FDA compliance for a food business rests on a handful of concrete obligations: being registered where registration is required, operating under the CGMP and preventive controls framework that applies to your products, holding records that can be produced and followed, and being able to host an inspection without improvising.
Most facilities we are called into are not failing on intent. They are failing because the food safety plan describes a process the plant no longer runs, because monitoring records have gaps nobody reviewed, or because the person named as PCQI has never been walked through what an investigator will ask them.
The obligations that generate most findings
Facility registration under 21 CFR Part 1 Subpart H is the administrative baseline, including biennial renewal and, for foreign facilities, a U.S. agent. Lapsed registration causes problems disproportionate to how easy it is to maintain.
The substantive requirements sit in 21 CFR Part 117: CGMP in Subpart B and the food safety plan in Subpart C, including hazard analysis, process, allergen, sanitation and supply-chain preventive controls, verification activities, and a recall plan where a hazard requires a preventive control. Exemptions and modified requirements are extensive — qualified facilities, certain storage operations, dietary supplement operations complying with Part 111 — and applicability has to be established against your actual activities and sales.
Inspection readiness in practical terms
Readiness is mostly about retrieval and consistency. An investigator asks for a record; the record exists, is complete, and matches what the plan says should have happened. Where those three things hold, an inspection is a routine event.
- A food safety plan reconciled against the current process flow, equipment and product mix
- Monitoring, corrective action and verification records that can reconstruct a lot from receiving to shipment
- A records review step with a signature that means something — who reviewed what, and when
- A document staging process so requests are answered from a known location rather than a search
- Front-desk and floor-team preparation: who greets, who escorts, what is answered and what is checked before answering
- Mock inspection walkthroughs against the questions investigators actually open with
When FDA has already issued observations
A Form FDA 483 records inspectional observations. It is not a final determination that a violation exists, but the response materially shapes what happens next. A credible response addresses each observation individually with root cause analysis that goes past operator error, dated corrective actions, preventive actions covering other areas exposed to the same cause, and objective evidence attached.
Several observations frequently share a single root cause — three record-completeness observations may all trace back to one absent review step. Addressing that systemically is both more honest and more persuasive than writing three unrelated corrective actions.
Where an observation carries enforcement exposure, or where a Warning Letter or litigation is in prospect, qualified counsel should review what is submitted. SURU Compliance builds the technical content and is not a law firm; we do not advise on legal strategy.
SURU Compliance is an independent regulatory consulting practice. We are not the FDA or any other government agency, not a certification body or accredited certifying entity, and not a law firm. We do not provide FDA approval, guaranteed inspection or audit outcomes, or legal advice, and we refer legal matters to qualified counsel. Regulatory applicability depends on your specific products, processes, size and jurisdiction.