The enactment of the Preventive Controls for Human Food regulation (21 CFT Part 117) has profoundly affected the food processing industry in the United States and throughout the world.

The regulation is one of many enacted to allow enforcement of the Food Safety Modernization Act of 2010. It basically mandates that all food processors regulated by the United States Food and Drug Administration develop, document, implement and maintain a HACCP-based food safety management system that incorporates risk assessment into the decision-making process for determining potential hazards.

The regulation provides some waivers, especially for small processors. However, even if the small businesses have a waiver, it will be interesting to see what the market tells them. Their customers may well tell them, “I couldn’t care less about the waiver, and if you wish to sell your products to us, we expect to see a well-documented food safety management system.” In fact, market demand has long driven HACCP development and implementation. Buyers demanded that their customers have the program in place, and the industry responded. In fact, the Global Food Safety Initiative (GFSI) audit schemes and the ISO 22000 standard were developed to meet this demand.

There are many who feel that the preventive controls regulation and the others enacted to ensure enforcement are new and different. Others feel that the program is not much different than traditional HACCP, which has evolved over the years to much more than what may be found in the seafood or juice HACCP regulations. In addition, the ISO 22000 standard and the GFSI audit schemes have included elements that have been incorporated into the preventive controls regulation. These include the following elements, to name a few:

• Conducting risk assessments incorporating severity of occurrence and likelihood of occurrence
• Sanitation and allergen preventive controls that are similar to the operational prerequisite programs (oPRPs) in the ISO 22000 standard
• GFSI audit schemes that mandate vendor quality programs

But the real point of the matter is that the expectations in the regulation are more demanding than what was included in the juice and seafood HACCP regulations and include elements not normally included in past agency investigations. These elements include:

1. Validation of process controls
2. Risk assessments of foods, ingredients, packaging and the process itself
3. Supplier verification
4. Allergen management
5. Environmental monitoring
6. The role of the PCQI

So, what are processors to expect when the FDA knocks on their front door? Food safety and quality experts have long recommended that food, beverage and ingredient processors develop, document and implement procedures as to what to do when that knock comes. Current procedures will need to be tweaked in some way, shape or form.

The knock on the door

When the agency does come to a company, the initial part of the visit should be the same. The consumer safety officers or investigators will identify themselves and why they have come to the plant. The processor should always anticipate such a visit, as the agency has the right to visit any facility under its jurisdiction at any time the facility is operating. Therefore, companies should develop protocols for administrative staff who greet visitors on what to do when an FDA stop occurs and make sure that these individuals understand the process. The staff members must notify the appropriate persons who will work with the FDA during the visit. One change to past protocols is that the investigators may be working in teams as the agency begins conducting FSMA-based inspections. This is being done as part of its in-house training program. In addition, the investigation may take more than one day.

The goal of the agency is to have all its CSOs trained to do full preventive controls inspections, which will take time. In the interim, the agency is taking the following approach:

All investigative staff members have been trained to do what are called GMP/Limited Scope PC inspections. These inspections will cover all facilities that are subject to regulation with a PC inspection. The investigative staff is trained to assess the modified GMP requirements and perform a broad-based inspection of process, allergen and sanitation controls (as necessary). If the CSO finds egregious conditions, he or she reports them, and a full preventive controls inspection by trained staff will be conducted. In this way, the agency is covering the requirements of the rule for all facilities subject to the rule and protecting public health by assessing the programs and calling for a full PC inspection when necessary.

The ultimate goal is to educate while regulating and base decisions on whether to write the observation on form FD-483 based on the significance of the finding. If the observation is significant (affects public health), it will go on the 483. If it is not, it is a discussion item. Discussion items will be captured in the system and, if not corrected (repeat violation) on next inspection, it will likely go on the 483.

Validation of preventive controls

The Preventive Controls for Human Food regulation mandates that all process preventive controls be validated. Validation means obtaining and evaluating scientific and technical evidence that a control measure, combination of control measures or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards. This can be a challenge in that, although the basic principles for validation apply to the wide range of process systems utilized throughout the food processing industry, the methodologies and procedures needed to properly validate different systems are extremely complex.

According to Dr. Aurora Saulo, a food science professor at the University of Hawaii who specializes in food safety, the most realistic option for the investigators will be basic training in validation principles and ensuring that the field people have access to persons or groups within or external to the FDA other than those involved with enforcement. For example, the recent work conducted through the American Institute of Baking on validating different baking technologies would be an excellent reference for the agency and persons in the field. On the subject of baking, it is very likely that certain bakery items might end up utilizing a combination of preventive controls, that is, process and supplier. What has been shown is that in products such as cookies, cakes or brownies with large inclusions such as nuts, chocolate chips or large seeds, the inclusions simply do not heat as quickly as the batter portion of the product. So, the end result might be a validated baking process along with a supplier control that says the inclusion, whatever it may be, is pathogen-free.

