Question 1

What food safety records does a food plant need to keep?

Accepted Answer

Under the FDA Preventive Controls rule (21 CFR 117), a plant keeps its food safety plan and the records that show it works: monitoring of preventive controls (for example, temperatures), corrective actions, verification (validation, instrument calibration, product testing, environmental monitoring and records review), the supply-chain program where it applies, and training records for the PCQI (preventive controls qualified individual), the qualified auditor and employees trained in food hygiene and safety. Certifications such as SQF and BRCGS ask for similar records and add others, such as document control, internal audits and complaint handling.

Question 2

What makes a record valid for the FDA?

Accepted Answer

Under 21 CFR 117.305, records may be originals, true copies or electronic; they must capture the actual values and observations; be accurate, indelible and legible; be created when the activity happens; and be as detailed as needed to show what was done. They must include the facility name (and location when necessary), the date (and time when appropriate), the signature or initials of the person who did the activity and, where appropriate, the product and lot code.

Question 3

How long do records have to be kept?

Accepted Answer

The FDA requires keeping them for at least 2 years after they are created (21 CFR 117.315). Records showing that equipment or a process is adequate, such as validations, are kept 2 years after you stop using that equipment or process. Records may be stored offsite if they can be provided within 24 hours of an FDA request, except the food safety plan, which must stay onsite; an electronic record counts as onsite if it can be opened from the plant. SQF asks you to keep them at least for the product's shelf life, or longer if customers or the law require it.

Question 4

Can I keep records digitally instead of on paper?

Accepted Answer

Yes. The FDA rule accepts electronic records (21 CFR 117.305) and exempts them from Part 11 unless another regulation requires it. SQF asks that records be legible, accessible, retrievable and securely stored, in any format. What matters is that the record is made at the time, is indelible (cannot be erased or changed without leaving a trace), and can be found quickly when someone asks for it.

Question 5

Which allergens do I have to declare on the label, and how?

Accepted Answer

The FDA recognizes nine major food allergens: milk, eggs, fish, crustacean shellfish, tree nuts, peanuts, wheat, soybeans and sesame, which the FASTER Act added effective January 1, 2023. For tree nuts, fish and crustacean shellfish, you must name the specific type, such as almond, cod or shrimp. The label declares the allergen source in one of two ways: in parentheses after the ingredient, such as "lecithin (soy)", or in a "Contains" statement immediately after or next to the ingredient list, which must list every major allergen in the product. Since its January 2025 guidance, the FDA no longer treats coconut as a tree nut for allergen labeling, although it still appears in the ingredient list. Advisory statements such as "may contain" are voluntary, do not replace good manufacturing practices and must be truthful.

Question 6

How do I approve and verify my suppliers?

Accepted Answer

If your hazard analysis identifies a hazard that your supplier controls before the raw material reaches your plant, the FDA requires a risk-based supply-chain program (21 CFR 117.405). The program includes using approved suppliers, deciding which verification to do and how often, doing it and documenting it. Verification can be onsite audits, sampling and testing, or reviewing the supplier's food safety records. If there is a reasonable probability that the hazard will cause serious adverse health consequences or death, the rule calls for an onsite audit before first use and at least once a year, unless a written determination justifies other verification. If the supplier is a qualified facility, a small farm or an egg producer with fewer than 3,000 hens, the rule allows verification through written assurances. SQF also requires an approved supplier program.

Question 7

What is the FSMA Preventive Controls (PCHF) rule?

Accepted Answer

It is the FDA rule for human food. It requires current good manufacturing practices (CGMPs) and, for most plants, a food safety plan prepared by a PCQI, with a hazard analysis and risk-based preventive controls; where applicable, the plan includes a supply-chain program and a recall plan. Very small businesses (under about $1 million a year in food sales, adjusted for inflation) are "qualified facilities": they follow CGMPs and file an attestation with the FDA every 2 years instead of the full plan. The compliance dates have passed: 2017 for small businesses (under 500 employees) and 2018 for very small businesses. The FDA publishes a plain-language guide for small businesses.

Question 8

What is the FSMA 204 traceability rule and when does it apply?

