It is been interesting to see how the new law and regulations have been described. HACCP on steroids and a contention that HACCP is a reactive program whereas HARPC is proactive are among my personal favorites. The latter is rather amusing since it’s been over 20 years since Former FDA Commissioner David Kessler praised HACCP as being proactive.

The most important point in FSMA is that it mandates all processors develop, document, implement and maintain a food safety plan or, even better, a food safety management system. Even though this is now a mandatory requirement, I wonder how many companies have not implemented such systems.

Food safety has been driven not by regulations, but by the business environment. Food processors’ customers expect their suppliers will have programs to ensure the safety of what they manufacture and sell. This has been further emphasized by the mandates that processors develop programs that will stand up to the scrutiny of a third-party audit.

Subpart C of the January 2013 proposal is entitled Hazard Analysis and Risk-Based Preventive Controls. It requires each processor to have a food safety plan, conduct a hazard analysis, establish preventive controls, establish a recall plan, establish programs to monitor the preventive controls, establish verification procedures and maintain records that the food safety plan is being managed as designed. Sounds very much like HACCP as described by the National Advisory Committee for Microbiological Criteria for Foods (NACMCF) and the Codex Food Hygiene documents. But it is more than that.

The language in the proposed mandate to conduct a hazard analysis seems much closer to what was drafted by NACMCF in its first set of HACCP principles back in 1989:

“Assess hazards associated with growing, harvesting, raw materials and ingredients, processing, manufacturing, distribution, marketing, preparation and consumption of the food.”

This original HACCP principle is very similar to what is expected in today’s HACCP programs. Processors must not only evaluate each step in the process for potential hazards, they must also conduct a hazard analysis of all their raw materials, ingredients and packaging materials. This assessment should incorporate the material in question, as well as the manufacturer and the country of origin. For food processors that have made the commitment to pursue and implement the ISO 22000 food safety standard, FSSC 22000 (Food Safety Systems Certification) or any of the other GFSI (Global Food Safety Initiative) audit schemes, this assessment will be an essential element of their program.

While risk assessments must be fully documented, they may be conducted in different ways. For instance, some companies have adopted Failure Mode and Effects Analysis (FMEA) whereas others utilize tools that look at the potential for an occurrence multiplied by the severity. To be honest, this is one element of HACCP plans I have found to be rather weak over the years. Processors have focused on filling in the Hazard Analysis Worksheet, but have not fully documented the path that was taken to reach their conclusions.  Consequently, when asked by a regulator or auditor to defend their position or describe the rationale behind their conclusions, they have not had the information in hand to do so.

Some people believe FSMA will result in a vast increase in the amount of documentation. This should not be the case. But there will be more paperwork that addresses potential risk, and there should be a greater commitment to ensuring all control measures are properly validated. Validation is another area where processors have been allowed to slide in the past, and it is an issue FDA will be examining. In fact, in 117.150, the proposal states, “the owner, operator, or agent in charge of a facility must validate that the preventive controls identified and implemented in accordance with 117.135 to control hazards identified in the hazard analysis as reasonably likely to occur are adequate to do so.”

The expectation is that companies will utilize existing scientific and/or technical information to do this, or they will need to develop their own data. Of course, food processors should have always had proper validation data in their files. If they did not have such data, their HACCP plan was deficient. And if these deficiencies were not flagged by a third-party auditor, shame on that auditor.

The industry still does not know what the final FSMA regulations will be. So, is there a way you can ensure your food safety management system will meet the final regulations? There is no guarantee, but some programs will increase your odds. If there is a program that truly can be dubbed “HACCP on steroids,” it is ISO 22000, Food Safety Management Systems — Requirements for Any Organization in the Food Chain. This standard incorporates all the elements mandated in the draft proposal, plus elements such as management commitment, internal communication and management review. Processors can utilize the standard to develop, document, implement and maintain their food safety management system without actually moving toward certification. However, if you go that far, take the last step and go for ISO 22000 or one of the GFSI-approved schemes.

References:

International Organization for Standardization (2005). ISO 22000: Food safety management systems — Requirements for any organization in the food chain. Geneva, Switzerland.

The National Advisory Committee on Microbiological Criteria for Food, Hazard Analysis and Critical Control Point System (1997). Hazard Analysis and Critical Control Point Principles and Application. FSIS Information Office. Washington, DC.

National Advisory Committee on Microbiological Criteria for Food (1989). HACCP Principle for Food Protection. USDA-FSIS Information Offices. Washington, DC.

United States Food and Drug Administration (2013). Current Good Manufacturing Practices and Hazard Analysis and Risk-Based Preventive Controls. Federal Register, 78:11, 3646 – 3824.