FSMA Preventive Controls
Aligned with FSSC 22000 – Optional Compliance Enhancement for U.S. FDA FSMA
Requirement Overview
The FSMA Preventive Controls Add-On is an optional enhancement for food facilities certified under FSSC 22000. It aligns your Food Safety Management System (FSMS) with the U.S. FDA’s Food Safety Modernization Act (FSMA), specifically 21 CFR Part 117: Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.
This module complements your ISO 22000-based FSMS by incorporating FSMA-specific requirements such as hazard analysis, preventive controls, recall planning, supply-chain controls, and recordkeeping—critical for facilities exporting to the U.S. or undergoing FDA inspections.
Aligned with BRCGS for Storage & Distribution Issue 4 – Clause 4.3.1 & 4.3.3
Requirement Overview
BRCGS for Storage & Distribution requires that products moved via cross-docking are traceable and controlled at all times, even when they are not held in storage for extended periods.
Clause 4.3.1: “The company shall ensure that traceability is maintained at all stages, including during cross-docking operations.”
Clause 4.3.3: “Procedures shall be in place to ensure that all products handled, including those not stored on-site, remain under control and are not subject to contamination or substitution.”
Cross-docking operations must not compromise product traceability, safety, or integrity. Even with minimal handling and temporary presence, each product must be accurately identified, documented, and protected.
Key Compliance Objectives
-
✓ Map FSMA-specific controls into your FSSC 22000 FSMS
✓ Demonstrate 21 CFR 117 alignment during FDA inspections
✓ Implement Hazard Analysis and Risk-Based Preventive Controls (HARPC)
✓ Define qualified roles and maintain compliant records
Step-by-Step Compliance Implementation
1. Conduct a HARPC-Based Hazard Analysis
-
Activities:
-
• Identify known or reasonably foreseeable hazards (biological, chemical, physical, radiological, economically motivated adulteration)
• Evaluate severity and likelihood
Evidence to Maintain:
-
• FSMA-aligned hazard analysis documentation
• Justifications for exclusion/inclusion of hazards
• Qualified Individual (QI/PCQI) signature
- • Identify known or reasonably foreseeable hazards (biological, chemical, physical, radiological, economically motivated adulteration) • Evaluate severity and likelihood
- • FSMA-aligned hazard analysis documentation • Justifications for exclusion/inclusion of hazards • Qualified Individual (QI/PCQI) signature
2. Identify and Implement Preventive Controls
-
Controls May Include:
-
• Process controls (e.g., temperature, pH)
• Sanitation and allergen controls
• Supply-chain controls
• Recall plans meeting FSMA standards
Records to Maintain:
-
• Monitoring and verification records
• Corrective actions
• Documented recall procedures in compliance with 21 CFR 117.139
- • Process controls (e.g., temperature, pH) • Sanitation and allergen controls • Supply-chain controls • Recall plans meeting FSMA standards
- • Monitoring and verification records • Corrective actions • Documented recall procedures in compliance with 21 CFR 117.139
3. Designate a Preventive Controls Qualified Individual (PCQI)
-
PCQI Responsibilities:
-
• Oversee FSMA elements of the FSMS
• Validate and reanalyze controls
Evidence to Maintain:
-
• PCQI training certificate or documentation
• Food safety plan signed by PCQI
• Review logs and change records
- • Oversee FSMA elements of the FSMS • Validate and reanalyze controls
- • PCQI training certificate or documentation • Food safety plan signed by PCQI • Review logs and change records
4. Establish a FSMA-Compliant Supply-Chain Program
-
If receiving ingredients requiring control:
-
• Verify suppliers via audits, COAs, sampling, or approved documentation
• Keep supplier verification and approval records
Evidence to Maintain:
-
• Supplier risk assessments
• Audit results and control documentation
• Justifications for exemptions
- • Verify suppliers via audits, COAs, sampling, or approved documentation • Keep supplier verification and approval records
- • Supplier risk assessments • Audit results and control documentation • Justifications for exemptions
5. Maintain FSMA Recordkeeping and Reanalysis
-
Plan Components:
-
• Keep records for a minimum of 2 years
• Ensure quick access during FDA inspection
• Conduct reanalysis at least every 3 years or upon significant changes
Evidence to Maintain:
-
• Controlled records aligned with 21 CFR 117 Subparts C & G
• Reanalysis logs
• Traceability of decisions and updates
- • Keep records for a minimum of 2 years • Ensure quick access during FDA inspection • Conduct reanalysis at least every 3 years or upon significant changes
- • Controlled records aligned with 21 CFR 117 Subparts C & G • Reanalysis logs • Traceability of decisions and updates
Common Audit Findings & Recommended Fixes
| Audit Finding | Recommended Action |
|---|---|
| No HARPC-based hazard analysis | Update your hazard analysis to align with FSMA |
| PCQI role not assigned or documented | Assign and train a PCQI, keep documentation |
| Recall plan missing FSMA elements | Revise to include FDA-mandated responsibilities |
| No supply-chain program for controlled hazards | Implement supplier verification and maintain proof |
