The FDA's FSMA Preventive Controls rule (21 CFR Part 117) requires registered food facilities to implement Hazard Analysis and Risk-Based Preventive Controls (HARPC). Affinity QMS provides the Food Safety Plan documentation, supplier verification, and corrective action workflows food manufacturers need to stay compliant and audit-ready.
21 CFR Part 117 is the FDA's FSMA (Food Safety Modernization Act) Preventive Controls for Human Food rule. It requires registered food facilities to implement a Food Safety Plan based on Hazard Analysis and Risk-Based Preventive Controls (HARPC). The regulation replaces the previously voluntary HACCP approach with a mandatory, documented, risk-based food safety system enforced through FDA inspections. It covers facility cGMPs as well as the Food Safety Plan requirements.
HARPC vs. HACCP — Key Differences
HACCP (Hazard Analysis Critical Control Points) was a voluntary framework for certain facilities. HARPC under 21 CFR Part 117 is mandatory and broader: it requires analysis of all food safety hazards (not just CCPs), addresses supply chain hazards, requires allergen preventive controls, includes a recall plan, and mandates reanalysis every three years or when significant changes occur. Affinity QMS is configured for HARPC, not just legacy HACCP.
Part 117 Food Safety Plan Components
Hazard Analysis (117.130)
Preventive Controls (117.135) — Process, Allergen, Sanitation, Supply Chain
Supply Chain Program (117.136)
Recall Plan (117.139)
Monitoring Procedures (117.145)
Corrective Action Procedures (117.150)
Verification Activities (117.165)
Record Keeping (117.190–117.315)
Each Part 117 requirement maps to an Affinity QMS module. One platform for your Food Safety Plan, supplier approvals, corrective actions, and audit records.
| Regulation Reference | Requirement | Affinity QMS Module | What It Does |
|---|---|---|---|
| 117.126 | Food Safety Plan | QMS Core + Document Control | Structured Food Safety Plan documentation with hazard analysis, preventive control records, recall plan; version-controlled and reviewed on schedule |
| 117.315 | Records & Record Keeping | Document Control | Controlled records with configured retention schedules (minimum 2 years for most Part 117 records); tamper-evident audit trail |
| 117.150 | Corrective Actions & Corrections | CAPA Management | Corrective action initiation from monitoring failures, root cause analysis, implementation tracking, effectiveness verification, and regulatory reporting support |
| 117.136 | Supply Chain Program | Supplier Management | Approved supplier list, supplier verification activities, audit records, Certificate of Analysis management, risk-based supplier approval |
| 117.165 | Verification Activities | Audit Management | Internal verification activity scheduling, calibration records, validation documentation, environmental monitoring records, audit findings |
| 117.4 | Qualified Individuals (PCQI) | Training Management | Training records for PCQI designation, food safety training by role, SOP acknowledgments, competency documentation |
| 117.135 | Preventive Controls | QMS Core | Preventive control records — process, allergen, sanitation, and supply chain controls; monitoring records; deviation documentation |
Food manufacturers, co-packers, and ingredient suppliers facing FSMA compliance obligations and voluntary certification pressures. Affinity QMS serves all three.
Food Manufacturer QA / Food Safety Manager
Responsible for the facility's Food Safety Plan and FSMA compliance. Needs a documented HARPC system, supplier verification records, and corrective action documentation that can withstand an FDA inspection. Likely also pursuing SQF, BRC, or FSSC 22000 certification simultaneously.
Co-Packer / Contract Food Manufacturer
Manufacturing products for multiple food brands under contract. Needs one Part 117-compliant system that manages supplier verification, allergen controls, and corrective actions across multiple client products without creating siloed documentation per client.
Ingredient Supplier or Importer
Supplying food ingredients to US manufacturers. Foreign supplier verification program (FSVP) under FSMA applies. Needs a supplier qualification and documentation system that satisfies the requirements their food manufacturer customers impose as part of their own Part 117 supply chain programs.
