FDA Food Safety Modernization Act

History of FDA Food Safety Modernization Act

The U.S. Congress passed updated food safety laws in 2010 to ensure the U.S. Food Supply was safe by shifting the focus of Federal Regulators from responding to contamination to preventing it. The Food Safety Modernization Act was signed into law by President Obama in 2011. The FSMA gives the FDA the authority to better protect public health by strengthening the food safety and security system of the U.S.

The Hazard Analysis and Risk-based Preventive Control or HARPC method was incorporated into the FSMA in 2012 and it applies to almost all U.S. food processing facilities. Soon after, the FDA published a proposed rule entitled “Current Good Manufacturing Practice (cGMP) and Hazard Analysis and Risk-based Preventive Control (HARPC) for Human Food”.

FDA Authority Under the FSMA

Under the FSMA, the FDA has a legislative mandate to require comprehensive, science-based preventive controls across the food supply chain. This mandate includes mandatory preventive controls for food facilities, mandatory produce safety standards, and authority to prevent intentional contamination.

The scope of FDA Authority includes:

• Responsibility for establishing science-based minimum standards for the safe production and harvesting of fruits and vegetables. These standards must consider naturally occurring hazards, as well as those that may be introduced either accidentally or intentionally, and must address soil amendments (materials added to the soil such as compost), hygiene, packaging, temperature controls, animals in the growing area, and water;
• Issuing regulations to protect against the intentional adulteration of food, including the establishment of science-based mitigation strategies to prepare and protect the food supply chain at specific vulnerable points;
• Provision of oversight, ensuring compliance with requirements, and the ability to respond effectively when problems emerge. The FSMA provides FDA with important new tools for inspection and compliance including mandated inspection frequency, record access, and testing of accredited laboratories;
• Facilitation of a risk-based inspection frequency for food facilities. The law directs FDA to inspect an increasing number of foreign facilities on an ongoing basis;
• Specification for certain food testing to be carried out by accredited laboratories and the establishment of laboratory accreditation programs to ensure that U.S. food testing laboratories meet high-quality standards;
• Mandates for tools to respond effectively when problems emerge, including mandatory food recall authority, expanded administration detention, suspension of registration, enhanced product traceability, and additional recordkeeping for high-risk foods. The FDA has the authority to issue a mandatory recall when a company fails to voluntarily recall unsafe food after being requested to do so by the FDA;
• Power to facilitate the administrative detention of food products that are potentially in violation of the law. Administrative detention is the procedure FDA uses to keep suspect food from being moved;
• Suspension of the registration of a food facility if it determines that the food poses a reasonable probability of serious adverse health consequences or death. A facility under suspension is prohibited from distributing food;
• Establishment of systems that will enhance the FDA’s ability to track and trace both domestic and imported foods. The FDA will also establish pilot projects to explore and evaluate methods to rapidly and effectively identify recipients of food to prevent or control a foodborne illness outbreak;
• Under the FSMA, the FDA has unprecedented authority to better ensure imported products meet U.S. standards and are safe for U.S. consumers. The FDA will ensure importer accountability. Food Importers have a specific responsibility to verify that their foreign suppliers have adequate preventive controls in place to ensure that the food they produce is safe;
• Establishment of a program through which qualified third parties can certify that foreign food facilities comply with U.S. food safety standards.

This certification may be used to facilitate the entry of imports, including special requirements for imported High-Risk Foods;

• Authority to refuse entry into the U.S. any food from a foreign facility if the FDA is denied access by the facility or the country in which the facility is located;
• The law allows the FDA to enter into interagency agreements to leverage resources for the inspection of food facilities, both domestic and foreign, as well as food imports.

Key Requirements of the FDA Food Safety Modernization Act

There are four key requirements for the implementation of the FDA Food Safety Modernization Act:

• Risk-Based Preventive Controls;
• Primary Production and Secondary Activities Farming;
• Supply Chain;
• Current Good Manufacturing Practices.

FSMS Rule 1 – Risk Based Preventive Controls

The first FSMS requirement is for all covered facilities to establish and implement a food safety system that includes an analysis of hazards and risk-based preventive controls. This includes requirements for a documented food safety plan including hazard analysis, preventive controls, and oversight and management of preventive controls.

In hazard identification, all known or reasonably foreseeable physical, biological, and chemical (including radiological) hazards must be considered. These hazards could be naturally occurring, unintentionally introduced, or intentionally introduced for economic gain (if food safety is affected).

Preventive measures must then be established so that the hazards identified will be minimized or prevented by these controls. Preventive controls include process, food allergen, and sanitation controls, as well as supply-chain controls and a recall plan. The rule provides flexibility in the steps needed to ensure that preventive controls are effective, as well as addresses problems that may arise by monitoring, corrections and corrective actions, and verification.

Monitoring procedures are designed to assure that preventive controls are effective and are consistently performed. It is conducted as appropriate for preventive control.

Corrections are immediate actions taken to timely identify and correct minor, isolated problems that occur during the production run. Corrections are short-term control. On the other hand, corrective actions include actions to identify a problem with preventive control implementation, reduce the likelihood the problem will reoccur, evaluate affected food for safety, and prevent it from entering the market. These actions are long-term controls. They must be properly documented with records maintained.

