Sanitation programs have moved from a back-of-the-plant afterthought to the first thing an investigator asks about. That shift didn't happen in a vacuum. The 2024 Listeria monocytogenes outbreak linked to Boar's Head deli meat was traced to a Jarratt, Virginia plant. It ended with the facility's closure and a body count that made national news. It also put a spotlight on exactly the kind of gap I see in half the facilities I walk through: a sanitation program that exists on paper but doesn't hold up against what's actually happening on the floor. Whether you manufacture drugs, food, dietary supplements, or cosmetics, the underlying question FDA is asking right now is the same one it's always asked, just louder: can you prove, with records, that your facility and equipment are clean before you tell me your product is safe?
I want to walk through what a sanitation program actually has to cover, where the regulatory requirements differ by industry, and where I keep finding the same gaps no matter what the label on the product says.
What a Sanitation Program Actually Is
A sanitation program is not a cleaning schedule taped to a wall. It's a documented system that defines what gets cleaned, how, how often, with what agents, who verifies it worked, and what happens when verification fails. Done right, it has five parts working together:
- Written procedures (SOPs) for cleaning and sanitizing each piece of equipment and each area.
- A master sanitation schedule that sequences all of it across shifts and downtime.
- Environmental monitoring that tests whether the cleaning actually worked.
- Records that tie a specific clean to a specific operator on a specific date.
- A corrective action path for when a swab comes back positive.
Miss any one of those five and the program collapses under inspection. I've seen sanitation SOPs that were technically excellent and completely useless because nobody could produce the log showing the SOP had been followed on the day a contaminated lot shipped.
The Regulatory Baseline Differs by Industry — Know Which One Applies
The specific citation an investigator reaches for depends on what you make, but the underlying expectation — a clean, controlled environment with documented proof — is consistent across all of them.
| Industry | Governing Regulation | Core Sanitation Requirement |
|---|---|---|
| Pharmaceuticals | 21 CFR 211.56, 211.67, 211.113 | Buildings maintained in clean, sanitary condition; written cleaning/maintenance procedures for equipment; procedures to prevent microbiological contamination of drug products purporting to be sterile |
| Human Food (FSMA Preventive Controls) | 21 CFR 117.35 | Written sanitation procedures for food-contact surfaces, non-food-contact surfaces, and utensils; monitoring and corrective action for sanitation failures |
| Dietary Supplements | 21 CFR 111.15, 111.27 | Physical plant and grounds maintained to prevent contamination (111.15); equipment and utensils cleaned, sanitized, and maintained on a documented schedule (111.27) |
| Cosmetics | No binding federal GMP yet; ISO 22716 §9 is the voluntary benchmark | Cleaning and sanitizing procedures for equipment and premises, with records — expected to become enforceable once FDA finalizes a GMP rule under MoCRA |
That last row matters more than it used to. MoCRA gave FDA authority to issue a binding cosmetic GMP regulation, and once it's final, the sanitation expectations that food and drug manufacturers have lived under for decades will apply to cosmetics too. If you're in that industry and treating sanitation as optional guidance rather than a rule you'll eventually be audited against, you're behind, not ahead.
The Master Sanitation Schedule Is Where Programs Actually Break
I've never once found a facility that lacked cleaning SOPs. I find facilities constantly that lack a master sanitation schedule (MSS) that actually reflects what's cleaned and when. The MSS is the document that sequences every cleaning task — daily wipe-downs, weekly deep cleans, quarterly overhead and HVAC cleaning, annual tank and vessel breakdowns — against a calendar, and assigns responsibility for each.
The gap I see most often: the MSS was built once, during initial qualification or a prior consultant's visit, and never updated when a new line was installed or a piece of equipment was retired. An investigator who cross-references your equipment list against your MSS and finds a fermenter or filler that isn't scheduled anywhere is going to ask why, and "we forgot to add it" is not an answer that ends well.
A good MSS also has to account for changeover cleaning — what happens between product runs, not just at the end of a shift or a week. Cross-contamination findings, particularly for allergens and potent actives, trace back to changeover gaps far more often than they trace back to the deep-clean schedule.
Cleaning, Sanitizing, and Disinfecting Are Not the Same Step
This sounds basic, and it is, but it's also the single most common documentation error I find. Cleaning removes visible soil and organic material. Sanitizing reduces microbial load to a safe level. Disinfecting, used more in pharma and device settings, destroys a broader range of pathogens including some spores, depending on the agent. A procedure that only cleans a surface and calls it "sanitized" hasn't done what the label on the log sheet claims.
This distinction matters because the agent, contact time, and concentration required for each step are different, and validation studies have to reflect the actual step being performed. If your SOP calls for a quaternary ammonium sanitizer at a contact time that was validated for cleaning but not for the bioburden reduction claimed on the batch record, that's a finding waiting to happen. Contact time is the detail I see skipped constantly — operators wipe and move on before the sanitizer has had time to work.
Environmental Monitoring Is the Verification Layer
A sanitation program without environmental monitoring is a claim without evidence. Monitoring — surface swabs, air sampling, ATP bioluminescence testing — is how you find out whether the cleaning you documented actually reduced the organisms you're worried about, rather than just moving them around.
The zone concept is useful here, and it's the same logic FDA leans on across food and drug facilities: Zone 1 is direct product contact, Zone 2 is near product contact, Zone 3 is the surrounding room, Zone 4 is outside the processing area entirely (drains, floors, mop sinks). A robust program tests all four zones on a rotating basis, because pathogens like Listeria monocytogenes are notorious for establishing niches in Zone 3 and 4 — drains, condensate lines, floor cracks — and migrating inward over weeks or months before they ever show up on a Zone 1 swab. FDA's 2017 draft guidance on controlling Listeria monocytogenes in ready-to-eat foods leans heavily on exactly this logic: test the environment, not just the finished product, because finished-product testing alone catches contamination too late and too rarely.
