Cream Cheese Recalls: GMP Controls That Prevent Listeria

When Made Fresh Salads, Inc. of Bay Shore, NY issued a voluntary recall of assorted flavors of cream cheese due to potential Listeria monocytogenes contamination (FDA recall notice), it joined a troubling pattern that repeats itself across the food manufacturing industry year after year. The recall is a symptom. The disease is a quality system that failed — or was never fully built in the first place.

This article is not about the recall. It is about prevention.

As a GMP consultant who has worked with 200+ food and FDA-regulated clients and maintained a 100% first-time audit pass rate, I want to walk you through the specific quality systems, environmental monitoring programs, and regulatory controls that, when properly implemented, make this kind of recall extraordinarily unlikely. I also want to address an important regulatory context: the FDA's FSMA Preventive Controls for Human Food rule (21 CFR Part 117), which was specifically designed to prevent exactly this type of contamination event — and what recent enforcement trends tell us about where manufacturers are still falling short.

Why Listeria in Cream Cheese Is a Preventable Regulatory Failure

Listeria monocytogenes is one of the most insidious pathogens in food manufacturing. According to the CDC, listeriosis causes approximately 1,600 illnesses and 260 deaths in the United States every year, making it one of the deadliest foodborne illnesses despite its relatively low incidence. The case-fatality rate for invasive listeriosis is approximately 20–30%, far exceeding that of Salmonella or E. coli O157:H7.

What makes Listeria particularly dangerous in dairy and deli-type environments is its resilience:

• It thrives in cold, wet environments — exactly the conditions of a cream cheese manufacturing facility
• It forms biofilms on drains, floors, food contact surfaces, and equipment joints that are extremely difficult to eradicate once established
• It can survive for months or years in harborage sites if environmental monitoring and sanitation programs are inadequate

The FDA has identified ready-to-eat (RTE) foods produced in environments where Listeria has been found as one of the highest-priority food safety risks in the United States. Cream cheese is, by definition, a ready-to-eat product. There is no kill step after packaging. The burden of prevention falls entirely on manufacturing controls.

Citation hook: Ready-to-eat dairy products like cream cheese carry a zero-tolerance regulatory standard for Listeria monocytogenes under 21 CFR Part 117, meaning a single positive environmental or finished product result can trigger mandatory recall and FDA enforcement action.

The Regulatory Framework: What FSMA Actually Requires

21 CFR Part 117 — Preventive Controls for Human Food

The Food Safety Modernization Act (FSMA) Preventive Controls rule, codified at 21 CFR Part 117, is the primary regulatory framework governing Listeria prevention in facilities like the one involved in the Made Fresh Salads recall. Understanding what this rule requires — and where manufacturers routinely fall short — is essential for any quality professional in the RTE food space.

What changed and when: The FSMA Preventive Controls rule for Human Food became effective on September 17, 2015, with staggered compliance deadlines: - Large businesses: September 19, 2016 - Small businesses (<500 employees): September 18, 2017 - Very small businesses (<$1M in sales): September 17, 2018

As of 2024–2025, every food manufacturer subject to this rule — regardless of size — should have been in full compliance for several years. Yet FDA inspection data continues to reveal significant gaps. According to FDA's published inspection observations, 21 CFR 117.135 (Preventive Controls) and 21 CFR 117.165 (Verification activities including environmental monitoring) remain among the most frequently cited regulations in FDA 483 observations for food facilities.

Recent Regulatory Emphasis: The Draft Guidance on Listeria Control

In 2024, FDA updated its enforcement posture on Listeria in RTE food environments, emphasizing that environmental monitoring programs (EMPs) are not optional — they are a required component of a food safety plan for any facility handling RTE foods in a post-lethality environment. The agency has signaled that EMP deficiencies will be treated as serious preventive control failures, not minor procedural gaps.

FDA's Compliance Policy Guide for Listeria monocytogenes in RTE Foods and the agency's Guidance for Industry: Control of Listeria monocytogenes in Ready-To-Eat Foods (updated 2022) both provide the compliance framework. Manufacturers who have not reviewed their food safety plans against the 2022 guidance are operating with outdated programs.

Citation hook: Under 21 CFR Part 117.135(a)(1), a facility producing ready-to-eat foods must identify and implement process preventive controls, sanitation preventive controls, and supply-chain preventive controls as applicable — all three categories are relevant to Listeria risk in cream cheese manufacturing.

