GMPs, FSMA and GFSI: Making the Right Connections

As FDA regulations spell out in 21 CFR Part 110, good manufacturing practices (GMPs) or current good manufacturing practices (cGMPs) are the basics you need to know and perform to keep the food products you make free of adulteration—whether from bacteria or chemicals. It doesn’t take long after you start reading 21 CFR Part 110 for you to realize these rules and regulations are simply based on common sense. After all, you take the same precautions when you prepare a meal for your family, whether from fresh or processed ingredients.

In fact, cGMPs are a basic part of FSMA and any GFSI scheme, along with HACCP (also found in Codex Alimentarius) and prerequisite programs (PRPs). All GFSI schemes approach food safety differently, but the outcome is the same: A certification from SQF, BRC or FSSC 22000 should be satisfactory for your customer, showing you have a documented HACCP plan(s) and risk-based preventive controls in place (HARPC)—and your staff and plant live and breathe food safety cGMPs.

As much as cGMPs are the building blocks of FSMA and GFSI schemes, the latter two not only have a mutual interrelationship, they both reflect back on and modulate cGMPs. You might say the three are contributing to each other’s growth and interconnectedness as we progress along the path toward food safety refinements with the help of technology.

cGMPs: Evolving with the times

For those interested in reminiscing, GMPs were actually started in the mid-1960s and first published in 1968, according to Jack Payne, Aptean vice president of solution consulting. A lot has changed since the Ozzie & Harriet days of the ‘50s and the turbulent ‘60s when not that much attention was paid to food safety. With the evolution from local to national and international supply chains, interest in food safety has picked up, and cGMPs have evolved to match today’s needs, adds Payne.

“Both FSMA and GFSI are changing or have changed cGMPs,” says Jim Cook, SGS food scientific and regulatory affairs manager. Revised in June 1986, cGMPs have changed little since they were amended in April 1996 and November 2001, according to Cook. “While what was listed was a common sense approach, the use of ‘shall’ and ‘should’ in the guidelines resulted in some manufacturers adhering to the ‘shall’ requirements but ignoring the ‘should’ requirements, thereby creating gaps in their systems,” adds Cook. It’s these gaps that often show up later on as processors prepare for FSMA or GFSI audits.

According to Cook, GFSI has taken these “should” requirements, made them “shall” requirements and expanded or clarified those areas. FSMA will remove most of the “should” requirements and convert some of them to “shall” requirements. For example: When it comes to Toilet Facilities and Handwashing, both FSMA and cGMPs state this is a requirement. However, they go on to state, “this may be accomplished by” and provide a list of how it may be done. In addition, GFSI requirements have turned “may be” requirements into “shall” requirements and have modified some, such as (d)(4): “providing doors that do not open into areas where food is exposed to airborne contamination, except …” where these exceptions have been removed. Validation of these exceptions would need to be accomplished by the facility for any of them to be utilized based on GFSI requirements.

“FSMA and GFSI platforms ensure a facility maintains and implements a robust cGMP program,” says Warren Gilbert, FSS Corp. food safety specialist. “They are specific regarding employee hygiene and awareness for product handling.”

While cGMPs provide the foundation for a food safety system, it is imperative to have a strong foundation of prerequisite programs in place to control basic food safety issues, says Jeff Chilton, principal of the Chilton Consulting Group. “This foundation also prevents certain hazards from becoming reasonably likely to occur, therefore reducing the number of CCPs required in HACCP plans.” Prerequisite programs include, for example, GMPs, sanitation, microbial control, pest control, allergen control, foreign material control, maintenance, training, calibrations, supplier approval, potable water, waste disposal, and storage and transport. “Effective PRP development [and] implementation are crucial to the success of the food safety system. Most failures in food safety systems that cause recalls for reasons such as allergen labeling or pathogen contamination are due to failures within these PRPs rather that a CCP failure,” adds Chilton.

“GFSI standards have definitely added more substance to the cGMPs,” Chilton continues. “All the GFSI schemes require verification and validation of these PRPs at least annually.” When done properly, this verification and validation process includes a review of the written programs, plant inspections to verify compliance, reviews to ensure effective implementation and analytical report reviews to ensure effective validation. These verification and validations ensure the programs are effective and identify opportunities for continuous improvement. FSMA will add more substance, too, once the final rules are published with anticipated additional requirements coming with the cGMP regulations, according to Chilton.

“The goal of FSMA is to shift the focus of federal regulators from responding to contamination to preventing it,” says Jennifer Wondergem, SSOE Group chemical engineer. “This places significant responsibility on farmers and food processors to prevent contamination. cGMPs are the main tool food processors have to monitor and control food safety within their processes. FSMA [Section 101] gives FDA access to all plant records, including industry food safety plans and the records firms will be required to keep to document implementation of their plans.”

Getting started

While writing this article I received an email from an American consultant who is helping processors in Central and South America. A major seminar was recently held on FSMA in Brazil by the Brazilian agency ANVISA, which controls food regulations. This consultant reports most Brazilian producers/processors, except the large international processors that are starting plants in South America, are just beginning to get on board with FSMA.

