What You Need To Know

Contents

What You Need to Know
What You Need to Do
What You Need to Have on File
Summary of Subpart G

• Subpart G describes the requirements for a Supply Chain Program.

• A Supply Chain Program demonstrates that your suppliers are producing their products (typically ingredients and packaging) in a safe manner.

• You must have a Supply Chain Program if your hazard analysis revealed a hazard requiring a supply-chain control.

• You have considerable leeway in how you verify your suppliers but there are some specific requirements (see below).

• You are obligated to document and take prompt action if you learn a supplier is not controlling a hazard as required.

---

Applicability & Exemptions

This section applies to any business whose hazard analysis reveals a hazard requiring a supply-chain-applied control. This means you can't complete your Supply Chain Program until you have completed your hazard analysis.

For Example - Let's say that Ned's Raw Cookies uses pasteurized eggs as an ingredient in their product. Since Ned's Raw Cookies are sold and consumed raw, the company is not controlling for the salmonella hazard that is present in eggs.

In this case, Ned's Raw Cookies would likely rely on a supply-chain-applied control to minimize the salmonella hazard in their product. Ned's Raw Cookies would request documentation from their egg supplier to prove that the supplier is controlling the risk of salmonella. This documentation may be an audit result, a copy of supplier's food safety plan, or sufficient food safety records to show that that hazard has been controlled.

Exemptions:

You are not required to apply a supply-chain-applied-control in the following scenarios:

1. No hazards requiring a supply chain applied control exist

2. Your business (the receiving facility) is able to use a process control to eliminate/minimize the hazard.

3. Your customer provides a written assurance that they must control the hazard.

4. The food produced is not consumed by the public (i.e. it's only for research purposes within the company)

5. The supplier is a "very small business"

---

What You Need to Do:

1. Review your hazard analysis to determine whether there is a hazard which requires a supply-chain-applied control.

2. Determine how you will approve the suppliers of those ingredients/packaging.

3. Request documents from your suppliers (i.e. a recent inspection report or their food safety plan) to demonstrate that they are controlling for that hazard. You may also verify your supplier's product yourself by conducting tests.

4. Review your suppliers' documents and document that you have reviewed them.

5. Only use approved suppliers

---

What You Need to Have on File:

Your supply chain program must be written and contain the following:

• An explanation of how you approve suppliers

• A list of approved suppliers

• A procedure for receiving products (i.e. a receiving SOP)

• Each of the following documents for each supplier (if their ingredient has a hazard which requires a supply-chain control)

  • Documentation of having reviewed the supplier's food safety records.

  • A written inspection report of the supplier by the state, FDA, city, or other agency

• Any records of supplier non-conformance and your response to that (could be a corrective action).

Summary of §117 Subpart G

Below is a summary of Subpart G so that you can get a quick sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.405 (a) (2) then just look up this same code in the CFR.

117.405 Requirement to Establish and Implement a Supply-Chain Program

a. 

1. A facility must establish a risk-based supply-chain program for the ingredients and raw materials that have a hazard requiring a supply-chain-applied control.

2. Importers who conduct foreign-supplier-verification programs don't need to conduct supply-chain-applied controls for those materials whose hazards have been mitigated.

3. Requirements in this part don't apply to food whose use is research or testing. However this food,

i. May not be sold or given to the public

ii. Must be labeled "food for research or evaluation use"

iii. Is supplied in small quantity and disposed of.

iv. Is accompanied with documents stating the food is for research and not for public consumption.

b. The supply-chain program must be written.

c. If the supply-chain-applied control is applied by a 3rd party (i.e. not the receiving facility and not the produce supplier -- let's say it's a 3rd party that washes produce on behalf of a farm who sells it to a food processor), then the receiving facility must:

1. verify the control themselves

2. obtain documentation to verify that the control was applied.

§117.410 General Requirements Applicable to a Supply-Chain Program:

a. The supply-chain program must include:

1. Using approved suppliers (i.e. an approved supplier list)

2. The determination of appropriate supplier verification activities

3. Conducting supplier verification activities

4. Documenting supplier verification activities

5. When applicable, verifying that a supply-chain-applied control was applied by a 3rd party.

b. The following are appropriate supplier verification activities for raw materials and other ingredients:

1. Onsite audits

2. Product sampling

3. Review of suppliers food safety records

c. The supply chain program must provide assurance that a hazard requiring a supply-chain-applied control is minimized or prevented.

d. 

