The winding path to FSMA compliance

From GMPs to HACCP to FSMA and HARPC (Hazard Analysis Risk-based Preventive Controls), food safety has come a long way since the mid-20th century. Two recent articles in Food Engineering, “GMPs, FSMA and GFSI: Making the right connections” (August 2014) and “FSMA HARPC update” (October 2014), have kept readers up to date on revised and new proposed regulations. But with the piecemeal adoption of FSMA sections this year and in 2016, processors will need all the tools they can amass to be sure they are meeting the new laws. These tools include consultants, educational programs, control/monitoring systems and software to aid both controls and recordkeeping.

Article Index:

Documentation: A hurtle for some
Training/tools to tie up the loose ends
Software tools to aid successful HACCP and FSMA outcomes
Process control/quality software offer input to FSMA

With the exception of juice and seafood, all FDA-regulated facilities will be expected to have a HARPC system place in place. (For FDA-regulated processors, HARPC is a more preventive-controls form of HACCP). Most USDA-regulated facilities already have HACCP plans, and several references and guidebooks are available to help them develop and live by their plans. But having a plan is not enough. If FDA makes an unscheduled, surprise visit, processors must have the documentation to prove they are following GMPs, HACCP or HARPC. The documentation can be on paper or electronic, but it needs to exist.

“While food companies are already required to follow GMPs, and many voluntarily implement some form of HACCP, the breadth and scope of FSMA—and the documentation required to demonstrate appropriate implementation of the new regulations—will create the greatest challenges for food companies,” says David Acheson, president and CEO of The Acheson Group.

“The interpretation of the rule, once it is final, will be difficult,” says LeAnn Chuboff, Safe Quality Foods Institute (SQFI) senior technical director. “Although many suppliers have programs in place, identifying the preventative controls as outlined in the requirements may be problematic.”

“FDA preventive control requirements will go beyond traditional HACCP,” adds Acheson. FSMA will require food companies to think in a different way about risks, so some will need to reexamine and adjust their HACCP plans to make them HARPC plans. Additionally, companies must be able to justify their decisions and processes, something many would currently be unable to do since they lack the scientific resources. “Supplier control is more important than ever before, and this is an area where we often see a lack of formal programs or processes. It’s not only critical for brand protection, it will also become a regulatory requirement when a customer relies on a supplier to control significant hazards,” continues Acheson.

The up-in-the-air nature of the finalization of the proposed rules causes concern for many processors. According to James Cook, SGS Inc. food scientific and regulatory affairs manager, during his interactions and discussions with members of the industry, the following issues have been noted. For the produce industry, the major concerns include the water testing part of the regulations, the withdrawal of the manure application time frames and/or the decision by FDA not to adopt the National Organic Program’s (NOP) application time frames. On the other hand, the supplier verification program is the major concern for importers, manufacturers and others, specifically how to collect the required information, where the information can/will be found, what information is necessary and how much information is required. Members of the animal feed industry are concerned about the continued need to meet the cGMP requirements on the use of human food waste in animal feed despite FDA relaxing the requirements during the supplemental proposals.

“In addition, we still find some companies and industries without HACCP plans in place, as well as facilities that can’t follow basic cGMPs,” observes Cook. “In addition, some companies will need to evaluate their HACCP plans to make sure they are correct.”

Mike Edgett, Infor director of industry marketing, process manufacturing, believes most of the processors he has encountered are following the spirit of GMPs, though they may not have the adequate documentation to prove it. HARPC is another matter. “There are some differences between the hazard controls requirements in FSMA and what is expected in HACCP,” says Edgett. “If you understand the latter, the move to cover the additional requirements of HARPC is manageable, but since HACCP was an FDA requirement only for juice and seafood, this is a new endeavor for other segments.”

GMP guidelines are not instructions companies must follow, but a series of principles that must be fulfilled, says Joe Scioscia, Vormittag Associates, Inc. (VAI) vice president of marketing and sales. “It is up to each company to decide how the guidelines will be put into practice. But compliance with HACCP is defined as meeting all regulatory requirements, including monitoring, verification, recordkeeping, corrective action and reassessment.”

“Processors must ensure their documented food safety and security procedures are always in place and working,” states David Baker, director, consulting & technical services, NSF International, global food division. “To achieve this, food safety and security must be emphasized throughout the facility and designed into daily routines and the company culture.”

Documentation: A hurtle for some

“How food companies document programs and keep records are as varied as the food they produce,” says Acheson. However, some generalizations can be made. For instance, if a facility is certified to a GFSI-benchmarked scheme, it tends to have more complete documentation. However, the format can vary widely, from highly sophisticated and automated systems to those that are manual and rudimentary. “Technology is part of our everyday lives—personally and professionally—so it’s archaic to run a facility using the same ‘technology’ as it did decades ago,” adds Acheson. “Still, processors need to see an ROI to implement new technology.”

