HACCP News
People call almost any food safety plan “a HACCP plan,” but which regulation actually governs yours depends on what you make and who inspects you. Meat and poultry plants answer to USDA FSIS. Most other FDA-regulated food facilities answer to a different rule entirely – one that borrows the hazard-analysis idea from HACCP but is not the same regulation. Getting this wrong matters: the required plan elements, and who is allowed to sign off on it, are not interchangeable between the two.
This post goes one level deeper than GFSI or HACCP: What’s the Difference, and Do You Need Both, which covers how a GFSI-recognized scheme sits on top of whichever HACCP-based plan you already maintain. Here, the question is which regulation applies to you in the first place.
Two Different Starting Points: FSIS and FDA
Some facilities must have a HACCP plan by regulation, full stop. USDA FSIS requires one for meat and poultry (9 CFR 417), and FDA requires HACCP for seafood (21 CFR 123) and juice (21 CFR 120). These are the classic HACCP programs most people picture: a hazard analysis, critical control points, critical limits, monitoring, corrective action, verification, and records, built on the seven HACCP principles.
Most other FDA-regulated food facilities fall under a different rule: Preventive Controls for Human Food, 21 CFR 117, often called HARPC (Hazard Analysis and Risk-Based Preventive Controls). It is HACCP-based – it starts from the same hazard analysis idea – but it is not the same regulation, and it does not use the term “HACCP plan.”
What 21 CFR 117 Actually Requires
A facility under 21 CFR 117 has to put together a written food safety plan covering a hazard analysis, the preventive controls needed to minimize or prevent the hazards identified, monitoring procedures, corrective action procedures, and verification activities – plus a recall plan, and a supply-chain program for any hazard controlled by a supplier rather than in-house. The plan has to be prepared, or overseen, by a preventive controls qualified individual – the regulation’s own shorthand for this is PCQI.
Where It Overlaps With Classic HACCP, and Where It Doesn’t
Both frameworks start from a hazard analysis, and both expect monitoring, corrective action, verification, and records that prove the system worked. The difference is in what gets controlled, and how. Classic HACCP only requires a formal critical control point – with a critical limit and monitoring at the frequency the plan sets – at the specific steps the hazard analysis identifies as necessary to control a hazard. The preventive controls under 21 CFR 117 are broader by design: alongside process controls that function much like CCPs, the rule can also call for sanitation controls, allergen controls, and supply-chain controls, each with its own monitoring and verification expectations that don’t map one-to-one onto the seven HACCP principles.
Who’s Allowed to Sign Off
Each of these regulations expects the hazard analysis and the plan built on it to come from someone trained to do the work, not whoever was available. FSIS and the FDA seafood and juice HACCP rules each set their own required HACCP training. 21 CFR 117 is more specific about the credential: the preventive controls qualified individual has to have completed recognized preventive controls training or have equivalent job experience, and that person’s role in preparing, reviewing, and reassessing the plan is itself something an inspector will ask about.
What Inspectors and Auditors Look For
An inspector working from any of these regulations wants to see that the written plan matches the process actually running on the floor today, not the process that was running when the plan was first written. That means the plan gets reassessed when the process, the recipe, or the facility changes; monitoring records match the frequency and the limits or parameters the plan specifies; deviations have a documented corrective action; and verification activities actually happened and were reviewed by someone with the authority to do so.
Where This Gets Confused
- Assuming “HACCP” is a single regulation, and never checking which rule actually governs the product or process in front of you.
- Treating a 21 CFR 117 hazard analysis and a classic HACCP plan as interchangeable paperwork, and copying one into the other without adjusting for what each actually requires.
- Making more than one category of product and assuming a single plan covers all of it, when different product lines in the same facility can fall under different rules.
- Having a plan on file that was never actually reviewed or signed by someone who meets the qualified-individual requirement for that regulation.
How HACCP Builder Helps
Whichever regulation applies to your facility, HACCP Builder keeps your HACCP plan, hazard analysis, and daily records in one system – always current and ready to hand to an inspector or an auditor – instead of a plan that gets written once while the logbook drifts away from it. Which specific plan elements and qualified-individual sign-off your regulation calls for is yours to confirm; see how a GFSI-recognized scheme builds on top of whichever HACCP-based plan you maintain on the GFSI or HACCP page.
An Honest Note on Scope
Scope note: which regulation, or regulations, apply to you depends on your product, your process, and your facility, and FSIS and FDA draw these lines differently from each other. Some facilities are subject to more than one rule at once. Confirm what applies to your operation with your regulator or a qualified individual – this post is general information, not legal or regulatory advice for your facility.
Contact HACCP Builder to see how this applies to your own facility.
We can be reached at (866) 577-4030 ext. 800 or via email at [email protected]. Leave us a message or book a free demo today!