The programs I see fail aren't the ones with no environmental monitoring. They're the ones that monitor Zone 1 religiously and never touch Zone 3 or 4, because that's where the uncomfortable results tend to show up.
What Happens When a Swab Comes Back Positive
This is the part of a sanitation program that separates a mature quality system from a paper one. A positive environmental result is not a failure of your program — it's your program working. What FDA actually evaluates is what you did next: did you re-clean and re-test, did you expand the investigation to find the source, did you check whether product made near that location during the relevant window needs to be held or evaluated, and did you document all of it in a closed-loop corrective action.
I tell clients the same thing every time: the facility that finds a positive, investigates it thoroughly, and can produce a clean paper trail showing containment is in a stronger position during an inspection than the facility that has never had a single positive result in five years of testing. The second one usually isn't testing hard enough to find anything.
Documentation That Actually Survives Review
Every sanitation program I've audited that failed an inspection failed on documentation, not on the cleaning itself. The floor was clean. The paperwork couldn't prove it. A few specifics that consistently hold up:
- Time-stamped, signed logs for every cleaning event, not just a checkbox — who cleaned it, when, with what lot of sanitizer.
- Sanitizer concentration verification, not just a statement that the correct chemical was used — test strips or titration records showing the actual concentration at time of use.
- Line clearance and changeover records that explicitly confirm the prior product and cleaning agents were removed before the next run started.
- A traceable link between environmental monitoring results and the batch records for product made in that location during that timeframe.
- Trending, not just pass/fail — a spreadsheet or LIMS record showing whether a given location's swab counts are climbing over months, which catches a developing problem before it becomes a positive.
If your records can't answer "prove this specific piece of equipment was clean before this specific batch," the SOP quality behind them doesn't matter.
Common FDA and Third-Party Findings Tied to Sanitation
In my inspection prep work, the sanitation-related findings that recur most are remarkably consistent across industries: SOPs that don't match observed practice on the floor, cleaning validation that was never repeated after an equipment or process change, environmental monitoring programs that skip Zone 3 and 4, master sanitation schedules that don't reflect current equipment, and corrective actions for positive results that were closed without confirming the root cause. None of these require exotic engineering fixes. They require someone walking the floor with the SOP in hand and checking whether the two match.
Building or Rebuilding a Sanitation Program
If you're starting from scratch or repairing a program that's drifted, this is the sequence that actually works:
- Walk the facility first, before touching a single document.
- Map every surface, drain, and piece of equipment against a zone classification.
- Write or revise SOPs to match what the facility genuinely requires, not a generic template pulled from another site.
- Build the master sanitation schedule around that equipment list and keep it as a living document tied to your change control process, so a new line automatically triggers an MSS update.
- Layer in environmental monitoring across all four zones with a rotation that actually reaches the corners people forget.
- Build the corrective action loop before you need it, not after your first positive result, so the team already knows the steps rather than improvising them under pressure.
That order matters. I've watched teams write beautiful SOPs first and then discover, once they finally toured the floor with fresh eyes, that half the equipment on their diagram wasn't even in the building anymore.
FAQ
What is the difference between a sanitation program and a cleaning schedule? A cleaning schedule tells you when to clean. A sanitation program includes the schedule plus written procedures, sanitizer verification, environmental monitoring to confirm the cleaning worked, and documented corrective action when it didn't. The schedule is one component, not the whole system.
Which regulation covers sanitation for dietary supplement manufacturers? Two clauses, not one. 21 CFR 111.15 covers the physical plant and grounds; 21 CFR 111.27 covers equipment and utensils, including the cleaning and sanitizing schedule and the documentation that verifies it happened. Inspectors checking dietary supplement sanitation will often ask for both — a clean building doesn't substitute for a documented equipment-cleaning record, and vice versa.
Do cosmetics manufacturers have a binding sanitation regulation? Not yet, but voluntary isn't the same as optional in practice. Cosmetics GMP sanitation today follows ISO 22716 section 9, and MoCRA already gives FDA the authority to make a version of it binding once the rule is finalized. Facilities that wait for the final rule to build their first sanitation SOP will be starting cold during their first inspection under it — the ones already documenting to the ISO 22716 standard won't be.
How often should environmental monitoring be performed? Frequency depends on product risk and zone classification, but a defensible program tests Zone 1 and 2 on a routine schedule (often weekly for high-risk operations) and rotates through Zone 3 and 4 locations regularly enough to catch an establishing niche before it migrates toward product contact surfaces.
What should happen after a positive environmental swab result? A closed-loop investigation: re-clean and re-test the location, expand testing to surrounding areas to trace the extent, evaluate whether product made nearby during the relevant window needs review or hold, identify the root cause, and document every step. A positive result handled this way strengthens your program's credibility rather than undermining it.
If your sanitation program hasn't been walked end-to-end against current equipment and current practice in the last year, that's the gap I'd close first — before the next inspection, not after. Our FDA inspection preparation work starts exactly there, and if microbial contamination in a supplement matrix is the specific risk keeping you up at night, our breakdown of Salmonella prevention in dietary supplement manufacturing goes deeper into the environmental monitoring piece.
Last updated: 2026-08-25
Jared Clark
GMP Compliance Consultant, Certify Consulting
Jared Clark is a GMP compliance consultant and founder of Certify Consulting, specializing in FDA GMP requirements for pharmaceuticals, dietary supplements, cosmetics, and food manufacturing.