“Documentation in small and medium-sized operations, those the FDA calls very small and small, is always a problem,” says SGS’s Cook. Generally, database programs are too expensive for them to purchase, and the companies don’t have the expertise to develop their own programs. In these cases, paper files are still the norm. Cook notes that if a processor has a proper program in place with knowledgeable personnel, paper documentation can still work, but enough hours must be spent on keeping the information up to date.

“Although many companies initially started using paper for this process, most have found that electronic systems offer significant benefit in managing both the process and the automation of data collection and actions,” says Colin Thurston, project director, informatics business unit, Thermo Fisher Scientific. LIMS (laboratory information management systems), for example, are used to manage the scheduling of monitoring programs, measurement of potential hazards, reporting, statistical data analysis and automations of alerts. “All of these activities are possible using a paper system, but this does not typically offer the responsiveness or flexibility today’s food processor needs,” adds Thurston.

“Speaking as a former [food] plant manager, I would say keeping paper-based records current is one of the most difficult processes to ensure,” says Katie Moore, GE Intelligent Platforms global industry manager-manufacturing. “Inherently, there is nearly always a missing date, timestamp, signature or piece of data.” Moore notes a trend for processors to adopt software-based recordkeeping programs. A good place to start is with the data they may already have from their process control systems. When automatic data collection isn’t possible, portable devices can make it easier for operations personnel to enter data into the system.

“SQF-certified facilities are documenting and keeping records regarding their entire food safety system, including GMPs and HACCP, since this is a requirement in the code,” says SQFI’s Chuboff. “The SQF Code does not require this [information] to be monitored electronically or through any software program; however, electronic records are perfectly acceptable and allowed within the code requirements.”

But electronic records are not always the panacea one might expect them to be. According to VAI’s Scioscia, many processors that have made the move to electronic records are doing only the bare minimum for compliance and have done a poor job keeping their records updated.

“Most facilities I’ve seen have at minimum some form of warehouse management system [WMS] since this software allows product to be received, placed in storage, found and used within inventory limits,” says NSF’s Baker. A WMS or an associated type of ERP system allocates materials by lot number and quantity to production. The system also traces raw materials, packaging and processing aids by the finished product lot number through internal storage and to its final introduction into the supply chain. Incorporating handheld scanners and applying internal barcodes represent the second level of sophistication of a WMS/ERP implementation.

However, small to medium-sized companies do not commonly use sophisticated software to manage GMPs, SOP, SSOP, HACCP or other essential documentation, says Baker. Instead, these documents typically “live” on a shared drive with accessibility permissions to protect them from unauthorized changes. However, the proliferation and growing affordability of handheld technologies such as smartphones and tablets have made electronic recordkeeping a possibility for smaller processors, especially when they are coupled with pay-as-you-go cloud-based systems.

Training/tools to tie up the loose ends

Are GFSI-certified processors better prepared for FSMA? “I think so,” answers SQFI’s Chuboff, “partly because of their food safety systems which include documentation, traceability, internal audits, recordkeeping and annual reviews, as well as the GMP program and the validation and verification programs that are in place. This type of system is more proactive than reactive and evolves with the facility.”

GFSI-certified processors are usually better prepared to meet the requirements of FSMA, especially its inspection regime, says Thermo Fisher’s Thurston. “GFSI aims to standardize food safety practices across the globe using a third-party certification program—in a similar way to ISO 9000 certification programs.” Standardization is the operative word and a real benefit in multiple ways. “With a GFSI approach, multinational companies can implement a standardized process across international operations and monitor and measure it consistently,” offers Thurston. This, in turn, drives the standardization of tools such as LIMS, which can make the business more consistent, reducing the costs of operations.

“Companies with GFSI certification are better prepared to comply with FSMA because they have established a strong food safety system based on HACCP, the prerequisite programs and cGMPs,” says SGS’s Cook. They have already put into place training, root cause analysis, corrective actions and preventative actions programs. “However, this doesn’t mean their tasks are complete. For example, they may still need to implement programs to prevent intentional adulteration or manage sanitary transport specifications.”

Acheson points out that certain FSMA requirements extend beyond HACCP-based preventive controls to include sanitation preventive controls, supplier controls and allergen controls with requirements (including documentation) that exceed most of the GFSI-benchmarked schemes to date. FDA’s proposed rules on foreign supplier verification and food defense may also require facilities to reconsider the details of their programs.

