The same spot keeps coming back. Where is it hiding, and how do I make it stop?

Start with whether the rule being quoted at you reaches you at all, because for a lot of readers it does not. Inside the food preventive controls rule, environmental monitoring becomes a requirement through one clause, and that clause carries two conditions at once. The verification activities are conducted “as appropriate to the facility, the food, and the nature of the preventive control and its role in the facility’s food safety system” (21 CFR 117.165(a)), and environmental monitoring is on that list, for an environmental pathogen or an appropriate indicator organism, only if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control (117.165(a)(3)). Section 117.5 then lifts subparts C and G of part 117 off whole classes of operation, and reading those exemptions against the clauses below is how you find out whether any of this is aimed at you.

Subparts C and G do not apply to a qualified facility, except as provided by subpart E, and a qualified facility is subject to modified requirements instead (117.5(a)) (117.201(a)). That is an exemption FDA can withdraw, not a permanent one. They do not apply to a facility with regard to a dietary supplement that is in compliance with part 111 and with section 761 of the Federal Food, Drug, and Cosmetic Act, on serious adverse event reporting (117.5(e)), and part 111 asks for sanitation without ever asking you to swab the room. Activities subject to the produce safety standards are out as well (117.5(f)).

So if you make a dietary supplement, or you are a qualified facility, the food clause everyone quotes is not your obligation, and what binds you here is the scheme you are certified to or the contract your customer holds you to. Read the scheme carefully, because it may not say what you have been told it says. A certified dietary supplement facility must establish a risk-based environmental monitoring program, and the standard scopes that mandatory sentence to controls that evaluate and mitigate nonpathogenic microorganisms in production areas and equipment, at clause 4.5.84 (NSF/ANSI 455-2). Pathogen testing is elective under that standard, and its consequence follows only where you have chosen it: where a program does include pathogen testing and a positive is found in product contact zones, the production area and equipment are not used until the area is cleaned and proven free of pathogens, at clause 4.5.85 (NSF/ANSI 455-2).

An over-the-counter drug facility is in a different position again, and it is not that one. Part 117 does not reach it as a drug facility, but parts 210 and 211 do. Appropriate written procedures designed to prevent objectionable microorganisms in drug products not required to be sterile must be established and followed (21 CFR 211.113(a)), and for aseptic processing the defined-area requirements include, as appropriate, “a system for monitoring environmental conditions” (211.42(c)(10)(iv)). There is also a route back into the food rule: the part 211 requirements are not enforced for OTC drug products where the products and all their ingredients are ordinarily marketed and consumed as human foods, and for those products parts 110 and 117 are applied instead in determining current good manufacturing practice (211.1(c)). So an antacid or a sunscreen made on a food line may be back inside part 117 by name. The over-the-counter GMP scheme requires an environmental monitoring program to include controls to mitigate the presence of microorganisms and particulate in processing areas, at clause 4.5.60, and prints 21 CFR 211.42 and 211.113 as its own basis (NSF/ANSI 455-4).

Cosmetics sit outside all of it. Part 117 is a food regulation and does not reach a cosmetic: cosmetic good manufacturing practice runs through regulations FDA is directed to establish by rule (21 USC 364b(a)), and a cosmetic manufactured or processed under conditions that do not meet them is adulterated (361(f)). Which of these reaches you is a reading of your own operation against the words, and nothing here makes that reading for you. The full map of where the federal food rule stops is in our piece on justifying a sampling plan and frequency to an auditor.

The obligation differs. The organism does not. Everything below is the same problem in every one of those buildings.

The rule already tells you what you are dealing with

Part 117 defines an environmental pathogen as “a pathogen capable of surviving and persisting within the manufacturing, processing, packing, or holding environment such that food may be contaminated and may result in foodborne illness if that food is consumed without treatment to significantly minimize the environmental pathogen,” and gives Listeria monocytogenes and Salmonella spp. as examples while excluding the spores of pathogenic sporeforming bacteria (117.3). Persistence is inside the definition. The thing you are chasing is characterized by its ability to live in your building, not by its ability to survive one clean.

That changes how you read your own record. A single positive is a result. The same site positive again is the definition being met in front of you, in your own data, before anyone else sees it.

Where it is hiding

The regulation never uses the word harborage for a microorganism. It uses it for pests: in the grounds clause about litter, waste and weeds (117.20(a)(1)), in the clause on controlling the areas over and around outdoor bulk vessels (117.20(b)(3)(ii)), and in the rubbish clause (117.37(f)). But the good manufacturing practice subpart names the physical features that make a niche, one clause at a time. The list below is ours, not the regulation’s; what each clause requires is the regulation’s.

