How to Investigate an Environmental Monitoring Excursion

All of it is written down so an auditor can follow your reasoning. The goal is a decision you can defend, not a "resample until it's clean" loop.

An excursion is any environmental monitoring result above your action limit, or a trend that crosses your alert limit. A positive for a target pathogen or indicator organism in a food plant also counts. Sterile-drug guidance uses different tools: EU GMP Annex 1 sets alert and action limits, and USP <1116> puts more weight on contamination recovery rates (the percentage of samples with any microbial growth, whatever the count) than on single-sample counts. Food plants more often act on any pathogen or indicator positive and on trends by zone. The steps below apply whether you run a food plant, a supplement or cosmetic line, or a testing lab.

For FDA-regulated food facilities, environmental monitoring is a verification activity under the Preventive Controls rule. 21 CFR 117.165 requires environmental monitoring for an environmental pathogen, or a suitable indicator organism, when contamination of ready-to-eat food is a hazard that needs a preventive control. That monitoring must follow written procedures and be documented (21 CFR 117.165(b)). When monitoring finds an environmental pathogen or an appropriate indicator organism, 21 CFR 117.150(a)(1)(ii) requires corrective action procedures, along with records of what you did.

Supplement, cosmetic and pharmaceutical operations have different rules. EU GMP Annex 1 and USP <1116> are written for sterile and aseptic manufacturing. Most non-sterile sites should treat them as useful benchmarks for investigation logic, not as requirements that apply to them.

• Check the result itself. Was the right sample site swabbed or plated? Were the media in date, did the incubation conditions match the method, and is the count or identification correct? Record what you checked, even if everything holds up.
• Notify the right people. Tell QA, production and sanitation. Note the date and time.
• Assess product impact. Identify which lots were made in that area since the last acceptable result. For a Listeria positive on a food-contact surface (Zone 1), evaluate the affected product for safety under your corrective action procedure (21 CFR 117.150(a)(2)). FDA's draft Listeria guidance gives an example: after a first Zone 1 positive, clean, sanitize and retest. If a follow-up sample is also positive, hold and test the affected lot when the food supports Listeria growth (or consider doing so when it does not), and hold product from the next two production days (FDA LM pp. 44–46).
• Start corrective sanitation, but take any extra vector swabs first. If you clean before you sample, you lose the evidence you need to find the source.

Build a short timeline covering:

• the sample site, zone, date, shift and the organism or count
• results for the same site and nearby sites over the past weeks or months, to show whether there is a trend
• maintenance, construction, equipment moves, water leaks or HVAC events
• sanitation records, chemical concentrations and any skipped cleanings
• personnel and traffic changes: new staff, temporary workers, changed routes
• raw material or ingredient changes

Trend data often tells you more than the single result. One isolated hit after a roof leak is a different investigation from a slow rise in counts over six weeks.

Sample outward from the positive site, toward drains, equipment framework, hollow rollers, door seals, carts and other likely harborage points. For Listeria positives, FDA's draft guidance gives an example of follow-up sampling: retest the positive site and at least three surrounding sites at least 3 hours into the next production run (FDA LM pp. 40, 44). After a repeat positive on a food-contact surface, continue intensified cleaning and sampling and return to routine monitoring only after food-contact-surface samples from three sequential production days are negative for Listeria spp. (FDA LM p. 45). Your procedure should also say when to identify Listeria spp. to L. monocytogenes. Some firms also use strain subtyping (for example, whole-genome sequencing) to tell a resident strain from a new introduction. That is an optional tool, not an FDA expectation.

Write down why you picked each extra site. That rationale is what an auditor will ask about.

Use a structured tool such as a fishbone (people, methods, materials, equipment, environment, measurement) or 5 Whys. Test each hypothesis against the evidence you collected. Avoid ending on "human error" or "inadequate cleaning". Ask why the cleaning was inadequate: wrong tool, unreachable equipment design, unclear SOP, or time pressure.

If you can't find a definitive cause, say so. Then list the most probable cause(s) and the evidence for each. A clearly stated "probable cause" is better than a forced one.