Unfortunately, getting on board with FSMA, GMPs and GFSI can be tough for smaller operations. “We see this a lot with smaller startup companies,” says Gilbert. “People just don’t know what they don’t know. It’s a learning process for them, and sometimes, they don’t know where to look for information.”

“This happens mainly with small manufacturers that have been providing an item to specialty retailers or their domestic market, and now, that item is being sold, or they desire it to be sold, to large retailers and/or the international market,” says SGS’s Cook. “GFSI identified this issue and developed a Basic cGMP audit program and accompanying requirements. Many GFSI schemes offer gap assessments, training and/or consultants to help companies achieve the desired compliance goals. An SQF Level 1 audit mainly involves a cGMP audit program and compliance.”

Even processors that think they’re prepared for FSMA or GFSI audits may be in for a surprise. “We receive calls every week from companies needing to become GFSI certified to meet customer requirements,” says Chilton. “It is common for companies to think they have good cGMPs in place, but when they are audited, numerous nonconformances are often identified that expose serious vulnerabilities in their food safety and quality systems.”

Evaluating the “gap” or the unknown

It’s the gap analysis that reveals the unknown—the surprise(s) where there’s some small detail missing from a processor’s GMPs that could spell trouble down the road. Better to find out now what remedies are needed to achieve a GFSI certification rather than wonder why a recall was needed for a product that never had problems before. “A [gap audit] is a good start for any processor,” suggests Gilbert. “Depending on the gap format chosen, it will give the facility good initial direction that will help with a timeline and budget for implementation.”

A gap audit performed by a technically competent internal or external auditor is essential to determine any areas that need to be addressed, says SGS’s Cook. This assessment is needed before any regulatory, customer or certification audit takes place. After a gap assessment, it is also essential that someone equally technically competent performs a root cause analysis and implements both corrective and preventative actions to address any found nonconformances. Unfortunately, in many small businesses, a person with this level of competency is not on staff, and they must obtain a consultant or third party to complete these tasks, adds Cook.

“Upon completion of the gap audit, a gap analysis will provide the processor with a clear summary of where gaps exist between its documentation and the standards,” says SSOE’s Wondergem. The analysis will also result in a list of corresponding actions that should be taken to close those gaps. This analysis can be done by a third party or internally, if the processor has the resources.

For processors thinking GFSI, a gap analysis is indispensable. “The gap analysis assesses the effectiveness of [a processor’s] existing programs, records and facility,” adds Chilton. “The gap analysis also compares all the GFSI standard requirements to identify what must be done to comply with the standard to achieve certification. With our consulting process, we also create action registers to formulate a strategy to correct the gaps to bring the client into compliance with the GFSI standard.”

Updating 21 CFR Part 110 to reflect the times

Soon, GFSI and FSMA will influence 21 CFR Part 110 in the areas of documentation and PRPs. “FDA’s 21 CFR Part 110 regulations on cGMPs already provide the foundation for a sound food safety program,” says Wondergem. “To accommodate requirements for FSMA and/or GFSI certifications, I could see them being expanded to include more guidance for controls and documentation since [they are] a major component of any certification program.”

“FDA’s GMP regulations are expected to be updated when the FSMA final rules are published,” says Chilton. “The GMPs will be strengthened and expanded to include additional items such as all the PRPs identified in the GFSI standards. In addition, the scope will be expanded beyond [human] food processing and will also apply to animal food and feed. Last, it will raise the bar for international companies exporting to the US, requiring them to meet the same standards.”

The updated GMPs also will show the shift from a HACCP environment to preventive controls, that is Hazard Analysis and Risk-Based Preventive Controls (HARPC). “cGMPs are being updated by FDA to create a link between them and the HARPC requirements,” explains Cook. “Probably the greatest area of change between the old cGMPs and the new will be in allergen management. This is being done because a large percentage of recalls are attributed to undeclared allergens. GFSI programs are addressing this issue.”

Tools to pull the loose ends together

Processors can get help with cGMPs, GFSI and/or FSMA from a variety of free or fee-based sources. “FDA’s 21 CFR Part 110 is a good starting point for a facility wanting to get FSMA or GFSI certification,” offers SSOE’s Wondergem. On its website, FDA provides HACCP Principles and Application Guidelines, which outline how a processor can develop, implement and maintain a HACCP plan. FSMA and GFSI offer guidance documents and other resources that demonstrate the requirements to become certified. Third-party auditors such as SQF provide information including audit checklists that can help prepare a facility for an audit.

SGS provides training programs for cGMP, HACCP and HARPC. Additionally, there are programs to help processors decide which GFSI scheme is appropriate for a particular business, with further training available in a specific GFSI scheme. Further training and information for each GFSI program also can be obtained through the scheme owner. For FSMA, SGS offers information through webinars, white papers and other specific training. In addition, FDA offers videos, webinars and training for food defense. USDA’s DSIS offers webinars and training on food defense.

