21 CFR 117.135 requires covered facilities to identify and implement preventive controls for each significant hazard identified in their hazard analysis. Preventive controls are the operational heart of the food safety plan — the specific, documented measures that actually control the hazards.
Types of Preventive Controls
Under 21 CFR 117.135(c), preventive controls include:
1. Process Controls
Procedures applied during manufacturing that control hazards at specific points in the process. Process controls include:
Time and temperature controls — kill steps (pasteurization, cooking) that reduce pathogens to safe levels
pH controls — acidification to prevent pathogen growth in fermented or acidified foods
Water activity controls — reducing available moisture to prevent microbial growth in low-moisture products
Metal detection — physical hazard controls
Process controls typically have specific critical limits — the parameter value (e.g., internal temperature of 165°F for poultry) at or beyond which a hazard is controlled. Deviation from a critical limit triggers the corrective action procedures.
2. Food Allergen Controls
Procedures to prevent allergen cross-contact and ensure proper allergen labeling. These are among the most critical controls for many supplement and food manufacturers because:
Allergen cross-contact can cause life-threatening reactions in sensitive consumers
Undeclared allergens are the most common cause of FDA Class I recalls (the most serious category)
Allergen preventive controls include:
Segregation: Physically separating allergen-containing products and ingredients from non-allergen products
Scheduling: Running allergen-containing products after non-allergen products (or using allergen-specific production runs)
Sanitation verification: Testing to confirm that equipment cleanings were effective in removing allergen residues
Label control: Procedures to prevent labels for one product being applied to another product (label mix-up is a common recall cause)
3. Sanitation Controls
Procedures to prevent contamination of food from environmental pathogens (e.g., Listeria monocytogenes in ready-to-eat product areas) and unsanitary conditions (pest control, employee hygiene, equipment cleaning and sanitizing). Sanitation controls include:
Sanitation procedures for food-contact surfaces, equipment, and utensils
Environmental monitoring programs for pathogen testing in high-risk areas
Personnel hygiene programs (handwashing, illness policy, protective clothing)
Pest control programs
4. Supply-Chain Controls
When a significant hazard in a raw material or ingredient is controlled by the supplier rather than by the manufacturer's own process, a supply-chain preventive control is required. Supply-chain controls include:
Approved supplier programs: Only purchasing from suppliers that have been evaluated and approved based on hazard control capability
Supplier verification activities: Onsite audits, sampling and testing, records review
Receiving verification: Inspection or testing at receiving to verify supplier-controlled hazards are effectively controlled
5. Other Controls
Any other measure the hazard analysis indicates is necessary to prevent, eliminate, or reduce a hazard — such as reconditioned water monitoring, refrigerated storage temperature controls, or foreign material inspection procedures specific to the facility.
Critical Limits and Parameters
For process controls, 21 CFR 117.135(c)(1)(ii) requires establishing critical limits — the maximum or minimum value to which a parameter must be controlled to prevent, eliminate, or reduce a hazard. Critical limits must be:
Based on scientific literature, regulatory standards, or process validation data
Specific and measurable (not vague standards like "adequate")
Documented in the food safety plan
Monitoring Procedures
Under 21 CFR 117.145, each preventive control must have written monitoring procedures specifying:
What is being monitored (e.g., temperature, pH, allergen test results)
How often monitoring occurs (frequency)
Who performs the monitoring
What records are kept
Monitoring records are critical — they are what FDA reviews during inspections to assess whether preventive controls are being consistently implemented.
Corrective Actions
Under 21 CFR 117.150, written corrective action procedures must address:
Corrective actions for each preventive control: what to do when a critical limit is not met or a control is not properly implemented
Determination of affected product disposition: assessing whether affected food should be released, held, or diverted
Root cause identification and remediation: identifying why the deviation occurred and preventing recurrence
If the corrective action procedures were not established in advance, the facility must take corrective actions as appropriate and document them.
Preventive Controls Qualified Individual (PCQI) Oversight
Under 21 CFR 117.135(c)(2), the preventive controls must be overseen by a PCQI — a person who has completed FDA-recognized preventive controls training or is otherwise qualified through job experience in the development and application of risk-based preventive controls.
The PCQI is responsible for reviewing records of monitoring, corrective actions, and verification activities — and for reanalyzing the food safety plan when required.
Application to Dietary Supplement Manufacturers
Dietary supplement manufacturers subject to 21 CFR Part 117 face specific preventive control challenges:
Supplement Hazard | Applicable Control Type |
|---|---|
Heavy metals in botanical ingredients | Supply-chain control (COA, testing program) |
Salmonella in powdered botanicals | Process control (heat treatment) or supply-chain control |
Allergen cross-contact (soy, wheat, tree nuts) | Food allergen controls (segregation, cleaning, label verification) |
Undeclared drug ingredients (adulteration) | Supply-chain controls, testing |
Microbial contamination of finished products | Process and sanitation controls |
How Truli Helps with Preventive Controls Compliance
Allergen control documentation review: Truli evaluates allergen preventive control procedures for completeness — segregation practices, cleaning verification, label control protocols
Supply chain program gap analysis: Truli identifies raw material hazards that require supply-chain preventive controls and flags gaps in supplier verification documentation
Critical limit documentation: Truli reviews process control records to verify that critical limits are documented, monitored, and that corrective actions are triggered and documented when limits are exceeded
PCQI qualification tracking: Truli tracks PCQI training certification and reanalysis schedules
Related Regulations
21 CFR Part 117 — FSMA Preventive Controls — Full FSMA rule overview
21 CFR 117 Hazard Analysis — Identifying which hazards require preventive controls
21 CFR 117 Food Safety Plan — The overarching food safety plan requirements
FALCPA / FASTER Act Allergen Labeling — Allergen declaration requirements that preventive controls must support
FDA FSVP — Foreign Supplier Verification — FSVP as it relates to supply-chain preventive controls for importers
Frequently Asked Questions
Do we need a preventive control for every hazard identified in our hazard analysis?
No — only for significant hazards (those that require a preventive control based on the severity and probability evaluation). Hazards determined to be non-significant must be documented in the analysis, but they do not require a preventive control.
We test our finished products for pathogens — does that count as a preventive control?
Finished product testing alone is generally not considered a preventive control under Part 117, because testing does not prevent contamination — it detects it after the fact. However, product testing can serve as a verification activity for a preventive control. A heat treatment step (process control) prevents contamination; testing the finished product verifies that the control worked.
What allergen controls are required if we use shared equipment?
When shared equipment is used for both allergen-containing and allergen-free products, you need documented cleaning procedures, cleaning verification (allergen testing of swabs or rinse water), and scheduling practices that minimize risk. The adequacy of shared-equipment allergen controls is a common FDA inspection finding.
A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
Last updated: April 2026. Reflects 21 CFR 117.135 as of April 2026. Book a demo to see how Truli monitors food safety compliance.
