Do I really need a food safety plan?

Start here. Facilities registered with the FDA as manufacturing food must comply with the Food Safety Modernization Act final rule, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. In the Preventive Control Qualified Individual curriculum, Preventive Controls for Human Food, a point is made that if a hazard is identified in the hazard analysis requiring a preventive control, then a written food safety plan is required. I am aware of only one company that has only one hazard identified, and the risk is truly low. Most companies can easily identify a hazard which must be controlled.

There are two more questions to answer. Am I exempt from the requirement to have a written food safety plan? If my facility is not exempt, when is my compliance date? The latter question is the easiest to answer. There are three compliance dates.

Businesses employing over 500 full-time equivalent employees must be compliant September 19th, 2016. I call these businesses “large;” FDA calls them “other.” September 19th has come and gone and the world has not ended. I am waiting to hear about FDA inspections under the human foods or animal foods rule. Please share.

Where did the medium facility go? Nowhere. There is no legal definition for a medium facility.

Small businesses employ fewer than 500 full-time equivalent employees and have over $1,000,000 in annual sales and holdings. Their compliance date is September 2017.

Very small businesses have less than $1,000,000 in annual sales and holdings. Their compliance date is September 2018. The latter date is also given to Grade “A” milk processors following the Pasteurized Milk Ordinance.

So, which one are you? Large, small, or very small? Now for the answer to the other question. Am I exempt from the requirement to have a written food safety plan? There are many operations which are exempt from having a full food safety plan. It is not possible to describe all exemptions here, but let’s look at a few examples:

Farms. Farms produce raw agricultural commodities (RAC). You would think this is a no-brainer, but the FDA has written a lot into the definition of a farm. Here is a little taste of what is written by the FDA.

Table 4—Revisions to the Proposed Definitions in the Section 415 Registration Regulations and the Section 414 Recordkeeping Regulations
FarmA farm is an “operation” rather than an “establishment.” There are two types of farms: (1) Primary production farm; and (2) secondary activities Farm.
Primary production farm
  • A primary production farm is “under one management” rather than “under one ownership.” Although a primary production farm continues to be “in one general physical location,” we have clarified that “one general physical location” is “not necessarily contiguous.”
  • A primary production farm is an operation devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities. Although some primary production farms both grow and harvest crops, other primary production farms grow crops but do not harvest them, and other primary production farms harvest crops but do not grow them.
  • Treatment to manipulate the ripening of RACs, and packaging and labeling the treated RACs, without additional manufacturing/processing, is within the “farm” definition.
  • We added an example of drying/dehydrating RACs to create a distinct commodity that would fall within the “farm” definition (i.e., drying/dehydrating grapes to produce raisins), as well as an example of additional manufacturing/processing that would cause an operation that dries/dehydrates RACs to create a distinct commodity to fall outside the “farm” definition (i.e., slicing).
  • We added an example of additional manufacturing/processing that can cause an operation that packages and labels RACs to fall outside the “farm” definition (i.e., irradiation).
Secondary activities farmA “secondary activities farm” is an operation, not located on a primary production farm, devoted to harvesting (such as hulling or shelling), packing, and/or holding of RACs, provided that the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm.• A secondary activities farm may also conduct those additional activities allowed on a primary production farm.

Compliance for produce follows a separate rule, Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption.

Qualified facilities. Qualified facilities are not required to have a written hazard analysis, preventive controls, or supply chain program. In creating exemptions, the FDA has tried to identify foods with low risk to consumers. This includes foods traditionally seen as safe due to processing, with limited distribution, lack of allergen and made at a farm mixed-type facility. Consider these foods made on “farms” by very small businesses.

  • Baked goods such as bread and cookies-The bake sale survives.
  • Game meat jerky-Note: USDA is responsible for non-game meats.
  • Pasteurized honey
  • Maple syrup
  • Jams, jellies and preserves-Think of all those pickled foods at your local farmers’ market!

Qualified facilities must follow Good Manufacturing Practices (GMPs) as detailed in Subpart B of the final rule. Businesses compliant with the juice HACCP rule or seafood HACCP rule must follow GMPs from Subpart B of the human foods rule. Infant formula has its own rule. Dietary supplements are covered under 21 CFD 111, but ingredients manufactured as dietary ingredients require a food safety plan. Alcoholic beverages are still exempt, because FDA has no jurisdiction over them. Low-acid canned foods must be compliant with their own rule which prevents microbiological hazards and have a food safety plan for chemical and physical hazards.

Warehouses. If the warehouse does no other activity, the warehouse is exempt from a food safety plan and still follows GMPs. In other words, the packaged food is delivered to the warehouse, sits in storage, and is moved out of storage. There can be no relabeling or repacking of the food.

Still confused? You are not alone. If you feel that your facility may be exempt, check into it. Contact us at ConnectFood or your local FDA office. Remember, the goal is a safe food supply, but there are reasonable exemptions to the rule.

