food-side equivalent of the Part 111 supplement rule and the Part 211 drug rule, but with a fundamentally different posture: instead of prescribing detailed manufacturing operations, it requires the facility to identify its own hazards and design controls proportionate to them. The HARPC framework — Subpart C — is what makes Part 117 different from Part 110 it replaced.

Subpart C is the heart of the rule. Subpart G is the operationalisation of supply-chain risk for any hazard that requires a control applied by the supplier rather than the receiving facility (e.g. raw-milk pathogens controlled by farm pasteurisation upstream, not by the ice-cream plant).

§117.126 requires every covered facility to prepare and implement a written Food Safety Plan, prepared by or under the oversight of a Preventive Controls Qualified Individual (PCQI). The plan has seven required elements: hazard analysis, preventive controls, supply-chain programme (if applicable), recall plan, procedures for monitoring, corrective-action procedures, and verification procedures. Each element has its own minimum content set.

The hazard analysis (§117.130) must consider biological, chemical (including radiological), and physical hazards. Known or reasonably foreseeable hazards must be identified for each type of food manufactured, processed, packed or held. The PCQI must evaluate each hazard for severity and probability and decide which require a preventive control. The reasoning must be documented — 'we considered Listeria but it isn't a hazard requiring a control because…' is the kind of statement the inspector wants to read.

§117.135 defines the categories of preventive controls. Process controls cover any control applied within the manufacturing process to ensure that critical parameters are met — typically time and temperature, but also pH, water activity, and chemical residues. Food allergen controls (§117.135(c)(2)) cover prevention of allergen cross-contact and label control. Sanitation controls (§117.135(c)(3)) cover the cleanliness of food-contact surfaces and prevention of cross-contamination. Supply-chain controls (§117.135(c)(4)) apply when the hazard is controlled before receipt.

Each preventive control needs a monitoring procedure (§117.140) with a defined frequency, a corrective-action procedure (§117.150) for when the control is not met, and verification activities (§117.165) that demonstrate the control is consistently effective. Validation (§117.160) — proof that the control as designed actually controls the hazard — is required for process and supply-chain controls but not for sanitation or allergen controls, which are validated implicitly by general scientific consensus.

When a hazard is controlled by the supplier rather than the receiving facility, the receiving facility must operate a documented supply-chain programme under §117.405. The programme has four parts: use only approved suppliers (§117.420), determine appropriate verification activities (§117.430), conduct those verification activities and document them, and maintain records. Verification activities include onsite audit, sampling and testing of the raw material or supplier finished product, review of the supplier's food safety records, and other procedures appropriate to the risk.

When the hazard is a 'serious adverse health consequence or death to humans' (SAHCODHA) hazard — e.g. Listeria in ready-to-eat foods, Salmonella in dry products meant for direct consumption — onsite audit at least annually is the default verification activity unless an alternative is justified in writing under §117.430(b)(1).

Any facility with a preventive control must have a written recall plan covering the food associated with that control. The plan must include procedures to notify direct consignees, notify the public when appropriate, conduct effectiveness checks, and dispose of recalled product. The recall plan must be ready to execute — not drafted after the recall is called. FDA's 2018 Mandatory Recall guidance walks through how an inspector tests the plan, often by asking the QA director to walk through a hypothetical recall during the inspection.

§117.305 requires records to be original, true, accurate, and contain the actual values and observations obtained during monitoring. §117.310 requires the dated signature of the person performing the activity. §117.315 requires retention onsite for at least six months after creation, with the full retention period of two years (some records — Food Safety Plan reanalysis, training, supplier verification — are three years). Off-site storage is permitted after six months if records can be retrieved within 24 hours of an FDA request.

The 'actual values' phrasing matters. A monitoring record that just says 'OK' is a non-compliant record; the temperature, the time, the moisture reading, the inspector's identifier all have to be in the record. The FDA-2017 inspection program (PCHF) prioritises record review and routinely cites this.

1. §117.126 / §117.130 — Hazard analysis is generic; site-specific hazards (the line layout, the local water source, the actual allergen profile) are not addressed.
2. §117.135 — Preventive controls are listed but not validated against the hazard they are meant to control.
3. §117.140 — Monitoring records show 'OK' instead of actual values; or monitoring is signed at end of shift rather than contemporaneously.
4. §117.150 — Corrective actions are taken but not documented, or the documentation does not show what was done with the affected product.
5. §117.165 — Verification activities (records review, calibration, environmental monitoring) are scheduled but not performed on schedule.
6. §117.405 — Supply-chain programme exists on paper but onsite audits of SAHCODHA-hazard suppliers are not performed annually as required.
7. §117.4 — PCQI is named but cannot demonstrate FSPCA-equivalent training or job experience.
8. §117.139 — Recall plan exists but the facility cannot demonstrate execution capability when asked to walk through a hypothetical recall.

• Food Safety Plan is a structured record with the seven HARPC elements linked — updating the hazard analysis surfaces the dependent preventive controls automatically.
• Monitoring steps at the kiosk capture actual values (time, temperature, pH, weight, observation) with operator e-signature and a contemporaneity timestamp.
• Corrective actions are first-class records linked to the monitoring excursion that triggered them and to the affected lots.
• Verification activities (record review, calibration, environmental monitoring) are scheduled, assigned and tracked; missed verifications surface in the PCQI's dashboard.
• Supply-chain programme tracks approved-supplier status, verification activity due dates, and the result of each annual audit; receipt blocks if a SAHCODHA-hazard supplier is out of compliance.
• Recall plan executes from FSMA-204 lot genealogy — the consignee list is generated by the system, not rebuilt by hand during a crisis.