Processors can use training to get up to speed on FSMA. But there’s a glitch: Standardized HARPC training is not yet available. However FDA is working with the Food Safety Preventive Controls Alliance to develop a curriculum that will satisfy FDA’s requirement to become a “Qualified Individual.” (See “FSMA HARPC Update,” FE, October 2014 for more on this subject.)

“But industry organizations, including the Grocery Manufacturers Association, offer online and onsite training as well as webinars on GMPs, HACCP, FSMA and other food-related topics,” says GE’s Moore. “GFSI schemes such as BRC and SQF also offer online and onsite training and certifications on the same topics.”

Consultants and GFSI scheme-holders (e.g., SQFI, BRC, FSSC 22000) offer training and courses to help processors meet and surpass FSMA requirements. For example, SQF has 30 licensed training centers, many of which hold FSMA preparedness training sessions. In addition, the SQF implementation training course is available at the training centers and online for processors seeking SQF certification.

Both SGS and NSF offer a broad array of training courses on cGMPs, HACCP and prerequisite programs, which are listed on their respective websites, sgs.com and nsf.org. “Training for GMPs, HACCP, HARPC, FSMA, etc. should be integrated with all the other training performed within the plant and operating community,” says NSF’s Baker. In-person presentations supported by video training aids are still the mainstay in many facilities, with sign-in sheets and written tests serving as the normal forms of recordkeeping.

“Training programs are available to help businesses develop cGMPs and HACCP plans and establish SQF, BRC, FSSC 22000 and other GFSI programs,” says Cook. The HARPC draft training curriculum outline was posted in October 2014 at www.iit.edu/ifsh/alliance/index.shtml, and the industry is developing training programs based on the curriculum outline.

Software tools to aid successful HACCP and FSMA outcomes

When considering software to aid in regulatory compliance, as well as improve its overall food safety and quality systems, an FDA-regulated facility should look for these attributes: easy to use and customize, and the ability to interface with existing systems, pull up data for an audit or inspection, give warnings and alerts if processes are trending out of control, etc., says Acheson. Several systems are commercially available, some of which manage big data to help minimize brand risk and promote the drive toward GFSI and federal regulatory compliance.

“Our view is that all the various software systems a food processor uses actually make the GMP/HACCP/HARPC system a whole, and by integrating the data across the manufacturing process, the processor gains business efficiency. This also engenders the traceability required to meet the needs of an FSMA audit,” says Thermo Fisher’s Thurston.

SGS has programs that place audit data into a system that can be searched for specific parameters and generate reports. “We also have systems that allow testing reports to be viewed and interrogated to generate specific trends and information,” says SGS’s Cook. “There are also results and trends analyses for environmental testing.”

Product lifecycle management (PLM) software programs track products from inception to recipe to manufacture, including all ingredient inputs to a product, and can form the basis for a track-and-trace system. They also provide secure access and have good reporting, alerting and trending capabilities, says Cook. Other, more web-based, systems are lower in cost but may be less intuitive and require more hands-on operation. Whatever software is used, however, must comply with 21 CFR 11 electronic recordkeeping and signatures regulations.

“No matter what system is in place, the operation must have personnel who understand the meaning of the documentation and the programs in place to control the issues, as well as how to perform root cause analysis, develop corrective actions and preventive controls and perform continuous improvement of the systems,” Cook continues. “We have systems that allow our customers to monitor product testing, sampling and inspection plus audit their facilities. If a customer already has a system in place, or chooses a third-party product, we will work with the preferred system.”

“Fundamentally, software isn’t a requirement for getting through an audit, although it will make the experience much faster and easier,” says GE’s Moore. It will also make it simpler to prove a policy or program is being validated. In addition, GE software provides the capabilities for track and trace, HACCP program monitoring, validation and documentation, control point monitoring and validation, specification management, finished product reports and documentation of prerequisite programs, adds Moore.

“Track-and-trace capabilities have been a component of our ERP solution for food manufacturers for years,” says Infor’s Edgett. “It should be considered a core requirement for anyone looking at an ERP system. You need to be able to track both forward to your finished goods and backward to individual lots so you can isolate all potential problems.” Equally important, however, is that only suspect products should be isolated, not all products made over a period of time. This helps minimize the cost of a recall or potential lost sales due to an out-of-stock situation.

With track and trace in place, best practices for lot control tracking come down to three key areas: RF barcoding, RF scanning and producing labels, says VAI’s Scioscia. Lot tracking can be done at a license plate, bin or individual box or case level. The license plate method is typically the easiest and most efficient approach to follow. When a food supplier receives a pallet of goods, it produces a pallet license plate with all the lot information already on it including the shelf, expiration and production dates. The food supplier scans every box that leaves its manufacturing floor.

