FSMA: Ignorance of the law is no excuse

Most of the FDA FSMA rules have been final since the last calendar year, but recently, the FDA has released some additional guidance and provided a few compliance date extensions and clarifications for four of the Final Rules. Here, we’ll look at some of the recent updates, and we’ll look at some training options available to get FDA-based processors ready for compliance.

Keep in mind that your best bet to keep up to date on FSMA is by checking out the FDA FSMA site. Consultants and training organizations also offer expert advice and educational services on FSMA, and chances are, you may be already using them for GFSI training and accreditation. If you already have GFSI certification, you’ll find that you’ve already done many of the steps you’ll need for FSMA compliance.

FDA’s FSMA, created in 2011, provides rules for food and beverage processors of all sizes, but does not cover USDA-regulated facilities or some areas such as seafood HACCP, juice HACCP and alcoholic beverages. A recently updated calendar of compliance dates by business size, provided by The Acheson Group (TAG), can be found below.

A quick timeline review of the seven foundational rules (as found in the Federal Register) follows:

Preventive Controls for Human Food (PCHF): Original rule proposed Jan. 2013; supplemental rule proposed Sept. 2014; Final Rule issued Sept. 10, 2015; compliance dates for some businesses began in September 2016.
Preventive Controls for Animal Food (PCAF): Original rule proposed Oct. 2013; supplemental rule proposed Sept. 2014; Final Rule issued Sept. 10, 2015; compliance dates for some businesses began in September 2016.
Produce Safety: Original rule, Oct. 2013; supplemental rule, Sept. 2014; Final Rule issued Nov. 13, 2015; compliance dates for some farms began in 2016, however, there are many changes—see compliance dates.
Foreign Supplier Verification Program (FSVP): Original rule, Jul. 2013; supplemental rule, Sept. 2014; Final Rule issued Nov. 13, 2015.
Third-Party Certification: Proposed Jul. 2013; Final Rule issued Nov. 13, 2015.
Sanitary Transportation: Proposed Jan. 2014; Final Rule issued Apr. 5, 2016.
Intentional Adulteration: For both domestic and foreign facilities, proposed Dec. 2013; Final Rule deadline, May 31, 2016; Final Rule published May 27, 2016 (effective Jul. 26, 2016).

Preventive controls

On Sept. 19, 2016 larger businesses had to comply with certain new standards under the preventive controls rules for human and animal food, according to Stephen Ostroff, FDA deputy commissioner for foods and veterinary medicine. The main purpose of these two rules is to drive down the incidence of foodborne illness in the US. Larger human food facilities must meet preventive controls and modernized current Good Manufacturing Practice (cGMP) requirements; larger animal food facilities must meet cGMPs. The human and animal food rules have staggered compliance dates; animal food businesses have additional time to meet the preventive control standards—as do smaller producers of human foods, says Ostroff.

On Oct. 28, 2016, FDA released a draft guidance for industry, “Describing a Hazard That Needs Control in Documents Accompanying the Food, as Required by Four Rules Implementing FSMA.” Being distributed for comment purposes, the document seeks to clarify certain provisions in cGMP and risk-based preventive controls for human and animal food, produce safety and the foreign supplier verification programs. When finalized, the draft guidance will represent the current thinking of FDA on this topic. This particular document covers biological documents that can be transmitted through the supply chain and at what point downstream a biological hazard is controlled before reaching the consumer level. The document assumes chemical and physical hazards are usually controlled by the first manufacturer and are not passed along the supply chain.

To clear up some of the confusion for small and very small processors, FDA released two documents to assist in the implementation of preventive controls for human food and animal food. FDA describes small businesses as having fewer than 500 full-time employees, and these types of companies must comply with the human and animal food rules by September 2017. Very small businesses, which average less than $1 million per year in human food sales or less than $2.5 million in animal food sales, must come into compliance by September 2018.

Because they require a different way of thinking than HACCP, FSMA’s preventive control rules have been the major area of preparation for most food and beverage processors. So much so, that FDA’s Technical Assistance Network (TAN) revealed as of October 1, 2016 (as these rules became effective for large and smaller establishments) that combined, the two rules made up more than half of the total inquiries for technical assistance (1,518) that FDA received via email, phone, mail and FDA’s TAN website, a total of 2,876.

“Most large processors have been very proactive in getting ready for FSMA compliance,” says David Acheson, CEO and president of The Acheson Group (TAG). “Some are building on existing procedures and processes by enhancing the programs, while others are rethinking the entire food safety program including organizational perspectives. One of the recurring challenges for companies is whether they need to be compliant with the FSVP as well as the PC rule. Usually, the answer is not, but TAG can help them figure that out.”