Verification activities are required to ensure that preventive controls are consistently implemented and are working correctly. They include validating with scientific evidence that a preventive control is capable of effectively controlling an identified hazard (For example, acidity below pH 4.6 or temperature below 5°C / 41°F); calibration (or accuracy checks) of process monitoring and verification instruments such as thermometers, and reviewing records to verify that monitoring and corrective actions (as needed) are being done.

Product testing and environmental monitoring are possible verification activities but are only required as appropriate to the food, facility, nature of the preventive control, and role of that control in the facility’s food safety system. Environmental pathogen testing would be required if contamination of a ready-to-eat food with an environmental pathogen (E.g. Listeria) is a hazard requiring a preventive control.

Food facilities are required to implement a documented preventive controls plan. These plans should cover evaluating hazards that could affect:

• Food safety;
• Specifying what preventive steps (or controls) will be put in place to significantly minimize or prevent the hazards;
• Specifying how monitoring of these controls will be done by the facility to ensure they are working;
• Maintaining routine records of monitoring; and
• Specifying the actions to be undertaken by the facility to correct any problems that arise.

FSMA Rule 2 – Primary Production and Secondary Activities Farming

The second FSMA requirement is the clarification of the definition of a “Farm” to cover two types of farm operations:

• Primary Production Farming; and
• Secondary Activities Farming.

Business operations defined as farms are not subject to the preventive controls rule.

A Primary Production Farm is an operation under one management in one general location devoted to the growing of crops, harvesting of crops, raising of animals (including seafood), or any combination of the above-mentioned activities. The Primary Production Farm is a kind that can pack or store raw agricultural commodities such as fresh produce. It may also conduct certain manufacturing /processing activities, such as dehydrating grapes to produce raisins and packaging/labeling of raisins.

The definition of “farm” in the new rule was expanded to include farms packing or storing raw agricultural commodities such as fresh produce that are grown on a farm under different ownership. Companies that solely harvest crops from farms are also included within the “farm” definition in the final rule.

A Secondary Activities Farm is an operation devoted to harvesting, packing, and/or holding raw agricultural commodities but not located on the

Primary Production Farm. It must be majority-owned by the Primary Production Farm supplying the majority of the raw agricultural products harvested, packed, and/or stored by the Secondary Activities Farm.

This definition for a Secondary Activities Farm was provided in the rule, in part, so that farmers involved in certain formerly off-farm packing now fit under the definition of “farm” as the packing is still part of the farming operation. This also covers operations in which nuts are hulled and dehydrated by an operation not located at the orchard before going to a processing plant. If the farmer that owns the orchards and supplies the majority of the nuts is a majority owner of the hulling/dehydrating facility, then the operation falls under Secondary Activities Farm.

Primary Production and Secondary Activities Farms conducting activities on produce covered by the Produce Safety Rule will be required to comply with that rule.

FSMA Rule 3 – Supply Chain

The third FSMA requirement covers the supply chain. Under the rule, the supply chain program is more flexible, with separate compliance dates established. As mandated by the rule, a manufacturing/processing facility should have a risk-based supply chain program for those raw materials and other ingredients for which it has identified a hazard requiring a supply-chain applied control. These facilities that control a hazard using preventive controls or that follow requirements applicable when relying on a customer to control hazards, do not need to have a supply-chain program for that hazard.

Covered food facilities are responsible for ensuring that only approved products from approved suppliers are received. Likewise, temporarily, unapproved suppliers whose products are still subject to verification activities before being accepted for use can also be received. Approved suppliers are those approved by the facility after a consideration of factors that include a hazard analysis of the food, the entity that will be controlling that hazard, and supplier performance.

Preventive control will not be required from a facility when an identified hazard will be controlled by a subsequent entity such as a customer or other processor. The facility will have to disclose that the food is “not processed to control” (identified hazard) and obtain documented assurance from its customer regarding certain actions the customer agrees to take.

A broker or distributor, which is another entity in the supply chain, can conduct supplier verification activities but the receiving facility will need to review and assess the broker/distributor’s documentation of the verification of control of the hazard.

The supply chain program provisions have separate compliance dates set so that the food facility will not be required to comply with the supply-chain program provisions before its supplier is required to comply with the preventive controls for human food rule or the produce safety rule.

FSMA Rule 4 – Current Good Manufacturing Practices

The fourth key FSMA requirement is the updating and clarification of the Current Good Manufacturing Practices (cGMPs). The final rule does not include nonbinding provisions which are more appropriate for guidance. Education and training, previously nonbinding provisions, are now binding in the new rule. All employees who manufacture, process, pack, or hold food should be qualified to perform their assigned duties. Management is required to ensure compliance. Employees with direct involvement in the production of foods must have the necessary combination of education, training, and/or experience essential to manufacture, process, pack, or hold clean and safe food. These individuals must receive training in the principles of food hygiene and food safety, including the importance of employee health and hygiene. Note that there are similar requirements related to preventive controls. Additionally, Current Good Manufacturing Practices addressing allergen cross-contact are now well defined.