Accepted Answer

It requires additional records for foods on the FDA's Food Traceability List: critical tracking events, key data elements, traceability lot codes and a traceability plan, and handing records to the FDA within 24 hours when asked. The list includes, among others, non-hard cheeses, shell eggs, nut butters, cucumbers, fresh herbs (such as cilantro), leafy greens, melons, peppers, tomatoes, tropical tree fruits, fresh-cut fruits and vegetables, finfish, crustaceans, bivalve mollusks and refrigerated ready-to-eat deli salads. Under a directive from Congress, the FDA will not enforce the rule before July 20, 2028; the FDA has proposed formally moving the date there, but the change is not yet final.

Question 9

Where can I ask the FDA questions about FSMA?

Accepted Answer

The FDA runs the FSMA Technical Assistance Network (TAN), where you submit questions through an online form. It also publishes answers to common questions.

Question 10

What is GFSI and why do buyers ask for SQF or BRCGS?

Accepted Answer

GFSI (Global Food Safety Initiative) does not certify plants: it recognizes certification programs that meet its requirements, such as SQF and BRCGS. A GFSI-recognized certificate is accepted by many buyers, which reduces the number of separate audits you face, though some customers still run their own. That is why many retailers and distributors ask their suppliers for one.

Question 11

Which edition of the SQF Code applies?

Accepted Answer

SQFI published Edition 10 in March 2026. Edition 10 audits are expected to start no earlier than January 2, 2027, subject to GFSI benchmarking, and SQFI notes the date may move. Until then, audits use Edition 9, and a single audit does not mix requirements from both editions: confirm with your certification body which one applies to you. SQF codes are free to read at sqfi.com.

Question 12

What does SQF require for documents and records?

Accepted Answer

Section 2.2 of the Food Manufacturing code (Edition 10) requires document control (staff can access the current version and changes are communicated) and records that show the system is implemented and improving: legible, accessible, retrievable and securely stored, kept at least for the product's shelf life or longer if customers or the law require it.

Question 13

Which version of BRCGS Food Safety is current?

Accepted Answer

Issue 9 is current. BRCGS is preparing Issue 10 but has not announced a publication date.

Question 14

What is the difference between first-, second- and third-party audits?

Accepted Answer

A first-party audit is internal: your own team (or someone you hire) checks whether the plant does what its procedures say. A second-party audit is done by a customer on its supplier, for example a supermarket auditing a vendor. A third-party audit is done by an independent body against a standard such as SQF or BRCGS, and it is the one that can lead to a certificate.

Question 15

How is a certification audit different from an FDA inspection?

Accepted Answer

An FDA inspection checks that you comply with the law and can have regulatory consequences. A certification audit is one you arrange with a certification body to check that you meet a voluntary standard such as SQF or BRCGS; a critical nonconformity, a failing score or not closing nonconformities on time can cost you the certificate. Even so, not every audit is announced: SQF requires an unannounced audit once every three years.

Question 16

What happens on audit day?

Accepted Answer

It usually starts with an opening meeting to confirm scope and schedule. Then the auditor walks the plant and watches the operation, reviews documents and records, and interviews staff to confirm that what is written is what is done. It ends with a closing meeting where the findings are presented. Start correcting from there: in SQF, the deadline to close nonconformities runs from the end of the audit, not from when the report arrives.

Question 17

Which documents should I have ready when the auditor arrives?

Accepted Answer

At a minimum: the food safety plan with its hazard analysis, the procedures (SOPs), monitoring records (temperatures, cleaning and sanitation), corrective actions, verification (calibration and records review), allergen control, traceability and your latest mock recall, environmental monitoring, supplier approval, staff training, pest control, internal audits, management review, food fraud and food defense plans, and previous audit reports with their close-out. What shows the most is being able to find any record in minutes, not hours.

Question 18

What is a minor, major or critical nonconformity, and how long do I have to close it?

Accepted Answer

In SQF, a minor nonconformity is an isolated or infrequent failure; a major one is a failure of a system element; and a critical one is a loss of control at a critical control point, a prerequisite program or another critical step that is likely to cause a significant public health risk or product contamination. A critical one fails an initial audit or suspends the certificate at recertification. To close minors and majors: under Edition 9, which applies today, you typically have 30 days after the audit, as set by your certification body; under Edition 10 it will be 40 calendar days from the end of the audit, with evidence of the root cause analysis. If you are audited under BRCGS, confirm the deadlines in its certification rules.

Question 19

What is a root cause analysis and why is it required?