Another highly useful tool that extends beyond track and trace is supply chain management (SCM). NSF International, for example, offers the Aspirago SCM system, which can be installed at a facility or implemented as a cloud-based software solution. Built by food safety experts, the system helps retailers, manufacturers, standards organizations and audit companies effectively manage product quality and food safety by providing secure, collaborative web-based software that aggregates and analyzes their third-party auditing and testing data.

According to NSF’s Baker, this system includes multiple audit schemes and requirements consistent with GFSI-benchmarked food safety standards, as well as customized retailer-specific audits. The system also ensures the processor’s data is secure within its firewall. NSF’s software has a complete suite of on-board tools to manage audit and corrective actions, complaints, scheduled tasks and escalating communication workflows. Plus, it provides dashboards and reports that can be easily interrogated to generate business intelligence.

Process control/quality software offer input to FSMA

Most process control software and/or shop floor programs have been developed to demonstrate quality control/assurance and management as part of the big picture, says SGS’s Cook. These programs easily translate into what FDA inspectors request. For example, the software that monitors a pasteurization temperature also readily supplies data to FDA on the critical control point during an investigation. With in-process monitoring software controls, it is just a matter of making sure the upper and lower control limits are in place, and the programs are set to take action when these limits are violated. All this documented data can be used to show root cause analysis and corrective and preventive actions, according to Cook.

“The use of statistical process control [SPC] is a proven method to demonstrate process stability and capability,” says NSF’s Baker. A stable process has normal variation around the target value. As controllable sources of variation are either removed or minimized, the process becomes increasingly capable, and the range of normal distribution around the target value becomes smaller. SPC can be applied to many processes to demonstrate control and process improvement, but most importantly, it demonstrates some degree of abnormal results can be detected and addressed before there is any loss of process control.

It is crucially important to have SPC data on record, and it needs to be coordinated and integrated with data from other sources such as LIMS, PLM and SCM. “Adopting a shop floor to top floor approach to food safety, quality and overall operational excellence enables manufacturers to support their business processes across organizational and systematic boundaries and is critical to drive supply chain excellence,” says GE’s Moore. “Having a single source of truth provides visibility to critical process and manufacturing data and enables the right people to make the right decisions in real time.”

The importance of document management

Since 1926, GNP Company has focused on providing quality chicken products to its foodservice, retail and deli customers. One continuous improvement the company has implemented is a new and improved document management system. In recent years, as the need for third-party safety audits like SQF 2000 Level II has increased, so has the need for effective systems to manage the paperwork and document checks associated with the audits.

“If you’re involved in an audit,” says Ann Voigt, GNP food safety systems manager, “you understand the struggle to keep all of your paperwork in the proper shape. Implementing our document management system required an all-out commitment and was hard work, but it has been worth it.”

“The question was: How do we want to manage our documents?” recalls Jill Stuber, quality assurance manager, who estimates nearly half her time is spent on continuous improvement. “When we saw Qualtrax [document management software], there was a collective ‘Why aren’t we using this?’ from the team in the room.”

Since implemented, the Qualtrax software has provided:

Consistency in document types, formats and content
Traceability of document history and approvals
A single storage location
The ability to move documents for approvals, notifications and access
The ability for process owners to be responsible for documents related to their processes.

“As more people use the system in their daily tasks, we learn more about how to improve our process,” says Voigt. For example, when the approval process was taking too long, the issue wasn’t the software; it was because every manager involved in a process wanted to sign off on it. Many of them simply wanted the exposure, so they could better understand the system. In effect, the approval process became a substitute for training.

“Managers are still learning the procedures,” says Voigt, “but they are experiencing tangible benefits because it takes them less time to find what they need when an audit comes around.”

“Document management may not seem very exciting, but it helps us find and capitalize on efficiencies, fast,” adds Stuber.

For more information: Qualtrax, 800-755-1875, Ext. 6, sales@qualtrax.com, www.qualtrax.com.

References:

Guidebook For The Preparation Of HACCP Plans, USDA, April 1997, www.haccpalliance.org/sub/haccpmodels/guidebook.pdf.

Hazard Analysis and Preventive Controls for Human Food (Draft Training Curriculum Outline), Food Safety Preventive Controls Alliance, http://www.iit.edu/ifsh/alliance/index.shtml.

Current Good Manufacturing Practice in Manufacturing, Packing or Holding Human Food, 21CFR Part 110, FDA, HHS, Federal Register, www.gpo.gov/fdsys/pkg/CFR-2001-title21-vol2/pdf/CFR-2001-title21-vol2-part110.pdf.