The investigators will definitely ask processors for their validation data, which must include the person or persons who developed the data (process authorities), the Preventive Controls Qualified Individual (PCQI) under whose supervision the information was developed, critical limits for operation and the technical references that support the final process parameters. If challenge studies were conducted to develop the validation data, that will be part of the review. And, as alluded to earlier, the validation data and methods of validation must be appropriate for the processing system.

Risk assessments

The regulation mandates that food processors conduct a risk assessment on all ingredients, raw materials, packaging, processes and the products they are manufacturing. The assessment must incorporate the severity of occurrence versus the likelihood of occurrence. Processors can utilize an expanded Hazard Analysis Worksheet that incudes these elements. Another consideration in evaluating risk is to utilize the FDA’s Hazard Analysis and Risk-Based Preventive Controls for Human Food: Draft Guidance for Industry (2018). This draft document, especially Appendix A, summarizes the agency’s thinking on biological, chemical and process concerns associated with a wide range of products. This draft document can be used by processors in their own risk assessments and will be referenced by Consumer Safety Officers during their inspections. If a company’s risk assessment differs from what is found in Appendix A, the processor will probably be asked to explain why.

Investigators will look at risk assessments conducted by the company, especially since the risk assessments will affect how so many of the different elements making up the food safety management system will be developed and documented. Food safety professionals strongly suggest that processors maintain written records of their HACCP team’s discussions when conducting risk assessments and determining preventive controls. The Hazard Analysis Worksheet is a great tool, but what is inserted in the table is usually only a summary of what was discussed by the team, and there is obviously no room to insert supporting references from the technical literature. Ideally, processors should include supporting documentation and the references that provided the road map for how decisions were made.

Supplier verification

Supplier verification has been an integral element of food safety management systems in the food processing industry for many years. The Preventive Controls for Human Food regulation mandates this program, especially for foreign suppliers. Supplier verification is especially important if there is no “kill step” in the process utilizing the ingredient or raw material in question. The risk assessment on ingredients and raw materials will be incorporated into this element of the food safety program.

When looking at a processor’s supplier verification or foreign supplier verification program, the investigators will focus on documented procedures and how they have been followed. The Consumer Safety Officers will base their assessment on the regulation. They will also look at the files for individual suppliers to determine whether the necessary documentation exists for each supplier and each imported food.

Allergen management

Given the large number of allergen recalls, it is not surprising that allergen management is a significant element in the Preventive Controls regulation. As may be seen from the data compiled by FARRP (Food Allergen Research and Resource Program at the University of Nebraska), allergen recalls have trended upward over the years. The big question posed by this data is, “Is the industry out of control, or are the number of recalls an indication of industry awareness?’’ But the bottom line is that food processors need to develop, implement and maintain programs to manage allergens, which must include sanitation preventive controls if allergens are among the ingredients being used. The regulation does not mandate that allergen cleanups be validated, but it is a best practice.

But how is the agency currently handling allergens and allergen management during investigations? When Dr. Steven Taylor of FARRP was asked whether his group had heard anything from its membership as to how FDA is handling allergen and sanitation preventive controls, his response was, “We have not heard much and believe FDA is doing little. We have polled our members, and no one has encountered much from FDA on allergens.”

The agency is in the process of drafting guidance documents for allergen management. Chapter 19 of the 4th Edition of the Fish and Fishery Products Hazards and Control Guidance (2011) addresses allergen management, which may be used by the industry and investigators as a yardstick for what is expected. This chapter is, however, also being revised. The keys for processors are twofold:

1. Prevent cross-contact during process operations from receiving to shipping
2. Properly label finished products so consumers know whether a product contains allergens

There are companies that have treated allergen labeling as a critical control point (or process preventive control) or as a preventive control (operational Prerequisite Program under ISO 22000 or FSSC 22000). To minimize the potential that the wrong label may be used, some operations utilize barcode scanners downstream of the labeling or packing operations. Others, especially canners that brite stack products, have even resorted to multiple scanners, one scanning the label and the second, the code on the container.