1. In approving suppliers and determining verification activities, you must consider:

i. The nature of the hazard

ii. Who will be applying the controls on behalf of your supplier

iii. Supplier performance, including their history, audit results, test results, etc.

iv. Storage and transportation practices

2. If you are considering the suppliers history, this may be limited if they are a small business, a farm, or a facility that is exempt from some FDA provisions.

e. If you learn that a supplier is not controlling a hazard that you identified must be controlled by the supplier, then you are obligated to document this and take prompt action.

117.415 Responsibilities of the Receiving Facility

a. 

1. the receiving facility must approve suppliers

2. The receiving facility must conduct all supplier verification activities.

3. A 3rd party may do the following on behalf of the receiving party:

i. establish procedures for receiving raw ingredients

ii. Document that written procedures for receiving raw materials are being followed

iii. Determine and conduct supplier verification activities

4. The supplier may conduct product testing themselves and provide this to the facility conducting the supplier verification.

b. A receiving facility may not accept any of the following as a supplier verification activity:

1. Determination by the supplier of appropriate supplier verification activities.

2. An audit conducted by the supplier

3. A review of records by the supplier of the supplier.

c. The receiving facility may accept a 3rd party audit result provided by the supplier.

§117.420 Using Approved Suppliers

a. Approval of Suppliers The receiving facility must approve suppliers and document it before receiving ingredients from them.

b. Written procedures for receiving raw materials and other ingredients 

1. You must write and implement procedures for receiving products (i.e. a receiving SOP)

2. Your written procedures must ensure that ingredients are only received from approved suppliers

3. The use of these written procedures must be documented (i.e. you must have a receiving log to show that you are following your written receiving procedure)

§117.430 Conducting Supplier Verification Activities for Raw Materials and Other Ingredients

a. You must conduct supplier verification activities before using the supplier.

b.

1. When a hazard in a raw material will be controlled by the supplier and the outcome of exposure to the hazard results in a serious injury or death, then:

i. the appropriate supplier verification activity is an onsite audit

ii. the audit must be conducted before that raw material is supplied and at least annually thereafter.

2. The requirements above (b) (1) don't apply if other verification activities can provide assurance that this hazard is controlled.

c. If the supplier is a qualified facility, the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the quality facility exemption for their supplier.

2. The receiving facility must get written assurance every 2 years that the supplier is compliant with FDA regulations or the equivalent. This must include

i. description of the preventive controls in place used to control hazards.

ii. Statement that the facility is in compliance with all applicable laws.

d. If the supplier is a farm that grows produce not covered under 112 (FDA produce standards), the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the supplier's exemption from part 112 for their supplier.

2. Obtains written assurance that acknowledges that the food is subject to FDA regulations

e. If the supplier is a shell egg producer not subject to requirements of part 118 (FDA Shell Egg Standards) because they have fewer than 3,000 laying hens, the receiving facility doesn't need to comply with parts (a) and (b) of this section.

1. The receiving facility must get an annual written assurance of the exemption from part 118 for their supplier, because the supplier has fewer than 3000 laying hens.

2. Obtains written assurance that acknowledges that the food is subject to FDA regulations

f. There must not be any financial conflicts of interests related to verification (i.e. payments to a company performing supplier verification cannot be related to the results of the activity).

§117.435 Onsite Audit

a. An onsite audit must be performed by a qualified auditor

b. The auditor must consider all regulations to which a supplier is subject. The audit must include a review of food safety plan/HACCP plan.

c.

1. The following may be substituted for an onsite audit:

i. Inspection results from the FDA, State, or local agency.

ii. Inspection results from an overseas FDA equivalent.

2. If the inspection is from a foreign authority recognized as equivalent to the FDA, then the food produced by the supplier must fall within the scope of that recognized authority.

§117.475 Records Documenting the Supply Chain Program

a. Records related to supply-chain program are subject to requirements of Subpart F

b. The receiving facility must review the supplier records below in part (c) in the same manner that they would complete their own record verification (as defined in §117.465)

c. The facility must document the following records in their supply-chain program

1. Written supply chain program

2. Documentation that an importer is in compliance with the supply chain verification program requirements.

3. Documentation of the approval of that supplier

4. Written procedures for receiving raw materials and ingredients.

5. Documentation demonstrating the use of written procedures for receiving raw ingredients (This could be a receiving log)

