FSMA 21 CFR 117 Corrective Actions — A Plain-English Guide

Educational summary for small & mid-size food manufacturers. The authoritative text is public on eCFR — verify specifics against §117.150, §117.155, and §117.165 before making compliance decisions.

Under FSMA's Preventive Controls for Human Food rule (21 CFR Part 117), your written Food Safety Plan has to include corrective-action procedures, and you have to document what you actually did when something went wrong. Here's the practical version.

What a documented corrective action must capture

When a deviation from a preventive control occurs, §117.150 ("Corrective actions and corrections") and common guidance say your record should capture:

The action taken in response to the deviation.
The product disposition decision — rework, reject, or reprocess.
A root cause analysis of why it happened.
Preventive measures that address the issue systemically — not just a one-time patch.
For supply-chain controls: when supplier verification / COA checks fail, the lot is quarantined and a corrective action opened.

The rule distinguishes "corrections" (immediate fixes) from "corrective actions" (preventing recurrence) — track both.

Verification — you're not done until you've checked

§117.155 and §117.165 cover verification: you must verify the food-safety plan is implemented as written and that corrective actions and monitoring are actually happening and effective. In practice that means record reviews, calibration of monitoring instruments, and confirming the fix worked.

Records & retention

Required records include hazard analysis, preventive controls, monitoring, corrective-action procedures, verification, recall plan, supply-chain program, and training.
Retention: monitoring and corrective-action records must generally be kept at least 2 years from creation; the Food Safety Plan and supporting validation/verification records at least 2 years after they're no longer current.
Records must be retrievable and protected; FDA can request records spanning the full retention period (and access timeframes can be tight).

Why this matters at inspection

Public analysis suggests a large share of FSMA Warning Letters cite inadequate monitoring or verification documentation — so record completeness and retrievability are high-risk areas. Auditors and investigators want a traceable chain: hazard → control → monitoring → corrective action → verification.

Build the habit with a ready template

Grab the free CAPA log template (FSMA-ready columns), the 5 Whys / RCA worksheet, and the audit-prep checklist.

When you're ready to stop relying on spreadsheets, Qualitronyx captures every FSMA corrective action with structured root cause, disposition tracking, verification-of-effectiveness sign-off, immutable audit trail, 2-year retention controls, and fast, filterable export for an FDA records request.