Skip Navigation LinksAgriculture > Protect > Food Safety > FSMA Preventative Controls

FSMA Preventive Controls for Human Food Rule 
Guidelines for PA Manufacturers & Distributors of Human Food

The Food Safety Modernization Act (FSMA), a federal law enacted in 2011, requires firms that manufacture, process, pack or hold human food, and that must register with FDA, follow the Preventive Controls for Human Food (PCHF) rule’s new food safety requirements found in 21 CFR Part 117. The PCHF rule is final, and compliance dates for some businesses began as early as September 2016.

The Pennsylvania Department of Agriculture (PDA) adopts the new federal regulations as dictated by the Food Safety Act (3 Pa. C.S.A. §5733(f)) and will enforce all applicable provisions. As Pennsylvania regulation, all PDA registered firms will be expected to comply with the applicable portions of the PC rule regardless of FDA registration status, unless specifically exempted in the rule. During inspection of food establishments, PDA will evaluate the required food safety plans and make sure the plans are being implemented properly.


PCHF requires eligible food establishments to follow updated good manufacturing practices (Modernized GMPs), and to establish and implement a comprehensive PCHF food safety plan.


           PCHF Food Safety Plan Requirements:

Firms that are subject to the full requirements of PCHF must establish and implement a food safety system that includes an analysis of hazards and risk-based preventive controls. This food safety system includes a written food safety plan that covers:


  • Hazard analysis: What are the known or reasonably foreseeable biological, chemical, and physical hazards that occur naturally, are unintentionally introduced, or are intentionally introduced, that could affect the safety of the food.
  •  Preventive controls: Measures that are required to minimize or prevent the identified hazards, including:
    • Process Controls;
    • Food Allergen Controls;
    • Sanitation Controls;
    • Supplier-Chain Controls — a risk-based approach to ensure suppliers are not providing food establishments with raw materials or ingredients that pose a significant risk to the final product made by the firm.
    • Other Appropriate Controls.
  •   Oversight and management of preventive controls:
    • Monitoring: to provide assurance that preventive controls are consistently performed.
    • Corrective Actions and Corrections: to quickly identify and correct a minor isolated problem that occurs during food production.
    •  Verification: to ensure that preventive controls are consistently implemented and effective.
  • Recordkeeping: Documentation of compliance with the written food safety plan to include but not limited to monitoring, corrective actions, corrections and verification activities. Required records shall be made available to the regulatory authority (which will include PDA and FDA).
  • Recall Plan: If the hazard analysis reveals that a preventive control is needed, the firm must also have a recall plan as part of their food safety plan. It must include steps and methods to be used to notify the direct recipients of the food about the recall, notify the public about any hazard, verify that the recall is carried out effectively, as well as procedures to appropriately dispose of the recalled food in the food establishment and by all recipients.


Timeline for Food Establishments that need to comply (if not exempted)

Business Size


Compliance Date

Very small

<$1M total annual sales of food (3 year avg.)

September 17, 2018


<500 full-time equivalent employees

September 18, 2017


All other businesses

September 19, 2016


Businesses subject to Pasteurized Milk Ordinance (PMO)

September 17, 2018


Compliance Dates for the Requirements of the Supply-Chain Program (Subpart G)


         Compliance Date

A receiving firm is a small business and its supplier will not be subject to the human PC rule or produce safety (PS) rule.

            September 18, 2017

A receiving firm is a small business and its supplier is subject to the human PC rule or the PS rule.

The later of: September 18, 2017 OR 6 months after the receiving firm’s supplier is required to comply with the applicable rule.

A receiving firm is NOT a small OR a very small business and its supplier will not be subject to the human PC rule or the produce safety rule.

A receiving firm is NOT a small OR a very small business and its supplier will be subject to the human PC rule or the PS rule.

March 17, 2017

6 months after the receiving firm’s supplier is required to comply with the applicable rule.


Exempted Food Establishments from the FSMA’s PCHF Rule (Subparts C, G and D)

  • Food establishments that manufacture products covered by separate regulations including juice, seafood, dietary supplements, alcoholic beverages, or Low-acid canned foods (for C. botulinum control ONLY as regulated by Part 113).
  • Establishments such as grain elevators and warehouses that are solely engaged in storing agricultural commodities (other than fruits and vegetables) intended for further processing.
  • Establishments, such as warehouses, that only store packaged foods that are not exposed to the environment and for which refrigeration is not required for safety.
  • Establishments that are VERY SMALL ON-FARM businesses that conduct certain low-risk manufacturing and processing, packing, or holding activities (e.g., making jams/jellies, honey, maple syrup, candy, soft drinks, etc.); see 117.5(g)(3) and 117.5(h)(3).

NOTE: A Farm is not covered by the new requirements, unless it is a mixed-type facility which is an establishment that is a Farm, but also conducts activities outside the farm definition that require the establishment to be registered as required under section 415 of the Federal FD&C Act.(See Definition in 21 CFR 117.3)

Food Establishments subject to or which qualify for the modified requirements (Subpart D)


  • VERY SMALL businesses as defined in  21 CFR 117.3.
  • SMALL ON-FARM businesses that conduct certain LOW-RISK manufacturing and processing, packing, or holding activities (e.g., making jams/jellies, honey, maple syrup, candy, soft drinks, etc.); see §117.5(g)(3) and §117.5(h)(3).
  • Qualified facilities as defined in 21 CFR 117.3 to which both of the following apply:

(1) During the 3-year period preceding the applicable calendar year, the average annual monetary value of the food manufactured, processed, packed or held at such facility that is sold directly to qualified end-users (as defined in this part) during such period exceeded the average annual monetary value of the food sold by such facility to all other purchasers; and

(2)  The average annual monetary value of all food sold during the 3-year period preceding the applicable calendar year was less than $500,000, adjusted for inflation.