21 CFR Part 117 is the regulatory foundation for food manufacturers. Most facilities pursuing GFSI certifications (SQF, BRC, FSSC 22000) use Part 117 as their baseline compliance framework.
HARPC (Hazard Analysis and Risk-Based Preventive Controls) is the food safety framework required by 21 CFR Part 117. It differs from traditional HACCP in several important ways: (1) HARPC is mandatory under federal law, while HACCP was voluntary for most food facilities; (2) HARPC requires analysis of all food safety hazards including intentional adulteration, not just biological, chemical, and physical hazards at CCPs; (3) HARPC requires allergen preventive controls, which HACCP did not address; (4) HARPC includes a mandatory supply chain program; (5) HARPC requires a written recall plan; and (6) HARPC must be reviewed and reanalyzed every three years or when significant changes occur to the food, facility, or process. If your facility previously had a HACCP plan, it must be upgraded to a full HARPC-compliant Food Safety Plan.
Certain entities are exempt or partially exempt from Part 117 requirements: farms that grow, harvest, and pack produce are generally covered by the Produce Safety Rule (21 CFR Part 112), not Part 117; retail food establishments and restaurants are exempt; facilities subject to the Juice HACCP (21 CFR Part 120) or Seafood HACCP (21 CFR Part 123) rules for those products are exempt from the Food Safety Plan requirement but must still comply with Part 117 cGMP requirements; and very small businesses (less than $1 million in annual food sales averaged over three years) have modified requirements. When in doubt, facilities should consult with a regulatory attorney or food safety consultant to determine their specific Part 117 applicability.
21 CFR Part 117 requires an extensive set of records including: the written Food Safety Plan itself; monitoring records for each preventive control; corrective action records for each corrective action and correction; verification records including validation studies, calibration records, environmental monitoring records, and review of monitoring records; supplier verification records; and training records for the PCQI and other personnel. Records must generally be retained for two years (some records for one year). All records must be available for FDA inspection. Affinity QMS maintains all of these record categories in a searchable, organized, audit-ready system.
The Food Safety Plan must be reanalyzed by a Preventive Controls Qualified Individual (PCQI) at least every three years. It must also be reanalyzed when: a significant change occurs that creates a reasonable potential for a new or significantly increased hazard; the facility becomes aware of new information about potential hazards; a preventive control is determined to be inadequate to control the hazard; a significant operational change occurs that might affect the hazard analysis; or a recall occurs or a serious foodborne illness is associated with the food. Affinity QMS provides a Food Safety Plan reanalysis schedule with automated reminders and tracks all changes with version control.
A Preventive Controls Qualified Individual (PCQI) is an individual who has successfully completed training in the development and application of risk-based preventive controls, or is otherwise qualified through job experience to develop and apply a food safety system. Under Part 117, the Food Safety Plan must be developed or overseen by a PCQI. The PCQI is also responsible for validating preventive controls, reviewing records, and reanalyzing the Food Safety Plan. PCQI training is typically obtained through FSPCA (Food Safety Preventive Controls Alliance) training courses. The PCQI can be an employee or a contracted third party. Your PCQI designation and training records are maintained in Affinity QMS Training Management.
Yes. Affinity QMS provides a structured Food Safety Plan template that guides you through each required element: facility and product description, hazard analysis (biological, chemical, physical, and economically motivated hazards), preventive controls identified for each hazard, monitoring procedures, corrective action procedures, verification activities, supply chain program, and recall plan. The template is configured to your specific product and process during onboarding. Once completed, the Food Safety Plan is maintained under document control with version history, change control, and scheduled reanalysis reminders. You can generate a clean, audit-ready Food Safety Plan document at any time for FDA investigators or third-party auditors.
From Food Safety Plan documentation to SQF certification readiness, Affinity QMS gives food manufacturers the Part 117 compliance infrastructure they need — without the SafetyChain price tag.