Rules for Implementation of the FSMA

The Food Safety Management Act has seven published foundational rules for its implementation:

• Current Good Manufacturing Practice and Hazard Analysis and Risk-based Preventive Controls for Human Food;
• Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption;
• Current Good Manufacturing Practice and Hazard Analysis and Risk-based Preventive Controls for Food for Animals;
• Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans and Animals;
• Accreditation of Third-Party Auditors / Certification Bodies to Conduct Food Safety Audits and Issue Certifications;
• Focused Mitigation Strategies to Protect Food Against Intentional Adulteration; and
• Sanitary Transportation of Human and Animal Food.
• Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Control.

Under the FSMA, the FDA requires the U.S. food industry to implement hazard analysis and risk-based preventive control measures to reduce the likelihood of food contamination. All food facilities covered by the FSMA must conduct Hazard Analysis and Risk-based Preventive Controls (HARPC). HARPC requirements include plans for potential terrorist acts, intentional adulteration for economic gain, and food fraud. The food defense plans include additional security such as visitor access and related controls.

The FDA regulation for Current Good Manufacturing Practice (cGMP) in Manufacturing, Packing, or Holding Human Food has been updated as part of the FSMA. The long-standing cGMP requirements were modernized and requirements for the domestic and foreign facilities subject to their regulation for Registration of Food Facilities to establish and implement hazard analysis and risk-based preventive controls for human food were added. Modernizing the requirements of the FDA’s long-standing current cGMP regulations regarding the manufacturing, processing, packing, or holding of human food involved updating, revising, and clarifying some existing regulations.

The cGMP rule is part of FDA FSMA which aims to better protect public health by adopting a modern, science-based, preventive, and risk-based approach to food safety regulation. The rule creates certain new requirements for the production of human food by registered food facilities and revises previous requirements. New requirements for certain domestic and foreign facilities to establish and implement hazard analysis and risk-based preventive controls for human food have been created. These requirements apply to establishments required to register with FDA as a food “facility”. The rule requires the registered food facilities to maintain a food safety plan, perform a hazard analysis, and institute preventive controls to mitigate the hazards. Facilities must also monitor controls established, conduct verification activities to ensure controls are effective, implement appropriate corrective actions, and maintain records documenting actions done.

This final rule is a result of significant stakeholder engagement starting from the proposal of the rule. Inputs from the food industry and other stakeholders resulted in supplemental notices to ensure that the risk-based, preventive requirements are practical and protective of public health. Exemptions may apply for the following:

• Companies under the exclusive authority of the U.S. Department of Agriculture (Meat, Poultry, Pork, Eggs, etc.);
• Farms, Cooperatives, Growers, Harvesters, and other companies handling raw fresh fruits and vegetables;
• Facilities subject to and comply with FDA’s seafood and juice HACCP regulations;
• More limited control to low acid and acidified canned food processors but only as regulatory controls govern and control aspects of microbial contamination; and
• Small and very small businesses may be exempted from complying with HARPC requirements.

HARPC Methodology and Steps

All FSMA relevant facilities are required to establish and implement a food safety system that includes hazard analysis and risk-based preventive controls including specific requirements for:

• Documented Food Safety Plan;
• Hazard Analysis;
• Preventive Controls:
• Monitoring;
• Corrective Action;
• FSMA Verification Requirements;
• Supply Chain Program;
• Recall Plan; and
• Requirements Applying to Records that must be Established and Maintained.

Documented Food Safety Plan

The qualified facility is required to prepare (or have prepared) and implement a documented food safety plan. The food safety plan must be prepared, or its preparation is overseen, by one or more preventive controls qualified individuals.

The documented food safety plan must include the documented hazard analysis, documented preventive controls, documented supply-chain program, documented recall plan, documented procedures for monitoring the implementation of the preventive controls, documented corrective action procedures, and documented verification procedures.

The food safety plan is a record that is subject to the requirements for Records for Current Good Manufacturing Practice, Hazard Analysis, and Risk-based Preventive Controls for Human Food.

Hazard Analysis

The facility must conduct a hazard analysis to identify and evaluate (based on experience, illness data, scientific reports, and other information) known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at the facility to determine whether any hazards are requiring a preventive control. The hazard analysis must be documented regardless of its outcome.

During hazard identification, there must be consideration of:

• Known or reasonably foreseeable hazards that include biological hazards (including microbiological hazards such as parasites, environmental pathogens, and other pathogens), chemical hazards (including radiological hazards, substances such as pesticide and drug residues, natural toxins, decomposition, unapproved food color, or color additives, and food allergens), and physical hazards (e.g., stones, glass, and metal fragments); and
• Known or reasonably foreseeable hazards that may be present in the food due to Naturally Occurring hazards, Unintentionally Introduced Hazards, or Hazards Intentionally Introduced for Purpose of Economic Gain.

The hazard analysis must include an evaluation of the hazards identified to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls. The hazard evaluation must include evaluation of environmental pathogens whenever a ready-to-eat food is exposed to the environment before packaging and the packaged food does not receive a treatment or include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen.