• Seams, joints and welds. Seams on food-contact surfaces must be smoothly bonded or maintained so as to minimize accumulation of food particles, dirt and organic matter and “thus minimize the opportunity for growth of microorganisms and allergen cross-contact” (117.40(b)). The rule states the mechanism out loud. A seam that has opened is not cosmetic damage. It is the growth site that clause exists to prevent.
• Anything hollow or closed. Holding, conveying and manufacturing systems, including gravimetric, pneumatic, closed and automated ones, must be of a design and construction that enables them to be maintained in an appropriate clean and sanitary condition (117.40(d)). Hollow rollers, square tubing, chain links, unsealed frame legs and the inside of a closed auger all pass a visual inspection without being clean.
• The space around and under the machine. Equipment must be installed so as to facilitate the cleaning and maintenance “of the equipment and of adjacent spaces” (117.40(a)(3)). Adjacent spaces is the phrase most programs read past.
• Equipment in the room that never touches food. Equipment in an area where food is manufactured, processed, packed or held that does not come into contact with food must still be so constructed that it can be kept in a clean and sanitary condition (117.40(c)), and its non-food-contact surfaces cleaned in a manner and as frequently as necessary to protect against contamination of food, food-contact surfaces and food-packaging materials (117.35(e)). Motor housings, control panels, guards, framework.
• Anything overhead that drips. The plant must be constructed so that drip or condensate from fixtures, ducts and pipes does not contaminate food, food-contact surfaces or food-packaging materials (117.20(b)(4)). Then read the definition: food-contact surfaces include those surfaces “from which drainage, or other transfer, onto the food or onto surfaces that contact the food ordinarily occurs during the normal course of operations” (117.3). A dripping fixture above an open line is a food-contact surface in the rule’s own words.
• Floors and drains. Adequate floor drainage is required in all areas where floors are subject to flooding-type cleaning or where normal operations release or discharge water or other liquid waste on the floor (117.37(b)(4)). A slow drain, a low spot and a cracked floor joint are where water sits between shifts.

Read your recurring site against that list before you read it against your zone map. In our experience the site that keeps coming back is usually not the niche. It is downstream of one.

Why re-cleaning does not clear it

Two words in the rule settle this. The first is cleaned. To sanitize is defined as adequately treating cleaned surfaces by a process that is effective in destroying vegetative cells of pathogens, and in substantially reducing numbers of other undesirable microorganisms, without adversely affecting the product or its safety for the consumer (117.3). Sanitizer on a surface that was never cleaned is not doing what the definition describes, and the surface inside a hollow leg was never cleaned, because nothing reached it. In wet processing, where cleaning is necessary to protect against the introduction of microorganisms into food, all food-contact surfaces must be cleaned and sanitized before use and after any interruption during which they may have become contaminated (117.35(d)(2)), which is a statement about reach as much as about frequency.

The second word is repair. Buildings, fixtures and other physical facilities must be maintained in a clean and sanitary condition and kept in repair adequate to prevent food from becoming adulterated (117.35(a)). Equipment and utensils must be so designed and of such material and workmanship as to be adequately cleanable, and must be adequately maintained to protect against allergen cross-contact and contamination (117.40(a)(1)). Those are two obligations, not one. A recurring positive is usually the second one failing and being answered with more of the first. You cannot clean your way out of a design or a repair problem, and the rule never asks you to.

Why your own swabs kept missing it

As appropriate to the facility, the food, the nature of the preventive control and its role in your food safety system, you must establish and implement written procedures for environmental monitoring (117.165(b)). Those procedures have to identify the test microorganisms (117.165(b)(3)(ii)), and both the number and location of sampling sites, and the timing and frequency of collecting and testing samples, must be adequate to determine whether preventive controls are effective (117.165(b)(3)(iii)) (117.165(b)(3)(iv)). Two consequences follow that most programs never act on.

The first is identity. A presence-or-absence result at genus level cannot tell you whether this is the same organism as last time. It reports that something in the genus was there. Persistence is a question about identity, and a test that never resolves identity cannot answer it. If you have several positives at one site and no way to say whether that is one organism or several separate arrivals, your record does not contain the finding you need to act on.

The second is placement. A site chosen because it is easy to reach is carrying no weight under the adequacy test, which asks whether the number and location of your sites can determine that the preventive controls are effective. A drain sampled monthly because it has never been positive is not doing that work. Building and defending that design is its own question, and we answered it in justifying a sampling plan and frequency to an auditor.

A positive that keeps returning is not just another corrective action

This is the part that changes what you do next. As appropriate to the nature of the hazard and the nature of the preventive control, and except where the corrections route in paragraph (c) applies, you must establish and implement written corrective action procedures for what has to be done if preventive controls are not properly implemented, including procedures to address, as appropriate, the presence of an environmental pathogen or appropriate indicator organism detected through the environmental monitoring conducted in accordance with 117.165(a)(3) (117.150(a)) (117.150(a)(1)) (117.150(a)(1)(ii)). Those procedures must describe the steps to be taken to ensure that appropriate action is taken “when necessary, to reduce the likelihood that the problem will recur” (117.150(a)(2)) (117.150(a)(2)(ii)), that all affected food is evaluated for safety (117.150(a)(2)(iii)), and that all affected food is prevented from entering into commerce if you cannot ensure it is not adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act or misbranded under section 403(w) (117.150(a)(2)(iv)).