Consultants like Chilton Consulting Group, FSS Corp. and SGS offer several services. For example, FSS Corp. offers classes for HACCP and internal auditor, SQF and BRC training. Chilton Consulting Group has partnered with SafetyChain Software to help clients automate, streamline and improve their food safety and quality assurance systems.

Problem is, some of today’s processors are still operating in the pre-computer era. Aptean’s Payne describes a typical scenario he’s seen at many processor locations. “They may have a very good food safety plan, a good HACCP plan and all the procedures in place, but how many are ensuring these procedures are followed every day and every shift? In most cases, they have a notebook where they write down that they have checked the temperature in the cooler, the cook temperature or whatever parts of their HACCP plan they followed.” But do they remember to put these entries into the manual, and are they alerted or reminded to make the entries automatically? And, if a food safety event occurs, how can they correlate the information and show what happened—much less provide the information to an auditor on a timely basis? “We need some type of formal, auditable software system that provides the ability to notify or alert operators when they need to take readings and advise management when prescribed actions weren’t taken,” states Payne.

At a recent conference I attended, a couple of food processors asked if software tools were readily available to help them prepare for an FSMA audit or a GFSI certification. To get some answers, I posed this question to a few software suppliers. From the responses I received, there are two main types of software.

There are static forms (often based on Microsoft Word, Excel or Access templates), and there are other, more automated systems that demand user participation. “Rather than filling out a standalone static document, processors can look into filling out actionable documents, where key data is extracted and put into a centralized database,” explains Gary Nowacki, TraceGains CEO. These tools can be used to alert operators when it is time to inspect or maintain a machine or gather fresh information from ingredient suppliers. “Once the actionable database is in place, processors can respond quickly to internal audits, GFSI readiness and third-party auditors,” says Nowacki.

“One of the things we provide is a utility, which we call an event management framework, that records specific events or actions that typically define part of a food safety plan,” says Aptean’s Payne. This utility is an application that prevents operators from moving to new tasks if the present ones haven’t been completed and signed off. “It prevents operators from getting ‘too busy.’” Also, quality (a software module) should be part of an enterprise system where information is recorded as ingredients come in the door, are processed and go out the door as finished product. All parts of a food safety plan should be recorded by the software, making track and trace possible at any step in the supply chain and at the processor’s facility, says Payne.

One tool constructed by SafetyChain Software allows food and beverage companies to assess risks and food safety gaps while putting HACCP, HARPC, GMP/cGMP and GFSI programs in place. According to Barbara Levin, SafetyChain senior vice president, marketing, the software provides processors with the ability “to say what they do, do what they say, make sure it works and make sure it’s documented. That’s what a food safety chain management system does.”

But is that how yours works? You may be doing all the right things in your process in all the critical stages, have several PRPs in place and work with equipment suppliers to find sanitary designs and with architectural and engineering firms to determine what may need to be done to bring your plant up to date. But if you haven’t been documenting it all, the amount of work that needs to be done to satisfy FSMA or a GFSI audit could be overwhelming. Before your customer asks you for a GFSI certification, why not get prepared now?

What are PRPs?

According to the ISO 22000 food safety certification, prerequisite programs (PRPs) are defined as “specified procedure(s) or instruction(s), specific to the nature and size of the operation, that enhance and/or maintain operational conditions to enable more effective control of food safety hazards, and/or that control the likelihood of introducing food safety hazards to—and their contamination or proliferation in—the products(s) and product processing environment.”

In an ISO 22000 food safety management system (FSMS), PRPs basically focus on the production environment—or in other words, people and facility—which will affect food safety and the validation of a processor’s ISO 22000 FSMS. Maintaining PRPs is essential to food safety operations and obtaining ISO and GFSI certification.

For more information on PRPs and ISO 22000, see ISO 22000: The General Prerequisite Program Requirements of ISO 22000, ISO 22000 Resource Center.

Food GMP development timeline

Date		Milestone
1906		1906 Pure Food and Drugs Act prohibits interested commerce in misbranded and adulterated foods, drinks and drugs
1933		FDA recommends revising 1906 act
1938		FDA passes 1938 Federal Foods, Drugs and Cosmetics Act, which provides identity and quality standards for food
Mid '60s		FDA decides to clarify FDCA through GMP regulations
1968		FDA proposes GMP regulations
1969		FDA finalizes GMP regulations
Early '70s		FDA considers promulgating industry-specific regulations
Late '70s		FDA decides to revise general GMPs rather than adopting industry-specific GMPs
1986		FDA publishes revised food GMPs
2002		FDA forms Food GMP Modernization Working Group
2004		FDA announces effort to modernize food GMPs
2007		Current Good Manufacturing Practice in Manufacturing, Packing, Labeling, or Holding Operations for Dietary Supplements (Final Rule) June 25, 2007
2011		FDA passes FSMA, which is enacted into law