When a CCP goes out of spec, the record you write next is the whole finding

The cook temp reads four degrees low. The metal detector rejects a unit and then rejects the next one. The cooler that has held 38°F all summer is sitting at 45°F at the 2 p.m. check.

You know what to do about the product. That part is muscle memory: hold it, pull it, re-run it, call the owner. The part that turns into an audit finding eleven months later is what you write down while you're doing it.

An inspector isn't looking for a facility where nothing ever went out of spec. They know production doesn't work that way. They're looking for whether you noticed, what you decided, and whether you can prove the product you shipped was safe. A clean logbook with no deviations in it isn't the goal. A logbook that shows you caught things and handled them is worth more.

Most small producers document the fix and skip the decision. "Reworked" is a note. A corrective action record has to carry more than that.

01First, work out which one you're doing

The Preventive Controls rule draws a line between two things that look identical on the floor, and which side you land on changes what you owe in paperwork.

A correction is what you do about a minor, isolated problem that doesn't directly affect product safety, or about certain sanitation and allergen conditions caught in a timely way. Under 21 CFR 117.150(c) you don't have to run the full corrective action procedure for those. Condensate on a non-product surface that you wipe down and note. A missed pre-op detail caught before production starts.

A corrective action is what 21 CFR 117.150(a) requires when a preventive control was not properly implemented. That's your out of spec cook temp. That's your cooler at 45°F. And the rule is specific about what the procedure has to accomplish, in four parts:

1. Identify and correct the problem that occurred with implementation of the control
2. Take action, when necessary, to reduce the likelihood the problem recurs
3. Evaluate all affected food for safety
4. Prevent all affected food from entering commerce if you cannot ensure it is not adulterated or misbranded

Read the third and fourth again. That's where floor-level records go quiet. Almost everybody writes down the first. Most people eventually get to the second. Very few records answer which product was affected, who evaluated it, and what happened to it.

There's a third bucket. 21 CFR 117.150(b) covers the unanticipated problem: a control fails and you had no written procedure for it, or a records review turns up that the activities didn't happen the way the food safety plan says, or that the corrective action decisions weren't appropriate. In that case you do the same four things and, when appropriate, reanalyze the food safety plan itself.

Look at that last trigger again. Under 117.150(b)(1)(iii), bad corrective action decisions are themselves a corrective action trigger. Sloppy documentation doesn't just sit there. It escalates.

02What has to be in the record

21 CFR 117.150(d) is one sentence long and it isn't optional: all corrective actions, and when appropriate corrections, must be documented in records. Those records are subject to verification under 117.155(a)(3) and records review under 117.165(a)(4)(i). 21 CFR 117.190(a)(3) lists corrective action records as a required implementation record, separate from monitoring records.

The general record requirements in 21 CFR 117.305 tell you what any of these records has to carry:

• The actual values and observations obtained during monitoring, not "out of spec" but the number you actually read
• The date, and when appropriate the time, of the activity documented
• The signature or initials of the person performing the activity
• The identity of the product and the lot code, where appropriate
• Information adequate to identify the plant or facility

Two more requirements in that same section quietly decide whether a record survives contact with an auditor. Records must be "accurate, indelible, and legible." And they must be "created concurrently with performance of the activity."

Concurrently. Not at end of shift. Not Tuesday, for Monday. If you're reconstructing a deviation from memory four hours later, the record is non-conforming on its face before anyone has read a word of it. We've written before about what happens when the last shift didn't log it, and this is the regulatory teeth behind that problem.

And 21 CFR 117.315 says you keep it at the facility for at least two years. If it lives offsite, you have to be able to produce it onsite within 24 hours of a request for official review.

03The clause that catches people: seven working days

Your deviation record isn't finished when you put the pen down.

21 CFR 117.165(a)(4)(i) requires that monitoring records and corrective action records be reviewed within 7 working days after they're created, by or under the oversight of a preventive controls qualified individual. A longer window is possible only if the PCQI prepares, or oversees the preparation of, a written justification for it.

The reviewer is checking four things: that the records are complete, that the activities happened in accordance with the food safety plan, that the preventive controls are effective, and that appropriate decisions were made about corrective actions.

This is the loop nearly every small producer breaks. The check gets logged. The deviation gets handled. Nobody reviews and signs within the week, because the binder lives in the office and the person who has to review it is also the person running payroll. Then the inspection comes, and there's a stack of unreviewed monitoring records going back four months.