6. Documentation of the approval of the supplier

7. Documentation of an onsite audit, including:

i. the name of the supplier being audited

ii. documentation of audit procedures

iii. dates of the audit

iv. conclusion of the audit

v. corrective actions to be taken in response to deficiencies found in the audit.

vi. documentation that the audit was conductected by a qualified auditor

8. Documentation of sampling and testing (if conducted as part of supplier verification) 

i. Identification of ingredient tested, number of samples tested.

ii. Identification of test conducted including the analytical methods.

iii. Dates of the tests

iv. Test results

v. Corrective actions taken in response to the testing

vi. Information identifying the lab conducting testing

9. Documentation of the review of the supplier's relevant food safety records.

i. The name of the supplier

ii. Dates of the record review

iii. General nature of the records review

iv. Conclusions of the review

v. Corrective actions taken in response to deficiencies found.

10. Documentation of other supplier verification activities conducted.

11. Documentation of the determination that verification activities conducted in lieu of an onsite audit are sufficient in the case that the hazard controlled by the supplier is one that could cause serious health consequences or death. You must provide adequate assurance that the supplier is controlling those hazards.

12. Documentation of an alternative verification activity if the supplier is a qualified facility.

13. Documentation of an alternative verification activity if the supplier is a farm.

14. Documentation of an alternative verification activity if the supplier is a shell egg producer.

15. The written results of an inspection of the supplier

16. Documentation of actions taken with respect to non conformance.

17. Documentation of mitigation of a hazard, if that control is applied by a 3rd party.

18. When applicable, documentation about the 3rd party and their verification activities.

This article is for you if…

∆ You are an FDA-regulated food business

∆ You purchase packaging/ingredients from one or more suppliers

∆ You are not defined as a very small business

---

---

Resources

FDA Regulation: Part 117 Subpart G - Supply Chain

---

More Regulation Guides

---

More Posts

---

What You Need to Know

• Records can be electronic or paper.

• They must have:

  • Plant name / address

  • The date/time

  • Product name

  • Signature/initials

  • Actual information/observations not summaries

• You must store records onsite for at least 2 years

• You must be able to retrieve records within 24 hours.

• All records must be made available upon request
  

All of our food safety plan templates are aligned with this section.

Summary of Subpart F: Record Keeping

Below is a summary of Subpart F so that you can get a deeper sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.305 (f) (2) then just look up this same code in the CFR.

§117.301 Records Subject to the Requirements of this Subpart

This section quickly states two points, neither of which are terribly important:

1. Only the food safety plan must be dated and signed when created and updated.

2. If a business is applying for a small business exemption (aka "Qualified Facility exemption") the standards for those records is less than what is described in this section.

§117.305 General Requirements Applying to Record

Records must:

a. Be kept as originals, true copies (i.e. scans, photocopies) or electronic records.

b. Contain the actual values and observations, not summaries.

c. Be accurate, unchangeable and legible

d. be created in real-time with the activity being documented.

e. Be as detailed as necessary

f. Include:

1. information about the plant identity

2. The date (and time, if necessary)

3. Signature or initials of the observer

4. Product name and lot code, if applicable

g. Electronic records required by other regulations may be subject to the requirements in Part 11 (This is the FDA section about electronic records, it unlikely applies to your business if you are following this statute)

§117.310 Additional Requirements Applying to the Food Safety Plan

The owner or operator of the plant must sign and date the food safety plan when it is first authored and whenever it is modified.

§117.315 Requirements for Record Retention:

a.

1. All records must be retained onsite for 2 years

2. A qualified facility must retain records attesting to their exempt status.

a. Small businesses operating under a Qualified Facility exemption must retain records to support that they apply for the exemption (typically 3 years of records)

b. Records that relate to equipment or processes that are no longer used must be retained for 2 years after their discontinuation.

c. You may store records offsite (not food safety plan) if you can retrieve them within 24 hours.

d. You can store a food safety plan offsite if the plant is closed

§117.320 Requirements for Official Review

All records must be made available upon request

§117.325 Public Disclosure

Your records may be disclosed by the FDA in accordance with Chapter 20 of the CFR

§117.330 Use of Existing Records

a. Existing records used for other purposes don't have to be duplicated to satisfy these requirements.

b. The records don't have to be kept in one set.

§117.335 Special Requirements Applicable to a Written Assurance

Any written assurance (which is required by other parts of the code) must contain the date and the names/signatures of the officials making the attestation.

