How do I justify my sampling plan and frequency to an auditor?

This is United States federal law, read from subparts C and G of FDA’s preventive controls rule at 21 CFR part 117 — the subparts that carry the hazard analysis, the preventive controls, and the verification activity this article is about. Part 117 does not reach every plant that runs an environmental monitoring program: section 117.5 lifts subparts C and G off a long list of facilities and activities, named in full under Where the federal rule stops. If the auditor asking is a certification scheme rather than an investigator, read that section as well: a scheme is a separate contract with its own requirements, and this article does not restate them.

If you make dietary supplements, read this first. Subparts C and G do not apply to any facility with regard to the manufacturing, processing, packaging, or holding of a dietary supplement that is in compliance with 21 CFR part 111 and section 761 of the Federal Food, Drug, and Cosmetic Act (117.5(e)). Part 111 carries sanitation and physical-plant requirements of its own, but it sets no environmental monitoring requirement and no written environmental monitoring procedure: there is no part 111 counterpart to the clauses read below. So for a supplement facility inside that exemption, the citations in this article are not the ones the sampling plan is measured against, and an auditor asking that facility to justify sites and frequency is asking under something else — a customer specification, a certification scheme, or the facility’s own written program. The reasoning below still travels. The clause numbers do not.

The short answer is that the rule judges your sampling plan by what it is capable of determining, not by how it compares with anyone else’s. Two sub-paragraphs carry that standard. Once you have read them, the shape a defensible justification has to take is set, and it starts further back than the plan does.

On this page: What the rule asks of the plan · The justification starts before the plan · What “adequate” is pointed at · Where the federal rule stops · What the inspection record shows · Four things a justification can answer

What the rule asks of the plan

Written verification procedures are required “as appropriate to the facility, the food, the nature of the preventive control, and the role of the preventive control in the facility’s food safety system” (21 CFR 117.165(b)). Environmental monitoring is one of the three activities that clause lists, and it carries seven requirements of its own (117.165(b)(3)). The procedures must:

• Be scientifically valid (117.165(b)(3)(i)).
• Identify the test microorganism or microorganisms ((b)(3)(ii)).
• Identify the locations from which samples will be collected and the number of sites to be tested during routine environmental monitoring. The rule then adds the standard: the number and location of sampling sites must be adequate to determine whether preventive controls are effective ((b)(3)(iii)).
• Identify the timing and frequency for collecting and testing samples, with the same standard attached: the timing and frequency must be adequate to determine whether preventive controls are effective ((b)(3)(iv)).
• Identify the tests conducted, including the analytical methods used ((b)(3)(v)).
• Identify the laboratory conducting the testing ((b)(3)(vi)).
• Include the corrective action procedures required by 117.150(a)(1) ((b)(3)(vii)).

Three of those seven set a standard the procedure has to meet rather than a thing to write down. Item (i) puts scientific validity on the procedure as a whole. Items (iii) and (iv) each attach the same test — adequate to determine whether preventive controls are effective — to the site list and to the interval. The remaining four name what the procedure must identify or include: the test microorganism, the tests and analytical methods, the laboratory, and the corrective action procedures. That is the answer to this question: the site count and the interval are the two things the rule refuses to fix for you and then measures against a purpose, and the method that produced them has to be scientifically valid before either number carries anything.

Adequate has a definition in the same part. It means “that which is needed to accomplish the intended purpose in keeping with good public health practice” (117.3). So the clause is not asking what your plan is next to. It is asking what your plan is for, and then whether it is enough to accomplish that. The purpose is stated one paragraph up: you must verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the hazards (117.165(a)).

That gives you the sentence a justification has to be able to finish. Not “we swab ten sites a week because that is normal for our size.” Rather: this many sites, in these places, at this interval, because that is what it takes to tell whether this control is working.

The justification starts before the plan

Environmental monitoring is not a free-standing obligation. It is one of the verification activities at 117.165(a), and it applies “for an environmental pathogen or for an appropriate indicator organism, if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control, by collecting and testing environmental samples” (117.165(a)(3)). Read to the end of the chapeau above it and there is a second qualifier: the listed activities are conducted “as appropriate to the facility, the food, and the nature of the preventive control and its role in the facility’s food safety system.”

So the trigger is an outcome of the hazard analysis, and the hazard analysis is where an auditor’s question about your sampling plan actually lands. Three definitions do the work, and each is the rule’s own:

• Environmental pathogen means a pathogen capable of surviving and persisting within the manufacturing, processing, packing, or holding environment such that food may be contaminated and may result in foodborne illness if that food is consumed without treatment to significantly minimize the environmental pathogen. The definition names Listeria monocytogenes and Salmonella spp. as examples and excludes the spores of pathogenic sporeforming bacteria (117.3).
• Ready-to-eat food means any food normally eaten in its raw state, or any other food, including a processed food, for which it is reasonably foreseeable that it will be eaten without further processing that would significantly minimize biological hazards (117.3).
• Hazard requiring a preventive control means a known or reasonably foreseeable hazard for which a person knowledgeable about safe manufacturing would, based on the outcome of a hazard analysis, establish one or more preventive controls to significantly minimize or prevent it, together with the components to manage those controls, as appropriate to the food, the facility, and the nature of the control (117.3).

