Manufacturing
Food manufacturing compliance, built once and used by every auditor.
If you make, pack, hold or brand food, three audiences are asking about the same system: FDA under the preventive controls rule, your customers under their supplier requirements, and a certification body under a GFSI-benchmarked scheme. We build one program that answers all three.
- Primary framework
- 21 CFR Part 117
- Coverage
- Nationwide, onsite and remote
- Method
- Assess → build → verify
Who this is for
One framework, many kinds of facility.
A co-manufacturer, a private-label brand and a warehouse are held to different parts of the same body of regulation. The starting question is always the same: what does your operation actually do to food, and who is relying on you to control it?
- Food manufacturers
- Ingredient suppliers
- Co-manufacturers
- Private-label manufacturers
- Importers
- Distributors
- Warehouses
- Dietary supplement manufacturers
- Beverage producers
- Bakery and snack producers
- Seafood processors
- Growing food companies
Not sure which category you fall into? That is a normal place to start. Tell us the products, the process steps and the customers, and working out what applies is the first part of the job.
The regulatory baseline
Know which rules you are actually under.
Manufacturers routinely build to the wrong framework — a Part 117 food safety plan at a seafood processor, a supplement facility run as though Part 111 did not exist, or an importer role nobody realised the company had taken on. Getting this right at the start is cheaper than discovering it during an inspection.
Records are the evidence
A program is judged on what its records can prove, not on what its binder says.
A general orientation to the frameworks manufacturers most often sit under. It is not a determination of what applies to your facility — that depends on your products, processes, size and role in the supply chain, and it is the first thing we establish.
- 21 CFR Part 117
- Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food. Subpart B is the cGMP baseline — personnel, plant and grounds, sanitary operations, equipment, processes and controls, warehousing. Subpart C adds hazard analysis and risk-based preventive controls, including a written food safety plan prepared by, or whose preparation is overseen by, a preventive controls qualified individual (PCQI). Subpart G sets the supply-chain program where a hazard is controlled before you receive the ingredient. Modified requirements can apply to qualified facilities.
- 21 CFR Part 123
- Seafood HACCP, for processors and importers of fish and fishery products. It is a separate rule with its own HACCP plan, sanitation control records and importer verification requirements — it is not satisfied by a Part 117 food safety plan.
- 21 CFR Part 120
- Juice HACCP. Applies to processors of juice and juice-containing beverages, including the pathogen reduction requirement and the associated validation.
- 21 CFR Part 111
- Current Good Manufacturing Practice for dietary supplements. A distinct framework built around specifications, component identity testing and an independent quality unit — a supplement facility is not simply a Part 117 facility.
- 21 CFR Part 1, Subpart L
- Foreign Supplier Verification Programs. This one catches manufacturers by surprise: if you import your own ingredients or finished goods, you may also be the FSVP importer, with hazard analysis and supplier verification obligations in that role as well.
- 21 CFR Part 1, Subpart S
- The Food Traceability Rule (FSMA 204). It applies to foods on the FDA Food Traceability List and requires key data elements to be captured at critical tracking events, plus a traceability plan. FDA has proposed extending the compliance date — confirm the current date for your operation before you plan around it, and confirm food by food whether your products are listed at all.
- FD&C Act § 415 — food facility registration
- Facilities that manufacture, process, pack or hold food for U.S. consumption generally must register with FDA, and registration must be renewed biennially. A lapsed registration is a quiet failure — nothing tells you until an entry or an inspection does.
- 9 CFR (USDA FSIS)
- Most meat, poultry and egg products are regulated by USDA FSIS rather than FDA, under mandatory HACCP and sanitation requirements with in-plant inspection. Which agency you answer to depends on the product, and some facilities answer to both.
SURU Compliance is an independent consulting practice. We are not FDA, USDA or any state health department, we are not a certification body, and we are not a law firm. We do not issue certificates or credentials, and we cannot guarantee an inspection outcome, an audit score or a certification decision.
Services
What we build, in the order a plant needs it.
Five bodies of work. Most engagements draw on more than one, because a food safety plan without sanitation behind it and records in front of it is a document rather than a control.
Food safety systems
The plan itself — built from the process as it actually runs, not from a template library.
- HACCP plan development and review
- Preventive Controls (21 CFR Part 117)
- Written Food Safety Plans
- Hazard analysis across biological, chemical and physical hazards
- Validation and verification activities
- Process authority coordination
- Reassessment when the process, product or supplier changes
GMP and prerequisite programs
The operational layer a food safety plan stands on. When these fail, the plan fails with them.
- GMP / cGMP program development
- Sanitation programs and master sanitation schedules
- Allergen control and changeover programs
- Environmental monitoring design and response plans
- Pest control program oversight
- Maintenance and hygienic design review
- Chemical control
Certification and audit readiness
Preparation only. Certification decisions rest entirely with your accredited certification body.