Part 117 -- Subpart F: Requirements Applying to Records That Must Be Established and Maintained

Resources

FDA Regulations: Part 117 -- Subpart F (Record Keeping)

More About Food Safety Plans

---

More Posts

This is a regulation summary For a more general guide to Food Safety Plans, start here

What You Need to Know:

This section outlines the pre-requisite for a food safety plan and associated operational and documentation requirements.

Summary of Subpart C: Hazard Analysis and Risk-Based Preventive Controls

Below is a summary of Subpart C so that you can get a quick sense of the requirements. If you want to read the original text, check out the source texts, linked below.

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease. For example,  you have a question about my wording in §117.126 (a) (2) then just look up this same code in the CFR.

---

§117.126 Food Safety Plan

a. Requirement for a food safety plan:

1. You must have a written and implemented food safety plan

2. It must be prepared or overseen by a Preventive Controls Qualified Individual

b. Contents of a food safety plan

It must include the following, in writing:

1. A hazard analysis

2. Preventive controls (if you identified a hazard in your hazard analysis that you deem requires a preventive control)

3. Supply chain program

4. Recall plan

5. Procedures for monitoring your preventive controls

6. Corrective Action Procedures

7. Verification procedures

c. Records: The records generated are subject to regulations under Subpart F. (i.e. you must store them either in print or electronically)

§117.130 Hazard Analysis

a. Requirement for a hazard analysis:

1. You must conduct a hazard analysis for each type of food manufactured, processed, packed, or held at your facility.

2. The hazard analysis must be written.

b. Hazard Identification: This must consider

1. known or reasonable hazards, including:

i. Biological Hazards (bacteria, parasites, etc.)

ii. Chemical hazards (i.e. toxins, pesticides, food allergens)

iii. Physical hazards (i.e. stone, glass, metal fragments)

2. Hazards that could be present in the food because:

i. the hazard occurs naturally (i.e. toxins in fish)

ii. The hazard may be accidentally introduced (jewelry from employee falls into food)

iii. The hazard may be introduced intentionally for economic gain (i.e. sabotage by a competitor)

c. Hazard Evaluation: 

i. the hazard analysis must evaluate the hazards identified to assess the severity of illness or injury that would occur and the probability that it would occur if left unaddressed.

ii. The hazard evaluation must consider environmental pathogens whenever a ready-to-eat (RTE) food is exposed to the environment before packaging.

2. The hazard analysis must consider these effects on the food:

i. formulation of the food

ii. condition and design of the facility

iii. Raw materials and other ingredients

iv. Transportation practices

v. Processing procedures

vi. Packaging and labeling activities

vii. Storage and distribution

viii. intended use of the product

ix. Sanitation, including employee hygiene

x. any other relevant factors (i.e. weather, natural toxins)

§117.135 Preventive Controls

a.

1. You must identify and implement preventive controls when required by your hazard analysis.

2. Preventive controls include: Critical Control Points and other controls.

b. Preventive controls must be written

c. Preventive controls include:

1. Process Controls: These are procedures and processes that are used to control parameters of processing (i.e. acidifying, refrigerating, cooking.) They must be written in a way that is specific to your process and they must include:

i. parameters associated with controlling the hazard (i.e. if you are using cooking as a process control, then you must include the required cook temperature and cook time)

ii. The maximum or minimum values required to control the hazard.

2. Food Allergen Controls include processes to control food allergens. These are implemented to:

i. Protect food from allergen cross contact

ii. Label food properly with allergens to ensure it isn't misbranded

3. Sanitation Controls: Practices to ensure the facility is kept clean and to minimize biological hazards. These relate to:

i. Cleanliness of food-contact surfaces (equipment, utensils, tables)

ii. Prevention of contamination of food from dirty sources (i.e. dirty people, dirty food, dirty packaging, dirty raw ingredients)

4. Supply Chain Controls: This is described fully in Part G

5. Recall Plan: You are required to have a recall plan (see below)

6. Other Controls: You may have other types of controls (i.e. hygiene training and current good manufacturing practices)

---

§117.136 Circumstances in which preventive controls are not required

a. Circumstances You aren't required to implement preventive controls if any of the following apply:

1. The food cannot be consumed without application of an appropriate control (i.e. coffee beans cannot be consumed without pouring boiling water on them, which would kill any bacteria on the bean)

2. You rely on your customer, who is subject to this subpart, to ensure that the hazard is mitigated. You must:

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that the customer is following the procedures you have provided, which will eliminate the hazard.

3. You rely on the customer who is not subject to this subpart to eliminate the hazard. You must:

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that the customer is following the procedures you have provided, which will eliminate the hazard.