The hazard evaluation must also consider the effect on the safety of the finished food for the intended consumer of:

• The formulation of the food;
• The condition, function, and design of the facility and equipment;
• Raw materials and other ingredients;
• Transportation practices;
• Manufacturing / Processing procedures;
• Packaging activities and labeling activities;
• Storage and distribution;
• Intended or reasonably foreseeable use;
• Sanitation, including employee hygiene, and
• Any other relevant factors such as the temporal (E.g., weather-related factors) nature of some hazards (E.g., levels of some natural toxins).

Preventive Controls

The facility must identify and implement preventive controls to provide confidence that any potential hazards will be significantly minimized or prevented from occurring. Preventive controls include any other procedures, practices, and processes necessary to satisfy the requirements for preventive controls, such as hygiene training and other current good manufacturing practices. Any food manufactured, processed, packed, or held by the facility must comply with the requirements of the Federal Food, Drug, and Cosmetic Act.

Preventive controls must include controls at critical control points and must be documented and must also include (as relevant) process controls, food allergen controls, sanitation controls, supply-chain controls, recall plans, and other controls.

Process controls may include procedures, practices, and processes to ensure the control of parameters during operations such as thermal processing, acidification, irradiation, and refrigeration. Process controls must also include parameters associated with the control of the identified hazard and the maximum or minimum value (or combination of values) to which any biological, chemical or physical parameter must be controlled to significantly minimize or prevent a hazard. Preventive Controls must also cover the supply chain.

Food allergen controls may include procedures, practices, and processes to control food allergens. Food allergen controls must include procedures, practices, and processes employed for ensuring the protection of food from allergen cross-contact during storage, handling, and use.

Food labeling for Food Allergens must be compliant with the Federal Food, Drug, and Cosmetic Act.

Sanitation controls include procedures, practices, and processes to ensure that the facility is maintained in a sanitary condition adequate to significantly minimize or prevent hazards such as environmental pathogens and food allergens. Sanitation controls must include procedures, practices, and processes for the cleanliness of food contact surfaces, including food-contact surfaces of utensils and equipment. Control measures must also include the prevention of allergen cross-contact / cross-contamination from objects, from personnel to food, from food packaging materials and other food-contact surfaces, and from raw product to processed product.

The manufacturer/processor is not required to implement a preventive control when identifying a hazard requiring a preventive control (identified hazard) if the facility determines and documents that the type of food could not be consumed without the application of an appropriate control (E.g., raw agricultural commodities like cocoa beans, coffee beans, and grains). Likewise, implementation of a preventative control is not required if the manufacturer/processor relies on the customer who is subject to the requirements for hazard analysis and risk-based preventive controls to ensure that the identified hazard will be significantly minimized or prevented. In this case, the facility must disclose in documents accompanying the food, that the food is “not processed to control [identified hazard]” and obtain an annual documented assurance from their customer that the customer has established and is following procedures (identified in the documented assurance) that will significantly minimize or prevent the identified hazard.

Preventive controls are not required if the manufacturer/processor relies on the customer who is not subject to the requirements for hazard analysis and risk-based preventive controls to provide assurance it is manufacturing, processing, or preparing the food as per applicable food safety requirements. Additionally, the facility must disclose in documents accompanying the food, as per the practice of the trade, that the food is “not processed to control [identified hazards]” and annually obtain documented assurance from their customer that the customer is manufacturing, processing, or preparing the food as per applicable food safety requirements.

Preventive controls are not required if the facility relies on the customer to assure that the food will be processed to control the identified hazard by an entity in the distribution chain after the customer. Additionally, the facility obtains annual documented disclosures accompanying the food, that the food is “not processed to control [identified hazard]” and only sell to another entity that agrees in writing that it will follow procedures that will significantly minimize or prevent the identified hazard; or manufacture, process or prepare the food as per applicable food safety requirements; or obtain a similar documented assurance from the entity’s customer.

If the facility has established, documented, and implemented a system that ensures control of the hazards at a subsequent distribution step in the distributed food and the facility documents the implementation of the system, preventive controls are also not required. Documentation of any such circumstance must be available, including:

• The determination that the type of food could not be consumed without the application of appropriate control,
• The annual documented assurance from the facility’s customer as per the circumstances noted above, and
• The system ensures control, at a subsequent distribution step, of the hazards in the food being distributed.

The facility must provide assurances that it is manufacturing, processing, or preparing the food per applicable food safety requirements. Additionally, the customer provides assurances that the food will be processed to control the identified hazard by an entity in the distribution chain after the end customer. The facility that provides a documented assurance must act consistently with the assurance and document its actions taken to satisfy the documented assurance.

Monitoring

The facility must establish and implement documented procedures for monitoring the preventive control including the frequency with which they are to be performed. The preventive controls must be monitored with adequate frequency to assure that they are consistently performed.

The facility must document the monitoring of preventive controls that are subject to verification and records review. Records of refrigeration temperature during storage of food that requires time/temperature control to significantly minimize or prevent the growth of (or toxin production by) pathogens may be affirmative records demonstrating temperature is controlled or exception records demonstrating loss of temperature control. Exception records may be adequate in circumstances other than monitoring refrigeration temperature.

Corrective Action

The facility must establish and implement documented corrective action procedures that must be taken if preventive controls are not properly implemented. This includes procedures to address (as appropriate):

• The presence of a pathogen or appropriate indicator organism in a ready-to-eat product detected through product testing; and
• The presence of an environmental pathogen or appropriate indicator organism detected through the environmental monitoring conducted.