Cleaning the site again addresses the instance. It does not reduce the likelihood of recurrence, and you already hold the proof of that: it recurred. So the return is not another turn of the same handle. It is evidence, in your own records, that a preventive control is not being consistently implemented and is not effectively and significantly minimizing or preventing the hazard, which is exactly what the verification clause asks you to establish (117.165(a)). In a plant with a resident organism that control is normally a sanitation control, which is defined to include the procedures, practices and processes that keep the facility in a sanitary condition adequate to significantly minimize or prevent hazards such as environmental pathogens (117.135(c)(3)).

The rule has a route for exactly that finding. Where a preventive control, a combination of preventive controls, or the food safety plan as a whole “is found to be ineffective” (117.150(b)(1)(ii)), you take corrective action to identify and correct the problem and reduce the likelihood it recurs, and when appropriate you reanalyze the plan (117.150(b)(2)(ii)). Reanalysis is required whenever you find a preventive control, a combination of them, or the plan as a whole is ineffective (117.170(b)(4)), separately from the three-yearly cycle (117.170(a)). And the hazard evaluation itself has to include an evaluation of environmental pathogens whenever a ready-to-eat food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure that would significantly minimize the pathogen (117.130(c)(1)(ii)), which is the question the reanalysis reopens.

There is a lighter route, and knowing which one you are on matters. You do not need to comply with paragraphs (a) and (b) where you take action, in a timely manner, to identify and correct conditions and practices that are not consistent with the food allergen controls in 117.135(c)(2)(i) or the sanitation controls in 117.135(c)(3)(i) or (ii) (117.150(c)(1)), or where you take timely action to identify and correct a minor and isolated problem that does not directly impact product safety (117.150(c)(2)). Neither of those is a count. The rule sets no number of positives at which one route becomes the other, and anyone who quotes you a number is quoting themselves. What we would say, as our reading and not as the rule’s words, is that a condition which keeps returning is on its face not one that timely correction resolved, and that the corrections route gets harder to sustain each time it comes back.

What the inspection record holds on this

FDA publishes the observations its investigators write up, each cited to the clause it was written under. Here is what that record says about the two physical clauses above and about the corrective action clause.

What these figures do and do not evidence. Every one of the 1,100 observations under 117.40 carries the same wording about equipment not designed and constructed to be adequately cleaned or maintained, so that row is evidence that cleanability by construction is an ordinary written-up finding rather than an exotic one. The 117.35(a) row counts only the observations whose text names repair, out of 2,256 recorded under that citation in total. None of these observations names Listeria, a harborage site, or a recurring positive, and the wording is generic, so they are not evidence that any of these firms had an organism living in the plant. They evidence what gets written up, not what caused it. The 117.150 rows appear in fiscal years 2017 through 2022 in FDA’s published records as read on that date and not after; we do not know why, and that absence is not evidence that the clause stopped being cited. These are counts of clause citations in inspection observations, one row per citation, and they are not counts of warning letters. The clause selection is ours.

How to make it stop

Take dated copies before you change anything. A food safety plan and its verification procedures are controlled records, and revising one is your own quality unit’s decision.

1. Stop treating the returns as separate events. Put every positive at that site on one page with its date, its exact location, what was done and what the re-swab said. If the record cannot show whether it is one organism or several arrivals, that gap is the first finding, not a detail.
2. Expand outward before you clean again. The adequacy test asks whether the number and location of your sites can determine that the preventive controls are effective (117.165(b)(3)(iii)). Sample away from the known site, toward the drains, the framework and the overhead, and sample during production rather than after a clean.
3. Resolve identity. Your procedures, as appropriate to the facility and the food, already have to identify the test microorganisms (117.165(b)(3)(ii)). Ask your laboratory what it can give you beyond genus. Until you can say whether the isolates match, you cannot say whether you have cleared anything.
4. Deal with the product question separately and on the record. Your corrective action procedures have to describe the steps that ensure all affected food is evaluated for safety, and that all affected food is prevented from entering into commerce if you cannot ensure it is not adulterated or misbranded (117.150(a)(2)(iii)) (117.150(a)(2)(iv)). The call on the lot in front of you is yours, and it does not wait for the investigation to finish.
5. Open the equipment. Not clean it. Open it. Pull the guard, split the roller, lift the belt, take the leg cap off, look at the weld. The clauses in the list above are the checklist we would work, not one the regulation writes, and the answer is usually a repair or a replacement (117.35(a)) (117.40(a)(1)).
6. Fix the water. Condensate and standing water are what let a niche survive between cleans (117.20(b)(4)) (117.37(b)(4)). A drain that will not clear, or a cold surface that sweats over an open line, is a design item with a date on it, not a sanitation item with a frequency.
7. Verify the fix with sampling, not with a signature. Re-sample the site and its neighbors on a schedule long enough to survive a seasonal swing. One negative swab the day after a repair proves the surface was clean that day.
8. Reanalyze. A control your own data shows to be ineffective triggers reanalysis (117.170(b)(4)), and reanalysis is where the sampling design, the organisms and the sanitation control get changed rather than repeated.

The honest part: some niches are built into the room. A wet, refrigerated space with hollow framework, poor fall to drain and condensate overhead will keep giving you the same result whatever the schedule says, and the answer there is drainage, equipment or flow. Saying so is cheaper than another year of swabs.