- GFSI scheme selection and readiness
- SQF readiness
- BRCGS readiness
- Organic certification readiness
- Internal audit program and auditor training
- Gap assessments against the current issue of the standard
- Corrective action support
- Mock audits under audit conditions
Quality assurance and documentation
The paperwork an auditor reads first, written so the people on the floor can actually follow it.
- QA program design
- CAPA with real root cause methodology
- SOP development
- Raw material and finished product specifications
- Document and record control
- Supplier approval programs
- Complaint management and trending
- Label and specification review
Traceability, recall and FDA readiness
What you need on the worst day, prepared on an ordinary one.
- Traceability systems and record design
- Recall plans
- Mock recall exercises
- FDA inspection readiness and team preparation
- FDA Form 483 response support
- Food defense and intentional adulteration planning
- Food fraud and vulnerability assessment
Go deeper
The practice pages behind this work.
Each of these covers one area in operational detail — the methodology, the regulatory basis and the engagement structure.
Manufacturing food safety programs
The prerequisite layer in depth — sanitation with validated contact times, environmental monitoring built around your zone map, allergen changeover validation, and CAPA that closes causes rather than findings.
- Sanitation
- Environmental monitoring
- Allergen control
- CAPA
HACCP development and review
Flow diagram verification on the floor, documented hazard reasoning, CCPs with defensible critical limits, and the seafood, juice and specialized-process plans that need their own rule.
- Part 123
- Part 120
- Variance support
- Training
GFSI and certification readiness
Scheme selection, a clause-by-clause gap assessment, the management system build and a pre-assessment audit — so the first non-conformance you see is one of ours.
- SQF
- BRCGS
- FSSC 22000
- Organic
FDA and FSMA compliance
Preventive controls, PCQI support, records and monitoring build-out, FSVP where you import, and structured preparation for the inspection that tests all of it.
- Preventive Controls
- PCQI support
- FSVP
- Inspection readiness
Situations we are called into
Four conversations that start most manufacturing engagements.
These are the calls we take most often. If one of them sounds like your week, the pattern below is roughly how it goes.
- Challenge
- A retail customer has told us we need GFSI certification by next season or we lose the listing.
- What is required
- GFSI does not certify anyone — it benchmarks schemes such as SQF and BRCGS, whose scheme owners set the standard. Your certificate is issued by an accredited certification body after it audits you against a specific issue and module. Before that audit you need a working management system, an internal audit cycle and records showing the system has been operating, not merely written.
- How SURU helps
- We help you choose the scheme your customers actually accept, run a clause-by-clause gap assessment against the current issue, build the missing system and documentation with your team, train your internal auditors, and run a pre-assessment audit under audit conditions. We will also tell you plainly if the target date is not achievable.
- What you receive
- A dated readiness plan with an owner and an artefact against every gap, the built management system, an internal audit cycle on the record, and a pre-assessment report. The certification decision remains solely with the certification body.
- Challenge
- FDA inspected us and left Form 483 observations. We have a response deadline and no idea where to start.
- What is required
- A 483 lists an investigator's observations. A credible written response addresses each one with root cause, the correction already made, the systemic preventive action, and evidence — and it commits only to what you will genuinely do. FDA decides what happens next; nobody outside the agency can close a 483 for you.
- How SURU helps
- We read the observations against your records and your floor, separate the document problem from the process problem, help you draft a response with real root cause analysis, and build the corrections into the food safety plan and prerequisite programs so the same observation does not return at the next inspection.
- What you receive
- A structured response draft with supporting evidence, a corrective and preventive action plan with completion dates, updated procedures and records, and a follow-up verification schedule.
- Challenge
- We outgrew the shared kitchen and just signed a lease on our own facility. We have never written a food safety plan.
- What is required
- Your own facility usually means registering with FDA under section 415, meeting cGMPs under Part 117 Subpart B, and — unless a modified requirement applies to you as a qualified facility — a written food safety plan under Subpart C, prepared by or overseen by a PCQI. Prerequisite programs, sanitation, allergen control and traceability records have to exist from the first production run, not from the first audit.
- How SURU helps
- We start with what actually applies to your products, size and process, and say what does not. Then we build it in order: registration support, plant layout and flow review, cGMP and sanitation programs, hazard analysis, the food safety plan, SOPs and records — and we train the people who will run them.
- What you receive
- A written Food Safety Plan, prerequisite programs, an SOP set, record templates your team can maintain, traceability and recall procedures, and a training record for the staff who were trained.
- Challenge
- Our co-manufacturer wants supplier approval documentation we have never produced, and our brand customer is asking the same of us.
- What is required
- Where a hazard requiring a preventive control is controlled before receipt, Part 117 Subpart G requires a supply-chain program: written approval of the supplier, defined verification activities appropriate to the hazard, and records of both. A certificate of analysis on its own is not a program. If any of that material is imported, FSVP obligations may sit on top.