The corrective action procedures must describe steps taken to ensure that appropriate action is taken to identify and correct a problem that has occurred with the implementation of preventive control and that appropriate action is taken, when necessary, to reduce the likelihood that the problem will recur. All affected food is evaluated for safety and all affected food is prevented from entering into commerce if the facility cannot ensure that the affected food is not adulterated or misbranded under relevant sections of the U.S. Food Acts.

The facility is subject to the requirements of this section if:

• The preventive control is not properly implemented and a corrective action procedure has not been established;
• The preventive control, a combination of preventive controls, or the food safety plan is found to be ineffective; or
• A review of records finds that the records are not complete, the activities conducted did not occur as per the food safety plan, or appropriate decisions were not made about corrective actions.

The facility must take corrective action to identify and correct the problem, reduce the likelihood that the problem will recur, evaluate all affected food for safety, and, as necessary, prevent affected food from entering commerce. When appropriate, the food safety plan should be reanalyzed to determine whether modification of the plan is required.

Corrections need not be applied if the facility takes action on time to identify and correct conditions and practices that are not consistent with the food allergen controls or the sanitation controls. Corrections also need not be applied if the facility takes action on time to identify and correct a minor and isolated problem that does not directly impact product safety.

All corrective actions taken must be documented in records. These records are subject to verification and records review.

FSMA Verification Requirements

FSMA Verification requirements include the following elements:

• Validation of Preventative Controls;
• Verification of Implementation and Effectiveness;
• System Review;
• Qualified Individuals and Qualified Auditors;
• Onsite FSMA Audit.

Validation of Preventative Controls

The facility must validate that the preventive controls identified and implemented are adequate to control the hazard as appropriate to the nature of the preventive control and its role in the facility’s food safety system.

Preventive controls must also be validated. It must be performed (or overseen) by preventive control qualified individuals:

• Before implementation of the food safety plan; or
• When necessary to demonstrate the control measures can be implemented as designed within 90 calendar days after production of the applicable food first begins; or
• Within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a documented justification for a timeframe that exceeds 90 calendar days after production of the applicable food first begins.

Validation must be conducted whenever a change to a control measure or combination of control measures could impact whether the control measure or combination of control measures, when properly implemented, will effectively control the hazards. Validation must also be conducted whenever a review of the food safety plan reveals the need to do so.

Validation processes must include obtaining and evaluating scientific and technical evidence to determine whether properly implemented preventive controls will effectively control the hazards. When such evidence is not available or is inadequate, validation studies will be conducted with records maintained.

The facility does not need to validate the food allergen controls, sanitation controls, recall plan, supply-chain program, and other preventive controls, if the preventive controls qualified individual prepares (or oversees the preparation of) a documented justification that validation is not applicable based on factors such as the nature of the hazard, and the nature of the preventive control and its role in the facility’s food safety system.

Verification of Implementation and Effectiveness

As appropriate to the nature of the preventive control and its role in the facility’s food safety system, verification activities must include validation, verification that monitoring is being conducted, verification that appropriate decisions about corrective actions are being made, verification of implementation and effectiveness, and system review. Outcomes of all verification activities must be recorded.

The facility must verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the hazards, including the following (as relevant to their business operation):

• Calibration of process monitoring instruments and verification instruments (or checking them for accuracy);
• Product testing, for a pathogen (or appropriate indicator organism) or other hazards;
• Environmental monitoring, by collecting and testing environmental samples, for an environmental pathogen or an appropriate indicator organism, if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control. Procedures for environmental monitoring must:
• Be scientifically valid;
• Identify the microorganisms of concern;
• Identify the locations from which samples will be collected and the number of sites to be tested during routine environmental monitoring. The number and location of sampling sites must be adequate to determine whether preventive controls are effective;
• Identify the timing and frequency for collecting and testing samples. The timing and frequency for collecting and testing samples must be adequate to determine whether preventive controls are effective;
• Identify the test(s) conducted, including the analytical method(s) used;
• identify the laboratory conducting the testing; and
• Include relevant corrective action procedures.
• Review of records within the specified timeframes by (or under the oversight of) preventive control qualified individuals, to ensure that the records are complete, the activities reflected in the records occurred as per the food safety plan, the preventive controls are effective, and appropriate decisions were made about corrective actions;
• Records of monitoring and corrective action records must be reviewed within 7 working days after the records are created or within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a documented justification for a timeframe that exceeds 7 working days;
• Records of calibration, testing (E.g., product testing, environmental monitoring), supplier and supply-chain verification activities, and other verification activities within a reasonable time after the records are created;
• Other activities appropriate for verification of implementation and effectiveness.

As appropriate to the facility, the food, the nature of the preventive control, and the role of the preventive control in the facility’s food safety system, the facility must establish and implement documented procedures covering the following activities:

• The method and frequency of calibrating process monitoring instruments and verification instruments (or checking them for accuracy);
• Procedures for product testing that are scientifically valid, identify the target microorganisms and other analytical parameters; specify the procedures for identifying samples (including their relationship to specific lots of product); include the procedures for sampling (including the number of samples and the sampling frequency); identify the tests conducted including the analytical methods used, identify the laboratory conducting the testing, and include the corrective action procedures.

