FSMA Final Rules: What’s New and How to Comply
The Food Safety Modernization Act (FSMA) is the most sweeping reform of food safety laws in over seven decades. Almost four years after it was signed into law, the final rules governing preventive control for human and animal foods were finally published this September. Now, most FDA regulated companies must prepare for compliance by September 2016.
Compliance dates for the new requirements are defined and more flexible to assist industry compliance while still advancing FDA’s food safety goals. Even with that flexibility, it is important for companies to fully understand five key points regarding the final rule:
- Food Safety Plan v HACCP Plan
- Risk Based Preventative Controls
- Qualified Individual & Auditor
- Good Manufacturing Practices (GMP’s)
- Supply Chain Program
1. Food Safety Plan v. HACCP Plan
Companies regulated by preventive controls for human food will be responsible to comply with Subpart C of the rule in sections 117.126-117.90, Hazard Analysis and Risk-Based Preventive Controls (HARPC). This requires regulated companies to go beyond HACCP plans by developing and implementing a food safety plan.
The food safety plan defined by the regulation differs from traditional HACCP plans. It must include a hazard analysis, preventive controls, monitoring procedures, corrective action procedures, verification procedures, a supply chain program, and a recall program.
The hazard analysis requires a risk based assessment. After a hazard is identified, a quantitative evaluation needs to be made on its potential severity and likelihood of occurring. Other significant changes from traditional hazard analysis include a requirement to assess radiological hazards. Companies will also be required to address concerns over economically motivated adulteration and food fraud.
2. Risk Based Preventative Controls
As part of the risk based hazard analysis comes the assignment of risk and severity ratings. The next major task is to identify where preventive control steps are located in the manufacturing process.
Most companies will use a matrix that will help determine if process steps should be identified as a critical control point, preventive control step, or a control point. The final rule, part 117.135, defines preventive controls as process controls, food allergen controls, sanitation controls (including environmental testing in RTE facilities), supply chain controls, a recall plan, and other controls. Steps previously identified as CCP’s in HACCP plans are an example of a process preventive control.
Additional key process controls used to mitigate biological, physical, or chemical hazards could be considered preventive controls if the process step significantly minimizes or prevents an identified hazard. Examples could include antimicrobial interventions, metal detection, or refrigerated storage steps. Other controls identified in 117.135 include hygiene training and current GMP’s.
Once a process step is identified as a preventive control, procedures must be defined for operating limit parameters, monitoring, corrective actions, verification and record keeping.
3. Qualified Individual and Auditor
Photo: Alchemy Systems
The final rule dictates that only a qualified individual and/or auditor can prepare a food safety plan, validate activities, and record reviews and reanalysis.
To be a preventive controls qualified individual, the person must successfully complete training in the development and application of risk based preventive controls under a standardized curriculum, or training that is recognized as adequate by the FDA. Individuals may also be qualified through job experience. Prior traditional HACCP training without a focus on this risk based approach is not considered acceptable. Formal requirements for risk-based experience have not been defined, so most people will take formal preventive control training to meet this qualification.
In addition, a qualified auditor must conduct an on site audit and have additional technical expertise obtained through education, training, or experience.
4. Good Manufacturing Practices
The next major point is Subpart B, which outlines requirements for current GMPs. The requirements defined in 117.10 through 117.110 will replace what has been previously required under 21 CFR 110. Specific requirements are defined for personnel, plants and grounds, sanitary operations, sanitary facility and controls, equipment and utensils, processes and controls, warehousing, distribution and defect action levels.
While these requirements may sound basic, it is a worthwhile exercise to closely read and understand them to assure basic compliance.
5. Supply Chain Program
To emphasize the importance of this process, the supply chain program was moved to its own Subpart G to assure proper attention and compliance. Regulations defined in 117.405-117.475 mandate a written risk-based supply chain program. This should include procedures for supplier approval, supplier responsibilities, receiving facility responsibilities, supplier verification activities, on site audits and record keeping requirements.
It is imperative to identify applicable hazards throughout the supply chain and determine who is responsible for controlling the hazards. Verification processes are needed to review written assurances and controls used by the supplier, in addition to on site annual audits of suppliers by regulatory or accredited certification bodies.
The Challenge Ahead:
A key question to be answered at each establishment is, “What are we going to hand the FDA investigator when he or she shows up asking for the food safety plan?” Rather than exposing all the elements of food safety, food quality, and GFSI programs, establishments may choose to have a separate food safety plan manual that contains only the required regulatory details.
The industry must also learn to be proactive and use a risk based philosophy to identify how preventive controls and practices apply to their systems. This new thought process can be learned with preventive control training. It will be necessary to cascade this thought process throughout the organization.
The final rules for preventive controls for human food and animal food are providing the impetus for industry re-evaluate their food safety systems. Ultimately, this will be beneficial for the industry to better protect the food supply while reducing risk of recalls and food borne illness. We all have to work together to make these systems successful – the time to start preparing is now.