When FSMA's Preventive Controls for Human Food rule was finalized, it changed the regulatory status of pest management in food facilities in a way that many QA managers still have not fully internalized. Pest management is no longer simply a Good Manufacturing Practice — it is a documented Sanitation Prerequisite Program that must be integrated into the facility's Food Safety Plan.
That distinction matters enormously. A GMP can be demonstrated through general compliance with operational standards. A Prerequisite Program under FSMA must be documented, implemented, monitored, verified, and corrected — with records available for FDA review. The bar is substantially higher, and the inspection criteria are substantially more specific.
Where Pest Management Lives in the FSMA Framework
Under 21 CFR Part 117, pest management falls under Subpart B — Current Good Manufacturing Practice — specifically 21 CFR 117.35. But its relationship to the Food Safety Plan is more complex than most facilities recognize.
21 CFR 117.135(c)(1) identifies sanitation controls as a required preventive control for facilities where sanitation conditions could introduce a hazard. Pest management is explicitly included within the scope of sanitation controls — which means it is subject to the full preventive controls framework: monitoring, verification, corrective actions, and records.
21 CFR 117.137 requires that when sanitation controls are implemented as preventive controls, the facility must monitor their implementation with sufficient frequency to ensure they are consistently performed. For pest management, this means documented evidence that the program is being implemented as written — not just that a PCO visits monthly.
The majority of food facilities have a pest control contract and PCO service reports. Very few have a written Pest Management PRP that documents the program's scope, monitoring procedures, verification activities, corrective action protocols, and record-keeping requirements. Without that document, the facility cannot demonstrate that pest management is being managed as a preventive control — regardless of how good the PCO service actually is.
The Eight Elements Your Pest Management PRP Must Document
1. Program Scope and Objectives
The PRP must define what the program covers: which pests are addressed, which areas of the facility are included, what the program's objective is (exclusion, detection, response), and who is responsible for program oversight at the facility level. This is the foundation document — without it, everything else is ad hoc.
2. Contractor Qualification and Oversight
The PRP must document how the PCO was selected, what qualifications are required (licensing, certifications, insurance), and how the facility oversees contractor performance. FSMA holds the facility — not the contractor — responsible for program effectiveness. That accountability requires documented oversight, not just a signed contract.
3. Monitoring Device Program
The PRP must describe the monitoring device network: device types, placement rationale by location and pest pressure, inspection frequency, and the procedure for recording and evaluating capture data. A device map is necessary but not sufficient — the map must be accompanied by documentation explaining why devices are placed where they are and how capture data is evaluated for trend analysis.
4. Structural Inspection Protocol
The PRP must define how structural conditions are assessed as part of the pest management program — what is inspected, how frequently, what conditions trigger a maintenance work order, and how the facility tracks work orders to closure. This is a maintenance-integration requirement that most pest control contracts do not address, but FSMA requires the facility to own.
5. Monitoring Procedures and Frequency
Under 21 CFR 117.137, the facility must monitor sanitation controls — including pest management — at a frequency adequate to ensure consistent implementation. For pest management, this typically means: PCO service visits at defined intervals, facility staff monitoring between PCO visits, and documented inspection of high-risk areas at defined frequencies. What constitutes "adequate frequency" is facility-specific and risk-based, but it must be defined in writing.
6. Corrective Action Protocol
This is the element most facilities are missing. The PRP must document what happens when pest activity is found: who is notified, what investigation is conducted, what corrective actions are required, how actions are assigned and tracked, what verification is required to close a corrective action, and when escalation is triggered. A PCO treatment is not a corrective action. It is a service. The corrective action addresses the condition that allowed the pest to establish.
7. Verification Activities
Under 21 CFR 117.140, the facility must verify that preventive controls are consistently implemented and effective. For pest management, this requires periodic verification activities beyond routine monitoring — such as quarterly trend analysis reviews, annual program effectiveness assessments, and documentation that the program is being implemented as written. This verification must be conducted by or overseen by a PCQI.
8. Records and Record-Keeping Requirements
The PRP must define what records are maintained, where they are stored, how long they are retained, and who has access. Under 21 CFR 117.300, records related to preventive controls must be retained for at least two years and must be available for FDA review within 24 hours of a request. This includes PCO service reports, monitoring records, corrective action logs, and verification records.
FSMA Pest Management PRP — Regulatory Requirements Map
How GFSI Schemes Align With FSMA PRP Requirements
For facilities pursuing GFSI certification alongside FSMA compliance, the PRP requirements align closely but not identically:
SQF 11.4 requires a documented pest management program that addresses ten specific elements including pest identification, monitoring procedures, device maps, pesticide records, contractor qualifications, and trend documentation. This maps directly to the FSMA PRP requirements, but SQF adds specific documentation requirements that go beyond the FSMA baseline — particularly around pesticide application records and contractor oversight.
BRCGS 4.14 requires that the site has a documented pest management system and that the site takes responsibility for ensuring PCO recommendations are implemented. The site responsibility language in BRCGS is particularly relevant to FSMA compliance — both frameworks reject the notion that pest management responsibility can be delegated to the contractor.
FSSC 22000 incorporates ISO 22000's prerequisite program requirements, which require that PRPs be documented, implemented, monitored, verified, and updated. The FSSC 22000 framework is structurally aligned with FSMA's preventive controls framework, making it the most directly translatable GFSI scheme for facilities navigating both.
The PCQI's Role in Pest Management Compliance
One element that many facilities overlook is the role of the Preventive Controls Qualified Individual in pest management compliance. Under FSMA, a PCQI must oversee or perform certain activities related to preventive controls — including sanitation controls.
For pest management, this means that verification activities — quarterly trend reviews, annual program effectiveness assessments, corrective action closure review for significant findings — should be overseen by the facility's PCQI. In many facilities, pest management is handled entirely by operations or facilities management, with no PCQI involvement. That disconnect is a compliance gap that FDA inspectors are specifically trained to identify.
After reviewing dozens of food facility Food Safety Plans, the pest management PRP is consistently the weakest section. Facilities invest significant resources in their HACCP plans, their allergen control programs, their environmental monitoring programs — and then treat pest management as a line item in their PCO contract. FSMA does not permit that approach. Pest management is a preventive control. It must be documented, monitored, verified, and corrected with the same rigor as any other element of the Food Safety Plan. The facilities that understand this are the ones that pass FDA inspections without pest-related citations.
The Practical Starting Point
If your facility does not currently have a written Pest Management PRP that addresses all eight elements above, the starting point is a gap assessment — a systematic comparison of your current documentation against what FSMA requires. That assessment should answer:
- What documentation exists and what is missing?
- Are monitoring procedures defined in writing and being followed?
- Does the facility have a corrective action protocol that addresses root cause, not just treatment?
- Is a PCQI involved in verification activities?
- Are records maintained in a format that supports FDA review within 24 hours?
The gap between what most facilities currently have and what FSMA requires is addressable — but it requires treating pest management as a compliance system, not a service contract.
Translate any pest finding to its FSMA requirements
FSAI360's free Audit Finding Translator identifies the exact regulations, corrective actions, and PCQI-level guidance for any pest finding — instantly, with scheme-specific output.
Try the Translator — Free →