21 CFR 117.130 requires food manufacturers covered by the FSMA Preventive Controls rule to perform and document a written hazard analysis for each type of food they manufacture, process, pack, or hold. The hazard analysis is the first and most foundational step in the food safety plan.
Purpose of the Hazard Analysis
The hazard analysis has two functions:
Identify known or reasonably foreseeable hazards associated with the food and the facility
Evaluate each identified hazard to determine whether it requires a preventive control (i.e., whether it is a significant hazard)
A hazard analysis that identifies no significant hazards is a valid outcome — but the analysis and its reasoning must still be documented in writing.
Types of Hazards to Evaluate
Under 21 CFR 117.130(b), the hazard analysis must consider three categories of hazards:
Biological Hazards
Pathogens: Salmonella, Listeria monocytogenes, E. coli O157:H7, Staphylococcus aureus, Bacillus cereus, Cronobacter, and others based on the specific food type
Toxin-producing organisms: molds (mycotoxins), Clostridium botulinum (botulinum toxin)
Parasites: relevant for certain raw or minimally processed foods
Chemical Hazards
Naturally occurring toxins: mycotoxins (aflatoxin, ochratoxin), heavy metals (lead, arsenic, cadmium, mercury), pesticide residues
Added chemicals: cleaning and sanitizing agents, food additives at unsafe levels, undisclosed allergens
Decomposition: unapproved food additives or chemical contaminants from packaging migration
Physical Hazards
Extraneous material: metal, glass, hard plastic, wood, stones, bone fragments
Sources: raw material contamination, equipment failure, packaging materials
Determining "Known or Reasonably Foreseeable"
FDA's standard for the hazard analysis is "known or reasonably foreseeable" hazards — a standard that captures not just hazards that have already occurred in your facility but hazards that could occur based on:
The type of food being produced (e.g., raw meat has different hazards than shelf-stable snack bars)
The ingredients and raw materials used (e.g., botanical ingredients may carry heavy metal hazards)
The processing steps applied
The equipment and facility conditions
The intended consumer population (e.g., vulnerable populations like infants, immunocompromised individuals)
Scientific literature, outbreak data, and FDA warning letters for similar products
A manufacturer of botanical dietary supplements, for example, should consider heavy metal contamination, microbial contamination from plant material, pesticide residues, and allergen cross-contact as reasonably foreseeable hazards — regardless of whether their specific facility has experienced these issues.
Evaluating Significant Hazards
Under 21 CFR 117.130(c), each identified hazard must be evaluated for:
Severity of illness or injury if the hazard were to occur (e.g., hospitalization, death vs. mild illness)
Probability that the hazard will occur in the absence of preventive controls (based on the food, facility conditions, and historical data)
A hazard that is both severe (could cause serious illness or death) and reasonably likely to occur without a preventive control is a significant hazard requiring a preventive control.
Hazards that are identified but determined to be not significant (low probability or low severity) must still be documented in the analysis — the record must explain why each hazard does not require a preventive control.
Hazard Analysis for Dietary Supplements
Supplement manufacturers should pay particular attention to:
Hazard | Why It Matters for Supplements |
|---|---|
Heavy metals in botanicals | High bioaccumulation in herbs, roots, mushrooms; FDA and state enforcement targets |
Salmonella in botanical powders | Persistent in low-moisture environments; implicated in multiple supplement recalls |
Allergen cross-contact | Soy, wheat, tree nuts commonly used in supplement facilities |
Undeclared ingredients | Weight loss and sexual enhancement supplements; also applies to allergen contamination |
Pesticide residues | Herbicides and fungicides on botanical raw materials |
Mycotoxins | Molds in grain-based or botanical ingredients |
Interaction with Supply-Chain Hazards
Under 21 CFR 117.130(b)(2)(ii), the hazard analysis must consider hazards that may be present in raw materials and ingredients. When a hazard in an ingredient requires control but the control is applied by the supplier (not by the manufacturer's own process), a supply-chain-applied control under 21 CFR 117.410–117.475 is required.
This is particularly relevant for supplement brands that source finished or near-finished ingredients: if Salmonella control for a botanical powder is the supplier's responsibility, the brand's hazard analysis must document this and the supply chain program must verify the supplier's controls.
Documentation Requirements
The written hazard analysis must document:
All hazards identified for each food/product type
For each hazard: whether it is significant or not, and the basis for that determination
The scientific or evidence basis for identifying hazards and assessing their significance
The specific foods and processes evaluated
The name and qualifications of the person(s) who performed the analysis
Reanalysis Requirements
Under 21 CFR 117.170, the food safety plan (including hazard analysis) must be reanalyzed whenever:
A new food is introduced at the facility
There is a change in the process, facility, or equipment that could introduce a new hazard
A preventive control, monitoring, or corrective action is found to be inadequate
New information suggests a previously unrecognized hazard
At least every 3 years even if no changes occur
How Truli Helps with Hazard Analysis Compliance
Hazard category completeness check: Truli evaluates whether a facility's hazard analysis covers all three hazard categories (biological, chemical, physical) for the product types manufactured
Supplement-specific hazard benchmarking: Truli compares hazard analyses for supplement products against FDA guidance and recall data for similar product categories to identify potential gaps
Documentation review: Truli verifies that the written hazard analysis includes required documentation elements — hazard identification, significance evaluation, and the basis for conclusions
Reanalysis trigger tracking: Truli monitors for process changes, new products, and 3-year reanalysis cycles that require hazard analysis updates
Related Regulations
21 CFR Part 117 — FSMA Preventive Controls — Full overview of the FSMA rule
21 CFR 117 Food Safety Plan — The overall food safety plan requirements
21 CFR Part 111 — Supplement cGMP — cGMP framework for dietary supplement manufacturers
FDA FSVP — Foreign Supplier Verification — Supplier verification for hazards controlled upstream
Frequently Asked Questions
Does every product need its own hazard analysis?
Not necessarily — a hazard analysis may cover a category of similar products if the hazards and processes are the same. However, if different products have different hazard profiles (e.g., a raw botanical powder versus a heat-treated protein powder), they should be analyzed separately or as clearly differentiated product categories.
We've never had a contamination event. Do we still have to document potential hazards?
Yes. The "known or reasonably foreseeable" standard requires you to document hazards based on the type of food and process — not just on your facility's specific history. An absence of past incidents does not mean a hazard is not reasonably foreseeable if scientific literature, outbreak data, or FDA guidance identifies it as a hazard for similar products.
What if our hazard analysis concludes there are no significant hazards?
That is a valid conclusion for some products and processes. However, the analysis must still be in writing, must document all hazards considered (and why they were determined not to be significant), and must be signed by the PCQI. FDA will review the hazard analysis during inspections and may challenge conclusions it finds unsupported.
A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Last updated: April 2026. Reflects 21 CFR 117.130 as of April 2026. Book a demo to see how Truli monitors food safety compliance.
