For more than four years, food industry stakeholders have been eagerly awaiting publication of the final versions of the “seven foundational rules” mandated by FDA Food Safety Modernization Act (FSMA). This month, the Food and Drug Administration (FDA) issued the two final rules requiring facilities to identify potential hazards and implement controls for human food and animal food.
In the simplest terms, the final rule for human food requires firms to identify significant food safety risks, implement controls to mitigate the risks, monitor and verify the effectiveness of the processes, manage supply chain risks, and document activities.
Facilities that manufacture, process, pack or hold human food and are required to register with FDA must comply with the rule, but some firms are exempt. Facilities currently subject to HACCP requirements (e.g. seafood and juice producers), dietary supplement facilities subject to CGMP requirements, and low-acid canned food facilities would be exempt from this rule. Additional exemptions are related to business size and certain low-risk, on-farm activities and facilities in compliance with the Pasteurized Milk Ordinance (PMO) code. The PMO will be revised to align with the preventive controls rule.
To successfully navigate the new requirements for human food, firms should be aware of the following key issues of the final rule:
1. Facilities must develop and implement a Food Safety Plan
Facilities would be required to prepare and implement a written food safety plan containing:
- Hazard Analysis – Facilities must identify and evaluate all known or reasonably foreseeable biological, chemical and physical hazards for each type of food manufactured, processed, packed or held at the facility. Hazards could be naturally present, unintentionally introduced, or intentionally introduced for economic gain.
- Preventive controls – Facilities must provide assurances that hazards that are reasonably likely to occur will be significantly minimized or prevented. Preventive controls encompass process controls, food allergen controls, and sanitation controls.
- Monitoring procedures – Monitoring should provide assurance that preventive controls are consistently performed and documented.
- Corrective actions – If preventive controls are not properly implemented, facilities must implement corrective actions to resolve problems.
- Verification – Verification activities should ensure preventive controls are implemented and effectively controlling an identified hazard.
- Recall plan – All covered facilities must develop and implement a recall plan for a food with a hazard requiring a preventive control.
- Supply chain program – The program includes the use of approve suppliers and appropriate supplier verification activities.
2. Current GMPs updated and clarified
The modernization of the current Good Manufacturing Practices (cGMPs) for human food has been a priority on the FDA’s regulatory agenda for years. CGMP provisions that were previously non-binding are now binding requirements, including mandates for employee education and training. Moreover, the revised CGMPs mandate strengthened protection against allergen cross-contact during manufacturing. Overall, the majority of revisions concern definitions and modified regulatory language (i.e. replacing the term “shall” with “must”).
3. Farms are exempt
The preventive controls rule would not apply to operations defined as farms. The final rule has clarified the definition of “farm” to mean one of two types: Primary Production Farm or Secondary Activities Farm. Primary Production Farm is an entity under one management, which is devoted to a core activity such as growing or harvesting of crops, raising of animals, or any combination of these activities. A Secondary Activities Farm must be majority owned by the Primary Production Farm, and focused on harvesting, packing and/or holding raw agricultural commodities. The final rule expanded the definition of farm to include packing or holding raw agricultural commodities.
4. Product and environmental testing expected
Product testing is referred to as a verification activity for a preventive control for high-risk foods. Product testing can apply to raw ingredients, in-process foods, and finished products. The agency expects product testing programs would be implemented by facilities that produce foods frequently associated with outbreaks of foodborne illness or produce food for which an effective preventive control cannot be implemented.
Environmental monitoring is required for certain facilities that identify an environmental pathogen as a hazard in ready-to-eat foods requiring a preventive control such as sanitation controls. According to the rule, environmental monitoring should target microbiological hazards, not chemical hazards such as allergens.
5. Supplier verification requirements will be flexible
Facilities must have a risk-based supply chain program for raw materials or other ingredients requiring a control due to an identified hazard. A supply-chain program for a hazard is not required if the facility uses preventive controls for the hazard, or relies on a subsequent entity such as a customer or processor to control hazards. A broker or distributor can conduct supplier verification activities, but the receiving facility must evaluate the “entity’s documentation of the verification of control of the hazard.”
6. New recordkeeping and documentation requirements
Facilities would be required to maintain records of preventive controls, monitoring, corrective actions and verification. As the axiom goes, “if it isn’t documented, then it didn’t happen”.
7. Guidance documents forthcoming
FDA will develop industry guidance documents to assist facilities to comply with the new rule. In particular, the agency plans to issue guidance for the hazard analysis and preventive controls requirements before the rule takes effect. Additional guidance documents will address food allergen controls, validation of process controls, and environmental monitoring.
8. A qualified individual must oversee activities
The final rule requires a “qualified individual” to conduct or oversee many of the activities related to preventive controls. According to the rule, a qualified individual is an individual that has completed certain training in the development and application of risk-based preventive controls under a standard curriculum or is otherwise qualified to apply a food safety system by job experience.
9. Compliance dates as early as September 2016
Compliance dates for the new requirements will be phased in over the next three years. Very small business (averaging less than $1 million per year) must comply within three years, and businesses subject to the Pasteurized Milk Ordinance must comply within three years. Small businesses (a business with fewer than 500 full-time employees) must comply within two years. All other businesses must comply within one year.
10. Federal budget could challenge implementation
The implementation of the preventive controls rule is dependent on the federal budget for the next fiscal year. While the FDA will prioritize the inspection of domestic facilities, funding for the adequate inspection of foreign shipments and foreign facilities is yet to be determined by Congress.
Overall, the food industry has been receptive to the preventive controls rule since many of the food safety requirements have already been implemented by the larger food companies. Moreover, the leading food industry groups collaborated extensively with the agency to craft the final versions of the rules for preventive controls.
Next month, the FDA is expected to publish additional FSMA regulations, including the final rules for produce safety, third party accreditation, and the Foreign Supplier Verification Program (FSVP).