2.4.3.1 A food safety plan shall be developed, effectively implemented, and maintained and outline the means by which the organization controls and assures food safety. The food safety plan shall:
i. Be prepared in accordance with the steps identified in the Codex Alimentarius Commission or NACMCF HACCP guidelines. Primary producers and feed manufacturers may utilize a HACCP-based reference food safety plan developed by a responsible authority.
ii. Cover a product or product group and the associated processes.
iii. Describe the methodology and results of a hazard analysis conducted to identify food safety hazards associated with all inputs and process steps including rework. Animal feed and pet food safety plans must include hazards associated with animal safety as well as the safety of consumers of animal products. iv. Prescribe those measures taken to apply the controls implemented that are critical to assuring, monitoring and maintaining food safety.
v. Process controls at control points in production to monitor product safety, identify when a process is deviating from set parameters and make corrections to keep a process under control; and vi. Include documented Standard Operating Procedures (SOPs) and Work Instructions
First off, the code references Codex, not FDA's preventive controls rule for a food safety plan. So the section of code they cited is incorrect. This finding should have been
2.4.1.1
2.4.1.1 The organization shall ensure that, at the time of delivery to its customer, the food supplied shall comply with the legislation that applies to the food and its production in the country of its origin and destination. This includes compliance with legislative requirements applicable to maximum residue limits, food safety, trade weights and measures, packaging, product description, nutritional, allergen and additive labeling, and to relevant established Industry codes of practice.
The FSMA Preventive controls rule compliance date for small manufacturers was last month (9/19/17), that's why this was never a finding before. You need to update your food safety plan to be in compliance with the rule. If you do not know what the FSMA preventive controls rule is, you need to educate yourself as soon as possible by attending a class to make you a "Preventive Controls Qualified Individual" (PCQI) to get acquainted with the new requirements and how your HACCP plan needs to change to comply with the rule. FDA approved course material is taught through FSPCA. By attending that course you will attend the same material that FDA auditors will and have the best chance to feel out how it will be enforced moving forward.
You could also give the food safety plan builder a shot to try and generate a compliant plan even though you do not yet know/understand how to implement the rule.