The Quality System Gaps That Lead to Listeria Recalls

Recalls involving Listeria in RTE dairy products are rarely random events. They are almost always traceable to one or more of the following systemic failures. Here is what I look for in every food facility assessment I conduct at Certify Consulting:

1. Inadequate or Absent Environmental Monitoring Programs (EMPs)

An EMP is the early-warning system for Listeria in a food facility. A properly designed EMP for an RTE dairy environment includes:

• Zone-based sampling: Zone 1 (food contact surfaces), Zone 2 (equipment near food contact), Zone 3 (facility surfaces near processing), Zone 4 (remote areas and traffic pathways)
• Adequate sampling frequency and site rotation: Static sampling plans that test the same sites repeatedly are nearly useless — Listeria harborage sites change over time with facility modifications, seasonal variations, and equipment changes
• Corrective action protocols triggered by positive results: Finding Listeria in Zone 3 or 4 is an opportunity; having no documented corrective action procedure means that opportunity is wasted
• Indicator organism monitoring: Testing for Listeria species (not just L. monocytogenes) and Listeria-adjacent organisms as early warning indicators

The gap I see most often: Facilities that conduct EMP swabbing as a checkbox activity, without a trained microbiologist or food safety professional reviewing trend data, root cause analysis for positives, or documented verification that corrective actions were effective.

2. Inadequate Sanitation Preventive Controls

Under 21 CFR 117.135(c)(3), sanitation preventive controls are required when contamination of food or food contact surfaces with environmental pathogens is a significant hazard. In an RTE cream cheese facility, Listeria in the environment is presumptively a significant hazard. This means:

• Sanitation procedures must be written, specific, and validated — not generic
• Master Sanitation Schedules (MSS) must address all surfaces, drains, floors, walls, overhead structures, and equipment — including hard-to-reach areas where biofilms establish
• Sanitary design of equipment must be assessed; equipment with cracks, crevices, dead legs, or hollow rollers is a Listeria biofilm factory
• Sanitation effectiveness must be verified through pre-operational ATP bioluminescence testing and/or microbiological swabbing before production resumes

3. Failure to Validate the Food Safety Plan Against Actual Hazards

Many food safety plans I review were written at initial FSMA implementation and never meaningfully updated. The hazard analysis conducted in 2017 may not reflect:

• New equipment added to the line
• Facility expansions that created new moisture-prone areas
• Ingredient supplier changes
• New product formulations
• Updated FDA guidance on Listeria risk

21 CFR 117.170 requires reanalysis of the food safety plan whenever there is a significant change to the food, facility, equipment, or supply chain, and at least every 3 years. This is a hard regulatory deadline that many small and mid-size manufacturers routinely miss.

4. Supply Chain Preventive Controls for Ingredients

Cream cheese and flavored cream cheese products incorporate multiple ingredients — dairy bases, flavorings, fruit preparations, spices, herbs, and packaging materials. Each is a potential Listeria introduction vector. Under 21 CFR Part 117, Subpart G (Supply-Chain Program), manufacturers must:

• Conduct a hazard analysis for each raw material and ingredient
• Identify approved suppliers and conduct supplier verification activities
• Obtain certificates of analysis, conduct audits, or perform incoming testing for high-risk ingredients

A flavoring or fruit preparation contaminated with Listeria that enters a cream cheese manufacturing environment can seed the facility for years.

What Best-in-Class Listeria Prevention Looks Like

The following table compares minimum regulatory compliance under 21 CFR Part 117 against best-in-class Listeria prevention programs in RTE dairy facilities:

Citation hook: The gap between minimum FSMA compliance and best-in-class Listeria prevention is not primarily a resource gap — it is a food safety culture gap, and FDA inspectors are trained to assess both the documented program and the organizational culture that sustains it.

The PCQI Requirement: A Human Element Often Overlooked

One of the most consequential requirements of 21 CFR Part 117 is the mandate that a Preventive Controls Qualified Individual (PCQI) oversee the food safety plan. A PCQI must have successfully completed training in accordance with a standardized curriculum recognized by FDA (typically the FSPCA Preventive Controls for Human Food course) or be otherwise qualified through job experience.

In many small food manufacturers — including producers of specialty deli items and flavored dairy products — the designated PCQI:

• Completed the course years ago and has not refreshed their knowledge
• Is not meaningfully involved in day-to-day food safety decisions
• Does not have the authority to halt production when food safety system failures are identified

This is a paper compliance problem. FDA investigators conducting food safety plan reviews will interview the PCQI and assess whether that individual can demonstrate substantive knowledge of the facility's specific hazards, controls, and monitoring systems. A PCQI who cannot answer those questions is a significant 483 risk — and more importantly, a food safety risk.

Practical Compliance Guidance: What to Do Right Now

If you produce RTE dairy products, flavored cheeses, or similar products in a post-lethality environment, the Made Fresh Salads recall is a useful prompt to conduct an honest assessment of your own program. Here is a prioritized action list:

Immediate Actions (Within 30 Days)

1. Pull your last 12 months of EMP data and look for trends. Are any sites repeatedly positive or repeatedly near the detection threshold? Have all positive results received documented corrective actions and effectiveness verification?
2. Walk your facility with a Listeria eye. Look at drains, condensation points, areas where water pools, equipment feet, conveyor belts, hollow structural members, and any location where cleaning is visually difficult.
3. Review your food safety plan reanalysis dates. If you cannot document that your plan was reviewed within the last 3 years — or that a reanalysis was triggered by a facility or process change — you are out of compliance with 21 CFR 117.170.