Accepted Answer

It is investigating why a problem happened so you fix the cause and not just the symptom, rather than blaming a person. Common techniques are the "5 whys" and the fishbone diagram. SQF requires methods to identify the root cause as part of corrective actions, and asks for evidence of that analysis to close audit nonconformities.

Question 20

What is a food fraud vulnerability assessment?

Accepted Answer

It is analyzing which raw materials, suppliers or products are susceptible to fraud, such as substituting a cheaper ingredient, diluting it, mislabeling the finished product or counterfeiting it, and putting controls in place to reduce that risk. It is sometimes called VACCP. SQF requires documenting, implementing and maintaining the methods, responsibilities and criteria for identifying the site's vulnerability to food fraud, and developing and implementing a plan to mitigate it.

Question 21

What do Walmart and Sam’s Club require from suppliers on food safety?

Accepted Answer

Walmart publishes its food safety requirements for its U.S. and Puerto Rico operations, which also cover Sam’s Club. For private-brand products, every site must be certified each year to a GFSI-recognized standard. National brands need an approved annual food safety audit, and GFSI certification is encouraged; FDA or state inspections do not replace that audit. Fresh produce, ground beef, poultry, seafood, eggs, deli meats and frozen berries have their own rules, and several of them require GFSI certification even for national brands: check the page for your category.

Question 22

Where can I find Costco’s food safety requirements?

Accepted Answer

Costco has no requirements page on costco.com. Its requirements are in Costco’s Global Food Safety Audit Expectations (version 3.0, effective September 1, 2025), with a Costco Addendum. Azzule, Costco’s audit platform, hosts the documents, including in Spanish. Confirm the current version with your Costco buyer or a Costco-approved audit company.

Question 23

What do Puerto Rico chains such as Pueblo, Econo, Selectos or Supermax require?

Accepted Answer

Each chain sets its requirements with its suppliers, usually through the buyer or the distributor. Before your first meeting, ask which audit or certification they accept (for example, a third-party audit or a GFSI-recognized certificate), what liability insurance and documents they need, and how they handle recalls. Keeping your records current and your food safety plan ready saves time with any chain.

Question 24

Does FSMA apply in Puerto Rico?

Accepted Answer

Yes. Under the Federal Food, Drug, and Cosmetic Act, Puerto Rico counts as a state, so FSMA rules apply to plants on the island just as they do in Florida or Texas. The Act defines "State" as any State or Territory of the United States, the District of Columbia and the Commonwealth of Puerto Rico (21 U.S.C. 321(a)(1)). The FDA registration rule calls any plant located in a State, Territory, the District of Columbia or Puerto Rico that manufactures, processes, packs or holds food for consumption in the United States a "domestic facility." The Preventive Controls rule (21 CFR 117) applies to domestic and foreign facilities that must register with the FDA. In practice, a Puerto Rico plant needs the same things as a mainland plant: FDA registration, current good manufacturing practices and, unless exempt, a food safety plan prepared by a PCQI.

Question 25

Who needs a HACCP plan, and how is it different from an FDA food safety plan?

Accepted Answer

HACCP (Hazard Analysis and Critical Control Point) is a written plan that identifies the hazards in a process and controls them at specific points. U.S. law requires it for three groups: juice processors (21 CFR 120), fish and seafood processors (21 CFR 123) and USDA-inspected meat and poultry establishments (9 CFR 417). In all three, you start with a hazard analysis, and a written HACCP plan is required when that analysis finds hazards that are reasonably likely to occur. For the juice rule, "juice" includes liquid extracted from fruits or vegetables, purees and concentrates, whether sold as juice or used as a beverage ingredient. Most other FDA-regulated plants do not write a HACCP plan; they write a food safety plan under the Preventive Controls rule (21 CFR 117). A plant that complies with the juice or seafood HACCP rule is exempt from the hazard analysis and preventive controls parts of Part 117 for those activities.

Question 26

What happens during an FDA food plant inspection?

Accepted Answer

FDA investigators show their credentials and hand a Notice of Inspection (FDA Form 482) to the owner, operator or agent in charge. They then interview management, walk through the plant, request records and may collect samples. The FDA may inspect as part of a routine investigation, a survey or a response to a reported problem. The opening interview checks administrative and operational details, such as hours and the sanitation schedule. During the walk-through, investigators observe processes and may review procedures and talk to employees. If they collect samples, the FDA suggests telling them whether the firm will voluntarily hold product until results come back. At the end, they discuss findings with management and, if there are significant observations, leave a written list: the FDA Form 483. The FDA recommends having staff available to answer questions and provide documents, and responding in writing with corrective actions within 15 working days of the inspection's close.