The finding that lands has nothing to do with the deviation. It's that the system meant to catch it was never running.

04If you're under juice or seafood HACCP instead

Not everybody reading this is under Part 117. If you make juice, 21 CFR Part 120 applies, and the corrective action rules read differently in a way that matters on the floor.

Under 21 CFR 120.10(a), you can write corrective action plans in advance that become part of your HACCP plan, predetermining what you'll do whenever there's a deviation from a critical limit. Those plans must ensure no product enters commerce that is injurious to health or otherwise adulterated as a result of the deviation, and that the cause of the deviation is corrected.

If a deviation happens and you don't have an appropriate plan for it, 21 CFR 120.10(b) walks you through a specific sequence: segregate and hold the affected product, have a review performed by trained personnel to determine acceptability, take corrective action on that product so nothing adulterated enters commerce, correct the cause, and get timely verification to determine whether the HACCP plan needs to change.

Segregate and hold comes first. Before the evaluation, before the decision. And 21 CFR 120.10(c) requires all of it to be fully documented in records subject to verification.

05Why the binder version fails

None of this is hard to understand. It fails for mechanical reasons.

The deviation happens at the equipment. The form is in the office. So the note gets written later, which breaks the concurrent requirement in 117.305. The lot code isn't on the deviation sheet because the deviation sheet is a different piece of paper than the batch record, so nobody can connect "the cooler ran warm from 1 to 2 p.m." to "these four batches were in that cooler." The product evaluation happens in a conversation and never lands anywhere. And the seven day review never happens because reviewing means physically finding the binder. Several of these show up in our list of batch record mistakes small producers make.

A spreadsheet doesn't fix this. It moves the same problem to a laptop, adds a version of the file on somebody's desktop, and still can't tell you which finished lots were exposed.

What closes the gap is capturing the deviation where it happens, attached to the batch it happened to, with the reading, the timestamp, and the person's name already on it because the system knows all three. Then the affected lots are a query. And the review queue is a list somebody clears on Friday morning instead of an archaeology project.

That's what FourFoxes is built to do. A CCP check logged at the equipment on a phone. A deviation that opens against the batch it belongs to, carrying the reading and the lot forward. Product disposition recorded as part of the record instead of alongside it. And an open review queue that shows the qualified individual exactly what still needs a signature, with the clock visible.

06The test to run this week

Pull your last out of spec reading. Any one. From the record alone, and without calling anyone, can you answer:

1. What the actual value was
2. When it happened
3. Who observed it
4. Which lots were affected
5. Who evaluated those lots for safety
6. What was decided
7. What was done to keep it from happening again
8. Who reviewed the whole thing, and when

If any of those eight require a phone call, that's your gap. It's a much cheaper thing to find on a Wednesday than during an inspection.

References

• 21 CFR 117.150, eCFR Title 21, Part 117, Subpart C. Corrective actions and corrections: the written procedure requirement, the four required outcomes at (a)(2), the unanticipated-problem provisions at (b) including the records-review trigger at (b)(1)(iii), the corrections exemption at (c), and the documentation requirement at (d).
• 21 CFR 117.140, eCFR Title 21, Part 117, Subpart C. Preventive control management components: monitoring, corrective actions and corrections, and verification.
• 21 CFR 117.155, eCFR Title 21, Part 117, Subpart C. Verification, including (a)(3), verification that appropriate decisions about corrective actions are being made.
• 21 CFR 117.165, eCFR Title 21, Part 117, Subpart C. Verification of implementation and effectiveness, including (a)(4), records review within 7 working days by or under the oversight of a preventive controls qualified individual.
• 21 CFR 117.190, eCFR Title 21, Part 117, Subpart C. Implementation records required for this subpart, including (a)(3), records documenting corrective actions.
• 21 CFR 117.305, eCFR Title 21, Part 117, Subpart F. General requirements applying to records: actual values and observations, date and time, signature or initials, product identity and lot code, facility identification, and the requirements that records be accurate, indelible, legible, and created concurrently with the activity.
• 21 CFR 117.315, eCFR Title 21, Part 117, Subpart F. Record retention: at least 2 years at the plant or facility, and retrieval of offsite records within 24 hours of a request for official review.
• 21 CFR 120.10, eCFR Title 21, Part 120, Subpart A. Juice HACCP corrective actions: predetermined corrective action plans at (a), the segregate-and-hold sequence at (b) when no plan applies, and full documentation at (c).