HACCP vs FSMA Preventive Controls: Key Differences Explained

HACCP: The Pre-FSMA Food Safety Framework

Hazard Analysis and Critical Control Points (HACCP) is a systematic preventive approach to food safety that originated in the 1960s through a collaboration between NASA, Pillsbury, and the U.S. Army Natick Research Laboratories. The goal was to develop a system to ensure safe food for space missions. HACCP was later adopted by food regulatory agencies worldwide and became the foundation of modern food safety management.

In the United States, FDA mandated HACCP for two specific food categories before FSMA:

• Seafood — 21 CFR Part 123, effective December 1997. Applies to processors of fish and fishery products.
• Juice — 21 CFR Part 120, effective January 2002. Applies to processors of juice and juice products.

HACCP is built on seven principles:

1. Conduct a hazard analysis — identify biological, chemical, and physical hazards associated with the food product
2. Identify Critical Control Points (CCPs) — determine the points in the process where control is essential to prevent, eliminate, or reduce hazards to acceptable levels
3. Establish critical limits — set measurable boundaries for each CCP (e.g., minimum cooking temperature of 165°F)
4. Establish monitoring procedures — define how CCPs will be monitored during production
5. Establish corrective actions — define actions to take when monitoring indicates a CCP is not under control
6. Establish verification procedures — confirm the HACCP system is working effectively
7. Establish record-keeping and documentation — maintain records of hazard analysis, CCP monitoring, corrective actions, and verification activities

HACCP remains the required food safety system for seafood and juice processors. FSMA did not eliminate HACCP for these categories — facilities subject to 21 CFR Part 120 or Part 123 continue to operate under HACCP, with some additional FSMA requirements layered on top.

FSMA Preventive Controls: The Modern Framework

The Food Safety Modernization Act (FSMA), signed into law on January 4, 2011, represented the most sweeping reform of U.S. food safety law in over 70 years. FSMA shifted FDA's approach from reacting to contamination to preventing it.

The Preventive Controls for Human Food rule (21 CFR Part 117), finalized in September 2015, is FSMA's signature regulation for food manufacturers. It applies to most food facilities that are required to register with FDA under Section 415 of the FD&C Act — with exemptions for facilities already subject to HACCP regulations (juice and seafood), as well as certain low-risk activities.

Key elements of the Preventive Controls rule include:

• Written Food Safety Plan — every covered facility must have a written food safety plan that includes a hazard analysis, preventive controls, monitoring procedures, corrective actions, and verification activities. This is comparable to a HACCP plan but broader in scope.
• Hazard analysis — must identify and evaluate known or reasonably foreseeable biological, chemical (including radiological), and physical hazards, including hazards introduced by the supply chain.
• Preventive controls — the controls identified to significantly minimize or prevent the identified hazards, including process controls, allergen controls, sanitation controls, and supply-chain controls (a concept not present in traditional HACCP).
• Recall plan — a written recall plan for each hazard requiring a preventive control is mandatory.
• Current Good Manufacturing Practice (cGMP) — Part 117 Subpart B codifies updated cGMP requirements for food manufacturing, replacing the older Part 110.

Key Differences Between HACCP and Preventive Controls

While HACCP and FSMA Preventive Controls share the same fundamental goal — preventing food safety hazards — they differ in several important ways:

Perhaps the most significant practical difference is the supply-chain program requirement. Under FSMA Preventive Controls, if your hazard analysis identifies a hazard that will be controlled by your supplier (rather than in your own facility), you must have a supply-chain program with written procedures for approving suppliers, verifying supplier controls, and taking corrective actions when verification shows problems.

Who Needs HACCP vs. Preventive Controls?

Determining which food safety system applies to your facility depends on the products you manufacture:

Facilities Subject to HACCP

• Seafood processors (21 CFR Part 123) — facilities that process fish and fishery products, including importers
• Juice processors (21 CFR Part 120) — facilities that manufacture, process, or import juice products

Facilities Subject to FSMA Preventive Controls

• Most other food manufacturers — bakeries, snack food manufacturers, beverage companies (non-juice), dairy processors, confectionery, spice processors, etc.
• Foreign food suppliers whose products are imported into the U.S. (in conjunction with the FSVP rule for importers)

Exemptions and Modified Requirements

• Very small businesses (averaging less than $1 million in sales per year) — subject to modified requirements
• Facilities solely engaged in storage of unexposed food — subject to modified requirements
• Farms — exempt from facility registration entirely
• Low-acid canned food (LACF) facilities — subject to 21 CFR Parts 108, 113, and 114 in addition to Part 117. See our FCE & LACF registration guide.

The PCQI Requirement

One of the most important requirements under FSMA Preventive Controls is the Preventive Controls Qualified Individual (PCQI). Every facility subject to Part 117 must have at least one PCQI who has the training and experience to develop and apply a food safety system.

The PCQI is responsible for:

• Preparing (or overseeing preparation of) the food safety plan
• Validating that preventive controls are adequate to control identified hazards
• Reviewing monitoring and corrective action records
• Performing (or overseeing) the reanalysis of the food safety plan at least every three years or when significant changes occur

A person can become qualified as a PCQI through:

• Completing an FDA-recognized PCQI training course (typically a standardized curriculum developed by the Food Safety Preventive Controls Alliance, FSPCA)
• Having equivalent job experience in developing and applying food safety systems

The PCQI does not need to be an employee of the facility — they can be a consultant or contractor. However, the facility owner/operator remains responsible for ensuring that the food safety plan is adequate and properly implemented.

For foreign food facilities, having a PCQI who understands both the facility's operations and U.S. regulatory requirements is essential. This is separate from the U.S. Agent requirement, which addresses FDA communication rather than food safety plan development.

Practical Steps for Compliance

Whether you need HACCP, FSMA Preventive Controls, or both, the following steps will help ensure compliance:

1. Determine your regulatory requirements — identify which regulations apply based on the food products you manufacture. If you process both seafood and bakery items, you may need both HACCP (for seafood) and Preventive Controls (for bakery).
2. Conduct a thorough hazard analysis — this is the foundation of both HACCP and Preventive Controls. Identify all biological, chemical, and physical hazards associated with your products and processes.
3. Train or hire a qualified individual — a HACCP-trained individual for HACCP plans and/or a PCQI for Preventive Controls. FSPCA training courses are widely available.
4. Develop your written plan — create a HACCP plan or food safety plan (as applicable) with all required elements, including hazard analysis, controls, monitoring procedures, corrective actions, and verification activities.
5. Implement and document — put the plan into practice and maintain thorough records. Documentation is what FDA inspectors will review during inspections.
6. Ensure FDA registration and U.S. Agent designation — foreign food facilities must be registered with FDA and have a designated U.S. Agent. Assurentry can handle both requirements.