HACCP, Preventive Control Plans and Food Safety Compliance in Canada

Food safety compliance in Canada is governed by a legislative framework that has been substantially modernised since 2019. The Safe Food for Canadians Act (SFCA, 2012) and its implementing regulations — the Safe Food for Canadians Regulations (SFCR, 2019) — replaced a patchwork of commodity-specific rules with a unified, preventive-controls-based regime administered by the Canadian Food Inspection Agency (CFIA). For most food businesses engaged in import, export or interprovincial trade, this means replacing traditional HACCP plans with documented Preventive Control Plans (PCPs), obtaining a CFIA licence, and meeting new traceability and labelling requirements that go significantly further than previous obligations.

Document fraud in food supply chains is a growing risk in the Canadian market. Our platform has processed over 2.4 million verified documents with a 94.8% fraud detection recall rate, and internal analysis shows a 23% year-on-year increase (2024–2025) in fraudulent food safety certificates — including fabricated audit reports, altered Certificates of Analysis and forged supplier certification documents. Automated document verification is itself a preventive control, not merely an administrative function.

This guide explains how Preventive Control Plans under the SFCR relate to traditional HACCP, what CFIA traceability requirements demand in practice, how the main Canadian and international certification schemes compare, and how food businesses are reducing audit preparation time by up to 83% using document management platforms across 85+ enterprise clients.

This article is provided for informational purposes only and does not constitute legal, financial or regulatory advice. Consult a qualified professional for questions relating to your specific situation.

Preventive Control Plans (PCPs): Canada's HACCP-Based Framework

A Preventive Control Plan is the documentary cornerstone of SFCR compliance for food businesses licensed by the CFIA. The PCP requirement under SFCR Part 4 applies to all federally licensed food businesses — those importing food into Canada, exporting food from Canada, or trading food interprovincially. Provincially regulated businesses selling only within their home province are subject to provincial food safety laws rather than the SFCR, though most provinces maintain broadly equivalent requirements.

The CFIA Toolkit for Food Businesses is the primary regulatory guidance document for PCP development and is the reference CFIA inspectors use when assessing compliance.

The PCP must be a written document that describes: the food safety hazards associated with each product and process step, the preventive controls in place (including CCPs, PRPs and other measures) to address those hazards, and the monitoring, corrective action and verification procedures for each control. Allergen controls must be explicitly addressed — a requirement that goes beyond traditional seven-principle HACCP.

Health Canada sets the food safety standards codified in the Food and Drugs Act and the Food and Drug Regulations (Division 28), which define the compositional, labelling and safety standards that PCPs must be designed to meet. CFIA enforces compliance against those standards in licensed establishments and for imported products.

For businesses operating in Quebec, MAPAQ (Ministère de l'Agriculture, des Pêcheries et de l'Alimentation du Québec) administers the provincial Loi sur les produits alimentaires, which applies to intra-provincial food operations and adds a further layer of inspection authority alongside CFIA for federally licensed facilities located in Quebec.

ISO 22000:2018 and GFSI Certifications in Canada

ISO 22000:2018 is accepted by CFIA as documentary evidence supporting a Preventive Control Plan, but it does not replace the PCP or the CFIA licence obligation. A business holding ISO 22000 certification that also holds a CFIA licence must still have a PCP in place and available for CFIA inspection — the ISO 22000 documentation can serve as the substance of that PCP, provided it covers all SFCR-required elements.

The standard's alignment with the SFCR PCP requirement is close:

• Hazard control plan (clause 8.5.4): specifies CCPs and Operational PRPs (OPRPs) with monitoring procedures and corrective action triggers — this directly maps onto the PCP's hazard control provisions
• Traceability system (clause 8.3): one-step-back/one-step-forward procedures for raw materials, ingredients, packaging and finished goods — directly supporting SFCR traceability obligations
• Prerequisite Programme documentation (clause 8.2): cleaning and sanitation programmes, pest control, maintenance, personnel hygiene, and allergen management procedures documented as PRPs
• Management review records (clause 9.3): annual top management review with food safety performance data and resourcing decisions
• Internal audit programme (clause 9.2): risk-based audit schedule with reports and non-conformity records

GFSI-recognised certifications — FSSC 22000, SQF and BRCGS — are widely used by Canadian food manufacturers as evidence to commercial customers that their FSMS has been independently assessed. Unlike the CFIA licence, these certifications are commercial rather than regulatory requirements, but they are frequently mandated by major Canadian and US retail customers as a condition of listing.

See our vendor compliance certificate verification guide for practical advice on collecting and verifying GFSI certificates from Canadian and international suppliers.

CFIA Traceability Requirements Under SFCR 2019

Traceability requirements under the SFCR apply to all CFIA-licensed food businesses and are based on a one-up, one-down model: each licence holder must be able to identify who supplied them with each food commodity and to which business they subsequently supplied it. This one-step-back/one-step-forward requirement must be demonstrable rapidly during a product recall or withdrawal.

For federally registered establishments, lot code traceability at the product level is additionally required — each batch or lot of finished product must be traceable to the incoming raw material lots used to produce it. This extends the simple one-up/one-down rule into a within-facility linkage obligation.

