← Back to Learning Center

Published: July 25, 2026 · By Sauce SOP

FDA 21 CFR Part 117 Explained for Small Sauce Makers — Preventive Controls Made Simple

A plain-English guide to the FDA Preventive Controls rule for sauce manufacturers. Understand HARPC, PCQI requirements, and how to build compliant documentation.

What exactly is 21 CFR Part 117?

21 CFR Part 117 implements the preventive controls provisions of FSMA. Subpart B covers Current Good Manufacturing Practice (CGMP) — facility hygiene, equipment maintenance, employee health, pest control, water quality, sanitation. Subpart C covers Hazard Analysis and Risk-Based Preventive Controls (HARPC) — identify hazards, implement preventive controls, monitor, take corrective actions, verify the system works.

Key difference from HACCP: HARPC goes beyond process CCPs — you must evaluate hazards across your entire operation including supply chain, allergens, and sanitation practices.

Who needs to comply?

Any facility that manufactures, processes, packs, or holds human food in the US must comply. Very small businesses with less than ~$1.2M in annual food sales AND primarily local sales may qualify for modified requirements. Acidified food producers must also comply with 21 CFR Part 114 in addition to Part 117.

What you actually need to do

  1. Hazard Analysis: Identify biological, chemical, physical, radiological hazards, and economically motivated adulteration risks. Must be prepared or overseen by a PCQI.
FDA 21 CFR Part 117 Preventive Controls framework diagram — the five types of preventive controls mapped to the HARPC workflow
Figure 1: HARPC Preventive Controls framework — five types extending beyond traditional HACCP CCPs.
  1. Preventive Controls: For each significant hazard — process controls (CCPs), allergen controls, sanitation controls, supply-chain controls, and a recall plan.
  2. Monitoring & Verification: Each preventive control must be monitored, documented, and verified. Applies across all preventive control types, not just CCPs.
  3. Supply Chain Program: Written supplier approval and verification procedures for ingredients carrying hazards you don't control in your process.

The PCQI requirement

A PCQI is a person who completed FDA-recognized training (FSPCA Preventive Controls course, ~$500-800, 2.5 days). Small manufacturers can become their own PCQI. The PCQI prepares the food safety plan, validates preventive controls, reviews records, and re-analyzes when changes occur.

Common compliance gaps

  1. No written recall plan
  2. Weak supply chain verification — documenting supplier approval is essential
  3. Missing allergen controls — cleaning between runs must be verified
  4. Environmental monitoring gaps — Listeria swabbing in wet processing areas
  5. Outdated CGMP documentation predating 2015

Build your Part 117-aligned documentation

Sauce SOP generates SOPs structured to align with Part 117 requirements — cutting documentation time from weeks to minutes.

Start free — 3 AI SOPs included

This site uses cookies to improve your experience. By continuing, you agree to our use of cookies. Learn more