Question 27

What is the FSMA 204 compliance date?

Accepted Answer

The FDA will not enforce the Food Traceability Rule before July 20, 2028. The original compliance date was January 20, 2026, but Congress directed the FDA not to enforce the rule before July 20, 2028, and the FDA says it intends to comply. The directive came in the Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act of 2026. Separately, on August 7, 2025, the FDA proposed formally extending the compliance date by 30 months, to July 20, 2028; as of November 11, 2026, the Federal Register shows no final rule adopting that change. The rule itself was published as a final rule on November 21, 2022. The rule covers foods on the FDA's Food Traceability List.

Question 28

What is a PCQI and how do you get PCQI certified?

Accepted Answer

A PCQI (preventive controls qualified individual) is the person who prepares or oversees a plant's food safety plan under the FDA Preventive Controls rule. The FDA has no PCQI certification process: a person qualifies through training at least equivalent to the standardized curriculum the FDA recognizes, or through job experience that gave them the same knowledge. Under 21 CFR 117.180, the PCQI prepares the food safety plan, validates preventive controls, reviews records and reanalyzes the plan, among other tasks. The PCQI does not have to be an employee of the plant. According to the FDA, the recognized standardized curriculum is the one from the Food Safety Preventive Controls Alliance (FSPCA); taking it is voluntary, and the FDA assesses whether the food safety plan is adequate rather than an individual's credentials. The FSPCA course (version 2.0) covers the same curriculum in at least 22 contact hours, delivered in person, virtually, self-paced or blended, and the participant manual is available in Spanish. Training must be documented with the date, type and people trained.

Question 29

Does a Puerto Rico food manufacturer need FDA registration to sell on the U.S. mainland?

Accepted Answer

Yes, if the plant manufactures, processes, packs or holds food for consumption in the United States and is not exempt. The FDA treats a Puerto Rico plant as a "domestic facility," which must register before it starts operating and renew every two years. Renewal runs from October 1 through December 31 of each even-numbered year, and the FDA considers the registration expired for any facility that does not renew in that period. Registration is done online through FDA Industry Systems, has no fee and requires a unique facility identifier; the FDA accepts the DUNS number. Qualified facilities also submit their attestation during the same period. Farms, retail food establishments, restaurants, nonprofit food establishments that serve food directly to consumers, certain fishing vessels and plants regulated exclusively by the USDA throughout the entire facility do not have to register.

Question 30

FDA or USDA: who regulates my food product?

Accepted Answer

It depends on the product. The USDA Food Safety and Inspection Service (FSIS) regulates aspects of the safety and labeling of traditional (non-game) meats, poultry and certain egg products, and the FDA regulates other foods, including dietary supplements, bottled water, food additives and infant formula. Some products with small amounts of meat fall to the FDA. According to the FDA, these include game meats such as deer or rabbit, products with 3% or less raw meat or less than 2% cooked meat, products with less than 2% cooked poultry meat or less than 10% cooked poultry skins, and closed-face sandwiches unless part of a dinner. USDA-inspected meat and poultry establishments follow the FSIS HACCP rule (9 CFR 417). A plant regulated exclusively by the USDA throughout the entire facility does not have to register with the FDA; if it also makes FDA-regulated products, that exemption does not apply.

Question 31

Which food safety certifications do U.S. retailers require from suppliers?

Accepted Answer

Many large buyers ask for a GFSI-recognized certification, such as SQF, BRCGS or FSSC 22000. GFSI does not certify plants: it recognizes certification programs, and a plant gets certified through a third-party audit against one of them. GFSI's list of recognized programs includes, among others, SQF Edition 9 (level 2), the BRCGS Global Standard for Food Safety Issue 9, FSSC 22000 version 6, IFS Food version 8 and PrimusGFS version 3.2; recognition is by scope, so confirm the one that fits your operation. Walmart, for example, publishes requirements for its operations in the United States and Puerto Rico. For private brands, every site that manufactures or processes the product must be certified or assessed to a GFSI-recognized standard and keep that certification every year. For national brands, it requires an approved annual audit, encourages GFSI certification and does not accept federal, state or local regulatory inspections in place of the audit. Before you invest in a certification, ask your buyer which ones they accept.