Documentary evidence required to demonstrate SFCR traceability compliance:

• Incoming materials records: supplier name and address, product description, lot or batch code, quantity, date received, cross-referenced to purchase orders and bills of lading
• Batch production records: which incoming material lots were used in each production batch, on which date, on which line, by which operator, producing which finished product lot code
• Outbound shipment records: which finished product lots were shipped to which customers, on which date, via which carrier, under which commercial document (bill of lading, delivery note or invoice)
• Recall and withdrawal procedures: a written procedure, tested at least annually through a mock recall, with mock recall records retained as evidence of the test
• Lot code assignment and maintenance procedures: documented procedures for assigning, applying and maintaining lot codes on both incoming materials and finished products

All traceability records must be retained for a minimum of 2 years. CFIA inspectors can request access to traceability records during routine inspections or in response to a food safety incident, and the expectation is that a complete trace can be produced within hours, not days.

Canadian food labelling regulations require bilingual English and French labels under the Food and Drug Regulations — a documentary obligation that intersects with traceability when product specifications, ingredient lists and allergen declarations must be maintained in both official languages as part of the product file.

Food Safety Certifications: SQF, BRCGS and FSSC 22000 in Canada

Major Canadian grocery retailers — including Loblaw Companies, Sobeys/Empire, Metro Inc. and Walmart Canada — require their direct food suppliers to hold a current GFSI-benchmarked certification from an accredited certification body. The dominant schemes in the Canadian market mirror those used in the broader North American and international markets:

SQF is the most widely used scheme among Canadian food manufacturers supplying domestic retailers. The SQF Code covers food safety (Level 2) and quality (Level 3). An SQF audit will examine the food safety plan in detail, including the hazard analysis, PRP documentation, allergen management programme, supplier approval records and food fraud vulnerability assessment.

FSSC 22000 is particularly well-suited to manufacturers that have already built an ISO 22000-based FSMS, as FSSC 22000 v6 adds the FSSC additional requirements (food fraud, food defense, allergen management, environmental monitoring) on top of ISO 22000 rather than replacing its documentation structure.

BRCGS Food Safety Issue 9 is required for export into the UK market and by Costco Canada for many product categories. The Issue 9 product safety culture programme requires documented evidence — not just a policy statement — that the food safety culture is being actively assessed and improved, which adds a new category of documentary evidence to the audit pack.

Automating Food Safety Document Management

Two questions appear regularly in Canadian food safety practitioner discussions: "How do I set up and maintain a Preventive Control Plan efficiently when CFIA requirements are constantly being refined?" and "How do I manage supplier documentation across a mixed Canadian and imported supply chain with different regulatory standards?"

Both questions reflect the same operational challenge: the volume of documentation required under the SFCR, GFSI scheme audits and retailer requirements cannot be reliably managed through shared drives, email chains and manual tracking spreadsheets. The consequences are predictable — PCP review records that cannot be located during a CFIA inspection, CoAs filed by product name rather than lot number, expired GFSI certificates in the approved supplier list, and mock recall exercises that reveal traceability gaps only after the annual test.

Our platform reduces audit preparation time by 83% for the 85+ enterprise food clients that have deployed it. Every document — supplier GFSI certificate, CoA, calibration record, corrective action form, PCP review record — is ingested at source, matched to the correct supplier, product and lot reference, and verified against expected parameters before it enters the approved document set. The 94.8% fraud detection recall rate means that a fabricated SQF certificate or a CoA with an altered microbiological result is identified at intake, not during a CFIA inspector's review.

Specific capabilities addressing Canadian food safety compliance needs:

• PCP version control and review tracking: the current version of each PCP document, associated review sign-offs and change logs are maintained with a complete audit trail, satisfying the SFCR requirement to demonstrate that the PCP is kept current
• SFCR traceability support: automated lot-code linkage from incoming material records through batch production records to outbound shipment records, enabling a complete one-up/one-down-plus-within-facility trace to be produced within minutes
• Supplier certificate management: GFSI certificates (SQF, FSSC 22000, BRCGS) and ISO 22000 certificates are tracked against expiry dates with automated alerts at 90, 60 and 30 days, preventing the approved supplier list from containing lapsed certifications at time of CFIA inspection
• Bilingual document handling: product specifications, ingredient declarations and allergen statements held in both official languages, supporting the label bilingualism requirement under the Food and Drug Regulations
• CoA intake and matching: suppliers receive a secure upload link triggered at each delivery; the platform matches the CoA to the purchase order and verifies reported values against approved specifications, with non-compliant or missing CoAs generating an automatic lot hold

For related guidance on supply chain document compliance, see our articles on transport and logistics document compliance and vendor compliance certificate verification, and the broader industry verification guide.

The CheckFile platform integrates with existing ERP and quality management systems via API, extending automated verification to food safety records without replacing existing infrastructure. Security architecture and data handling details are available at /securite; pricing for food sector deployments is at /tarifs. Businesses with supplier onboarding or KYC requirements can review the /solutions/banque-kyc capability set.

