Food safety consulting

Food safety consulting that builds the program, not just the finding list.

Hazard analysis and written food safety plans, HACCP, GMP and sanitation, allergen control, FSVP, audit readiness and quality systems — developed with your team, trained into the shift that runs them, and verified before FDA or a certification body tests them for you.

Request Compliance SupportSee What We Build
Core framework
21 CFR Part 117
Also covering
Parts 123, 120, 111 and FSVP
Method
Assess, build, train, verify

See it in 90 seconds

See how SURU simplifies compliance

From supply-chain risk to complete food safety programs, discover how SURU brings regulatory expertise, technology and practical solutions together.

  • Supply-chain complexity
  • Regulatory & food safety
  • Import & supply chain
  • Audits & operations
  • Build My Program
  • Supply Chain Intelligence
  • Compliance Intelligence
  • Human expertise

Have a food safety or compliance question?

Talk with SURU Compliance.

Contact UsExplore our services

What we do

Four groups of work, one program.

Most engagements draw on more than one of these, because the parts hold each other up. A food safety plan without sanitation beneath it and records in front of it is a document, not a control.

  • FDA & Regulatory

    The federal layer — establishing what genuinely applies to your products, making the records show it, and preparing for the day an investigator asks.

    • FDA Inspection Preparation
    • FDA 483 Response Support
    • FSMA Compliance
    • Preventive Controls
    • FSVP
    • Seafood HACCP
    • Regulatory Assessments
    • Corrective Actions

  • Food Safety Systems

    The program itself, written from your process, your equipment and your terminology rather than out of a template library.

    • HACCP
    • Food Safety Plans
    • GMP Programs
    • Sanitation
    • Allergen Control
    • Environmental Monitoring
    • Traceability
    • Recall Programs
    • SOP Development

  • Audit & Certification Readiness

    Preparation only. Certificates are issued by an accredited certification body after its own audit, and that separation is deliberate.

    • GMP Audits
    • GFSI Readiness
    • SQF Readiness
    • BRCGS Readiness
    • Organic Certification Readiness
    • Internal Audits
    • Gap Assessments
    • Corrective Actions

  • Quality Assurance

    What keeps the program running between audits: the specifications, documents, investigations and verification that make the system self-correcting.

    • QA System Development
    • Supplier Approval Programs
    • Specifications
    • Document Control
    • CAPA
    • Complaint Management
    • Verification Programs
    • Compliance Monitoring

Each area has a practice page behind it with the methodology and engagement structure in full: FDA & FSMA compliance, HACCP development and review, GFSI and certification readiness and organic certification readiness.

The regulatory framework

Know which rules you are actually under.

Almost every expensive food safety problem starts as a scoping error. A seafood processor builds a Part 117 food safety plan and never writes the Part 123 HACCP plan the rule actually requires. A supplement facility runs as though Part 111 replaced the cGMPs it sits alongside. A company signs a purchase agreement and discovers months later that it, not its broker, is the FSVP importer.

So the first work in any engagement is establishing what applies. The table below is an orientation to the frameworks U.S. food businesses most often sit under, worded as carefully as we can make it. It is not a determination for your operation — that depends on your products, processes, size and role in the supply chain, and it is the first thing we settle.

A general orientation to the frameworks U.S. food businesses most often sit under. It is not legal advice and not a determination of what applies to your operation — that depends on your products, processes, size and role in the supply chain, and establishing it is the first part of the job.