Small manufacturers often have much less in-house expertise, so they may be in more need of help from groups like TAG. However, it is important for processors to remember that FSMA extends beyond just controlling risks at home.

“With FSMA’s focus on proactive, risk-based prevention, food processors are responsible for taking the steps necessary to ensure that they’ve identified and controlled hazards—throughout the supply chain—that could make foods unsafe,” says Patrick Pimentel, NSF International manager, consulting & technical services. “Processors are required to know their ingredient suppliers and understand the risks associated with them. Specifically, HACCP/preventive controls, product traceability, second- and third-party supplier audits and corrective actions, and product recalls are issues that our clients are wrestling with. Not all processors are currently well suited to manage this [they may not have enough people] or have current systems in place [need to add processes] to ensure supply chain conformance.”

Pimentel lists some of the most important issues that processors will face:

The “how to” of what to do next in order to leverage their GFSI certification programs and food safety management system (FSMS) to facilitate compliance with the regulations. Many processors have GFSI certification, but are not clear if this will be enough to meet FSMA compliance.
Environmental monitoring and onsite inspection sampling by FDA investigators and inspectors.
Implementing the requirements of FSMA, meeting training timelines that coincide with compliance dates and having the necessary resources to be successful.
Documentation, records and how to manage and improve the systems they may already have regarding documentation.

Food processors will find that not only will preventive controls require new thinking, they must keep records.

“FSMA was created to address important prevention issues versus a reactive response,” says Mike Edgett, Infor director of industry marketing, process manufacturing. “The underlying challenge for many companies is to better document preventive processes and identify areas for improvement.”

Having a system for the thorough, ongoing documentation needed is a crucial part of FSMA. In an FDA-conducted interview, Joann Givens, the co-chair of the FSMA Operations Team Steering Committee and director of FDA’s Food and Feed Program in the Office of Regulatory Affairs, says the better the records a company has means the better it will be able to demonstrate it is meeting the legal standard.

“Put processes and procedures in place to prevent problems in the first place and consider having some redundancy in the system, so that if one measure fails, another can take its place,” she says.

“The most important issue that food and beverage processors face with ensuring compliance is managing the available company and external resources to understand and fully implement the program and training,” adds Acheson. “If it’s not documented, it hasn’t been done.”

To be in FSMA compliance, there are a few major factors, says Jill Bender, vice president of marketing for SafetyChain Software, which include, “identifying risks, identifying preventive controls to control those risks, implementing those controls, monitoring they are working and keeping documentation to prove compliance.”

One solution to documenting and maintaining food safety is to use a food safety/quality management program like SafetyChain, which not only manages documents but also ensures that a food processor’s food safety/food quality programs are being executed as planned, every day. More important, data and records are actionable.

Which rules for me?

There’s been some confusion as to what rules need to be followed. Facilities have been trying to figure out the actual requirements of the law and how they apply to them, says Hank Karayan, global FSMA program director, SGS Agriculture, Food and Life. Some of them are busy determining if they are even covered by the law or if they need to be worried about compliance if they already hold GFSI certification. Knowing exactly which rules apply to an organization is important, but don’t forget about the bigger picture.

“There has to be a holistic approach taken with FSMA compliance, ensuring that all moving parts are taken into consideration,” he says. “Further, once a company has developed the appropriate program, such as a food safety plan [FSP], it then has to develop a process to maintain that program. FDA is expecting food companies not just to write a FSP, but also maintain it and show FDA that they are operating under the FSP each and every day.”

The first year of compliance affects larger processors—typically those with more than 500 employees.

“Many businesses of that size already have a HACCP program,” says Givens. “We don’t expect them to need to make many changes to come into compliance. Aspects of the GMP and preventive controls rules are similar to HACCP. The human and animal food rules have staggered compliance dates; smaller businesses have a year or more additional time to comply.”

But just because Givens’ comments sound like an easy transition from HACCP to HARPC (preventive controls), processors shouldn’t get complacent, warned Acheson in an Oct. 2016 FSMA Friday, sponsored by SafetyChain Software.

“I think we all recognize that there are many aspects of FSMA compliance that go beyond HACCP. That almost sends a mixed message, ‘Well, if you’ve got a HACCP plan, you’re fine.’ Well, you have to plan, control and talk about risks that go beyond HACCP. Many HACCP plans don’t. If you aren’t talking about some of those risks, you’ll get dinged,” Acheson says. “So, we’re hearing two messages from FDA. They are trying to train and educate internally as well as externally, but I think they will also begin to press the enforcement buttons as we go forward.”

