Glossary

Process Controls

Back to Glossary

Definition

Process controls are the documented operational parameters, monitoring methods, and corrective action procedures that govern how a specific production step must behave to keep food safe and on-spec. Think of them as the standing rules for your most critical steps: what value must be maintained, how it's measured, how often, by whom, and what happens when it drifts.
They're not the same as monitoring. The process control is the defined parameter itself (a minimum cook temperature of 165°F, held for 15 seconds). Monitoring is how you verify it's being met. Corrective action is what you do when it's not. All three are required, none substitutes for the others.
If you're a quality manager, process controls are the backbone of your daily program; they define what "in control" looks like, shift after shift, line after line.

Where It Fits

Process controls appear across every major food safety framework, though the terminology and scope differ.
  • FSMA Preventive Controls (21 CFR Part 117): Process controls are a defined category within preventive controls, applied at any step where a hazard needs to be addressed. That includes CCPs but isn't limited to them.
  • HACCP: Controls apply specifically at Critical Control Points. FSMA's scope is broader. If you're navigating both, see what separates a food safety plan from a HACCP plan.
  • SQF Code: Requires documented process controls tied to food safety fundamentals and product specifications. See SQF Code guidance.
  • BRCGS Global Standard for Food Safety (Issue 9): Clause 6.1 covers manufacturing process controls and requires documented process control parameters with defined limits. 
  • ISO 22000:2018 / FSSC 22000: Process control requirements appear within operational prerequisite programs (OPRPs) and HACCP principles. For more, see our guide to ISO standards in food safety.

FAQs

A Critical Control Point (CCP) is a specific step in your HACCP plan where a food safety hazard is prevented, eliminated, or reduced to an acceptable level. A process control under FSMA can apply at a CCP or at any other step appropriate for food safety. FSMA's scope is deliberately broader. You can have process controls that aren't CCPs, but every CCP should have documented process controls. The FDA's FSMA FAQ page explains this distinction directly.
If your facility is subject to 21 CFR Part 117, yes. A HACCP plan alone doesn't satisfy the FSMA preventive controls requirement. Your food safety plan must include process controls documented under the FSMA framework, even if your underlying HACCP plan is solid. See HACCP compliance and food safety programs for more on the overlap.
Many teams treat process controls as documentation requirements rather than operational systems. Writing a process control into your food safety plan doesn't enforce it at 2 a.m. on third shift. A new operator working alone won't look up the binder. The control has to be embedded in what operators actually do during production, whether that's a defined check on a digital form, a sensor alert, or a required sign-off before product moves forward.
Start with your hazard analysis. Every hazard that requires a preventive control needs a documented process control with a defined parameter, acceptable limit, monitoring method, frequency, and corrective action. Work through your highest-risk steps first, typically thermal processes, pathogen controls, and allergen-risk steps. Your PCQI is responsible for overseeing this under 21 CFR 117.180.
Whenever conditions change. New equipment, reformulations, new ingredient suppliers, facility layout changes, or modifications to a production process can all invalidate the scientific basis for existing control parameters. 21 CFR 117.140 requires ongoing verification, which includes revalidation after changes. Document the trigger, the revalidation study or review, and the updated procedures.
At minimum: the defined parameter and its acceptable limit, monitoring records with timestamps, the responsible party's identification, and corrective action records for any deviation. During an inspection, every one of these needs to be retrievable on demand. "We have the data somewhere" isn't an answer that satisfies an FDA investigator or a third-party auditor.

Compliance Requirements

  • 21 CFR 117.3 (Definitions): Defines "preventive controls" as risk-based procedures a knowledgeable person would use to significantly minimize or prevent identified hazards. Process controls fall within this definition.
  • 21 CFR 117.80 (Processes and Controls): Specifies that raw materials and ingredients must either not contain levels of microorganisms that could render food injurious to health, or must be pasteurized or otherwise treated during manufacturing so they no longer contain such levels. Document both paths.
  • 21 CFR 117.126 (Food Safety Plan): Requires a written food safety plan that includes process controls with defined parameters and values (such as critical limits), monitoring procedures, corrective actions, and verification activities.
  • 21 CFR 117.140 (Verification activities): Requires verification that your process controls are consistently applied and effective. Changes in equipment, ingredients, suppliers, or production processes trigger revalidation.
  • 21 CFR 117.150 (Corrective actions): Requires documented procedures for what must happen when monitoring shows a loss of control. Judgment calls in the moment don't satisfy this requirement.
Non-compliance findings during FDA inspections or third-party GFSI audits frequently involve gaps in monitoring records, missing corrective action documentation, or process control parameters that haven't been revalidated after a change. These are findings that can result in 483 observations, warning letters, or lost certification. For a broader look at FSMA compliance requirements, see our FSMA guide for food and beverage companies.

Get every record is stored centrally and retrievable without manual assembly from paper logs.

Book a Demo