21 CFR Part 117
Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. Subpart B is Current Good Manufacturing Practice. Subpart C is Hazard Analysis and Risk-Based Preventive Controls, including the written food safety plan. Subpart G is the Supply-Chain Program, which applies where a hazard requiring a preventive control is controlled before you receive the ingredient.
21 CFR § 117.180(c)(1)
The preventive controls qualified individual. A written food safety plan must be prepared, or its preparation overseen, by a PCQI. The rule sets two co-equal pathways: successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA, or being otherwise qualified through job experience. The PCQI may be, but is not required to be, an employee of the facility. FDA does not certify individuals, so no one is an FDA-certified PCQI.
Qualified facility status
The sales thresholds that define a qualified facility are inflation-adjusted from a 2011 baseline, so they must be calculated against FDA's currently published figures rather than a number quoted somewhere online. Qualifying does not mean exemption from FSMA. It means modified requirements in place of subparts C and G; the Subpart B cGMPs still apply, and the facility must attest to FDA biennially.
21 CFR Part 1, Subpart L
Foreign Supplier Verification Programs. The FSVP importer is the U.S. owner or consignee at the time of entry, or, where there is none, the U.S. agent or representative of the foreign owner or consignee as confirmed in a signed statement of consent. It is not necessarily the importer of record and it is not the customs broker. The program requires a written hazard analysis (§ 1.504), evaluation for foreign supplier approval (§ 1.505, reevaluated at least every three years), verification activities (§ 1.506), corrective actions (§ 1.508) and records (§ 1.510) retained at least two years. Section 1.503 requires a qualified individual, who need not be an employee of the importer.
21 CFR Part 123
Seafood HACCP, for processors and importers of fish and fishery products. Section 123.10 requires certain functions to be performed by an individual trained at least equivalent to that received under standardized curriculum recognized as adequate by FDA, or who is otherwise qualified through job experience; the trained individual need not be an employee of the processor. Section 123.12 requires importers either to source from a country with an active memorandum of understanding with FDA, or to have and implement written verification procedures listing product specifications and affirmative steps.
21 CFR Part 120
Juice HACCP. Applies to processors of juice and juice-containing beverages, with its own HACCP plan and pathogen reduction requirements. A Part 117 food safety plan does not satisfy it.
21 CFR Part 111
Current Good Manufacturing Practice for dietary supplements — specifications, component identity testing and an independent quality unit. Part 111 applies alongside Part 117 subpart B rather than instead of it, with Part 111 controlling where the two conflict.
FD&C Act § 415 — food facility registration
Facilities that manufacture, process, pack or hold food for U.S. consumption generally must register with FDA, and registration is renewed biennially during the period beginning October 1 and ending December 31 of each even-numbered year. There is no registration fee, and FDA does not issue a certificate of registration.
Major food allergens
There are nine: milk, egg, fish, Crustacean shellfish, tree nuts, wheat, peanuts, soybeans and sesame. Sesame became the ninth under the FASTER Act, effective January 1, 2023. Tree nuts, fish and Crustacean shellfish must be declared by specific type or species. May-contain advisory statements are voluntary and are never a substitute for allergen labeling or for cross-contact controls on the floor.
21 CFR Part 1, Subpart S (FSMA 204)
The Food Traceability Rule, which applies to foods on the Food Traceability List. State the position carefully: the compliance date in the rule remains January 20, 2026; FDA has proposed extending it to July 20, 2028 but has not finalized that rule; and Congress has restricted the use of appropriated funds to enforce the rule before July 20, 2028. Confirm the current position for your operation, and confirm food by food whether your products are listed at all.
FDA Form 483
A list of inspectional observations. In FDA's own words, it does not constitute a final Agency determination of whether any condition is in violation. FDA's stated review policy is that if it receives a response within 15 business days after the Form 483 was issued, it plans to conduct a detailed review of that response before deciding whether to issue a Warning Letter. That is a review policy, not a legal deadline. The Establishment Inspection Report is normally transmitted to the firm after the inspection is closed.
GFSI-recognized certification schemes
GFSI benchmarks and recognizes schemes. It does not certify, audit or accredit anyone, and there is no such thing as GFSI certification — the correct phrasing is certified against a GFSI-recognized scheme. SQF is owned by SQFI, a division of FMI, and is currently audited to Edition 9; Edition 10 was published in March 2026, with audits expected to transition to it around January 2027. BRCGS is owned by BRC Trading Ltd, part of LGC ASSURE, and the current standard is Global Standard Food Safety Issue 9. Certificates are issued by a certification body accredited to ISO/IEC 17065.

