.png)
FSMA's Preventive Controls rule (21 CFR Part 117, Subpart F) requires food manufacturers to create and keep specific records - monitoring logs, corrective action records, verification and validation records, and the written food safety plan itself - retained for at least two years and retrievable onsite within 24 hours of an FDA request. Missing or incomplete records are one of the most common reasons small manufacturers fail a food safety audit.
The Records FSMA Requires You to Keep
Under 21 CFR Part 117, Subpart F, a covered facility's records generally fall into a few groups:
- The food safety plan itself, including the hazard analysis and the preventive controls identified for each hazard (117.310 requires the plan to be signed and dated).
- Monitoring records that show what actually happened during production - temperatures, times, pH readings, visual checks - not just that a step was "completed."
- Corrective action records documenting what happened when a preventive control wasn't met, what was done with the affected product, and what was changed to prevent recurrence.
- Verification and validation records, including calibration checks, environmental monitoring results, and evidence that a control is capable of doing what it's supposed to do.
- Supply-chain verification records for raw materials and ingredients tied to a hazard controlled by your supplier rather than your own process.
Format and Retention Rules
Per 21 CFR 117.315, records must be retained at the plant or facility for at least two years after the date they were prepared, and records supporting the general adequacy of equipment or processes must be kept for at least two years after their use is discontinued. Records can be original documents, true copies (scans, photos, microfilm), or electronic records - FDA does not require paper. Except for the food safety plan itself, offsite storage is allowed as long as records can be produced onsite within 24 hours of a request; electronic records are considered onsite if they're accessible from an onsite location.
Why Documentation Fails Audits
In practice, most recordkeeping failures aren't about missing an entire category - they're smaller gaps that add up: a monitoring log with a blank cell and no explanation, a corrective action that isn't linked to the batch it affected, a food safety plan that hasn't been updated after a new supplier or process change, or records scattered across binders, shared drives, and someone's email. An auditor doesn't need to find fraud to flag a nonconformance; an unreadable, unsigned, or inconsistent record is enough.
How Software Changes the Recordkeeping Picture
The retention and retrievability requirements above are the same whether your records are on paper or in software, but the practical risk is different. A digital system that timestamps entries, flags missing fields before a shift ends, and keeps every corrective action linked to its original monitoring record removes most of the gaps that show up in a manual review. It also makes the 24-hour retrievability requirement trivial instead of a scramble through file cabinets. This is the same logic behind building a food safety plan that's actually maintained rather than written once and filed away - and the same audit trail an inspector checks first in a HACCP audit.
FAQ
How long do food safety records need to be kept under FSMA?
At least two years from the date the record was prepared, per 21 CFR 117.315. Records supporting the adequacy of equipment or processes must be kept for at least two years after their use is discontinued.
Can food safety records be kept electronically?
Yes. FSMA does not require paper records - electronic records, scans, and other true copies are acceptable as long as they're trustworthy, accurate, and retrievable within the required timeframe.
What happens if a food safety record is incomplete?
An incomplete or unsigned record is typically treated as a nonconformance during an audit or FDA inspection, even if the underlying process was actually followed correctly - the record has to demonstrate that the control was implemented as intended.
Keep every monitoring log, corrective action, and verification record connected and audit-ready. See how IONI continuously audits your documentation against FSMA, SQF, and BRCGS requirements.