System Review

The facility must conduct a review of the food safety plan as a whole at least once every three years. The facility must conduct a review of the food safety plan as a whole or the applicable portion of the food safety plan:

• Whenever a significant change in the activities conducted at the facility creates a reasonable potential for a new hazard or creates a significant increase in a previously identified hazard;
• Whenever the facility becomes aware of new information about potential hazards associated with the food;
• Whenever appropriate after an unanticipated food safety problem; and
• Whenever the facility finds that a preventive control, a combination of preventive controls, or the food safety plan as a whole is ineffective.

As relevant to the nature of the preventive control and its role in the facility’s food safety system, the facility must complete the system review and validate any additional preventive controls needed to address the hazard identified:

• Before any change in activities (including any change in preventive control) at the facility is operative; or
• When necessary to demonstrate the control measures can be implemented as designed within 90 calendar days after production of the applicable food first begins; or
• Within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a documented justification for a timeframe that exceeds 90 calendar days after production of the applicable food first begins.

Revision of the documented food safety plan must be done if a significant change in the activities conducted at the facility creates a reasonable potential for a new hazard or a significant increase in a previously identified hazard or document the basis for the conclusion that no revisions are needed. Reviews must be conducted (or overseen) by preventive control qualified individual.

The facility must also conduct a review of the food safety plan when the FDA determines it is necessary to respond to new hazards and developments in scientific understanding.

The facility plan must be reviewed at least once every three years or whenever there is a significant change at the facility that may increase potential hazards. HARPC elements are required to be submitted to the FDA review as part of site licensing requirements. Possible Consequences of Violating the FDA FSMA and HARPC requirements may include:

• Criminal charges upon the company or owner/operator/agent;
• Issue of a Public Warning Letter or an Import Alert;
• Suspension of the facility’s food facility registration; and
• Detaining shipment of importations thereby barring entry from the U.S. market.

Qualified Individuals and Qualified Auditors

One or more preventive controls qualified individuals must do (or oversee) the following activities:

• The preparation of the food safety plan;
• Validation of the preventive controls;
• Documented justification for validation to be performed in a timeframe that exceeds the first 90 calendar days of production of the applicable food;
• Determination that validation is not required;
• Review of records;
• Documented justification for a review of records of monitoring and corrective actions within a timeframe that exceeds 7 working days;
• System review of the food safety plan; and
• Determination that system review can be completed, and additional preventive controls validated, as appropriate to the nature of the preventive control and its role in the facility’s food safety system, in a timeframe that exceeds the first 90 calendar days of production of the applicable food.

A qualified auditor must conduct an onsite audit.

The preventative controls qualified individual must have completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA, or be otherwise qualified through job experience to develop and apply a food safety system. Job experience may qualify an individual to perform these functions if such experience has provided an individual with knowledge at least equivalent to that provided through the standardized curriculum. This individual may be but is not required to be an employee of the facility.

To be a qualified auditor, a qualified individual must have technical expertise obtained through education, training, and/or experience necessary to perform the auditing function.

All applicable training in the development and application of risk-based preventive controls must be documented in records, including the date of the training, the type of training, and the person(s) trained.

Onsite FSMA Audit

Only a qualified auditor must conduct an onsite audit of a supplier. If the raw material or other ingredients at the supplier is subject to one or more FDA food safety regulations, an onsite audit must consider such regulations and include a review of the supplier’s documented plan (E.g., HACCP plan or other food safety plan), if any, and its implementation, for the hazard being controlled. When applicable, an onsite audit may consider relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the U.S.

Provided that the inspection was conducted within 1 year of the date that the onsite audit would have been required to be conducted, the following may be substituted for an onsite audit:

• The documented results of an appropriate inspection of the supplier for compliance with applicable FDA food safety regulations by the FDA, by representatives of other Federal Agencies (such as the United States Department of Agriculture), or by representatives of State, local, tribal, or territorial agencies; or
• For a foreign supplier, the documented results of an inspection by the FDA or the food safety authority of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States.

For inspections conducted by the food safety authority of a country whose food safety system FDA has officially recognized as comparable or determined to be equivalent, the food that is the subject of the onsite audit must be within the scope of the official recognition or equivalence determination, and the foreign supplier must be in, and under the regulatory oversight of, such country.

If the onsite audit is solely conducted to meet requirements by an audit agent of a certification body that is accredited, the audit is not subject to the requirements in those regulations.

Supply Chain Program

The receiving facility must establish and implement a risk-based supply chain program for those raw materials and other ingredients for which the receiving facility has identified a hazard requiring a supply-chain applied control. The supply-chain program must be documented. This requirement does not apply to food that is supplied for research or evaluation use provided that such food is not intended for retail sale and is not sold or distributed to the public. Such foods need to be labeled with the statement “Food for research or evaluation use” and must be supplied in a small quantity that is consistent with research, analysis, or quality assurance purposes. The food can only be used for specified purposes. Any unused quantity of such materials needs to be properly disposed of and must be accompanied by documentation stating that the material has been used for research or evaluation purposes and cannot be sold or distributed to the public.