SURU Compliance is an independent regulatory consulting practice. We are not FDA, USDA or any state or local health department, we are not a certification body or an accredited certifying agent, and we are not a law firm. We do not issue certificates or credentials, and we cannot guarantee an inspection outcome, an audit score, a certification decision or the closure of a Form 483.

Situations we are called into

Four situations, and exactly what happens next.

Nobody calls a consultant to buy consulting. They call with a letter, a customer deadline, a lease or a records request. These are the four we take most often.

  • Challenge
    FDA finished the inspection and left us Form 483 observations.
    What is required
    A Form 483 lists inspectional observations. In FDA's own words it does not constitute a final Agency determination of whether any condition is in violation, and there is no legal deadline to respond — a firm is not required to respond at all. What exists is a stated review policy: if FDA receives a response within 15 business days after the Form 483 was issued, it plans to conduct a detailed review of that response before deciding whether to issue a Warning Letter. The clock runs from issuance of the 483, not from the close of the inspection, and FDA may issue a Warning Letter at any time regardless.
    How SURU helps
    We read each observation against the underlying requirement and against your actual records, then separate the documentation problem from the process problem, because they need different fixes. We help you draft a response that gives root cause, the correction already completed, the systemic preventive action and the evidence for each observation — committing on paper only to what you will genuinely do, since a missed commitment is worse than a modest one. Then we build those corrections into the food safety plan and the prerequisite programs so the same observation is not available at the next inspection. Where an observation carries legal or enforcement exposure we say so and recommend qualified counsel.
    What you receive
    A structured response draft with the supporting evidence attached, a corrective and preventive action plan with named owners and completion dates, revised procedures and records, and a verification schedule. To be plain about the limit: no one outside FDA can close a 483, and we will never tell you otherwise.
  • Challenge
    A customer says we need a GFSI-recognized certification to keep the business.
    What is required
    There is no such thing as GFSI certification. GFSI benchmarks and recognizes schemes; it does not certify, audit or accredit anyone. You are certified against a GFSI-recognized scheme. SQF is owned by SQFI, a division of FMI, and is currently audited to Edition 9 — Edition 10 was published in March 2026, with audits expected to transition to it around January 2027, so confirm which edition your audit date falls under. BRCGS is owned by BRC Trading Ltd, part of LGC ASSURE, and the current standard is Global Standard Food Safety Issue 9. The certificate is issued by a certification body accredited to ISO/IEC 17065 after its own audit, and before that audit you need a management system that has been operating, not merely written.
    How SURU helps
    We help you choose the scheme your customer accepts in writing, run a clause-by-clause gap assessment against the edition you will actually be audited to, build the missing system and records with your team, train your internal auditors and run a pre-assessment audit under audit conditions. Note who does what: ISO/IEC 17065 prohibits a certification body from providing consultancy to its certification clients, and SQF bars an auditor from auditing an organization where they consulted within the previous two years. SURU prepares; a separate accredited body certifies. That separation is what makes the certificate mean something.
    What you receive
    A scheme recommendation with the reasoning written down, a dated readiness plan with an owner and an artefact against every gap, the built management system and its records, an internal audit cycle on the record, and a pre-assessment report with graded findings. The certification decision rests solely with the accredited certification body.
  • Challenge
    We have grown into our own facility and nothing is written down.
    What is required
    Facilities that manufacture, process, pack or hold food for U.S. consumption generally register with FDA under section 415. Part 117 subpart B sets the cGMP baseline. Unless modified requirements apply to you as a qualified facility, subpart C requires a written food safety plan built on hazard analysis, and that plan must be prepared, or its preparation overseen, by a preventive controls qualified individual. Subpart G adds a supply-chain program where a hazard is controlled before you receive an ingredient. Prerequisite programs, allergen control and traceability records have to exist from the first production run, not from the first audit.
    How SURU helps
    We establish what genuinely applies to your products, size and process before writing a word, and we tell you what does not apply rather than selling you a program you do not need. Then we build in order: cGMP and sanitation, hazard analysis, the food safety plan, allergen control across all nine major allergens, environmental monitoring where the product warrants it, traceability and recall, SOPs and records. On the PCQI question, the rule sets two co-equal pathways — successfully completed training at least equivalent to the standardized curriculum FDA recognizes as adequate, or being otherwise qualified through job experience — and the individual may be, but is not required to be, your employee. FDA certifies no individuals, so treat any offer of an FDA-certified PCQI as a warning sign.
    What you receive
    A written Food Safety Plan with the hazard analysis behind it, GMP and sanitation programs, an allergen control program, record templates your team can realistically maintain, traceability and recall procedures, an SOP set, and training records for the people who were trained.
  • Challenge
    An FSVP records request has arrived from FDA.
    What is required
    The first question is whether you are the FSVP importer at all. Under Part 1 subpart L that is the U.S. owner or consignee at the time of entry, or, where there is none, the U.S. agent or representative of the foreign owner or consignee as confirmed in a signed statement of consent. It is not necessarily the importer of record and it is not your customs broker. Where it is you, the file has to hold a written hazard analysis under § 1.504 — written regardless of the outcome — evaluation for foreign supplier approval under § 1.505, reevaluated at least every three years, verification activities under § 1.506, corrective actions under § 1.508 and records under § 1.510 retained at least two years. Section 1.503 requires a qualified individual, who need not be an employee of the importer.
    How SURU helps
    We establish in writing which entity is the FSVP importer for each line, because that alone resolves a surprising share of these requests. Then we assemble or rebuild the file: a hazard analysis for each food, supplier evaluation and approval with the reasoning documented, and verification activities chosen to match the hazard — onsite audits, sampling and testing, review of the supplier's food safety records, or other appropriate activities — rather than defaulting to whatever is cheapest. We also check your entry data, since the importer's name, email address and a unique facility identifier recognized by FDA, currently a DUNS number, must be transmitted at entry, and the UNK placeholder has not been accepted since July 24, 2022.
    What you receive
    A written FSVP for each food and each foreign supplier, the hazard analyses, approval and reevaluation records, a verification activity schedule with the reasoning behind each selection, corrective action records, and a records index a reviewer can actually follow. Records are retained at least two years.