The hazard evaluation has a specific instruction on this point. It must include an evaluation of environmental pathogens whenever a ready-to-eat food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure, such as a formulation lethal to the pathogen, that would significantly minimize the pathogen (117.130(c)(1)(ii)). Both halves have to be true for that instruction to bite, and the hazard analysis has to be written regardless of what it concludes (117.130(a)(2)).

That is the chain. Hazard analysis, then the environmental pathogen evaluation inside it, then whether that is a hazard requiring a preventive control, then the control, then monitoring as the verification that the control is doing its job. Verification is itself defined as the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended and to establish the validity of the food safety plan (117.3).

A sampling plan handed over without that chain behind it is being asked to justify itself out of its own numbers, which it cannot do. This is the ordinary way a number in routine use turns out to have nothing behind it: it was inherited from a template, or from the plant somebody worked at before, and the reason it was the right number there did not travel with it. It is the same problem as a specification limit with no derivation, in a different document. The same argument about a run count rather than a limit is how many PPQ batches you can actually defend.

What “adequate” is pointed at

Because 117.165(a) makes monitoring the verification of a preventive control, the plan has to be aimed at the control it verifies. For an environmental pathogen that is usually the sanitation controls, which the rule describes as procedures, practices and processes to ensure the facility is maintained in a sanitary condition adequate to significantly minimize or prevent hazards such as environmental pathogens, biological hazards from employee handling, and food allergen hazards (117.135(c)(3)). As appropriate to the facility and the food, those controls must cover the cleanliness of food-contact surfaces, including food-contact surfaces of utensils and equipment ((c)(3)(i)), and the prevention of allergen cross-contact and cross-contamination from insanitary objects and from personnel to food, food packaging material and other food-contact surfaces, and from raw product to processed product ((c)(3)(ii)).

Set the two clauses side by side and the question a site list has to answer becomes concrete. If the control is the cleanliness of food-contact surfaces, a plan that samples the floor and the drain is not wrong, but it is not yet reading the control the rule points it at. Whether it is adequate is a judgment about your plant that only your records can support, and the same is true of the interval: a sampling frequency slower than the rate at which the control can drift will report the state of the plant on a lag it never declares.

The other items are not decoration either, and the first of them sits over all the rest: the procedure must be scientifically valid (117.165(b)(3)(i)). A site count and an interval reached by a method that will not stand up are not made adequate by being written down, which is why (i) is the item that carries most of the weight when the design itself is what an auditor is probing. The written procedure then names the test microorganism (117.165(b)(3)(ii)), the tests and the analytical methods ((b)(3)(v)), the laboratory ((b)(3)(vi)), and the corrective action procedures required by 117.150(a)(1) ((b)(3)(vii)). Those written verification procedures are part of the food safety plan itself (117.126(b)(7)). The results are records you must establish and maintain, named in the rule as verification records for environmental monitoring (117.190(a)(4)(vi)). And records of testing, environmental monitoring among them, are reviewed by, or under the oversight of, a preventive controls qualified individual within a reasonable time after they are created (117.165(a)(4)(ii)). The chapeau above that sub-paragraph says what the review is for: to ensure that the records are complete, that the activities reflected in the records occurred in accordance with the food safety plan, that the preventive controls are effective, and that appropriate decisions were made about corrective actions (117.165(a)(4)). That is the second place in this clause where the rule uses effective, and it aims the record review at the same question the site count and the interval are built to answer. The reviewer is a person qualified by training at least equivalent to the standardized curriculum FDA recognizes, or otherwise qualified through job experience, and who may be but need not be your employee (117.180(c)(1)).

A worked example of the gap between a plan that reads correctly and a plan that can find something is in our constructed case on a refrigerated ready-to-eat line, where the persistence was already sitting in the plant’s own results. When the same site keeps coming back positive, where the organism is hiding and how to make it stop is the question after this one.

Where the federal rule stops

Three boundaries are worth knowing before you build a justification on part 117 alone.

The rule may not reach you. Except as provided by subpart E of this part, subparts C and G of part 117 do not apply to a qualified facility, which is instead subject to the modified requirements at 117.201 (117.5(a)), and those modified requirements begin with attestations submitted to FDA rather than with a food safety plan (117.201(a)). Those five opening words matter: subpart E runs from 117.251 onward and sets out the circumstances that lead FDA to withdraw a qualified facility exemption, so the carve-out at 117.5(a) is conditional rather than permanent.

