FIC Article - Regulatory Clarification
Do You Need to Replace Your HACCP Plan Under FSMA?
Written by Nima Saidi
March 1, 2026
Introduction
When the Food Safety Modernization Act (FSMA) introduced the Preventive
Controls for Human Food (PCHF) rule under 21 CFR Part 117, many food businesses
asked the same question:
Do we need to throw out our HACCP plan and start over? The short answer is no. Preventive Controls does not replace HACCP. It builds on existing HACCP principles and expands them. In most cases, facilities do not need to discard their HACCP plan. They need to review it and ensure it aligns with the broader scope and documentation requirements of the Preventive Controls rule.
From HACCP to Preventive controls
The Preventive Controls rule does not replace the HACCP approach. It extends it.
HACCP involves seven principles: conducting a hazard analysis, determining CCPs, establishing critical limits, establishing monitoring procedures, establishing corrective actions, establishing verification procedures, and establishing recordkeeping systems. These are supported by five preliminary steps, including assembling the HACCP team, describing the food and its intended use, developing and verifying a flow diagram. Altogether, these form the well-known twelve steps of HACCP.
The Preventive Controls rule builds on these same concepts. Hazard analysis remains central. Process controls function similarly to CCPs. Monitoring, corrective actions, verification, and recordkeeping remain required management components. The core structure is the same.
Where the Preventive Controls rule expands beyond traditional HACCP is in the formal inclusion of additional preventive control categories. While HACCP plans often focus primarily on CCP process controls, the Food Safety Plan under 21 CFR Part 117 may require food allergen controls, sanitation controls, and supply-chain controls in addition to process controls.
Undeclared allergens are a leading cause of Class I recalls. Poor sanitation can lead to environmental contamination from pathogens such as Listeria monocytogenes or Salmonella, particularly in ready-to-eat facilities. Suppliers may introduce hazards through contaminated ingredients or inadequate lethality steps. The Preventive Controls framework ensures these areas receive the same structured attention as traditional CCPs from HACCP.
Do You Need to Replace Your HACCP Plan?
You do not need to replace your HACCP plan. You need to update it. Under 21 CFR Part 117, you must expand your HACCP plan to formally include preventive controls beyond traditional CCPs when required by your hazard analysis. That means allergen controls, sanitation controls, and supply-chain controls cannot just sit as general GMPs or prerequisite programs if they control a hazard that requires a preventive control. They must be treated as preventive controls and include the required management components: monitoring, corrective actions or corrections, verification, and recordkeeping.
If your HACCP plan already addresses hazards properly and you formally manage those additional control areas with the required documentation, you are largely aligned. If not, you must adjust your plan so it meets the Preventive Controls rule.
The bottom line is simple: do not throw out your HACCP plan. Modify it so it complies with the Preventive Controls requirements. Keep in mind, in addition to the identification of controls other than CCPS, there are other technical requirements for the food safety plan. See below.
Other Requirements of a Food Safety Plan Under 21 CFR Part 117
A Food Safety Plan under the Preventive Controls rule is not just about identifying preventive controls. It also includes additional required elements that must be documented and implemented.
First, we can see that
compared to a HACCP plan, the food safety plan requires broader hazard
considerations—such as radiological hazards (a type of chemical hazard) as well
as economically-motivated food safety hazards.
The rule also introduces the concept of corrections, which are immediate fixes such as re-cleaning a line before startup. In some situations, a correction may be taken instead of implementing a full corrective action procedure. Traditional HACCP plans typically focus on corrective actions when a critical limit is not met, but they do not formally distinguish between corrections and corrective actions in the same structured way required under Part 117.
Furthermore, a written recall plan must be included if the hazard analysis identifies any hazard requiring a preventive control. This is a specific regulatory requirement under Part 117 and must outline procedures for notifying consignees, conducting effectiveness checks, and appropriately disposing of affected product.
Finally, the Food Safety Plan must be developed or overseen by a Preventive Controls Qualified Individual, or PCQI. The PCQI is responsible for preparing the plan, validating process controls when required, reviewing records, and conducting reanalysis.
Conclusion
Overall, while the foundation remains HACCP-based and risk-focused, the Food Safety Plan under Part 117 requires expanded documentation, broader preventive controls, formal management components for each required control, a recall plan, and oversight by a PCQI. The goal is not to abandon HACCP, but to ensure your plan meets the full regulatory framework of the Preventive Controls rule.
Training Resources
If you want a step-by-step breakdown of how to update or build a Food Safety Plan that aligns with 21 CFR Part 117, our online self-paced PCQI training (FDA-recognized curriculum) provides an in-depth and interactive walkthrough of hazard analysis, preventive controls, management components, and regulatory expectations. In the course, we also cover additional differences between traditional HACCP systems and the Preventive Controls framework that go beyond what is summarized in this article.
Explore all available PCQI training options using the button below. The self-paced format is available to start anytime.