How we work

We don't just identify the problem. We help build the solution.

We write it. We build it. We train your team. We help you implement it.

  1. Assess

    We walk the operation, read the records and confirm the process as it actually runs, then establish which rules genuinely apply to your products.

  2. Identify gaps

    A prioritised finding list that separates real regulatory exposure from best-practice improvement, so effort goes where the risk is.

  3. Build

    Hazard analysis, food safety plan, prerequisite programs, specifications, SOPs and record forms — written in your terminology for your equipment.

  4. Train

    The supervisors, operators and QA staff who have to run the system, plus the team who will host an inspection or an audit.

  5. Implement

    Programs go live with monitoring in place and named owners, so the records show a system operating rather than a binder existing.

  6. Verify

    Internal audits, mock recalls and mock audits, with corrective action tracked to closure. We find it first, while there is still time.

What you receive

The documents and programs you own.

Consulting is not a deliverable. These are. Everything is written in your terminology, sized to what your team can realistically maintain, and yours to keep and to use with any auditor, customer or investigator who asks.

  • Gap assessment report
  • Written Food Safety Plan
  • HACCP plan
  • Hazard analysis
  • GMP program
  • Sanitation program (SSOPs)
  • Allergen control program
  • Environmental monitoring program
  • FSVP file
  • Supplier approval program
  • Specifications
  • Document control system
  • CAPA program
  • Recall plan
  • Traceability procedure
  • Internal audit program
  • QA manual
  • SOP set
  • Training materials and records
  • Audit readiness plan
  • Corrective action plan

Questions

Answered plainly, including where the answer is no.

Who has to write our food safety plan, and what is a PCQI?