Kathy Knutson, Ph.D., Lead Instructor for Preventive Controls for Human Food (PCHF), Preventive Controls Qualified Individual (PCQI), and trained in prevention of Intentional Adulteration (IA). She has food safety expertise in microbiology, hazard analysis, and risk assessment. As a recovering academic, she resides in Green Bay home-of-the-Packers, Wisconsin with her brilliant husband and two handsome sons. Learn more about her consulting services at

In June 2016 I started teaching a workshop with FDA-recognized curriculum. Everyone was there to get a certificate as a Preventive Controls Qualified Individual (PCQI). After a day of training, someone asked, “What is FSMA?” Much to my own surprise I could not succinctly articulate the extent of FSMA nor did the curriculum do a great job of summarizing FSMA. After much research on the FDA and Federal Register websites, I have this summary for you.

FSMA is the federal Food Safety Modernization Act, signed by President Obama in January of 2011. The purpose is to ensure the U.S. food supply is safe by shifting the focus from responding to hazards to preventing them ( I now understand there are seven foundation rules with FSMA, all under the jurisdiction of the FDA. All seven rules were published from September 2015 to May 2016 with unique compliance dates. Most of you reading this are going to want information on the rule for the manufacture of human food. The preventive controls for human food final rule requires a written food safety plan, record-keeping, a recall plan, and oversight by a PCQI. A future blog will detail the role of a PCQI.

Final rule: Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
Who? Human food manufacturers and their ingredient suppliers

When? Initial compliance date of September 2016 for large businesses

FDA actually calls large businesses “other businesses.” That is because the large businesses by definition are not small, very small, qualified facilities, or subject to the Pasteurized Milk Ordinance. All of these have compliance dates beyond September 2016.

Small businesses have a compliance date of September 2017 and are defined as having fewer than 500 employees. Therefore, “other businesses” have more than 500 employees. Very small businesses have a compliance date of September 2018 and are defined as having less than $1,000,000 in annual sales and holdings. By default, very small businesses have fewer than 500 employees. With only $1,000,000 in revenue, that makes sense that the business employs fewer than 500.

Very small businesses are qualified facilities. Having a designation as a qualified facility exempts the facility from the hazard analysis, preventive controls and supply chain requirements. This is a big deal. The business is still required to follow Good Manufacturing Practices, provide attestations in support of their status, provide evidence of oversight and compliance in their location, maintain records, and provide evidence of status annually. Even though a qualified facility is not required to conduct a hazard analysis and identify preventive controls for those hazards, the qualified facility is required to state how they are controlling hazards in their process. In other words, what is the qualified facility doing to make their product safe for the consumer? If a very small business believes they are a qualified facility, their status records must already now be in place.

Businesses subject to the Pasteurized Milk Ordinance (PMO) have a compliance date of September 2018. These grade A milk processors come into compliance after the next revision of the PMO is published. The PMO will include elements of preventive control requirements.

What are the foundation rules of FSMA? Here is a summary of them:

Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Food for Animals
This is the animal food rule.
Who? Animal food manufacturers and their ingredient suppliers
When? Initial compliance date of September 2016
In the same way that food for human consumption must be made in a safe manner, the diverting of human food to animal food and the production of animal food must be done safely.

Foreign Supplier Verification Programs for Importers of Food for Humans and Animals
This is the import rule.
Who? Importers of ingredients or food for humans or animals
When? Initial compliance date of May 30, 2017
To see descriptions of who has later dates, go to this FDA document at

Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption
This is the produce rule.
Who? Raw agricultural commodity farmers
When? Produce growers with more than $500,000 in annual sales must be compliant starting in November 2017. Small businesses with annual sales between $250,000 and $500,000 must be compliant November 2018. Very small businesses with annual sales between $25,000 and $250,000 must be compliant November 2019. Due to high risk, sprout growers must be compliant in November 2016, with small and very small sprout growers compliant in November 2017 and 2018, respectively.
Growers may have modified compliance dates for parts of the rule including water quality standards, testing and recordkeeping; labeling; or retention of records supporting eligibility for a qualified exemption. Many commodities are exempt from parts of the rule due to the nature of the crop.

Accreditation of Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications
This is the audit rule.
Who? Third-party auditors
When? The rule was published November 2015. The Model Accreditation Standards when published will include FDA’s final recommendations on third-party auditor/certification body qualifications and incorporate requirements. Thereafter, auditors will be able to apply for FDA recognition. See the draft guidance for the Model Accreditation Standards at

Sanitary Transportation of Human and Animal Food
This is the transportation rule.
Who? Motor carriers, shippers, and receivers of human or animal food
When? Initial compliance date of April 2017
Motor carriers employing fewer than 500 persons and having less than $27.5 million in annual receipts must be compliant in April 2018.

Mitigation Strategies to Protect Food Against Intentional Adulteration
This is the intentional adulteration rule.
Who? Human food manufacturers
When? This being the last of the rules was published in May 2016. The first compliance date is May 2019. Small businesses employing fewer than 500 employees must be compliant in May 2020.
The definition of the very small business is annual sales and holdings less than $10,000,000 and not $1,000,000 as defined in the preventive controls for human foods rule. The very small business must be compliant in May 2021.