Question 32

What is an FDA Form 483, and how is it different from a warning letter?

Accepted Answer

An FDA Form 483 is the list of observations an investigator gives management at the end of an inspection when they saw conditions that may violate the law. A warning letter is more serious: the FDA sends one when it identifies significant violations of federal requirements. A 483 is not a final agency determination: the FDA weighs it together with the inspection report, the evidence collected and the company's response before deciding on further action. The FDA recommends answering a 483 in writing with a corrective action plan within 15 working days of the inspection's close. A warning letter lists the problems, requests a response within a set timeframe and lets the company explain if it disagrees. The FDA posts warning letters on its website. Once the FDA verifies that corrections were actually made, usually through a follow-up inspection, it may issue a close-out letter; it does not issue one based on promises alone.

Question 33

Can a Puerto Rico food product be sold in the U.S. with a Spanish-only label?

Accepted Answer

No, unless the product is distributed only in Puerto Rico. FDA rules require all mandatory label information to appear in English, and only allow the predominant language to replace English for articles distributed solely in Puerto Rico or in a territory where another language predominates (21 CFR 101.15(c)(1)). If your product will ship off the island, the mandatory information must be in English. In addition, if the label carries any text in a foreign language, such as Spanish, all mandatory information must also appear in that language (21 CFR 101.15(c)(2)). In practice, a bilingual label has to repeat all the mandatory information in both languages, not just the product name or marketing copy. The only exemption from that second requirement is for very small individual serving packages served with meals in restaurants, institutions and passenger carriers and not sold at retail, when the only foreign-language text is the name of the food.

Question 34

What does a food label need to sell in the U.S.?

Accepted Answer

At a minimum: the product name, the ingredient list, the name and place of business of the manufacturer, packer or distributor, the Nutrition Facts panel and the allergen declaration. All of it must be in English if the product leaves Puerto Rico. The product name goes on the principal display panel (21 CFR 101.3). Ingredients are listed by common name in descending order by weight (21 CFR 101.4). If your company did not make the product, its name must be qualified with a phrase such as "Manufactured for" or "Distributed by" (21 CFR 101.5). Nutrition labeling is required unless an exemption applies (21 CFR 101.9). The FDA has small business exemptions: one for sellers with annual gross sales of no more than $500,000, or no more than $50,000 in food sales to consumers, and a low-volume one for firms with fewer than 100 full-time equivalent employees on average selling fewer than 100,000 units of the product in 12 months, which requires an annual notice to the FDA. Low-volume products that bear nutrition claims do not qualify. The allergen declaration covers the nine major allergens, including sesame since January 1, 2023.

Question 35

What is Stratum PR?

Accepted Answer

Stratum PR is a Puerto Rican data and technology company based in Trujillo Alto. We help Puerto Rico food manufacturers replace paper logs and spreadsheets with digital systems for compliance, inventory and traceability.

Question 36

Who is Stratum PR for?

Accepted Answer

Food manufacturers and processors in Puerto Rico, especially small and mid-size plants and family businesses that do not have their own IT department.

Question 37

How does Stratum PR help with FDA inspections and FSMA?

Accepted Answer

We digitize the records that inspections and audits ask for: temperatures, sanitation, preventive controls and lot traceability. Documentation stays current every day and can be found in seconds instead of being assembled at the last minute.

Question 38

Does my team have to change how it works?

Accepted Answer

Very little. We design the system around how your team already works, with a low learning curve and no features you will not use.

Question 39

How much does it cost and how do I start?

Accepted Answer

It depends on the size and needs of your plant. You start with a free 30-minute conversation, in Spanish or English. Then you see a working demo with your own processes before you commit to paying.

Question 40

What is Alertas PR?

Accepted Answer

Alertas PR is a free public portal by Stratum PR that collects, in Spanish, FDA and USDA food recalls and CDC outbreak investigations, with a filter for products sold in Puerto Rico. No sign-up is needed to use it, and optional email alerts are available.

Frequently Asked Questions

Records, labels and suppliers

FSMA (FDA)

SQF, BRCGS and GFSI

Audits and certification

Selling to retailers

Puerto Rico and exporting to the U.S.

About Stratum PR

Guides (in Spanish)

Have a question about your business?