Under 21 CFR Part 117, the written food safety plan must be prepared, or its preparation overseen, by a preventive controls qualified individual. Section 117.180(c)(1) sets two co-equal pathways to that qualification: successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA, or being otherwise qualified through job experience. FDA does not require any particular course, and FDA does not certify individuals — there is no such thing as an FDA-certified PCQI, and anyone selling you one is describing something that does not exist. The rule also says the PCQI may be, but is not required to be, an employee of the facility. We commonly work alongside your named PCQI or help you develop one internally, because an investigator will ask your team about the plan, not us.

Can SURU certify us to SQF, BRCGS or organic?

No, and no consultant can. GFSI benchmarks and recognizes schemes; it does not certify, audit or accredit anyone, so there is no such thing as GFSI certification — you are certified against a GFSI-recognized scheme. SQF is owned by SQFI, a division of FMI; BRCGS is owned by BRC Trading Ltd, part of LGC ASSURE. The certificate itself is issued by a certification body accredited to ISO/IEC 17065, and USDA organic certification is issued by a USDA-accredited certifying agent rather than by USDA and never by a consultant. That separation is structural: ISO/IEC 17065 prohibits a certification body from providing consultancy to its certification clients, and SQF bars an auditor from auditing an organization where they consulted within the previous two years. We prepare you. Someone else certifies you. That is how the certificate keeps its value.

FDA left us a Form 483. Do we have 15 days to respond?

Not as a legal deadline. A Form 483 lists inspectional observations and, in FDA's own words, does not constitute a final Agency determination of whether any condition is in violation. The 15 business days come from FDA's stated review policy: if the agency receives a response within 15 business days after the Form 483 was issued, it plans to conduct a detailed review of that response before deciding whether to issue a Warning Letter. A firm is not required to respond at all, and FDA may issue a Warning Letter at any time regardless. Two details get missed often: the clock runs from issuance of the 483, not from the close of the inspection, and the Establishment Inspection Report is normally transmitted to the firm after the inspection is closed. Finally, no one outside FDA can close a 483 — treat any promise to do so as disqualifying.

We are small. Does qualified facility status exempt us from FSMA?

No, and this is one of the most common misreadings we correct. A qualified facility is subject to modified requirements in place of subparts C and G — the hazard analysis, preventive controls and supply-chain program provisions. The Subpart B current good manufacturing practice requirements still apply in full, and the facility must attest to FDA biennially. On the thresholds themselves: they are inflation-adjusted from a 2011 baseline, so we will not publish a dollar figure here. They have to be calculated against FDA's currently published figures using your own averaged sales, and the calculation is worth doing properly rather than assuming from a number someone quoted you.

Do we need to renew our FDA food facility registration this year?

If your facility is registered under section 415 of the FD&C Act, then yes — 2026 is a renewal year. Renewal is biennial, during the period beginning October 1 and ending December 31 of each even-numbered year, so the window runs from October 1 to December 31, 2026. Two things worth knowing: there is no registration fee, and FDA does not issue a certificate of registration, so any certificate offered by a third-party service is not an FDA document. A lapsed registration is a quiet failure. Nothing announces it — an entry or an inspection does.

Has the Food Traceability Rule deadline moved to 2028?

Not as a settled matter, and the honest answer has three parts. The compliance date written in the rule remains January 20, 2026. FDA has proposed extending it to July 20, 2028, but has not finalized that rule. Separately, Congress has restricted the use of appropriated funds to enforce the rule before July 20, 2028. So the practical enforcement position and the text of the rule are not currently the same thing, and you should confirm the current position for your operation rather than planning around a date you saw quoted. Two things are true regardless: applicability is determined food by food against the Food Traceability List, not company by company, and traceability records are worth building anyway — a mock recall is where most operations discover how long theirs really takes.

Start right

Tell us what you make and what is coming.

An inspection date, a 483 on the desk, a customer audit deadline, a records request, or a first production run in a facility that has nothing written down yet. Send us the products, the process and the date. We will tell you what applies, what does not, and what it takes to be ready — before you commit to anything.

Request Compliance SupportExplore All Services

Direct contact

SURU Compliance is a regulatory consulting practice. We are not a government agency, a certification body, or a law firm, and we do not provide legal advice or guarantee regulatory outcomes.