Environmental monitoring

Part 117.130 (c) ii states, “The hazard evaluation required by paragraph (c)(1)(i) of this section must include an evaluation of environmental pathogens whenever a ready-to-eat food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen.” If a processor believes that its product would be lethal to an environmental pathogen, it should conduct challenge studies to determine if this is indeed the case. If the product is lethal, then environmental monitoring would be unnecessary, and the cost of the study would pay for itself over the years. Regulators would want to examine this study as part of their investigation.

If the risk assessment indicates that environmental pathogens are a concern, the processor must develop, document and implement an environmental monitoring program. The pathogens deemed to be significant when it comes to environmental monitoring are Listeria monocytogenes for ready-to-eat (RTE) products, such as filled pasta, cheeses and pre-cut fruits and vegetables, and Salmonella for products such as nuts, cereals and baked foods. The environmental monitoring program (EMP) should address all four zones (see Page 55) and include documented procedures on how the processor will address positive or presumptive positive results. However, the regulation does not require that all four zones be sampled. Zone 2 is the target in the regulation. For most processors, the finding of a presumptive positive for an environmental pathogen will trigger the same reaction as a positive result. One element of the program should be a statement that product will be held until the environmental monitoring test results are completed and found to be negative.

In all likelihood, FDA investigators will examine the environmental monitoring program in great detail and focus specifically on the company’s response(s) to positive or presumptive positive test results.

Role of the PCQI

The investigators will want to work closely with the PCQI (Preventive Control Qualified Individual). They will expect to see the person’s certificate indicating that he or she has had the appropriate training or that the individual’s resume supports his or her knowledge, education and experience. If the company is a multiple-shift operation, there may well be more than one PCQI at the facility. The agency has trained its CSOs and state inspectors to ask questions to assess the qualifications and competency of Qualified Individuals (QIs) and PCQIs. At this moment, citing a firm for not having a PCQI is probably a low priority. However, if there are lots of things wrong, it may be an add-on violation. The agency won’t base its decision on whether the employee has a certificate, as the certificate does not indicate if the individual can apply what he or she learned.

One of the challenges for the PCQI is the workload: developing and managing the food safety plan, validating preventive controls, reviewing monitoring records and reviewing corrective action records. What the PCQI needs to understand is that others can do the work under his or her supervision. If a company adopts a delegation of responsibilities, there should be documented procedures on how records should be reviewed and records that the designated persons have been trained on those procedures by the PCQI. The agency investigators will also check to determine that records have been reviewed within the time frames defined in the regulation; that is, seven working days. This is usually not an issue with monitoring results, but could be an issue with corrective action records, especially if the operation in question has experienced very few deviations. The regulation does allow the period for corrective action record review to be expanded, but only with approval. So, if a company wishes to expand the time frame to review corrective action records, it would be best to get an approval first.

How will the investigation go?

So, what will happen when there are full FSMA-based investigations by FDA?  We are still waiting to see how these will fully shake out. But processors can expect a team of persons to come to their plant during the rollout period for FSMA-based inspections, and it is very likely that the team will remain onsite for more than one day. The Consumer Safety Officers will go through the processing facility to see what is being done, and they will likely question management and persons working on the floor, especially those responsible for monitoring preventive controls. Their questions will focus on how these people do the work and why it is important. And, remember, the inspection may be a team effort as part of training.

As in past inspections, the Consumer Safety Officers will look for issues related to good manufacturing practices, but there will be a much greater emphasis on procedures and records. It will be much more of a desk audit than in the past. In fact, in speaking with processors that have already experienced an FSMA-based investigation, the company representatives were unanimous in emphasizing that the company’s commitment to adopting one of the Global Food Safety Initiative (GFSI) audit schemes or seeking ISO 22000 certification helped them significantly in both preparing for the audit and working with the investigators. As alluded to earlier, these programs are comprehensive and include many of the elements making up the Preventive Controls regulation. In some cases, the audits schemes and ISO 22000 ask for more than what the regulations require, so processors may have programs that are operating at a slightly higher level.

Another of the responses from the companies that have experienced these audits is that there was a great deal of discussion. The agency investigators asked pointed questions related to the whys and wherefores of the company’s food safety program. They expected the company’s food safety staff to be able to explain their programs and how they came to develop them. The company officials also stated that investigators were polite and fair in their dealings with them. And again, they cited that their GFSI audits provided immeasurable assistance during the FDA visit. The bottom line is that there will be changes and that these changes will not come as quickly as some hope, but the end results will be a more comprehensive investigation by the agency.

The food processing industry, handlers and retailers themselves deserve some kudos. They have driven the mandates that their suppliers be subject to third-party audits, which has moved food safety forward. Industry requirements that are more stringent than what FSMA requires will not go away.