The supply chain program must include:

• Use of approved suppliers;
• Determination of appropriate supplier verification activities including the required frequency of such verification activities;
• Facilitation of supplier verification activities;
• Records of supplier verification activities; and
• Verification of a supply chain control applied by an entity other than the receiving facility’s supplier and recording that verification or obtaining documentation of an appropriate verification activity from another entity, reviewing and assessing that documentation, and documenting the review and assessment.

Supplier verification activities for raw materials and other ingredients include onsite audits, sampling and testing of the raw material or other ingredients, review of the supplier’s relevant food safety records, and other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material or other ingredients.

The supply chain program must assure that a hazard requiring a supply-chain applied control has been significantly minimized or prevented. In approving suppliers and determining the appropriate supplier verification activities and the frequency with which they are conducted, the following must be considered:

• The hazard analysis of the food, including the nature of the hazard controlled before receipt of the raw material or other ingredients, applicable to the raw material and other ingredients;
• The entity or entities that will be applying controls for the hazards requiring a supply-chain applied control; and
• Supplier performance.

Supplier performance includes the supplier’s procedures, processes, and practices related to the safety of the raw material and other ingredients. Supplier performance also includes applicable FDA food safety regulations and information relevant to the supplier’s compliance with those regulations, including an FDA warning letter or import alert relating to the safety of food and other FDA compliance actions related to food safety (or, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States, and information relevant to the supplier’s compliance with those laws and regulations). Additionally, supplier performance includes the supplier’s food safety history relevant to the raw materials or other ingredients that the receiving facility receives from the supplier, including available information about results from testing raw materials or other ingredients for hazards, audit results relating to the safety of the food, and responsiveness of the supplier in correcting problems); and any other factors as appropriate and necessary, such as storage and transportation practices.

If the owner, operator, or agent in charge of a receiving facility determines through auditing, verification testing, document review, relevant consumer, customer, or other complaints or otherwise that the supplier is not controlling hazards that the receiving facility has identified as requiring a supply-chain applied control, the receiving facility must take and record prompt action to ensure that raw materials or other ingredients from the supplier do not cause the food that is manufactured or processed by the receiving facility to be adulterated or misbranded under the Federal Food, Drug, and Cosmetic Act.

If a receiving facility is an FSVP compliant importer and has documentation of verification activities (which assures that the hazards requiring a supply-chain applied to control for the raw material or other ingredients have been significantly minimized or prevented), that receiving facility does not need to conduct supplier verification activities for related raw materials or ingredients.

When a supply chain applied control is applied by an entity other than the receiving facility’s supplier (E.g. When a non-supplier applies controls to certain products because growing, harvesting, and packing activities are under different management), the receiving facility must verify the supply-chain applied control, or obtain documentation of an appropriate verification activity from another entity, review and assess the entity’s applicable documentation and document that review and assessment.

Using Approved Suppliers

The receiving facility must approve suppliers and document that approval before receiving raw materials and other ingredients from such suppliers. Documented procedures for receiving raw materials and other ingredients must be established and followed. These procedures for receiving raw materials and other ingredients must ensure that raw materials and other ingredients are received only from approved suppliers (or, when necessary and appropriate, temporarily from unapproved suppliers whose raw materials or other ingredients are subjected to adequate verification activities before acceptance for use). Use of the documented procedures for receiving raw materials and other ingredients must be documented.

Appropriate supplier verification activities (including the frequency of conducting the activity) must be determined. Supplier verification activities must be conducted for each supplier before using the raw material or other ingredients from that supplier and periodically thereafter. When a hazard in raw material or other ingredients will be controlled by the supplier and is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans, the appropriate supplier verification activity is an onsite audit of the supplier. The audit must be conducted before using the raw material or other ingredients from the supplier and at least annually thereafter. The audit may not be required if there is a documented determination that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled.

If a supplier is an FSMA qualified facility, the receiving facility does not need to comply with these requirements if the receiving facility:

• Obtains documented assurance that the supplier is a qualified facility before first approving the supplier for an applicable calendar year and on an annual basis thereafter by December 31 of each calendar year for the following calendar year;
• Obtains documented assurance, at least every two years, that the supplier is producing the raw material or other ingredients in compliance with applicable FDA food safety regulations (or, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States). The documented assurance must include either a brief description of the preventive controls that the supplier is implementing to control the applicable hazard in the food; or a statement that the facility complies with State, local, county, tribal, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign countries.

If a supplier is a farm that grows produce, the receiving facility need not comply with requirement activities if the receiving facility obtains documented assurance, at least every 2 years, that the farm acknowledges that its food is subject to the relevant section of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

If a supplier is a shell egg producer that is not subject to the requirements because it has less than 3000 laying hens, the receiving facility does not need to comply if the receiving facility obtains documented assurance, at least every 2 years, that the shell egg producer acknowledges that its food is subject to the relevant section of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

There must not be any financial conflicts of interests that influence the results of the verification activities and payment must not be related to the results of the activity.