4. You rely on the customer to provide assurance that the food will be processed to control the hazard by a subsequent entity in the supply chain

i. Disclose in writing that the food is "not processed to control [identify hazard]" and

ii. Annually obtain written assurance that your customer will:

A. Disclose in documents accompanying the food that it is "not processed to control [identify hazard]"

B. Will only sell to another entity that agrees in writing that it will mitigate the hazard and obtain similar written assurance from subsequent customers.

5. You have established and implemented a system that ensures control of the hazards in your product, at the distribution step.

b. Records: You must document any circumstance (related to a., above) that applies to you, including written assurances from customers.

---

§117.139 Recall Plan

If your food has a hazard that requires a preventive control,

a. You  must establish a written recall plan.

b. The recall plan must include a procedure for a recall scenario and assign responsibility for taking those steps. It must address how to:

1. Directly notify recipients of the product being recalled and how to dispose of/return the food.

2. Notify the public about any hazard in the food, when this is required to protect public health.

3. Conduct effectiveness checks to verify the recall is carried out.

4. Dispose of recalled food.

---

§117.140 Preventive Control Management Components

a. You must conduct the following activities for each of your preventive controls:

1. monitoring activities

2. corrective actions

3. verification activities

b. You must conduct the following activities for your supply-chain program:

1. corrective actions, especially related to supplier non-conformance.

2. Review of records

3. Re-analysis of your supply chain program over time and as it changes.

c. You do not need to conduct the following activities for your recall plan: monitoring, corrective actions, verification activities.

---

§117.145 Monitoring

as appropriate to the nature of the preventive control, you must implement

a. Written Procedures: You must have written procedures for how and how often you will monitor preventive controls.

b. Monitoring: You must monitor preventive controls enough to ensure they are being peformed.

c. Records: 

1. You must document your monitoring actions and verify this (see §117.165)

2. Exception Records: You can use exception records (i.e. the record only shows when a deviation occured.) For example, a log monitoring refrigeration may only show records when the temperature is unacceptable

---

§117.159 Corrective Actions and Corrections

a. Corrective Action Procedures: 

1. You must establish and implement written corrective action procedures. They must address:

i. the presence of a pathogen in a ready-to-eat product

ii. the presence of an environmental pathogen detected.

2. Corrective Action Procedures must describe the steps to be taken to ensure that:

i. appropriate action is taken to correct a problem associated with a preventive control.

ii. Appropriate action is taken to reduce the likelihood that the problem will recur.

iii. All affected food is evaluated for safety

iv. All affected food is prevented from entering commerce.

b. Corrective Action in the Event of an unanticipated food safety problem:

1. You must follow the procedure in (b)(2) if

i. a preventive control fails and a corrective action hasn't been established.

ii. a preventive control is found to be ineffective

iii. Verification records are found to be incomplete or improper decisions were made about corrective action

2. If any of the circumstances above in (b) (1) apply, you must:

i. Take corrective action, Ensure it doesn't happen again, re-evaluate all food for safety.

ii. reanalyze your food safety plan to see if changes are required.

c. Corrections: You don't need to follow sections (a) and (b) above if

1. You take action to correct a minor and isolated problem, insofar as these are not related to allergen controls or sanitation controls.

2. You take action in a timely manner to correct a minor and isolated problem insofar as it doesn't directly impact product safety

d. Records: All corrective actions taken in this section must be documented. Corrective actions must also be verified according to §117.155

---

§117.155 Verification

Note: The Verification process is one that verifies various other parts of the plans have been undertaken as specified. This can take the form of a supervisor regularly reviewing records and verifying them with a signature.

a. Verification Activities: As it relates to a preventive control, you must verify

1. That the preventive control is valid

2. that monitoring is being conducted as required.

3. that appropriate decisions are being made in relation to corrective action.

4. that the preventive control is implemented and effective.

5. the reanalysis of your preventive controls (as your process changes or at minimum every 3 years)

b. Documentation: All verification activities must be documented in records.

§117.160 Validation

a. You must validate that the preventive controls implemented actually work.

b. Your validation must:

1. Be performed by a Preventive Controls Qualified Individual (PCQI)

i. Within 90 days of beginning production or there must be written justification for why if  >90 days after production begins.

ii. Whenever a change is made that could impact how a hazard is controlled.

iii. Whenever the food safety plan is reanalyzed.