CFIA Inspections: What Inspectors Evaluate

CFIA inspectors carry out inspections of licensed food establishments and imported food shipments under authority granted by the Safe Food for Canadians Act and the Canadian Food Inspection Agency Act. Inspections of licensed establishments may be unannounced. CFIA has a risk-based inspection frequency model — higher-risk products and facilities with previous non-compliance history receive more frequent inspections.

During a CFIA inspection of a licensed food establishment, inspectors will typically evaluate:

• Preventive Control Plan: Is a written PCP in place? Does it address all identified hazards — biological, chemical, physical and allergen? Are all CCPs, PRPs and other preventive controls documented with monitoring procedures, corrective action procedures and verification activities?
• PCP currency: Has the PCP been reviewed and updated following any changes to products, processes, premises or incoming materials? Are review records available?
• Monitoring records: Are CCP and preventive control monitoring records current, complete and signed? Are there unexplained gaps or out-of-range results without associated corrective action records?
• Traceability records: Can the facility produce a one-step-back/one-step-forward trace for any finished product lot? For federally registered establishments, can incoming material lots be linked to the finished product lots they contributed to?
• Allergen management: Are allergen controls documented in the PCP? Are cleaning verification records maintained for allergen changeovers? Are incoming material allergen declarations from suppliers current?
• Supplier controls: Does the business have documented incoming material controls? Are supplier approval records, CoAs and relevant GFSI certificates maintained and current?
• Training records: Are records available demonstrating that food handlers and supervisory staff have received appropriate food safety training?
• Labelling compliance: For federally registered products, are English and French label specifications on file and current?

CFIA enforcement options include Corrective Action Requests (CARs) for minor deficiencies, Administrative Monetary Penalties (AMPs) of up to $5 million for serious violations under the Safe Food for Canadians Act, licence suspension, and mandatory recalls for immediate safety risks.

The most common documentary gaps observed in CFIA inspection outcomes are: PCPs that identify hazards but lack documented monitoring procedures for PRPs, corrective action records that address the immediate deviation but do not document root cause analysis or disposition of potentially affected product, and supplier approval files that were established on initial approval but not maintained with current CoAs and certificate renewals.

Frequently Asked Questions

Does a Preventive Control Plan replace a HACCP plan under Canadian law?

Yes, for businesses subject to the Safe Food for Canadians Regulations (SFCR). The SFCR came into full force in 2019 and replaced the CFIA's previous Food Safety Enhancement Program (FSEP), under which HACCP plans were the mandated documentary standard for federally registered establishments. Under the SFCR, a Preventive Control Plan is the required document for all CFIA-licensed food businesses. A PCP incorporates HACCP-based CCP analysis but is broader — it must also address allergen controls, sanitation preventive controls and incoming material controls in a way that traditional seven-principle HACCP did not explicitly require. Businesses operating solely within a single province and not importing, exporting or trading interprovincially remain subject to provincial food safety laws and may still operate under HACCP-based frameworks depending on their province.

Is a CFIA licence required for all Canadian food businesses?

A CFIA licence is required for food businesses that import food into Canada, export food from Canada, or trade food across provincial or territorial boundaries (interprovincial trade). Businesses that produce and sell food exclusively within one province or territory — without importing, exporting or interprovincial trade — are not required to hold a federal CFIA licence and are instead regulated by their provincial food safety authority. Many provinces and territories have their own licensing or registration requirements for such businesses.

How long must food safety records be kept under the SFCR?

The SFCR generally requires a minimum retention period of 2 years for records relating to a Preventive Control Plan and associated monitoring, corrective action and verification records. Some operational records — such as certain incoming material records — have a 1-year minimum retention period. Where a GFSI scheme (SQF, FSSC 22000, BRCGS) is also in place, its requirements typically set a 5-year retention standard for technical documents such as hazard analyses and validation studies, which exceeds the SFCR minimum and should be followed where the longer period applies.

Are FSSC 22000 or SQF certifications accepted by CFIA in lieu of a Preventive Control Plan?

No. GFSI-recognised certifications such as FSSC 22000 and SQF demonstrate that an independently audited food safety management system is in place and are valued by retail and foodservice customers, but they do not substitute for CFIA licence obligations or the PCP requirement under the SFCR. A licensed business holding FSSC 22000 or SQF certification must still have a written PCP available for CFIA inspection. The ISO 22000-based documentation that underpins FSSC 22000 can serve as the substance of the PCP, provided all SFCR-required elements are present, but the regulatory and commercial obligations remain parallel and independent.

How should a Canadian food manufacturer manage documentation for both CFIA compliance and a major retailer's SQF requirement?

The most efficient approach is a unified document management system that holds the PCP, monitoring records, corrective action records, supplier certificates and CoAs in a single, searchable repository with role-based access and automated expiry tracking. This eliminates the common problem of maintaining separate document sets for CFIA and SQF audit purposes. Automated CoA intake — triggered at goods receipt, matched to purchase orders and checked against approved specifications — provides the incoming material control records that satisfy both the SFCR supplier control requirement and the SQF supplier approval programme documentation. The CheckFile platform supports this integrated approach for businesses managing supplier bases from 20 to over 2,000 active suppliers. See /tarifs for deployment options.