To help facilities get started with FSMA, SGS has developed complimentary online solutions to answer the following two basic questions: Does the rule apply to me, and do I still need to comply if I’m already certified by GFSI? To help answer these, a simple yes/no online questionnaire is available at www.sgs.com/fsmacheck, and companies can decide for themselves how close they are to FSMA compliance and what the gaps are.

“So far, FDA has not said that it will accept just GFSI,” says Acheson. “Food safety management schemes that are recognized by GFSI are just one part of the puzzle, and these bring the processors up to a good starting point in meeting minimum food safety requirements. However, the scope and level attained by the processor are also the key elements in addressing how ready the processors are for FSMA. TAG has undertaken a comparison between FSMA preventive control rules and several of the GFSI schemes. If a company is GFSI certified, [it] will have many of the basic programs needed for FSMA preventive controls rule compliance. However, it will likely have to present the information in a different way for FDA.”

NSF International is a leading global certifier to GFSI-benchmarked standards. The organization considers GFSI certification to be a solid building block and strong indicator of FSMA readiness, but that no GFSI standard or scheme is better than another.

“Processors who have GFSI certifications already have a food safety management system [FSMS] in place, so there should be less FSMA implementation time based on addressing the gaps between their GFSI scheme and the preventive controls rule,” says NSF’s Pimentel. “Most GFSI schemes have put optional FSMA readiness checklists or addendums in place to give their certified sites another tool to help facilitate compliance.”

Training for preventive controls and beyond

FSMA requires every processing facility to have a trained resource person or preventive controls qualified individual (PCQI) who has completed a specialized training course developed by the Food Safety Preventive Controls Alliance (FSPCA), which is recognized by FDA. This person, who does not have to be a direct employee of a food processor, will oversee the implementation of the facility’s food safety plan and other key tasks.

“The most urgent training need would be the preventive controls qualified individual course that would help facilities understand the requirements of the PCHF rule and the way it applies to the facility,” says SGI’s Karayan. “At the same time, this formal course curriculum ensures compliance with the site-specific PCQI requirement of the regulation.”

FSPCA provides training for Preventive Controls for Human Food, Preventive Controls for Animal Food, Foreign Supplier Verification Programs (FSVP) and Intentional Adulteration. FSPCA also provides the FSPCA Technical Assistance Network and is part of FDA’s FSMA Technical Assistance Network. While FSPCA offers course material for end users (food processors), it also offers courses for training trainers.

“SGS offers a variety of FSMA training courses to educate and qualify personnel at all levels of the food facility,” says Karayan. SGS has been a pioneer in offering FSPCA PCQI training courses onsite and in virtual (online) formats. The virtual PCQI class minimizes business disruption and maximizes employees’ time.

NSF International was in the vanguard of companies accredited to deliver the FSPCA-approved curricula for “Preventive Controls Qualified Individual” and “PCQI Train the Trainer” courses. To date, NSF has 12 lead instructors for this program, which is currently being delivered across North America and Mexico—and soon to launch in Germany, says Pimentel.

The latest report (October 17, 2016) from FSPCA shows that it has issued 17,984 FSPCA Preventive Controls/Human Food certificates domestically and 4,134 internationally. The course for animal food has yielded 1,134 certificates domestically and 28 internationally. As the timeline on page 86 shows, course implementation for animal food lags human food, as compliance for animal food has been delayed slightly compared to human food.

Recent updates, not preventive controls

On Nov. 7, the FDA made available a draft guidance for industry entitled “Questions and Answers Regarding Food Facility Registration (Seventh Edition).” The document contains 15 sections of a multi-section guidance intended to provide updated information and answer frequently asked questions about FDA registration requirements. The seventh edition adds information regarding amendments to the registration of food facilities final rule released in July 2016 and answers questions received after publication of the sixth edition.

On Nov. 10, the FDA announced a final guidance for a voluntary, fee-based program to allow the expedited review and importation of foods into the US from importers (Voluntary Qualified Importer Program or VQIP) with a proven track record of food safety and security. The final guidance, in Q&A format, explains how this program works. Importers should meet several criteria to participate in the program. These include:

Developing and implementing a quality assurance plan
Assurance of compliance with the supplier verification and other importer responsibilities
Current facility certification issued under FDA’s Accredited Third-Party Certification regulations
Three-year minimum history of importing food to the US
No ongoing FDA administrative or judicial action
Having a Dun & Bradstreet Data Universal Numbering System (DUNS).

In terms of a timeline, the program began in Oct. 2016 and runs through Sept. 2017. Those interested need to submit the necessary form between January and May.