2. Must include scientific and technical evidence (or conducting your own studies) to determine whether preventive controls will control the hazards.

c. You do not need to validate:

1. Food allergen controls

2. Sanitation controls

3. Recall plan

4. Supply chain program

5. Other preventive controls if the PCQI prepares the written justification that a validation is not applicable based the nature of the hazard and the preventive control.

---

§117.165 Verification of Implementation and Effectiveness

a. Verification Activities: You must verify that preventive controls are consistently implemented and effective. This includes doing the following:

1. Calibrating instruments for accuracy

2. Product testing

3. Environmental monitoring

4. Review of records to ensure they are complete and activities were performed according to the plan

i. Records of monitoring and corrective action must occur within 7 days (or provide a written justification for why not)

ii. Other records (calibration, supplier, product testing) must occur in a reasonable amount of time.

b. Written Procedures: The following activities must be written:

1. The method and frequency of calibrating tools

2. Product testing. These procedures must be scientifically valid, they must identify the tests conducted, the methods used, the pathogens, the laboratory conducting the testing, and the corrective action procedures.

3. Environmental monitoring must be: scientifically valid, identify the locations and sites to be tested, the timing and frequency of these samplings, the tests conducted and methods used, the laboratory, and the corrective action procedures.

---

§117.170 Reanalysis

a. You must reanalyze your food safety plan every 3 years.

b. You must reanalyze your plan whenever:

1. A change creates a new hazard or increases an existing hazard

2. Whenever you become aware of a new hazard

3. Whenever appropriate after an unanticipated food safety problem.

4. When you find a part of your plan or a preventive control is ineffective

c. You must complete the reanalysis

1. before any changes in activities OR

2. Within 90 days of the beginning of production for a new product (or >90 days if written justification is provided)

d.  You must also document the basis for the conclusion that no revisions are required.

e. A preventive controls qualified individual must oversee this reanalysis.

f. You must conduct a reanalysis when the FDA determines necessary and when there are new developments in scientific understandings.

---

§117.180 Requirements Applicable to a Preventive Control Qualified Individual and a Qualified Auditor

a. One or more PQCI must do or oversee the following:

1. preparation of the food safety plan

2. validation of the preventive controls

3. written justification for >90 day time frame for validation

4. Determination that validation is not necessary.

5. Review of records

6. Written justification for exceeding 7 day time frame for reviewing records.

7. reanalysis of food safety plan

8. determination that reanalysis can be completed in a time frame that >90 days of the production of the new food being produced.

b. A qualified auditor must consult an onsite audit:

c. 

1. To be a PCQI, one must have completed training equivalent to that developed by the FDA or be qualified through job experience. This individual may or may not be an employee of the facility.

2. To be a qualified auditor requires technical expertise achieved through training, education, or experience.

d. All training in the development and applications of preventive controls must be documented in records.

---

§117.190 Implementation Records Required for this Subpart

a. You must establish records regarding the implementation of a food safety plan, including:

1. Documentation for not establishing a preventive control (you can do this in the hazard analysis using our template)

2. Records documenting the monitoring of preventive controls

3. Records documenting corrective actions

4. Records that document verification, as related to

i. Validation

ii. Verification of monitoring

iii. Verification of corrective actions

iv. Calibration of process monitoring and verification instruments

v. Product testing

vi. Environmental monitoring

vii. Records review

5. Records documenting the supply chain program

6. Records documenting training for the Preventive Conrols Qualified Individual and qualified auditor.

b. These records are subject to requirements in subpart F.

---

This Article Is For You If…

∆ You manage a facility that makes, holds, or packs food.

∆ You are subject to Part 117 Subpart C (very small businesses are exempt from this requirement)

More About Food Safety Plans

More Posts

Resources

FDA Regulation Title 21 — Part 117 — Subpart C Hazard Analysis and Risk-Based Preventive Controls

What You Need to Know

Part 117 Subpart B is called Current Good Manufacturing Practices (CGMPs). 

These CGMPs outline the major requirements that a food processor must adhere to, including:

• Facility requirements

• Employee requirements

• Equipment requirements

• Cleaning requirements

• Warehousing & Distribution requirements

Summary of Current Good Manufacturing Practices

This text is aligned with the coding used in the FDA Regulations so that you can hunt down the corresponding section with ease.

For example,  you have a question about my wording in §117.110 (b) (2) then just look up this same code in the CFR.

