If you manufacture, process, pack, or hold food in the United States, there’s a good chance you’re required to have a written Food Safety Plan. Not a binder of good intentions an actual, FDA-compliant document that a regulator can pick up and verify during an inspection.

For small manufacturers, the process can feel overwhelming. This guide breaks it down into clear, actionable steps so you know exactly what goes in your plan and how to build it right the first time.

First: Do You Actually Need a Food Safety Plan?

Generally, domestic and foreign food facilities that are required to register with the FDA under section 415 of the Food, Drug & Cosmetic Act must comply with the requirements for risk-based preventive controls under FSMA — including having a written Food Safety Plan in place. FDA

There are exemptions very small businesses below certain sales thresholds, farms, and some other categories — but don’t assume you’re exempt without verifying. Check your facility’s classification against FDA guidance, and confirm your status at FDA.gov if you haven’t already. SafetyChain Software

If you’re unsure, that uncertainty itself is a signal to get a professional assessment before an inspector shows up to answer the question for you.

What Is a Food Safety Plan?

The FDA defines a Food Safety Plan as a tool designed to assist owners and operators of food facilities with developing food safety systems specific to their facilities  systems that meet the requirements of the Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food regulation. These plans serve as your roadmap for maintaining consistent food safety standards across all aspects of your operation, from ingredient sourcing to final product distribution. Alleratech

Under FSMA, your Food Safety Plan must include a hazard analysis, preventive controls, supply chain programs, and a recall plan  and it must be developed by a Preventive Controls Qualified Individual (PCQI), with ongoing compliance and regular updates. Food Docs

Who Has to Write It?

A PCQI  a Preventive Controls Qualified Individual  must develop or oversee the development of your Food Safety Plan. A PCQI is a person with the education, training, or experience to develop and apply a food safety system. Importantly, the PCQI does not need to be an employee of the facility. FDA

That last point matters for small manufacturers. You don’t need to hire a full-time food safety director. You can bring in a qualified consultant to develop or oversee your plan which is often the most cost-effective path for businesses under 50 employees.

FSMA requires food manufacturers to identify hazards, implement preventive controls, and document everything in a way that FDA inspectors can verify. The PCQI is the person responsible for making sure all of that happens correctly.

The 7 Required Components of a Food Safety Plan

FSMA Food Safety Plans must include a hazard analysis to assess for hazards requiring a preventive control, preventive controls to minimize identified hazards, monitoring procedures, corrective actions, verification activities, a supply chain program, and a recall plan. SafetyChain Software

Here’s what each one means in practice:

Step 1: Assemble Your Food Safety Team

Before you write a single word, get the right people in the room. Your food safety team should include anyone who touches the product production staff, quality leads, receiving personnel, and your PCQI. If you’re a very small operation, this might be two or three people. That’s fine.

Once your team is in place, create a process flow diagram a step-by-step map of your entire manufacturing process, from purchasing ingredients through production, storage, and distribution. Walk through the production area in the order of the manufacturing process to ensure everything is accurate and nothing is missed. The diagram should include the purchasing of ingredients and supplies. Foodsafedrains

This flow diagram becomes the backbone of your entire Food Safety Plan. Every subsequent step references it.

Step 2: Conduct Your Hazard Analysis

This is the most technically demanding part of the plan — and the most important.

A thorough Hazard Analysis consists of two primary components: Hazard Identification and Hazard Evaluation. The first step is identifying potential food safety hazards in raw materials, processing steps, storage conditions, and distribution. Registrar Corp

The three categories of hazards you’re analyzing:

• Biological — Pathogens like Salmonella, Listeria, and E. coli
• Chemical — Allergens, pesticides, cleaning chemical residues, naturally occurring toxins
• Physical — Foreign objects like metal fragments, glass, bone, or plastic

Your PCQI must evaluate ingredients, processing steps, and storage conditions for risk factors, identify hazards requiring preventive controls such as bacterial contamination or allergen cross-contact, and document findings with justification for decisions on whether each hazard requires control measures. Registrar Corp

The hazard analysis isn’t just a list  it’s a documented decision. For every hazard identified, you need to explain why it does or doesn’t require a preventive control. That reasoning has to be in writing.

Step 3: Establish Your Preventive Controls

For every hazard your analysis determines requires a control, you need a preventive control in place. Every FSMA-compliant food safety plan must include preventive controls  the specific measures your facility takes to minimize or prevent identified hazards from occurring. Alleratech

The four types of preventive controls under FSMA:

• Process Controls — Time/temperature controls like cooking, pasteurization, cooling
• Allergen Controls — Labeling procedures, cross-contact prevention, sanitation between runs
• Sanitation Controls — Cleaning and sanitation procedures for food-contact surfaces and equipment
• Supply Chain Controls — Verification that your ingredient suppliers control hazards you can’t control at your facility

Each preventive control needs to specify what the control is, how it’s monitored, who is responsible, and what happens when it fails.