The rule carves out whole categories. Section 117.5 lifts subparts C and G off each of the following, on its own terms, and each is worth reading in full before anyone relies on it. Activities subject to part 123, Fish and Fishery Products, at a facility required to comply with and in compliance with part 123 (117.5(b)). Activities subject to part 120, the juice HACCP regulation, on the same terms ((c)). Activities subject to part 113, thermally processed low-acid foods packaged in hermetically sealed containers, and there only with respect to the microbiological hazards part 113 regulates ((d)). The manufacturing, processing, packaging, or holding of a dietary supplement in compliance with part 111 and section 761 of the Federal Food, Drug, and Cosmetic Act ((e)). Activities subject to section 419 of the Federal Food, Drug, and Cosmetic Act, the produce safety standards ((f)). Certain low-risk on-farm packing or holding, and certain low-risk on-farm manufacturing or processing, by a small or very small business at a farm mixed-type facility ((g), (h)). Alcoholic beverages at a facility meeting the two conditions in (i)(1), and prepackaged food that is not an alcoholic beverage at such a facility where it prevents direct human contact and is not more than five percent of overall sales ((i)). And facilities solely engaged in the storage of raw agricultural commodities, other than fruits and vegetables, intended for further distribution or processing ((j)). Whether any of these reaches your operation is a reading of your own facility against the definitions, and nothing here makes that reading for you.

Your auditor may not be reading part 117 at all. A certification scheme audit is a contract you entered, and the scheme sets its own requirements for environmental monitoring and for the risk assessment behind it. Those requirements are not in the Code of Federal Regulations, they are not always the same as the federal ones, and we do not restate them here. If the finding you are answering came from a scheme auditor, the clause you have to satisfy is the scheme’s, and satisfying part 117 does not close it. The reasoning chain in this article is still the one that makes the plan explainable to either reader; the clause reference is not.

What the inspection record shows

FDA publishes the observations its investigators write up, cited to the clause each was written under. Here is what that record holds on the clauses in this article.

What these figures do and do not evidence. The 165 break down by wording as 93 reading “did not establish and implement,” 40 “did not establish,” 31 “did not implement,” and one other phrasing. That is evidence about written procedures judged absent or inadequate. It is not evidence that the site counts and frequencies inside programs that do exist are unsound, and the observation text does not say which of the seven items in 117.165(b)(3) was short. The 1,242 hazard-analysis observations use generic wording; none of them names an environmental pathogen or Listeria, so they evidence that hazard analyses get written up for missing a hazard requiring a preventive control, not that the missed hazard was an environmental one. In FDA’s published records as read on that date, 117.165(b) appears in fiscal years 2017 through 2022 and not after; we do not know why, and that absence is not evidence that the requirement stopped being cited. These are counts of clause citations in inspection observations, one row per citation, and they are not counts of warning letters. The clause selection is ours and the list is not exhaustive.

Four things a justification can answer

Take dated copies before you change anything. A food safety plan and its verification procedures are controlled records, and revising one is your own quality unit’s decision rather than a tidy-up.

1. Which hazard the program verifies a control over, and where that is written. The answer lives in the hazard analysis and the environmental pathogen evaluation inside it, not in the sampling plan. If the plan is the only document in the room, the justification has nowhere to start.
2. What “effective” would look like at each site. 117.165(b)(3)(iii) asks whether the number and location are adequate to determine whether preventive controls are effective. A site that could not change your answer either way is not carrying that weight.
3. Why this interval rather than a longer one. Same standard, applied to time (117.165(b)(3)(iv)). The useful version of the answer names what could go wrong between two samples.
4. What happens on a positive, written into the same procedure. 117.165(b)(3)(vii) folds the corrective action procedures of 117.150(a)(1) into the monitoring procedure itself. Those procedures are required “as appropriate to the nature of the hazard and the nature of the preventive control, except as provided by paragraph (c) of this section” (117.150(a)), they must be established and implemented in writing for what has to be done if preventive controls are not properly implemented, including procedures to address, “as appropriate” ((a)(1)), the presence of an environmental pathogen or appropriate indicator organism detected through the environmental monitoring conducted in accordance with 117.165(a)(3) ((a)(1)(ii)) — so the limb reaches monitoring done under (a)(3), not any swab you happen to take. And 117.150(c) removes the requirement to comply with paragraphs (a) and (b) altogether where you take action, in a timely manner, to identify and correct conditions and practices that are not consistent with the sanitation controls in 117.135(c)(3)(i) or (ii), which are the very controls this monitoring verifies, or to identify and correct a minor and isolated problem that does not directly impact product safety (117.150(c)). Which of those two routes a given result falls on is a reading of your own facility.