FSMA PCQI cheat sheet

Biological, chemical (including radiological), physical, and economically motivated adulterant hazards are the four hazard categories recognized under 21 CFR 117.

A hazard is a biological, chemical, or physical agent that is reasonably likely to cause illness or injury absent its control; a hazard requiring a preventive control is one reasonably likely to occur.

Hazard analysis under 117.130 is the first required element; a preventive control is required only for hazards the analysis identifies as reasonably likely to occur.

Process controls affect a parameter during manufacturing (e.g., thermal kill step, pH, aw, metal detection); they are distinct from sanitation, allergen, and supply-chain controls.

Sanitation controls apply when the hazard analysis shows environmental pathogens or cross-contact risks require them, not as a default for every facility.

Allergen cross-contact is a chemical hazard under the rule; controls include segregation, dedicated lines, cleaning validation, and label verification.

The rule exempts certain low-risk activities (e.g., some on-farm packing, juice/seafood with HACCP, dietary supplements), but exemption does not remove the underlying hazard obligation.

Preventive controls must be written into a food safety plan that is prepared or overseen by a preventive controls qualified individual (PCQI).

Hazard identification considers biological, chemical (including radiological), and physical agents, plus economically motivated adulteration (EMA) where applicable.

The hazard evaluation weighs severity of illness/injury, probability of occurrence, and the effect of the process on the hazard (e.g., a kill step may eliminate a biological hazard).

A hazard is 'reasonably likely to occur' when experience, data, or the nature of the ingredient/process shows it can occur without controls; the standard is risk-based, not zero-risk.

Process controls require a parameter and value (e.g., 72°C for 15 s, pH ≤ 4.6, aw ≤ 0.85) that, if met, controls the hazard.

Sanitation controls address hazards from the environment, food-contact surfaces, or cross-contact, and typically specify cleaning frequency and verification method.

Supply-chain controls apply when a hazard in an ingredient is controlled before receipt; the receiving facility must approve the supplier and verify the control.

Recall/withdrawal plans, allergen labeling, and corrective action procedures are required food safety plan elements even though they are not 'preventive controls' in the narrow sense.

The hazard analysis must be reanalyzed at least every 3 years and whenever a change in activities, process, or new hazard information occurs.

Monitoring provides evidence that a preventive control is consistently implemented; it must be documented in records subject to verification.

Monitoring procedures must specify what is monitored, how, frequency, and who performs it (117.145).

Process monitoring examples: continuous temperature charts, pH meters, aw meters, metal detector checks, and time/temperature logs.

Sanitation monitoring may include visual inspection, ATP swabs, or environmental pathogen testing depending on the hazard analysis.

Allergen controls require label verification and changeover cleaning checks documented at the time of production.

Monitoring frequency must be sufficient to detect a deviation before product is affected; continuous monitoring is preferred where feasible.

Records must be made at the time of the activity or immediately after, and must be reviewed by a PCQI or qualified individual within a defined timeframe.

Deviations from a critical limit or control parameter must trigger corrective action; monitoring records alone do not correct a deviation.

Validation establishes that the preventive control, as designed, is capable of controlling the hazard; it is required before the control is relied upon and after changes.

Verification confirms the control is being implemented as designed; it includes calibration, product testing, environmental monitoring, record review, and supplier verification.

Corrective action must identify the cause, correct the deviation, reduce the likelihood of recurrence, and evaluate the affected product for safety.

Affected product must be evaluated for safety and may require rework, reprocessing, or disposition; records must document the evaluation.

Verification of implementation includes reviewing monitoring records within a defined period (e.g., 7 days) and documenting the review.

Reanalysis is required at least every 3 years and when a significant change occurs; reanalysis must be documented.

Calibration of monitoring instruments (thermometers, pH meters, metal detectors) is part of verification and must be recorded.

Corrective action records must include the deviation, the action taken, the product disposition, and the person responsible.

A supply-chain program applies when the hazard analysis identifies a hazard in an ingredient that is controlled before receipt by the supplier.

The receiving facility must approve suppliers based on their ability to control the hazard, using audits, sampling, or other verification activities.

Supplier verification activities may include onsite audits, sampling and testing, review of food safety records, or a combination, chosen based on risk.

Supplier approval must be documented, including the basis for approval and the verification activities performed.

The supply-chain program must be written and must include supplier approval, verification activities, and corrective actions for supplier nonconformance.

If the receiving facility controls the hazard itself (e.g., a kill step), a supply-chain control may not be required for that hazard.

Supplier audits must be conducted by qualified auditors and must cover the hazard of concern; audit frequency is risk-based.

Records of supplier approval and verification must be retained and available for review.

The food safety plan must include the hazard analysis, preventive controls, monitoring, corrective actions, verification, and recall plan.

The plan must be prepared, or its preparation overseen, by a PCQI; the PCQI must have completed training or have equivalent experience.

Records must be legible, dated, and signed or initialed by the person performing the activity; electronic records must meet the same standards.

Records must be retained for at least 2 years after the record is made; records for a specific product must be retained for 2 years after the product's shelf life.

The plan must be reanalyzed at least every 3 years and whenever a significant change occurs, with reanalysis documented.

The written plan must be available to the FDA upon request during an inspection; records must be provided within a reasonable time.

Records must be reviewed by a PCQI or qualified individual to verify implementation and effectiveness.

The plan must identify the person responsible for each element and the frequency of each activity.

A recall plan must be written and must include procedures for notifying customers, retrieving product, and conducting effectiveness checks.

Recall classifications: Class I (serious health risk), Class II (temporary or reversible health risk), Class III (unlikely to cause harm).

Traceability requires records that identify the source of ingredients and the destination of finished product (one step back, one step forward).

The FDA may request records during an inspection; failure to provide records can lead to enforcement action, including suspension of registration.

Recall effectiveness checks verify that consignees received notice and removed product from distribution.

A recall plan must be tested or reviewed periodically to ensure it remains effective.

Regulatory compliance includes registration, prior notice for imports, and adherence to the Food Safety Modernization Act preventive controls rule.

Corrective actions and recalls must be documented, including the root cause and the steps taken to prevent recurrence.