- How SURU helps
- We build the supplier approval program in both directions — the one you run over your ingredient suppliers and the evidence pack your brand customers and co-manufacturers ask you for — including specifications, approval criteria, verification activity selection and the audit or testing schedule behind it.
- What you receive
- A written supplier approval and supply-chain program, approved supplier list with approval criteria, ingredient and packaging specifications, verification records, and a customer-facing documentation pack.
How we work
We do not stop at telling you what is wrong.
Anyone can produce a finding list. The work that matters is what happens after it — building the program, training the people who run it, and verifying it holds before someone else tests it for you.
Assess
Walk the plant, read the records, confirm the process flow, and establish which rules genuinely apply to your products.
Identify gaps
A prioritised finding list that separates real regulatory exposure from best-practice improvement.
Build
Food safety plan, prerequisite programs, SOPs, specifications and records — written for your equipment and your terminology.
Train
The supervisors, operators and QA staff who have to run the system, plus the team who will host the audit.
Implement
Programs go live on the floor with monitoring in place, so the records show a system operating rather than a binder existing.
Verify
Internal audits, mock recalls and mock audits — we find it first, while there is still time to fix it.
What you receive
Documents, programs and records you own.
Consulting is not a deliverable. These are. Everything is written in your terminology, sized to what your team can realistically maintain, and yours to keep.
- Written Food Safety Plan
- HACCP plan
- Hazard analysis
- GMP program
- Sanitation program (SSOPs)
- Allergen control program
- Environmental monitoring program
- Supplier approval program
- Raw material and product specifications
- CAPA program
- Recall plan
- Traceability procedure
- Internal audit program
- QA manual
- SOP set
- Training records
- Gap assessment report
- Audit readiness plan
Questions
What manufacturers ask first.
Do we need a HACCP plan, a preventive controls food safety plan, or both?
It depends on the product. Most FDA-regulated human food manufacturers fall under 21 CFR Part 117, which requires a written food safety plan built on hazard analysis and risk-based preventive controls. Seafood processors follow Part 123 and juice processors follow Part 120, each with its own HACCP requirements that a Part 117 plan does not satisfy. Many manufacturers also maintain a HACCP plan because a customer or a certification scheme requires one alongside the food safety plan. We determine which of these applies to you before building anything, and we tell you which ones do not.
What is a PCQI, and does someone on our staff have to be one?
A preventive controls qualified individual is the person who prepares the food safety plan, or oversees its preparation, and performs specified activities such as validating preventive controls and reviewing records. The qualification comes from successfully completing training in the standardized curriculum recognized by FDA, or from job experience sufficient to perform those functions. It does not have to be an employee, but relying entirely on an outside PCQI is fragile — an investigator will ask your team about the plan. We work with your named PCQI, or help you develop one internally.
Can SURU certify us to SQF or BRCGS?
No, and no consultant can. GFSI benchmarks schemes rather than certifying companies; SQF and BRCGS are scheme owners; the certificate is issued by an accredited certification body after its own audit. USDA organic certification is issued by a USDA-accredited certifying agent. What we do is readiness: scheme selection, gap assessment, system and documentation build, internal auditor training, and a pre-assessment audit. We are independent of every certification body and cannot influence an audit outcome.
Does the Food Traceability Rule apply to us?
It applies to foods on the FDA Food Traceability List, and applicability has to be determined food by food rather than company by company — a facility can have some products in scope and others out. Where it applies, you must capture key data elements at critical tracking events and maintain a traceability plan. FDA has proposed extending the compliance date, so confirm the current date for your operation rather than working from a figure you saw quoted earlier. Separately, traceability records are worth having regardless: a mock recall is where most facilities discover how long theirs really takes.
We are a small manufacturer. Are we exempt from some of this?
Possibly. Part 117 provides modified requirements for qualified facilities, and other exemptions exist depending on the activity, the product and the sales figures involved. Exemptions are narrower than they sound, they are usually conditional, and they generally do not remove the cGMP requirements in Subpart B. We assess your specific position rather than assuming either way, and if a requirement does not apply to you we say so instead of selling you a program you do not need.
How long does it take to build a program from nothing?
It depends far more on your starting point and internal bandwidth than on the size of the plant. A facility with functioning prerequisite programs and complete records is in a very different position from one starting without document control. We give you a dated plan after the assessment rather than a number before it — and if a customer deadline or an audit date is not achievable, we will tell you that early, while there is still room to negotiate it.
Start right
Tell us what you make and who is asking about it.
Send us the products, the process, the facility and the deadline — a customer audit date, an FDA response window, a first production run. We will tell you what applies, what does not, and what it takes to be ready, before you commit to anything.
Direct contact
- info@surucompliance.com
- 651-329-4787
- Serving food businesses nationwide, onsite and remotely.
SURU Compliance is a regulatory consulting practice. We are not a government agency, a certification body, or a law firm, and we do not provide legal advice or guarantee regulatory outcomes.