Written and maintained by CASRAI Editorial Board
Last updated
A food safety plan is the written document that a covered food facility must prepare and implement under 21 CFR 117.126: it must be prepared, or its preparation overseen, by a preventive controls qualified individual, and it must contain seven specific written components, starting with a hazard analysis. This page cross-walks each required component to the regulation section that defines it. It describes general regulatory content, not legal advice for a specific facility.
Short answer
Under 21 CFR 117.126(a), a facility must prepare (or have prepared) and implement a written food safety plan, and a preventive controls qualified individual must prepare it or oversee its preparation. Under 117.126(b) the plan must include the written hazard analysis, preventive controls, supply-chain program, recall plan, monitoring procedures, corrective action procedures and verification procedures. Under 117.126(c) the plan is itself a record subject to the records requirements of subpart F.
Definition and scope
The food safety plan is the central document of the preventive controls framework in 21 CFR Part 117 (Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food), issued by the U.S. Food and Drug Administration under the Food Safety Modernization Act. For the wider legal context, see the CASRAI guide to Food Safety Modernization Act requirements. Whether a particular facility is covered, or qualifies for a modified requirement, depends on the scope provisions of Part 117 and is determined facility by facility; the content rules below apply where the food safety plan requirement applies.
The regulation defines a preventive controls qualified individual as a qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA, or who is otherwise qualified through job experience to develop and apply a food safety system (21 CFR 117.3).
What the plan must contain: a section-by-section cross-walk
21 CFR 117.126(b) lists the required contents. Each item points to another section that sets out what that written element must say.
| # | Required written component | Defined in |
|---|---|---|
| 1 | Hazard analysis | 21 CFR 117.130(a)(2) |
| 2 | Preventive controls | 21 CFR 117.135(b) |
| 3 | Supply-chain program | Subpart G of Part 117 |
| 4 | Recall plan | 21 CFR 117.139(a) |
| 5 | Procedures for monitoring the implementation of the preventive controls | 21 CFR 117.145(a) |
| 6 | Corrective action procedures | 21 CFR 117.150(a)(1) |
| 7 | Verification procedures | 21 CFR 117.165(b) |
Because the regulation names the written hazard analysis and the written preventive controls as separate items, a plan that records only a list of controls, without the analysis that explains why each control exists, does not match the list in 117.126(b).
How the hazard analysis feeds the plan
The hazard analysis (21 CFR 117.130) identifies known or reasonably foreseeable hazards. The regulation groups them into three categories:
- Biological hazards, including environmental pathogens.
- Chemical hazards, including radiological hazards, natural toxins, allergens and unapproved additives.
- Physical hazards, such as glass or metal fragments.
Under 117.130(b) these hazards may occur naturally, may be unintentionally introduced, or may be intentionally introduced for economic gain. The analysis then evaluates each hazard (117.130(c)) by the severity of the illness or injury and the probability that it will occur in the absence of preventive controls. Factors the regulation says the evaluation must consider include formulation, the facility and equipment, ingredients, transportation, processing, packaging and labeling, storage, intended use, sanitation, and time-related hazards such as weather.
Preventive control types
Under 21 CFR 117.135(a) a facility must identify and implement preventive controls so that hazards requiring one are significantly minimized or prevented, and under 117.135(b) those controls must be written. Section 117.135(c) lists the types:
| Control type | What the regulation says it covers |
|---|---|
| Process controls | Parameters with maximum or minimum values, for example for heat processing, acidifying, irradiating or refrigerating |
| Food allergen controls | Preventing allergen cross-contact, and labeling so the food is not misbranded under section 403(w) of the FD&C Act |
| Sanitation controls | Cleanliness of food-contact surfaces, prevention of cross-contamination, and environmental pathogens, employee-related biological hazards and allergens |
| Supply-chain controls | Controls applied through the supply-chain program in subpart G |
| Recall plan | The written recall plan under 117.139 |
| Other controls | Other controls appropriate for food safety, for example hygiene training and other current good manufacturing practices (see current good manufacturing practice) |
Plan, records and audits are different things
Three terms are often blurred. The plan is the written set of seven components in 117.126(b). Because 117.126(c) makes the plan a record subject to subpart F, the plan itself must be kept as a record; it is not merely a policy statement. Implementing the plan, including monitoring, corrective action and verification, is a separate obligation, since 117.126(a) requires the facility to both prepare and implement it. Third-party or customer assessments are a further layer: see the CASRAI guide to the food safety audit and, for private certification schemes, GFSI certification.
Where it matters for labs and quality teams
For a food facility, the hazard analysis is where chemical, biological and physical hazards are named and ranked, so it defines which hazards later need controls and verification. Teams that handle chemical hazards in a laboratory or production setting can compare this approach with general laboratory practice in the CASRAI guide to good laboratory practice, and with the microbiology side of food safety in food microbiology testing. Part 117 sets out what the written plan must include; it is the facility’s own analysis that decides which controls are needed.
Common misunderstandings
“A food safety plan is the same as a HACCP plan.”
Part 117 sets its own required contents. A 117.126 plan must include a written supply-chain program and a written recall plan in addition to the hazard analysis, preventive controls, monitoring, corrective action and verification elements, and its hazard analysis covers radiological hazards and hazards introduced for economic gain (21 CFR 117.126(b), 117.130(b)).
“A template makes the plan compliant.”
Section 117.130 requires the analysis to evaluate the facility’s own formulation, equipment, ingredients, processing and storage. A plan has to reflect those facility-specific factors, and a qualified individual must prepare it or oversee its preparation (117.126(a)(2)).
“The plan only lists critical control points.”
Section 117.135(a) says preventive controls include controls at critical control points, if there are any, and other controls appropriate for food safety. Allergen, sanitation and supply-chain controls are listed as separate control types in 117.135(c), alongside process controls.
FAQ
What is a food safety plan?
It is the written plan required by 21 CFR 117.126 that documents a facility’s hazard analysis, preventive controls, supply-chain program, recall plan, monitoring, corrective action and verification procedures.
Who must prepare it?
One or more preventive controls qualified individuals must prepare it or oversee its preparation (21 CFR 117.126(a)(2)).
Is the plan a record?
Yes. 21 CFR 117.126(c) states that the plan is a record subject to the requirements of subpart F of Part 117.
What hazards must the analysis consider?
Known or reasonably foreseeable biological, chemical (including radiological hazards, natural toxins, allergens and unapproved additives) and physical hazards (21 CFR 117.130(b)).
Sources
- 21 CFR 117.126, Food safety plan. law.cornell.edu/cfr/text/21/117.126 (read 2026-11-08).
- 21 CFR 117.130, Hazard analysis. law.cornell.edu/cfr/text/21/117.130 (read 2026-11-08).
- 21 CFR 117.135, Preventive controls. law.cornell.edu/cfr/text/21/117.135 (read 2026-11-08).
- 21 CFR 117.3, Definitions. law.cornell.edu/cfr/text/21/117.3 (read 2026-11-08).
