Food Safety and HACCP Consulting Editing and Proofreading Services

Five words make up paragraph (b) of 21 CFR 117.135. "Preventive controls must be written."¹ The rule has a great deal more to say elsewhere, and several of those requirements are about what a particular sentence has to contain.

Where the rule names what a sentence must contain

Process controls are one of six categories of preventive control the rule lists.¹ They must include, "as appropriate to the nature of the applicable control and its role in the facility's food safety system," the parameters associated with the control of the hazard.¹ They must also include "The maximum or minimum value, or combination of values, to which any biological, chemical, or physical parameter must be controlled."¹ The sentence ends by naming a purpose, "to significantly minimize or prevent a hazard requiring a process control."¹

Section 117.145 opens with a similar condition: "As appropriate to the nature of the preventive control and its role in the facility's food safety system."² A facility then "must establish and implement written procedures, including the frequency with which they are to be performed, for monitoring the preventive control."² Paragraph (b) separately requires the facility to "monitor the preventive controls with adequate frequency to provide assurance that they are consistently performed."² The frequency is named as part of what the written procedure contains, and the section attaches no number to the word adequate.

The hazard analysis is required whatever it concludes. Section 117.130(a)(2) is one sentence: "The hazard analysis must be written regardless of its outcome."³ A facility that identifies no hazard requiring a preventive control still has that sentence to satisfy.

A second federal agency regulates the same kind of plan differently

Meat and poultry plants work under 9 CFR part 417 instead. That rule enumerates seven contents for a HACCP plan.⁴ Among them are a list of the critical limits for each critical control point, and a recordkeeping system whose records "shall contain the actual values and observations obtained during monitoring."⁴ A flow chart is required separately.⁴ The plan is signed and dated by the responsible establishment individual on three named occasions: initial acceptance, any modification, and at least annually on reassessment.⁴

The recordkeeping rule reaches each entry. Under 9 CFR 417.5(b), an entry "shall be made at the time the specific event occurs and include the date and time recorded."⁵ The same sentence requires that it "be signed or initialed by the establishment employee making the entry."⁵ A pre-shipment review is, "Where practicable," to be "conducted, dated, and signed by an individual who did not produce the record(s)."⁵

Some of the observations are about what a document says

FDA warning letters cover much more than documents, and the two below also record insanitary conditions and physical hazards. Some observations within them are about wording. In March 2026 the agency wrote to a Baltimore nut processor about its written process preventive control procedures.⁶ They "were not appropriate to significantly minimize or prevent hazards requiring preventive controls, as required by 21 CFR 117.135(c)(1)."⁶ In September 2025 it wrote to Compass Group USA about a facility in San Fernando, California.⁷ "You did not appropriately evaluate physical hazards such as metal, to determine whether it is a hazard requiring a preventive control."⁷

Two further letters were issued under the seafood rule at 21 CFR part 123, a separate rule with its own requirements. In January 2026 the agency wrote that a Los Angeles firm "must have a HACCP plan that, at a minimum, list monitoring procedures and their frequencies for each critical control point."⁸ In 2017 it told a New York seafood processing and distribution establishment that three named HACCP plans "are not being reviewed, signed, and dated at least annually."⁹ The letter recorded the date on the page: "The last time these HACCP plans were signed and dated was on June 14, 2012."⁹

What we read, and what the qualified individual decides

Whether a hazard is reasonably foreseeable, which control addresses it, and what value belongs in a critical limit are decided by the preventive controls qualified individual and the plant's technical staff. The plant's own experts make those judgments. We are not a food safety consultancy, we do not audit anything, and we do not tell a client whether a document complies with a rule.

The written plan is what we take up. We check that a frequency stated in the narrative matches the frequency printed on the monitoring form, and that a value in a table matches the value in the paragraph introducing it. We check that a term keeps one meaning across the plan, the procedures, and the training records. We check that every control the plan names has a written procedure in the package, and that a heading is followed by the section it names. What a client sends us goes no further.

The two rules set different intervals for revisiting a plan. Under 21 CFR 117.170(a) a facility conducts "a reanalysis of the food safety plan as a whole at least once every 3 years."¹⁰ Paragraph (b) adds four circumstances that do not wait for the three years.¹⁰

Under 9 CFR 417.4 an establishment reassesses at least annually and makes a record of it.¹¹ That record documents "the reasons for any changes to the HACCP plan based on the reassessment, or the reasons for not changing the HACCP plan based on the reassessment."¹¹ One exception is narrow. At an annual reassessment that finds no changes needed, the basis for that determination need not be documented.¹¹