If you're familiar with the processing of juice, seafood, meat, or poultry, HACCP is the risk-based preventive food safety system you know and love. And although historically not required, many other types of food commodities have used HACCP, either to satisfy customer requirements or to achieve a third-party certification. I have heard many people express the notion that "well I have a HACCP plan, so I'm good". But in reading the regulation (21 CFR Part 117), I think there is more to it than just considering the biological, chemical and physical hazards associated with the product and the process. Traditionally, HACCP is taught as being built upon other programs such as sanitation, hygiene, and good manufacturing practices. These other programs are sometimes described as the base of the pyramid and the HACCP plan being the peak of the pyramid. In my understanding of the new regulation, the HACCP (or preventive controls) portion of the overall food safety plan is more like one of many pillars that supports the whole building. I think it's an important distinction because sometimes a complete focus on HACCP causes some of the other programs to lose priority. We get focused on maintaining the required paperwork but lose sight of the basics like pest control or cleaning. It's interesting to note that in 117.126(a)(2), the food safety plan must be prepared (or its preparation overseen) by a so-called qualified individual, who can demonstrate through experience and education that they have the knowledge to do so. If we look at 117.126(b), this section details contents of the food safety plan.I recognize here that the hazard analysis must be written. This is in contrast to seafood, where the hazard analysis is not required to be written. And I like this addition because it shows the thought process behind the selection of the hazards. It goes on to list that the plan must also include written preventive controls, a written supply chain program, a recall plan, monitoring and implementation procedures, written corrective actions, verification procedures, and records requirements for the aforementioned items. So far, a lot of similarities with traditional HACCP. Even the hazard analysis section is pretty standard. But when we get to 117.135(a)(2), there is a subset of controls that may be incorporated into the preventive controls plan. Here we see:• Process Controls (cooking, refrigerating, blanching, acidifying)• Food Allergen Controls (labeling, separating, scheduling)• Sanitation Controls (cleaning of food contact surfaces and utensils)• Supply Chain Controls (supplier approval, third party audits, testing)• Recall Plan (not a preventive control, but important nonetheless)• Other Controls (specific training or practices relevant to a particular food or process)Just from this short analysis of 2 sub sections in subpart C of 21 CFR 117, I think there are some additional things to think about that go beyond just thinking about the hazards associated with the product. We can't just slap together a HACCP plan. We need to look at how sanitation, supply chain, allergens, and the process affect the safety of the food and if it's critical. If determined to be critical, then it needs to be monitored, documented, and verified. Then we must go a step further and seek out what those "other controls" are. There is no template or one size fits all approach. It takes an incredible amount of critical thinking, team work, and research. It will be interesting to see the creative ways food safety scientists come up with the proper controls necessary to address these hazards and how they fit into compliance with the regulation.