Short-Term Actions (30–90 Days)

1. Validate your sanitation procedures for Listeria-specific effectiveness. ATP testing tells you surfaces are clean; it does not tell you Listeria is absent. Both are needed.
2. Assess your equipment for sanitary design gaps. Bring in a sanitary design specialist if needed. Equipment that cannot be effectively cleaned is a regulatory liability and a food safety liability.
3. Review supplier verification files for all RTE ingredients. Document the basis for each approved supplier and confirm verification activities are current.

Strategic Actions (90 Days+)

1. Consider voluntary Whole Genome Sequencing (WGS) of any Listeria environmental isolates. WGS allows you to determine whether a strain is persistent (same strain appearing multiple times over months) or transient. Persistent strains indicate a harborage site that sanitation is not reaching.
2. Conduct a mock recall exercise. If a Listeria positive were found in your facility today, could you identify all affected product, initiate a voluntary recall within 24 hours, and execute your crisis communication plan? If the answer is uncertain, your recall program needs work.
3. Schedule a third-party food safety plan audit against 21 CFR Part 117 requirements. Internal teams become blind to their own gaps. External auditors see what familiarity hides.

Our team at Certify Consulting specializes in exactly this type of assessment — food safety plan gap analysis, EMP design, and FSMA readiness for RTE food manufacturers.

The Cost of Inaction vs. The Cost of Prevention

Food safety professionals sometimes face internal resistance when pushing for more robust Listeria prevention programs. The business case is straightforward:

• The average cost of a food recall in the United States is $10 million, according to the Food Marketing Institute, when accounting for direct costs, lost sales, brand damage, and regulatory remediation
• FDA consent decrees imposed on food manufacturers following Listeria outbreaks have resulted in facility shutdowns lasting months to years
• Civil litigation following a listeriosis outbreak can result in multimillion-dollar judgments, particularly when deaths occur

By contrast, a comprehensive Listeria prevention program — including an enhanced EMP, validated sanitation procedures, PCQI training, and annual third-party audits — typically costs a fraction of a percent of annual revenue for a mid-size food manufacturer.

For more on building compliant food safety management systems, see our related guidance on FDA food facility inspection readiness and FSMA preventive controls implementation on this site.

FAQ: Listeria Prevention and GMP Compliance for RTE Dairy Products

Q: Is environmental monitoring for Listeria required under FSMA? A: Yes. For facilities producing ready-to-eat foods in post-lethality environments, environmental monitoring is a required verification activity under 21 CFR 117.165(a)(3) when Listeria monocytogenes or indicator organisms are identified as significant environmental hazards in the food safety plan.

Q: How often should a cream cheese manufacturer test for Listeria in the environment? A: FDA does not specify a universal minimum frequency, but guidance documents and industry best practices suggest Zone 1 food contact surfaces should be tested at least weekly, with Zone 2–3 tested monthly. Any positive result should trigger immediate intensified sampling.

Q: What is a PCQI and does every food manufacturer need one? A: A Preventive Controls Qualified Individual (PCQI) is a person who has completed FDA-recognized training (typically the FSPCA course) or has equivalent job experience. Under 21 CFR 117.180, a PCQI must prepare, validate, and review the food safety plan. This is a mandatory requirement for covered facilities under 21 CFR Part 117.

Q: What triggers a required reanalysis of a food safety plan under FSMA? A: Under 21 CFR 117.170, a reanalysis is required every 3 years, whenever a significant change occurs in the food, facility, equipment, or supply chain, when a new hazard is identified, when preventive controls are found to be inadequate, or when FDA requires one following an inspection.

Q: Can a small food manufacturer qualify for exemptions from FSMA Preventive Controls requirements? A: Very small businesses with less than $1 million in total annual sales of human food (averaged over 3 years) may qualify as "qualified facilities" under 21 CFR 117.201 and be subject to modified requirements. However, these businesses must still submit a written attestation to FDA and may be subject to full requirements if implicated in a foodborne illness outbreak.

Final Thought: Recalls Are Failures of Systems, Not Just Luck

Every recall involving Listeria in a ready-to-eat food product represents a preventable failure. Not an act of God. Not an unforeseeable event. A failure of one or more quality systems that exist precisely to catch these hazards before product leaves the facility.

The Made Fresh Salads recall, like dozens of similar recalls before it, is a reminder that FSMA's preventive controls framework is not bureaucratic overhead — it is the minimum floor of what we owe to consumers who trust that the food they buy is safe.

If your facility has not recently stress-tested its Listeria prevention program against the requirements of 21 CFR Part 117 and the FDA's current guidance posture, now is the right time to do so. Not after your next audit. Not after a positive environmental result. Now.

Have questions about your facility's FSMA compliance or Listeria prevention program? Contact Jared Clark at Certify Consulting for a confidential assessment.

Last updated: 2026-03-04