HACCP Plan vs FSMA Food Safety Plan

Aaron Lyon

4 hours ago

5 min read

Food safety teams often ask whether their existing HACCP plan satisfies the FDA Preventive Controls for Human Food rule. The short answer is that a HACCP plan is a good starting point, but an FSMA food safety plan under 21 CFR Part 117 covers more ground. This post walks through the main differences and how the ISO 22000 hazard control plan fits between them.

Where each plan comes from

A HACCP plan follows the HACCP principles published by the Codex Alimentarius in its General Principles of Food Hygiene (CXC 1-1969). It identifies critical control points (CCPs) and sets critical limits, monitoring, corrective actions, verification and records for each.

An FSMA food safety plan is required by 21 CFR 117.126 for facilities subject to Subpart C of the Preventive Controls for Human Food rule. It is built on a hazard analysis like HACCP, but it is organized around "preventive controls" rather than CCPs alone.

Difference 1: scope of controls

A HACCP plan focuses on CCPs: points in the process where control is essential and where you can set a measurable critical limit, such as a cook temperature or a metal detector reject.

Under 21 CFR 117.135, preventive controls include controls at CCPs, but also other controls appropriate for food safety. The rule names these types:

Process controls: parameters such as heating, acidifying or refrigerating, with minimum and maximum values.
Food allergen controls: procedures, practices and processes to prevent allergen cross-contact and to make sure labels are accurate.
Sanitation controls: keeping the facility sanitary enough to minimize or prevent hazards such as environmental pathogens and allergen cross-contact.
Supply-chain controls: the supply-chain program under Subpart G.
Recall plan: a written plan under 21 CFR 117.139.
Other controls: for example, hygiene training and other CGMPs where they are needed to control a hazard.

Many allergen and sanitation controls would not be CCPs in a traditional HACCP study. Under FSMA, if the hazard analysis shows they are needed to control a hazard, they become preventive controls with written procedures and records.

Difference 2: who must have what

Requirements depend on the type of operation:

USDA-inspected meat and poultry establishments need HACCP plans under 9 CFR Part 417.
Seafood and juice processors need HACCP plans under FDA's 21 CFR Part 123 and Part 120. Activities covered by those rules are exempt from 21 CFR 117 Subpart C when the facility complies with them.
Most other FDA-registered human food facilities need an FSMA food safety plan under 21 CFR 117 Subpart C, unless an exemption applies.
Qualified facilities (generally very small businesses, as defined in the rule) follow modified requirements instead of the full food safety plan.

These categories have details and exceptions, so confirm which rules apply to your facility. Customer and certification requirements may also call for a documented hazard control plan even where the law does not.

Difference 3: who prepares and oversees the plan

A HACCP plan is developed by a HACCP team, and some regulations require a trained individual for specific tasks.

The FSMA food safety plan must be prepared, or its preparation overseen, by one or more Preventive Controls Qualified Individuals (PCQIs). Under 21 CFR 117.180, the PCQI also performs or oversees validation of preventive controls, records review, reanalysis, and several justification decisions on timeframes. The owner, operator or agent in charge must sign and date the plan when it is first completed and whenever it is modified.

Difference 4: records

Both plans depend on monitoring and corrective action records. The FSMA rule adds specific expectations:

Monitoring, corrective action and verification records, including validation, calibration, product testing, environmental monitoring and records review, as applicable
Records of the supply-chain program
Training records for PCQIs and qualified auditors
Documentation of the basis for not establishing a preventive control in the circumstances allowed by the rule
Review of monitoring and corrective action records by, or under the oversight of, a PCQI within seven working days, unless a longer timeframe is justified in writing

Records must generally be kept for at least two years. The food safety plan itself must stay onsite. Other records may be stored offsite if they can be retrieved within 24 hours of an official request.

Difference 5: the recall plan

A HACCP plan does not usually include a recall plan. Under 21 CFR 117.139, a facility that makes food with a hazard requiring a preventive control must have a written recall plan. It must include procedures and assigned responsibilities for:

Directly notifying consignees
Notifying the public when appropriate
Conducting effectiveness checks
Appropriately disposing of recalled food

ISO 22000 and FSSC 22000 also require withdrawal and recall procedures, so one procedure can be written to cover both, as long as it includes the elements the FDA lists.

Difference 6: reanalysis

Review frequency differs by rule. For example, USDA's 9 CFR 417 requires establishments to reassess the HACCP plan at least annually and whenever changes occur that could affect the hazard analysis.

Under 21 CFR 117.170, the food safety plan must be reanalyzed as a whole at least once every three years. Reanalysis is also required when:

A significant change in activities creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard
You become aware of new information about potential hazards
An unanticipated food safety problem occurs
A preventive control, combination of controls or the plan itself is found to be ineffective

A PCQI must perform or oversee reanalysis, and you must either revise the plan or document why no revision is needed.

How the ISO 22000 hazard control plan fits

ISO 22000:2018, clause 8.5.4, requires a hazard control plan, sometimes called a HACCP/OPRP plan. Each significant hazard is controlled either:

At a CCP, with measurable critical limits, or
By an operational prerequisite program (OPRP), with measurable or observable action criteria

This structure sits between HACCP and FSMA. CCPs line up with HACCP and with FSMA process controls. OPRPs often line up with FSMA allergen, sanitation and other controls, which also do not need critical limits.

In practice, a site certified to ISO 22000 or FSSC 22000 can extend its hazard control plan to meet 21 CFR 117 by adding:

Clear identification of which CCPs and OPRPs are FSMA preventive controls
The supply-chain program, where suppliers control a hazard
The written recall plan
PCQI oversight, records review and reanalysis
The plan signature by the owner, operator or agent in charge

Keeping one set of records

Separate HACCP and FSMA binders create duplicate work and gaps. A better approach is one hazard analysis, one hazard control plan, and a map showing where each FSMA element lives.

A.P. Lyon's Food Safety Plan and HACCP Workbook ($149) is an editable Excel file with sheets for product description, process steps, hazard analysis, CCP/OPRP categorization, the hazard control plan, FSMA preventive controls, the supply-chain program, a verification schedule and plan approval. The FSMA Food Safety Plan and Preventive Controls Procedure covers preparing, signing, maintaining and reanalyzing the written plan, with a PCQI record review log. Both are part of the Food Safety Management System, Complete, described in our launch post.

The documents need to be adapted to your site and products, and a PCQI or other qualified person should review your food safety plan. They are documentation, not validation or certification.

Next steps

To see how ISO 22000, FSSC 22000 and 21 CFR 117 fit together, read our Food Safety Guide. Browse the food safety documents, choose individual procedures in Build Your QMS, or contact A.P. Lyon about consulting for help structuring your hazard analysis and food safety plan records.