• Corrective actions fix this event: deep cleaning, teardown, repair, product disposition.
• Preventive actions stop recurrence: equipment redesign, a revised sanitation SOP, retraining, changed traffic flow, a new sampling site or frequency.
• Effectiveness check: define in advance what "fixed" means, for example a set number of consecutive negative results at the site and its vectors. (FDA's draft Listeria guidance gives three sequential production days of negative food-contact-surface results as one example; FDA LM p. 45.) Schedule it and record the outcome.

A complete investigation record usually includes:

1. the excursion description and the original result
2. lab result verification
3. containment and product impact assessment, including lot numbers and disposition
4. the timeline and trend review
5. vector sampling plan and results
6. root cause analysis and conclusion
7. corrective and preventive actions, with owners and dates
8. effectiveness check results
9. QA approval and the closure date

Under 21 CFR Part 117, records must be kept for at least 2 years after the date they were prepared (21 CFR 117.315(a)(1)).

• Resampling until the result comes back negative, then closing the investigation
• Cleaning before taking vector swabs
• No product impact assessment
• "Human error" given as the root cause, with retraining as the only action
• No trend review, so repeat excursions at the same site are treated as separate events
• Investigations left open for months with no interim decisions

If excursions keep coming back at the same sites, your sampling plan lacks a written rationale, or an audit is coming up, an outside review can help. Micro-Core's environmental monitoring services cover program design, trend review and investigation support. You can also start with our free pre-audit checklist.

What's the difference between an alert limit and an action limit?

An alert limit is an early warning that a level is drifting from normal and may need closer watching. An action limit is the level that requires an investigation and corrective action (as defined in EU GMP Annex 1, a sterile-manufacturing benchmark).

Do I always need to hold product after an EM positive?

Not always. It depends on the zone, the organism, whether the food is ready-to-eat and whether it supports pathogen growth. Under 21 CFR 117.150(a)(2), affected food must be evaluated for safety and kept out of commerce if you can't show it is safe. In FDA's draft Listeria guidance, a hold-and-test is the example step after a repeat positive on a food-contact surface (FDA LM pp. 44–46). Document the decision either way.

How long should an investigation take?

No regulation or guidance we cite sets a fixed number of days. Start promptly, contain product right away, and close the investigation per your written procedure, with documented extensions. If you're under 21 CFR Part 117, a preventive controls qualified individual must review monitoring and corrective action records within 7 working days, or within a longer timeframe they justify in writing (21 CFR 117.165(a)(4)(i)). That deadline is for reviewing records, not for how long the investigation takes.

Do Annex 1 and USP <1116> apply to my food or supplement plant?

Usually not as requirements. They are written for sterile products, although Annex 1 notes that some of its principles "may be used to support" the manufacture of non-sterile products such as creams and ointments (EU GMP Annex 1, §1). Their approach to trending and investigation is a useful benchmark.

This article is general information, not regulatory or legal advice. Requirements depend on your products and jurisdiction.

1. 21 CFR 117.165, Verification of implementation and effectiveness (see 117.165(b), written procedures): https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-C/section-117.165 ↗
2. 21 CFR 117.150, Corrective actions and corrections (see 117.150(a)(1)(ii)): https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-C/section-117.150 ↗
3. 21 CFR 117.315, Requirements for record retention (see 117.315(a)(1)): https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-117/subpart-F/section-117.315 ↗
4. FDA Draft Guidance for Industry: Control of Listeria monocytogenes in Ready-To-Eat Foods ("FDA LM"; 2017 revised draft; nonbinding; not finalized as of Nov 2026; cited by printed page numbers): https://www.fda.gov/media/102633/download ↗ (guidance landing page: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/draft-guidance-industry-control-listeria-monocytogenes-ready-eat-foods ↗)
5. EU GMP Annex 1 (2022), Manufacture of Sterile Medicinal Products: https://health.ec.europa.eu/system/files/2022-08/20220825_gmp-an1_en_0.pdf ↗
6. USP <1116>, 'Microbiological Control and Monitoring of Aseptic Processing Environments,' USP–NF (2017): https://doi.usp.org/USPNF/USPNF_M99835_01_01.html ↗ (subscription; official text not publicly verifiable)