A preventive control is a step, procedure, or practice that a food facility uses to minimize or prevent a known hazard in its products. The term comes from the FDA’s Food Safety Modernization Act (FSMA), which shifted the U.S. food safety system from reacting to contamination after it happens to preventing it in the first place. Under FSMA’s Preventive Controls for Human Food rule, every food facility must identify the hazards reasonably likely to occur in its operations and then put controls in place to address each one.
There are four main categories of preventive controls: process controls, allergen controls, sanitation controls, and supply-chain controls. Each targets a different type of risk, and together they form the backbone of a facility’s food safety plan.
How Preventive Controls Differ From HACCP
If you’ve worked in food safety before, you’re probably familiar with HACCP (Hazard Analysis and Critical Control Points), the system that has governed meat, seafood, and juice production for decades. Preventive controls build on HACCP’s foundation but expand the scope significantly. Under HACCP, facilities identify critical control points, the specific steps where a hazard can be eliminated or reduced, and set strict limits for each one. The preventive controls framework keeps that concept (calling limits “parameters and values” instead of “critical limits”) but adds three entire categories of controls that HACCP never formally required: sanitation, allergen management, and supply-chain verification.
The preventive controls rule also introduces the idea of a “food safety system” with two layers. The first layer is the food safety plan itself, which addresses higher-risk hazards through formal preventive controls with monitoring, corrective actions, and verification. The second layer consists of prerequisite programs that manage lower-risk hazards, things like general employee hygiene and pest control that support the plan but don’t require the same level of documentation.
Process Controls
Process controls are the closest equivalent to traditional HACCP critical control points. They target biological, chemical, or physical hazards by applying a specific treatment during manufacturing. The most common example is heat treatment. A facility producing canned goods, for instance, applies temperatures above 212°F (100°C) under pressure to achieve commercial sterility. For products that don’t need to be shelf-stable, lower heat treatments between 158°F and 212°F (70°C to 100°C) reduce harmful bacteria to safe levels without fully sterilizing the food.
Temperature isn’t the only tool. Acidifying foods to a pH of 4.6 or below prevents the growth of dangerous bacteria, which is why pickled vegetables and certain sauces are considered lower risk. Irradiation is another option: doses of 2 to 7 kiloGray effectively eliminate disease-causing bacteria that don’t form spores. For uncooked poultry specifically, the maximum allowed dose is 4.5 kGy for fresh products and 7.0 kGy for frozen.
Each process control requires documented monitoring. If your preventive control is a cooking step, that means recording actual temperature values at defined intervals, not just assuming the oven is set correctly.
Allergen Controls
Allergen preventive controls focus on two things: preventing cross-contact between allergenic and non-allergenic foods during production, and making sure labels accurately reflect what’s in the product. Cross-contact happens when trace amounts of an allergen transfer from one food to another, often through shared equipment, airborne particles, or poor scheduling of production runs.
Effective allergen controls start at the receiving dock. When ingredients arrive, staff should compare the labels on incoming materials against product specifications and check for any changes in the list of declared allergens. During storage, allergenic ingredients should be kept in separate areas or, when that isn’t possible, stored below non-allergenic ingredients to prevent accidental contamination. Rework materials (leftover product being reprocessed) need to be stored in closed, labeled containers that clearly identify the allergens present, the intended finished product, and the batch code.
On the production floor, controls include scheduling allergen-containing products to run after non-allergenic ones, physically separating production lines, controlling foot traffic between areas, and using air filtration where airborne particles are a concern. Between production runs of different products, thorough cleaning and verification that equipment is free of allergen residue are critical steps.
Sanitation Controls
Sanitation controls are procedures that keep a facility clean enough to prevent contamination, particularly from environmental pathogens like Listeria monocytogenes and from employee handling of food. These controls matter most for ready-to-eat products, foods that won’t undergo any further cooking before someone eats them. A pathogen on a raw chicken breast may be killed during cooking, but a pathogen on a deli salad has no such safety net.
When a facility identifies that an environmental pathogen could contaminate a ready-to-eat product, environmental monitoring becomes a requirement. This typically means swabbing surfaces, drains, and equipment on a regular schedule, then testing those samples for the target organism. The goal isn’t just to confirm that cleaning happened but to verify that cleaning actually worked. If monitoring detects a pathogen, the facility must take corrective action: identifying the source, intensifying cleaning, retesting, and evaluating whether any affected product needs to be held or discarded.
Supply-Chain Controls
Not every hazard is controlled inside your own facility. When a raw material arrives with a hazard that your supplier is responsible for managing, such as a spice that needs to be treated for Salmonella before you receive it, supply-chain preventive controls apply. These controls require you to verify that your suppliers are actually doing what they’re supposed to do.
Verification can take several forms, but the most rigorous is an onsite audit conducted by a qualified auditor. An annual onsite audit is required when the hazard in question could result in serious health consequences or death, unless the facility has documented in writing that other verification methods provide adequate assurance. Those alternatives might include reviewing the supplier’s food safety records, sampling and testing incoming materials, or relying on the supplier’s regulatory compliance history. Regardless of the method chosen, the receiving facility bears responsibility for confirming that its suppliers meet FDA food safety standards.
Monitoring, Verification, and Corrective Actions
Every preventive control needs a system to confirm it’s working, and a plan for when it isn’t. That system has three parts.
Monitoring is the real-time or near-real-time observation that a control is being performed correctly. Recording cooking temperatures during a heat process is monitoring. Checking that an allergen-containing ingredient was stored in the correct location is monitoring. All monitoring activities must be documented.
Verification is the periodic check that the entire system is functioning as designed. Where monitoring asks “did we hit the right temperature today?” verification asks “is our temperature monitoring program reliable over time?” Verification might involve calibrating thermometers, reviewing monitoring records for trends, or conducting product testing.
Corrective actions kick in when monitoring or verification reveals a problem. The facility must identify what went wrong, determine whether any affected product is safe to release, fix the immediate issue, and address the root cause to prevent it from recurring. Every step of this process must be documented. If product has already been distributed and may pose a safety risk, the facility must take action on that distributed product as well.
Who Needs a Preventive Controls Plan
The Preventive Controls for Human Food rule applies to most food facilities that are required to register with the FDA. This includes manufacturers, processors, packers, and holding facilities. There are some exemptions: farms that only perform activities like packing or holding raw agricultural commodities, very small businesses with specific qualifying conditions, and facilities already subject to other FSMA rules (like the seafood or juice HACCP regulations) may have different requirements.
Facilities that fall under the rule must have a written food safety plan that includes a hazard analysis, preventive controls for each identified hazard, monitoring procedures, corrective action procedures, and verification activities. The plan must be prepared or overseen by a “preventive controls qualified individual,” someone who has completed training equivalent to the FDA’s standardized curriculum for preventive controls.