FDA 483 Citations for Not Having a Written Food Safety Plan Under 21 CFR 117.126

22 hours ago

5 min read

"You did not have a written food safety plan." FDA investigators cited 21 CFR 117.126(a)(1) with that wording 61 times on system-generated Form FDA 483s in fiscal year 2025.

The preventive controls rule for human food, Part 117 Subpart C, requires most registered food facilities to have a written food safety plan prepared or overseen by a preventive controls qualified individual (PCQI). Firms cited for having no plan are often small manufacturers that thought they qualified for an exemption, or facilities that grew past the size where an exemption applied.

What the citation means

Examples written after "Specifically" usually describe:

No written food safety plan at all
A HACCP plan or GMP manual presented in place of a food safety plan
A plan that covers only some products made at the facility
A plan written by a consultant years ago and never implemented or updated
A facility claiming qualified facility status without having submitted the attestation to FDA
No PCQI involved in preparing or overseeing the plan

Who needs a food safety plan

Covered facilities. Facilities that must register with FDA under section 415 of the Federal Food, Drug, and Cosmetic Act, because they manufacture, process, pack or hold human food, are subject to Subpart C unless an exemption applies.

Common exemptions and modified requirements:

Qualified facilities, including very small businesses, generally those with less than $1 million per year in sales of human food plus the market value of food held without sale, adjusted for inflation. They must submit an attestation to FDA (Form FDA 3942a) and meet modified requirements under 117.201
Facilities subject to and in compliance with the seafood HACCP (Part 123) or juice HACCP (Part 120) rules, for those products
Low-acid canned food under Part 113, for the microbiological hazards it covers
Dietary supplements subject to Part 111
Facilities solely engaged in storage of unexposed packaged food, which have modified requirements under 117.206 for food needing temperature control
Certain on-farm activities and farm mixed-type facilities with low-risk activities

Even exempt facilities must meet the good manufacturing practices in Subpart B.

What 21 CFR 117.126 requires

The plan (117.126(a)). You must prepare, or have prepared, and implement a written food safety plan. The plan must be prepared, or its preparation overseen, by one or more preventive controls qualified individuals.

Contents (117.126(b)). The written food safety plan must include:

The written hazard analysis (117.130)
The written preventive controls (117.135)
The written supply-chain program (Subpart G)
The written recall plan (117.139)
The written procedures for monitoring the implementation of the preventive controls (117.145)
The written corrective action procedures (117.150)
The written verification procedures (117.165)

Records and signature (117.126(c) and 117.310). The food safety plan is a record subject to Subpart F. It must be signed and dated by the owner, operator or agent in charge of the facility upon initial completion and upon any modification.

Reanalysis (117.170). The plan must be reanalyzed as a whole at least once every 3 years, and whenever there is a significant change that creates a new hazard or significantly increases a hazard, when you become aware of new information about hazards, when an unanticipated food safety problem occurs, or when a preventive control is found to be ineffective.

How to respond to the 483

FDA does not set a single deadline for responding to a food 483, but most firms respond in writing within 15 business days, so FDA has the response before it decides on further action.

Confirm the requirement

Check whether any exemption applies and document the basis. If you are a qualified facility, submit the attestation and meet the modified requirements. If not, a full plan is required.

Name the PCQI

Assign a PCQI who has completed training under the FSPCA standardized curriculum or an equivalent, or who is qualified through job experience.

Write the plan

Complete the hazard analysis for each product or product group, identify preventive controls, and write monitoring, corrective action and verification procedures, the supply-chain program and the recall plan. Validate process controls where required.

Implement it

Train the people who monitor and record preventive controls, start keeping records, and review them on schedule. A plan on paper that is not followed will draw the next citation.

Assess product already made

If hazards were not controlled, evaluate product made and in distribution and decide whether any action is needed.

What a compliant food safety plan contains

Facility and product description and process flow
Hazard analysis by product or group
Preventive controls: process, allergen, sanitation, supply-chain and other
Monitoring procedures
Corrective action procedures
Verification procedures, including validation, calibration and records review
Supply-chain program
Recall plan
PCQI identification and signature of the owner, operator or agent in charge
Reanalysis schedule

Common mistakes in food safety plan responses

Submitting a HACCP plan without allergen, sanitation and supply-chain controls
Claiming qualified facility status without filing the attestation
Writing a plan with no records to show it is implemented
Covering some products and not others
Forgetting the recall plan

Example: how one response section might read

This illustrates structure only; your response must describe your own products and facts.

Observation 8: You did not have a written food safety plan. Specifically, the facility produces refrigerated hummus and dips and has no food safety plan.

Response:

PCQI: The production manager completed PCQI training on a stated date.
Food safety plan: A food safety plan was completed and signed by the owner on a stated date. It identifies Listeria monocytogenes and pathogen growth, and allergens including sesame, as hazards requiring preventive controls.
Preventive controls: Process controls for pH and refrigeration, allergen labeling controls and sanitation controls with environmental monitoring were put in place, with monitoring records starting on a stated date.
Recall plan: A recall plan was written and a mock recall was performed.
Verification: The PCQI reviews monitoring and corrective action records weekly.

Frequently asked questions

Is a HACCP plan enough?

A HACCP plan can be the basis of a food safety plan, but 117.126 also requires preventive controls beyond critical control points where needed, such as allergen, sanitation and supply-chain controls, plus a recall plan.

Who signs the food safety plan?

The owner, operator or agent in charge of the facility, upon initial completion and upon any modification.

How often must the plan be reanalyzed?

At least once every 3 years, and sooner when changes, new information or problems occur.

How A.P. Lyon documents help

A.P. Lyon's FSMA Food Safety Plan and Preventive Controls Procedure and Food Safety Plan and HACCP Workbook cover the elements of 117.126. They work with the Hazard Analysis Procedure and the Product Withdrawal and Recall Procedure. All are also available within the full food safety management system.

Documents are editable Word and Excel files and must be adapted to your facility and products. A PCQI must prepare or oversee your plan. A.P. Lyon does not provide food safety consulting or prepare food safety plans.

Next steps

Confirm whether an exemption applies, and document it
Name a PCQI and write the plan
Implement monitoring, corrective actions and verification
Respond in writing within 15 business days with dates for each action

To build a complete set of procedures at a volume discount, use Build Your QMS.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.