What is FSMA?
The FDA Food Safety Modernization Act (FSMA), signed into law in 2011, represents the most significant overhaul of U.S. food safety regulation in over 70 years. FSMA shifts the regulatory focus from reacting to foodborne illness outbreaks to preventing them in the first place.
For food and dietary supplement companies, FSMA's Preventive Controls for Human Food rule (21 CFR Part 117) is the most impactful regulation to understand and implement.
Who Does FSMA Apply To?
The Preventive Controls rule applies to facilities that manufacture, process, pack, or hold human food for consumption in the United States — including dietary supplement manufacturers that are not solely subject to 21 CFR Part 111.
Small and very small businesses have different compliance timelines, but all covered facilities must be in compliance.
FDA Food Facility Registration
Before addressing Preventive Controls, your facility must be registered with FDA under 21 CFR Part 1, Subpart H. Registration is required for:
- Domestic food manufacturers, processors, packers, and warehousers
- Foreign facilities that export food to the United States
Registration must be renewed every two years (October–December of even-numbered years). Failure to register or renew is a prohibited act under the Federal Food, Drug, and Cosmetic Act.
Core Requirements of the Preventive Controls Rule
1. Food Safety Plan
Every covered facility must prepare and implement a written Food Safety Plan, which includes:
- Hazard Analysis
- Preventive Controls
- Supply-Chain Program
- Recall Plan
- Monitoring Procedures
- Corrective Actions
- Verification Activities
The Food Safety Plan must be prepared by or overseen by a Preventive Controls Qualified Individual (PCQI) — someone who has successfully completed FSMA PCQI training.
2. Hazard Analysis
You must identify and evaluate biological, chemical, and physical hazards that are known or reasonably foreseeable in your process. For each significant hazard identified, you must implement a preventive control.
3. Preventive Controls
Preventive Controls include:
- Process Controls: Parameters like time, temperature, pH, and water activity to minimize or prevent hazards
- Food Allergen Controls: Procedures to prevent undeclared allergen contamination through mislabeling or cross-contact
- Sanitation Controls: Cleaning and sanitizing procedures for surfaces, equipment, and personnel hygiene
- Supply-Chain Controls: Verification of your raw material suppliers' ability to control hazards
4. Monitoring, Corrective Actions & Verification
You must monitor your preventive controls, take corrective action when deviations occur, and verify that your controls are working as intended through activities like calibration, testing, and record review.
Key Records Required
FSMA requires extensive recordkeeping, including:
- Food Safety Plan
- Monitoring records
- Corrective action records
- Verification records
- Supply-chain program records
Records must be kept for at least 2 years at the facility.
Dietary Supplements and FSMA
While dietary supplements are primarily regulated under 21 CFR Part 111 (cGMP for Dietary Supplements), supplements that are processed or manufactured in facilities that also handle conventional food may be subject to both Part 111 and Part 117. FSMA's allergen controls and supply-chain program requirements are especially important for supplement manufacturers sourcing botanical or food-derived ingredients.
How to Prepare for an FDA FSMA Inspection
- Have your written Food Safety Plan readily available
- Ensure your PCQI credentials are documented
- Maintain complete and current monitoring and verification records
- Conduct internal audits at least annually
- Verify that supplier approval programs are current
How United Regulatory Can Help
We help food and supplement companies build FSMA-compliant Food Safety Plans, conduct PCQI-led gap assessments, prepare for FDA inspections, and establish robust supply-chain verification programs. Reach out for a free consultation.