117.10 Personnel:

For a reduced summary of this section, see Personnel

a. Disease Control: Sick employees must be excluded from operations that could result in food contamination

b. Cleanliness: Employees must have clean practices:

1. Clothing that protects against contamination

2. Adequate personal cleanliness

3. Hand washing

4. Removing unsecured jewelry

5. Wearing gloves in a safe manner

6. Wearing hair restraints

7. Storing other belongings in areas where food is exposed/equipment is washed.

8. Not eating food, chewing gum, drinking beverages, or using tobacco in food areas.

9. Taking other precautions

§117.20 Plants & Grounds

For a reduced summary of this section, see Facility Requirements

a. Grounds: They must be kept in a condition that protects against contamination. Methods include:

1. Eliminate conditions for breeding/harboring pests

2. Maintain roads, yards, parking lots

3. Drain areas (i.e. puddles) that may breed pests or contribute to food contamination

4. Even if the grounds aren’t in your control, you must still mitigate contamination hazards.

b. Plant Construction & Design: The space must be suitable in size, construction and design for food production.

1. Must have adequate space for equipment and storage.

2. Must allow you to take precautions which reduce allergen contamination and food contamination (for example -- by chemicals, filth, other materials). Ways to eliminate contamination include separating operations by: location, time, partition, air flow systems, dust control system, etc.

3. Protect food that is stored outside in bulk containers:

4. Floors, Walls, Ceilings must be constructed in a way that allows them to be cleaned. The construction of the space must allow employees to do their jobs and not contaminate food, packaging, and work areas.

5. There should be adequate lighting in all food and employee areas (including food storage areas and employee locker rooms). All bulbs and glass that is suspended over areas where food is exposed should be shatter resistant.

6. There should be adequate ventilation to minimize dust, steam, odors, and vapors.

7. Provide screens or other protection against pests (door sweeps, air curtains)

§117.35 Sanitary Operations

For a reduced summary of this section see Sanitary Operations in Food Processing Facilities

a. General Maintenance: Your space and everything in it must be in good repair to prevent food from being contaminated (i.e. no leaky ceilings, which could drip in food). Your cleaning processes should protect your food, packaging, and workspace from contamination.

b. Cleaning chemicals:

1. You must only use safe cleaning chemicals. Toxic chemicals may only be allowed in food areas if they are:

i. Required for cleaning

ii. Used in lab testing

iii. Necessary for equipment maintenance

iv.  Absolutely necessary

2. You must store toxic chemicals in a way that protects food from contamination (Label it with the everyday name and keep it away from food and packaging)

c. Pest Control - Pests aren’t allowed in any area of the plant. You must exclude pests in the space and only use pesticides when it won’t result in contamination of food, packaging or work spaces.

d. Sanitation - You must clean food contact surfaces, including utensils, tables, equipment, to protect against contamination.

1. If you process low moisture (dry) food, your food contact areas must be clean and dry before use.

2. In “wet processing” food processing areas must be cleaned before use and after any contamination occurs.

3. Paper towels, paper cups and other single-use items must be protected from contamination.

e. Non-food-contact-surfaces (i.e. walls, ceilings or anything that doesn’t touch food) must be cleaned as much as necessary to prevent contamination of food, packaging, or work areas.

f. Portable equipment and utensils must be stored in a way that doesn’t contaminate work areas.

§117.37 Sanitary Facilities and Controls

For a reduced summary of this section see Facility Requirements

a. Water Supply must be from an adequate source. Running water must be of a suitable temperature and pressure and be provided in all food processing/cleaning areas.

b. Plumbing: Must

1. Carry adequate amounts of water around the plant.

2. Remove sewage from the plant.

3. Avoid contaminating food, equipment, water supply, utensils, ec.

4. Provide floor drainage in spaces where floors get very wet

5. Avoid back flow between plumbing systems

c. Sewage Disposal: Sewage must be disposed of adequately

d. Toilet Facilities: Each plant must have clean toilet facilities.

e. Hand-washing facilities: Each plant must provide hand washing facilities.

f. Rubbish: store rubbish to minimize odor, pests, and contamination

§117.40 Equipment and Utensils

For a reduced summary of this section see Equipment and Utensils

a. Equipment and Utensils

1. Equipment and utensils must be designed to be cleanable and maintained to avoid contamination.

2. Equipment and utensils must not contaminate food with lubricants, metal fragments, water, etc.

3. Equipment must be installed in a way that they can be cleaned and maintained.

4. Food-contact surfaces must be corrosion-resistant.

5. Food-contact surfaces must be non-toxic

6. Food-contact surfaces must be maintained to protect food from allergen cross-contact

b. Seams on food-contact surfaces must be seamless to minimize accumulation of particles.

c. Equipment kept in food areas must be constructed so it can be kept clean -- even if it doesn’t contact food.

d. Machinery must be designed in a way that can be kept clean

e. Each freezer and refrigerator must have a thermometer in it.

f. pH meters, thermometers, and other measuring devices must be accurate.

g. Compressed air must be treated in a way that it does not contaminate food.