       (See modified requirements that apply to qualified facilities in §117.201)

  •   Establishments that are solely engaged in the storage of refrigerated unexposed packaged foods when temperature controls are necessary to prevent pathogen growth. These firms must:
    1. Establish and implement temperature controls adequate to significantly minimize or prevent pathogen growth, and toxin formation,
    2. Monitor the temperature controls at adequate frequency,
    3. Take appropriate corrective actions when there is loss of temperature control,
    4. Verify temperature controls,
    5.  Establish and maintain records,
                  (See complete requirements in §117.206)

Updated Current Good Manufacturing Practices (Modernized GMPs)

The PCHF Rule also updates the current Good Manufacturing Practice requirements. Updates include:

  • Clarifications on protections against cross-contact of food by allergens,
  • Deletion of certain nonbinding provisions (any language containing “recommendations”),
  • Some previously nonbinding provisions are now modified to be binding provisions.
    An example is education and training, in which management is now required to ensure that all employees who manufacture, process, pack or hold food are         qualified to perform their assigned duties. These employees must have the necessary combination of education, training, and/or experience necessary to             manufacture, process, pack, or hold clean and safe food. Individuals must receive training in the principles of food hygiene and food safety, including the               importance of employee health and hygiene.

     Establishments that are exempt or subject to modified requirements in the new requirements for Hazard Analysis and Risk-Based Preventive Controls                  (HARPC) would generally be subject to cGMP requirements.


How does the Preventive Controls Plan compared to a HACCP plan?

The general concepts are very similar. However, these “preventive controls plans” also cover monitoring, records, and corrective actions for items that are generally considered pre-requisite programs in HACCP plans, including food allergen controls, sanitation controls, and a recall plan. The table below compares the requirements for both plans.




PC Rule Food Safety Plan

Hazard Analysis

Biological, chemical, physical hazards

Biological, Physical & Chemical. Chemical hazards include radiological hazards. Also, consideration of economically motivated adulteration (21 CFR 117.130(b)(1)(ii))

Preventive Controls

CCPs for processes

Process CCPs + controls at other points that are not CCPs (21 CFR 117.135(a)(2))

Parameters and values

Critical limits at CCPs

Parameters and minimum/maximum values (equivalent to critical limits for process controls) (21 CFR 117.135(c)(1))


Required for CCPs

Required as appropriate for preventive controls (21 CFR 117.145)

Corrective actions and Corrections

Corrective actions

Corrective actions or corrections as appropriate (21 CFR 117.150(a))

Verification (including validation)

For process controls

Verification as appropriate for all preventive controls; validation for process controls; supplier verification required when supplier controls a hazard (21 CFR 117.155, 117.160)


For process controls

As appropriate for all preventive controls (21 CFR 117.190)

Recall plan

Not required in the plan

Required when a hazard requiring a preventive control is identified (21 CFR 117.139)


Assistance to Industry

The PDA will continue to communicate and work with firms, especially small and very small businesses, to understand and comply with the new PC Rules, including during routine inspections. PDA will also communicate available training opportunities as they are available (see below).

The FDA is developing several guidance documents on subjects that include:

  • Hazard Analysis & Preventive Controls,                          
  • Food Allergen Controls,
  • Sanitation Controls,                                               
  • Validation of Process Controls,
  • A Small Entity Compliance Guide for a small and very small firm.

FDA has developed a partial draft guidance for industry (5 Chapters) covering some of the subjects above and is still working on 9 more chapters and other guidance documents.

All available guidance documents can now be found at (under related guidance tab):

  • To determine whether you are affected by the FSMA PCHF Rule, check the Flow Chart at the link below:
FSMA Preventive Controls for Human Food Rule-PDA Fact Sheet.pdf

Usefull Links:

  • For more information about the FDA’s FSMA Final Rule for PC for Human Food, please visit:



  • The FDA FSMA Technical Assistance Network (TAN) is now operational and providing technical assistance regarding overall FSMA regulatory                    aspects. Inquiries may be submitted through a web form accessible at:


  • For technical assistance to industry, academia and others regarding training and scientific/technical questions related specifically to FDA’s PC for              Human Food and Animal Food regulations, the Food Safety Preventive Controls Alliance (FSPCA) Technical Assistance Network (TAN) is now                  operational and inquiries can be submitted online at:


  • To find resources and information about the Food Safety Modernization Act (FSMA) of 2011, and how Penn State Extension is responding and                   assisting industry:


  •  To determine whether you are affected by the FSMA PCHF Rule, see the Flow Chart in the Fact Sheet attached under Publications.

Training Opportunities

The regulation requires that certain activities must be completed by a Preventive Controls Qualified Individual (PCQI) who has successfully completed training in the development and application of risk-based preventive controls. FSPCA has developed a standardized curriculum recognized by FDA; and successfully completing this course is one way to meet the requirements for a PCQI.
These courses are taught by Lead Instructors trained by the FSPCA, who have been instructed in how to teach the FDA-recognized standardized curriculum.

  • List of upcoming courses and registration information can be accessed at: 



  • For more information about FSPCA Alliance Training opportunities, visit:



  • A copy of the FSPCA PC for Human Food Participant manual can found at: 



  • Other training opportunities can be found on the Penn State Extension website: