One hazard analysis
Write a single hazard analysis that identifies CCPs and the other preventive controls FSMA requires, with the justification written down.
Guide · Regulations vs certifications
FSMA vs HACCP vs SQF: what each one is and which you need
Three terms that get used as if they were interchangeable. One is a federal law, one is a food safety method that is also a legal requirement for some products, and one is a voluntary certification your buyers may demand.
What is the difference between FSMA, HACCP and SQF? FSMA is U.S. federal law enforced by the FDA. HACCP is a hazard-control method that is legally required for seafood, juice and meat and poultry, and is the base of most food safety plans. SQF is a voluntary GFSI-benchmarked certification that buyers require. Many plants need all three.
Juan S. VargasSQF Food Safety Auditor · Exemplar Global
- Certified SQF auditorExemplar Global · 2024
- On-site, hands-onMiami-based · across the U.S.
- English & SpanishBilingual training
- Free 30-min gap callReply within one business day
The short answer
FSMA, HACCP and SQF in one paragraph each
Summary. FSMA is the law: most FDA-registered food facilities must have a written food safety plan under the Preventive Controls for Human Food rule (21 CFR 117), prepared or overseen by a PCQI. HACCP is a method with 7 principles; it is a legal requirement for seafood (21 CFR 123), juice (21 CFR 120) and USDA-inspected meat and poultry (9 CFR 417). SQF is a voluntary certification run by the SQF Institute; it isn't required by law, but retailers and distributors often require it. Compliance with one does not replace the others.
FSMA
The Food Safety Modernization Act moved U.S. food regulation from reacting to outbreaks toward preventing them. Its rules cover preventive controls in facilities, produce safety on farms, foreign supplier verification for importers, sanitary transportation, intentional adulteration and food traceability. The FDA enforces it through inspections.
HACCP
Hazard Analysis and Critical Control Points is a systematic way to identify biological, chemical and physical hazards and control them at critical points. It was developed as a preventive method and is recognized by the Codex Alimentarius. It is both a legal requirement for certain products and the technical core of FSMA plans and GFSI schemes.
SQF
Safe Quality Food is a certification program owned by the SQF Institute, a division of FMI. Its food safety codes are benchmarked by GFSI. A licensed certification body audits the site and grants the certificate. Buyers use it to qualify suppliers without auditing each one themselves.
Side by side
FSMA vs HACCP vs SQF comparison table
The table below compares the three on the points buyers, auditors and inspectors actually ask about.
| Question | FSMA (Preventive Controls) | HACCP | SQF |
|---|---|---|---|
| What is it? | U.S. federal law and FDA regulations | A food safety method; also the name of specific federal regulations | A private, voluntary certification program |
| Legal or voluntary? | Legal requirement for covered facilities | Legal for seafood, juice and USDA-inspected meat and poultry; voluntary elsewhere unless a customer or code requires it | Voluntary under law; often a commercial requirement |
| Who requires it? | The FDA | FDA (seafood, juice), USDA-FSIS (meat, poultry); buyers and GFSI schemes for everyone else | Retailers, food service distributors, brand owners and co-packing customers |
| Who it applies to | Facilities that manufacture, process, pack or hold human food and must register with FDA, unless exempt or modified | Processors in the regulated categories; any food business that adopts it | Any site in the supply chain that chooses to certify, from farms to manufacturers, distributors and packaging |
| Scope | Hazard analysis plus process, allergen, sanitation and supply-chain preventive controls, recall plan, verification and records | Hazard analysis, critical control points, critical limits, monitoring, corrective actions, verification and records | Management system, HACCP-based food safety plan, prerequisite programs and sector-specific good practices; Quality Code optional |
| Core document | Written food safety plan | HACCP plan | SQF system documentation, including the food safety plan |
| Who prepares it? | A Preventive Controls Qualified Individual (PCQI) must prepare or oversee it | A trained HACCP team; regulated HACCP rules require trained individuals | The site, led by an SQF Practitioner employed by the site |
| Checked by | FDA inspectors, or state inspectors working with the FDA | FDA or USDA-FSIS inspectors for regulated products; auditors when used for certification | An auditor from a certification body licensed by SQFI |
| Outcome | Inspection findings; possible Form FDA 483 observations, warning letters or further enforcement | Regulatory compliance, or a HACCP audit report or certificate issued by a third party | Scored audit (E, G, C or F) and a certificate if the site passes |
| GFSI recognition | Not applicable (it is regulation) | Not on its own | Yes, for the SQF Food Safety Codes |
Source: FDA, FSMA; SQF Institute.
How they fit
How FSMA, HACCP and SQF overlap
Think of them as layers. HACCP is the technical method at the bottom. FSMA builds on HACCP thinking and adds preventive controls that aren't limited to critical control points, plus a legal obligation. SQF sits on top: it expects you to meet the law of the country where you operate and adds a management system and a certification audit.
- An SQF-certified site in the U.S. is still subject to FDA inspection under FSMA.
- A FSMA food safety plan does not give you a certificate your buyer will accept.
- A HACCP plan alone usually doesn't satisfy FSMA for facilities covered by the Preventive Controls rule, because FSMA also requires allergen, sanitation and supply-chain controls where they apply.
- One well-built food safety plan can serve all three, if it is written with FSMA and the SQF code in mind from the start.
HACCP-regulated products. Seafood and juice processors that follow their HACCP regulations are largely exempt from the hazard analysis and risk-based preventive controls requirements of the Preventive Controls rule, but other FSMA requirements can still apply. USDA-inspected meat and poultry plants are regulated by USDA-FSIS. If you process more than one kind of product, map which rule covers each.
Decision guide
Which do I need? A decision guide
Answer these questions in order. Most plants end up with more than one "yes."
Do you manufacture, process, pack or hold food for sale in the U.S.?
If you must register with the FDA, you likely need a FSMA food safety plan prepared or overseen by a PCQI, unless you qualify for an exemption or modified requirements. Check the exemption criteria carefully rather than assuming. See FSMA and PCQI consulting.
Do you process seafood, juice, or meat and poultry?
Then a HACCP plan under the matching regulation is a legal requirement: 21 CFR 123 for seafood, 21 CFR 120 for juice, 9 CFR 417 for USDA-inspected meat and poultry. See HACCP consulting.
Do you import food into the U.S.?
Importers have obligations under the Foreign Supplier Verification Program (21 CFR 1 Subpart L), which is separate from your suppliers' own plans.
Are you a farm growing produce?
The Produce Safety Rule may apply. Buyers of fresh produce often ask for a GFSI certificate such as PrimusGFS.
Has a buyer asked for SQF or a GFSI certificate?
Then you need certification, and the buyer's requirement decides the scheme. If they name SQF, see our SQF consultant service and the guide on how to get SQF certified.
Are you a restaurant or food service operation?
In Florida, restaurants are licensed and inspected by DBPR under the food code rather than FSMA. HACCP plans are needed only for certain specialized processes. See the Florida restaurant inspection checklist.
Examples
Typical situations and what applies
| Business | FSMA | HACCP | SQF or other GFSI |
|---|---|---|---|
| Sauce manufacturer selling to a national retailer | Preventive Controls food safety plan | HACCP-based analysis inside the food safety plan | Likely required by the retailer |
| Seafood importer and processor | FSVP for imported product; other FSMA rules as applicable | Seafood HACCP (21 CFR 123) required | If buyers require it |
| Small bakery selling locally | Depends on registration status and exemptions | Voluntary, useful for allergen and foreign material control | Usually not required |
| Cold storage warehouse | Applies to facilities that hold food, with modified requirements for some | Voluntary unless a customer requires it | Often requested by customers; SQF has a storage and distribution code |
| Restaurant in Miami | Generally not covered by the Preventive Controls rule | Required for certain specialized processes under the food code | Not applicable |
These are general patterns, not legal determinations. Exemptions and modified requirements depend on the facts of your operation. A gap assessment maps exactly what applies to your site.
FSMA beyond preventive controls
The FSMA rules most businesses ask about
When people say "FSMA," they usually mean the Preventive Controls rule. But FSMA is a set of rules, and several of them can apply to the same company. This is a quick map of the ones we're asked about most.
| FSMA rule | Who it applies to | Core requirement |
|---|---|---|
| Preventive Controls for Human Food (21 CFR 117) | Registered facilities that manufacture, process, pack or hold human food, unless exempt | Written food safety plan prepared or overseen by a PCQI, plus current good manufacturing practices |
| Foreign Supplier Verification Program (21 CFR 1 Subpart L) | Importers of food into the U.S. | Evaluate foreign suppliers and verify that the food they supply meets U.S. safety standards |
| Produce Safety Rule | Farms that grow, harvest, pack or hold covered produce | Standards for water, soil amendments, worker hygiene, equipment and animal intrusion |
| Food Traceability Rule (FSMA 204) | Businesses that handle foods on FDA's Food Traceability List | Key data elements at critical tracking events, traceability lot codes and records to FDA within 24 hours of request; compliance date July 20, 2028 |
None of these rules is replaced by a certificate. An SQF audit may look at how you meet them, but the obligation and the enforcement stay with the FDA.
Doing it once
Building one system that satisfies all three
The costly mistake is building three separate paper systems: a HACCP binder for the auditor, a FSMA plan for the FDA, and SQF documents for the certification body. They drift apart, and the inconsistencies show up at the worst time.
Shared prerequisite programs
Sanitation, allergen control, supplier approval, environmental monitoring and training serve FSMA and SQF at the same time.
One record system
The same monitoring and verification records answer an FDA inspector and an SQF auditor. Design forms once, in the language operators use.
Clear roles
Name the PCQI and the SQF Practitioner. They can be the same employee if qualified; the Practitioner must be employed by the site.
FAQ
Frequently asked questions
Is SQF certification required by law?
No. SQF is voluntary under U.S. law. It becomes a requirement when a customer makes it a condition of doing business, which is common with retailers and large distributors.
Does SQF certification mean I comply with FSMA?
Not automatically. SQF expects you to comply with applicable law, and a good SQF system covers much of what FSMA requires, but FDA inspectors check FSMA requirements such as a PCQI-prepared food safety plan directly.
What is the difference between HACCP and SQF?
HACCP is a method for controlling hazards at critical control points. SQF is a certification program that requires a HACCP-based food safety plan plus a management system, prerequisite programs and a third-party audit.
Is a HACCP plan the same as a FSMA food safety plan?
No. A FSMA food safety plan includes the hazard analysis and may include CCPs, but it also covers allergen, sanitation and supply-chain preventive controls and a recall plan where applicable, and must be prepared or overseen by a PCQI.
Do I need SQF certification if I sell only to local stores?
Only if those customers require it. Many local buyers don't. You still need to meet FSMA or other applicable regulations regardless of certification.
Free gap call
Have an audit on the calendar?
In 30 minutes we review your standard, your date and your most likely gaps, and tell you honestly whether you need us.
- +1 786 209 7451
- Mon–Fri · 8:00 AM – 5:00 PM ET
- jusevalu02@gmail.com
- 5.0 on Google
Juan S. VargasSQF Food Safety Auditor · PCQI
Request a gap call or a quote
Takes under a minute. Juan reviews every request personally.