§117.80 Processes and Controls

For a reduced summary of this section see Processes and Controls

a. General:

1. All operations involving food must align with sanitation principles.

2. Quality control must be used to ensure food and packaging is safe.

3. One or more competent individuals must be responsible for sanitation

4. You must protect your food from allergens and contamination.

5. Testing must be used to identify sanitation failures or possible product contamination.

6. Any contaminated food must be discarded or treated to eliminate the contamination.

b. Raw Materials & Ingredients

1. Ingredients must be inspected for cleanliness and stored safely. If necessary, raw materials should be washed using clean water.

2. Ingredients must be safe for consumption or treated to make them safe (i.e. washed or cooked).

3. Ingredients susceptible to toxins must comply with FDA regulations.

4. Ingredients that are contaminated must comply with FDA regulations if they are to be used.

5. Ingredients must be held in containers that prevent contamination and at an acceptable temperature and humidity level.

6. Frozen ingredients must be kept frozen.

7. Ingredients stored in bulk must be safe from contamination.

8. Ingredients that contain allergens must be identified and held in a way that prevents cross-contact.

c. Manufacturing Operations:

1. Equipment must be maintained in clean condition.

2. All operations should be controlled to minimize growth of bacteria, contamination and spoilage.

3. Food requiring refrigeration must be refrigerated throughout the operation.

4. Measures used to prevent bacteria growth (i.e. cooking, sterilizing, refrigerating) must be adequate.

5. Re-work must prevent contamination and bacteria growth.

6. When ingredients are unprotected they must not be handled in a way that could cause contamination. Food on conveyor belts must be protected.

7. Equipment, containers, and utensils must be constructed and used in a way that doesn’t contaminate food.

8. You must take measures to protect your product from metal or foreign objects.

9. Contaminated food must:

i. Be disposed of OR

ii. Re-worked and re-examined,

10. Food that is being processed must be protected from contamination.

11. Heat blanching --if used-- must be performed properly

12. Foods that are used repeatedly (i.e. dipping sauces, breading) must be protected from contamination and bacteria growth

13. Filling, assembling, and packaging processes must not contaminate food.

14. Dry foods that rely on low moisture for safety must be sufficiently dry.

15. Acidified foods that rely on acid for safety must be sufficiently acidic (pH≤4.6)

16. Ice that touches food must be food quality.

§117.93 Warehousing and Distribution

Storage and transportation of food must protect the food from contamination.

(That’s it!) See source code 21 CFR 117.93 to see for yourself

§117.95 Holding and distribution of Human food by-products for use as animal food

a. By-products held for use as animal food must be protected from contamination:

1. Containers must be safe

2. Food by-products must be protected from contamination

3. By-products used for animal food must be labeled

b. Labeling must use common name

c. Shipping containers must be inspected for contamination prior to use

§117.110 Defect Action Levels

a. Quality control must be used to minimize defects

b.Mixing contaminated food with uncontaminated food to dilute the contamination level is not permitted.

Exemptions

This section applies to most traditional food processors that fall under FDA jurisdiction. However, there are some notable exceptions.

• Farms

• Fishing Vessels

• Establishments who solely hold and transport agricultural products

• Establishments who only raw process (i.e. shell or dry) nuts.

• Mixed-Type farm facilities (defined in §1.227)

---

This Article is For You If…

∆ You produce, pack or pack food that is consumed in the US.

∆ Your food product enters interstate commerce

---

Table of Contents

§117.10 Personnel
§117.20 Plants and Grounds
§117.35 Sanitary Operations
§117.37 Sanitary Facilities and Controls
§117.40 Equipment and Utensils
§117.80 Processes and Controls
§117.93 Warehousing and Distribution
§117.95 Holding and Distribution of Human Food Byproducts for Use as Animal Food
§117.110 Defect Action Levels
Exemptions

---

More About Operating Requirements

More Posts

---

References

FDA Regulations on cGMPS