Step 4: Define Your Monitoring Procedures

A preventive control only works if someone is checking it. Your monitoring procedures answer: who checks what, how, how often, and how it gets recorded.

FDA inspectors are increasingly requesting electronic access to monitoring records during inspections. Facilities relying on handwritten logs and binders face significantly longer inspection timelines and higher rates of 483 observations. Transitioning to a digital food safety management system with real-time record capture is now a practical necessity, not a luxury.

For small manufacturers just getting started, paper logs are still acceptable but build your system with digital migration in mind.

Step 5: Write Your Corrective Action Procedures

What happens when something goes wrong? Your Food Safety Plan needs to answer that question before it happens  not in the moment.

Corrective actions must define clear procedures for what to do if a preventive control fails including how to identify and contain affected product, determine the cause of the failure, and prevent recurrence. Registrar Corp

Corrective actions aren’t a sign of a failing food safety program. They’re proof that your system is working. An FDA inspector reviewing your records would rather see documented corrective actions than a record that looks suspiciously perfect.

Step 6: Build Your Verification Activities

Verification answers a different question than monitoring. Monitoring asks: is the control working right now? Verification asks: is the overall system actually preventing hazards over time?

Common verification activities include calibration of monitoring equipment, reviewing monitoring records, conducting environmental or product testing, and validating that your process controls are actually achieving their intended effect. Registrar Corp

Under FSMA, each facility must reanalyze its food safety plan at least once every three years, or whenever a significant change occurs in your process, product, or facility that could introduce new hazards or change existing ones. Alleratech

Step 7: Develop Your Recall Plan

No one likes writing a recall plan. But the time to figure out what you’d do in a recall is not during one.

A PCQI must develop clear procedures for identifying, containing, and removing unsafe products from the market, establish communication protocols for notifying regulatory agencies, suppliers, and consumers, and conduct mock recall exercises to ensure the team is ready. A well-prepared recall plan can significantly mitigate financial and reputational risks if a contamination issue arises. Registrar Corp

At minimum, your recall plan should include: a lot-coding system that lets you identify affected product, a customer contact list, a communication template for notifying buyers and regulators, and a chain of command for who makes decisions.

Step 8: Establish Your Supply Chain Program

If any of your ingredients come from a supplier who controls a hazard that you don’t  meaning you’re not cooking, pasteurizing, or otherwise treating the ingredient at your facility you need a supply chain program.

Acceptable supplier verification activities include onsite audits, ingredient testing, review of the supplier’s food safety records, and certificates of conformance. For the highest-risk materials those associated with hazards that could cause serious adverse health consequences annual onsite audits conducted by a qualified auditor are required unless an alternative verification approach is documented and justified.

The Most Common Mistakes Small Manufacturers Make

Copying a template without customizing it. A generic food safety plan downloaded from the internet is not your food safety plan. It has to reflect your actual facility, your actual ingredients, and your actual process. An FDA inspector will spot a boilerplate plan immediately.

Skipping the hazard analysis justification. It’s not enough to list hazards. You have to document why each one does or doesn’t require a control. That reasoning is what regulators are looking for.

Not training staff on the plan. Food safety plans aren’t static documents regular review and updating ensures your plan remains effective and compliant, and staff training must account for both new employees and ongoing education to keep staff current with evolving requirements. Alleratech

Treating it as a one-time project. Your food safety plan is a living document. Every time you add a product, change a supplier, modify a process, or update your equipment, the plan needs to be reviewed.

Where to Start If You’re Building From Scratch

The FDA offers a free Food Safety Plan Builder tool at fda.gov that walks you through the plan development process step by step. It’s a legitimate starting point  especially for understanding the structure and required components.

But for most small manufacturers, the most efficient path is a gap assessment first. Before you start building, find out where you actually stand. What documentation do you already have? What hazards are most relevant to your product category? What’s the fastest path to a compliant plan?

That assessment shapes everything that comes after and prevents you from spending time building sections of a plan that don’t apply to your operation.

Afya Food Safety & Sanitation helps small manufacturers develop FDA-compliant Food Safety Plans from the ground up  including hazard analysis, preventive controls documentation, and PCQI oversight. [Schedule your gap assessment today.]