A preventive control is a specific step a food facility takes to reduce or eliminate a safety hazard before it reaches consumers. The term comes from U.S. food safety regulation: the FDA’s Preventive Controls for Human Food rule, finalized in September 2015 under the Food Safety Modernization Act (FSMA). Every domestic or foreign facility that manufactures, processes, packs, or holds food for the U.S. market is generally required to identify hazards in its operations and put written preventive controls in place to address them.
Why Preventive Controls Exist
Before FSMA, food safety regulation in the United States was largely reactive. The FDA responded to contamination after people got sick. FSMA flipped that approach, requiring facilities to anticipate problems and build safeguards into their processes from the start. The centerpiece of that shift is the written food safety plan, which every covered facility must develop and implement. That plan starts with a hazard analysis, where the facility evaluates every step of its operation to identify biological, chemical, and physical hazards that are reasonably likely to occur. If any hazard is severe enough and likely enough to require a control, the facility must put a written preventive control in place to significantly minimize or prevent it.
Facilities have flexibility in how they design these controls. A bakery faces different risks than a frozen-meal manufacturer, so the rule doesn’t prescribe a single set of procedures. Instead, it requires each facility to tailor its controls to its own products, ingredients, and processes.
The Four Types of Preventive Controls
The rule organizes preventive controls into four categories. Most food facilities will use more than one type.
Process Controls
Process controls are the hands-on production steps that eliminate or reduce hazards during manufacturing. Cooking food to a specific internal temperature to kill bacteria is a classic example. Refrigerating perishable items to slow microbial growth, acidifying a product to lower its pH, and pasteurizing liquids all fall under this category. Each process control must include defined parameters and values (sometimes called critical limits) that are appropriate to the hazard. For instance, a facility cooking chicken might set a minimum internal temperature and a minimum hold time. If the product doesn’t hit those numbers, the control has failed and corrective action is required.
Food Allergen Controls
Allergen controls address two risks: cross-contact and mislabeling. Cross-contact happens when a product that isn’t supposed to contain an allergen picks up traces of one, often from shared equipment, poor production scheduling, or improper handling of rework (leftover product mixed back into a new batch). Facilities must have written procedures to prevent this, which can include using dedicated equipment for allergen-containing products, scheduling production runs so that allergen-free items are made first, and thoroughly cleaning shared lines between runs.
The labeling side is equally important. Federal law requires every allergenic ingredient to be declared on the label, even when the allergen is a sub-ingredient of a spice, flavor, or coloring. The FDA does not grant labeling exemptions for food allergens because even very small amounts can trigger serious reactions in sensitive individuals. Allergen controls ensure that what’s on the label matches what’s actually in the package.
Sanitation Controls
Sanitation controls cover the procedures, practices, and processes that keep a facility clean enough to prevent contamination. They target three main risks: environmental pathogens (like Listeria living on equipment surfaces or in drains), hazards introduced by employees handling food, and allergen residues left behind after production. In practice, sanitation controls often involve detailed cleaning and sanitizing schedules, employee hygiene protocols, and environmental monitoring programs where facilities routinely swab surfaces and test for dangerous organisms. These controls are especially critical in facilities that produce ready-to-eat foods, where there’s no cooking step downstream to kill any pathogens that get into the product.
Other Controls
This is a catch-all category for any preventive measure that doesn’t fit neatly into the first three. If the hazard analysis identifies a risk that requires a control but it isn’t a process, allergen, or sanitation issue, the facility still needs a written procedure to address it. An example might be a control to prevent physical contamination from packaging materials, or a procedure to manage a chemical hazard that isn’t addressed by a processing step.
The Food Safety Plan
Preventive controls don’t exist in isolation. They’re part of a broader written food safety plan that every covered facility must maintain. That plan includes the hazard analysis, the preventive controls themselves, and several management components that keep the system running.
Monitoring is the ongoing observation or measurement that confirms a control is working as intended. If a process control requires cooking to a certain temperature, monitoring means checking and recording that temperature during production. Verification goes a step further: it’s the evidence-gathering that proves the overall system is effective. This can include reviewing monitoring records, calibrating thermometers, or testing finished products. Corrective actions are the predetermined steps the facility takes when a control fails, such as holding and evaluating affected product, identifying the root cause, and adjusting the process to prevent a repeat. All of these activities must be documented and kept as records.
The food safety plan also needs to be reanalyzed periodically or whenever something significant changes, such as a new ingredient, a new piece of equipment, or a new hazard that the facility didn’t originally anticipate.
Who Develops the Plan
Every food safety plan must be prepared, or its preparation overseen, by a Preventive Controls Qualified Individual, commonly called a PCQI. This person must have successfully completed a standardized training course recognized by the FDA, or have equivalent knowledge gained through job experience. The training covers hazard analysis, risk-based control design, monitoring, verification, corrective actions, and recordkeeping. Many food companies send multiple employees through PCQI training so they have qualified staff available at all times, but only one individual needs to formally oversee the plan.
How Preventive Controls Differ From HACCP
If you’ve worked in food safety before, preventive controls will look familiar. The system retains most of the elements of HACCP (Hazard Analysis and Critical Control Points), the framework that has governed meat, seafood, and juice safety for decades. Both approaches require hazard analysis, monitoring, corrective actions, verification, and recordkeeping. Good Manufacturing Practices remain the foundation for both.
The differences are mostly in scope and terminology. HACCP focuses on critical control points with strict critical limits. The preventive controls framework uses broader language, referring to “parameters and values” rather than just critical limits, which gives facilities more flexibility in how they define and manage controls. Preventive controls also explicitly include allergen controls, sanitation controls, and supply-chain verification, areas that HACCP plans typically addressed only indirectly through prerequisite programs. In regulatory terms, the FSMA rule uses the acronym HARPC (Hazard Analysis and Risk-Based Preventive Controls) to distinguish itself from traditional HACCP.
Supply-Chain Controls
When a facility identifies a hazard in a raw material or ingredient that it doesn’t control itself, it may rely on its supplier to manage that hazard. In those cases, the facility must have a supply-chain program that verifies the supplier is actually doing its part. This could mean reviewing the supplier’s food safety records, conducting audits, or requiring certificates of analysis for incoming ingredients. The receiving facility remains responsible for ensuring the hazard is controlled, even though the actual control happens upstream.
Who the Rule Applies To
The Preventive Controls for Human Food rule applies broadly to facilities that manufacture, process, pack, or hold human food. There are some exemptions and modified requirements for very small businesses (based on annual sales), farms that only conduct certain low-risk activities, and facilities already subject to other FDA safety regulations like the seafood or juice HACCP rules. Facilities that qualify as “qualified facilities” under the rule have simplified requirements but must still meet baseline safety standards.