Facility Receivals

The receiving facility must approve suppliers and must determine and conduct appropriate supplier verification activities. An entity other than the receiving facility may do the following provided that the receiving facility reviews and assesses the entity’s applicable documentation and records:

• Establish documented procedures for receiving raw materials and other ingredients by the entity;
• Document that documented procedures for receiving raw materials and other ingredients are being followed by the entity.

The supplier may conduct and document sampling and testing of raw materials and other ingredients, for the hazard controlled by the supplier, as a supplier verification activity for a particular lot of the product and provide such documentation to the receiving facility, provided that the receiving facility reviews and assesses that documentation and documents that review and assessment. A receiving facility may not accept any of the following as a supplier verification activity:

• A determination by its supplier of the appropriate supplier verification activities for that supplier;
• An audit conducted by its supplier;
• A review by its supplier of that supplier’s own relevant food safety records; or
• The conduct by its supplier of other appropriate supplier verification activities for that supplier.

The receiving facility may rely on an audit provided by its supplier when the audit of the supplier was conducted by a third-party qualified auditor.

Supply Chain Program Records

The records documenting the supply-chain program are subject to the records requirements previously discussed. The receiving facility must review the records and must document the documented supply-chain program, which includes:

• Documentation that a receiving facility that is an importer complies with the foreign supplier verification program, including documentation of verification activities;
• Documentation of the approval of a supplier;
• Documented procedures for receiving raw materials and other ingredients;
• Documentation demonstrating the use of the documented procedures for receiving raw materials and other ingredients;
• Documentation of the determination of the appropriate supplier verification activities for raw materials and other ingredients;
• Documentation of the conduct of an onsite audit with the document containing the name of the supplier subject to the onsite audit, documentation of audit procedures, the dates the audit was conducted, the conclusions of the audit, corrective actions taken in response to significant deficiencies identified during audit and documentation that the audit was conducted by a qualified auditor.

Also included is documentation of sampling and testing conducted as a supplier verification activity. The documentation must incorporate: – Identification of the raw material or other ingredient tested (including lot number as appropriate) and the number of samples tested;

• Identification of the test(s) conducted, including the analytical method(s) used; the date(s) on which the test(s) were conducted, and the date of the report;
• The results of the testing; corrective actions are taken in response to detection of hazards; and
• Information identifying the laboratory conducting the testing.

Documentation of the review of the supplier’s relevant food safety records must also be maintained, including:

• The name of the supplier whose records were reviewed;
• The date(s) of review;
• The general nature of the records reviewed;
• The conclusions of the review; and
• Corrective actions were taken in response to significant deficiencies identified during the review.

Appropriate supplier verification activities based on the supplier performance and the risk associated with the raw material or other ingredients must also be documented. Documentation of any determination that verification activities other than an onsite audit, and/or less frequent onsite auditing of a supplier provide adequate assurance that the hazards are controlled when a hazard will be controlled by the supplier and is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans. Alternative verification activities for suppliers that are a qualified facility must also be documented. This could be a documented assurance that the supplier is a qualified facility before approving the supplier and on an annual basis thereafter; and documented assurance that the supplier is producing the raw material or other ingredients in compliance with applicable FDA food safety regulations (or, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

For a supplier that is a farm that supplies raw material or other ingredients that is not covered, the following documentation of an alternative verification activity can be considered:

• Documented assurance that supplier is not a covered farm before approving the supplier and on an annual basis thereafter; and
• Documented assurance that the farm acknowledges that its food is subject to the relevant section of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

For a supplier that is a shell egg producer that is not subject to the requirements, the following documentation of an alternative verification activity is considered:

• The documented assurance that the shell eggs provided by the supplier are not subject to the requirement because the supplier has less than 3000 laying hens before approving the supplier and on an annual basis thereafter; and
• The documented assurance that the shell egg producer acknowledges that its food is subject to the relevant section of the Federal Food, Drug, and Cosmetic Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

Documented results of an appropriate inspection of the supplier for compliance with applicable FDA food safety regulations by FDA, by representatives of other Federal Agencies (such as the United States Department of Agriculture), or by representatives from State, local, tribal, or territorial agencies, or the food safety authority of another country when the results of such an inspection are substituted for an onsite audit is also included.

The supply chain program must include records of actions taken for supplier non-conformance including:

• Documentation of verification of a supply-chain-applied control applied by an entity other than the receiving facility’s supplier;
• When applicable, documentation of the receiving facility’s review and assessment of applicable documentation from an entity other than the receiving facility that documented procedures for receiving raw materials and other ingredients are being followed;
• Applicable documentation, from an entity other than the receiving facility, of the determination of the appropriate supplier verification activities for raw materials and other ingredients;
• Applicable documentation, from an entity other than the receiving facility, of conducting the appropriate supplier verification activities for raw materials and other ingredients;
• Applicable documentation from its suppliers (of results of sampling and testing conducted by the supplier; or results of an audit conducted by a third-party qualified auditor); and
• Applicable documentation, from an entity other than the receiving facility, of verification activities when a supply-chain-applied control is applied by an entity other than the receiving facility’s supplier.

Recall Plan

For food with a hazard requiring a preventive control, the facility must establish a documented recall plan for the food. The documented recall plan must include procedures that describe the steps to be taken and assign responsibility for taking those steps to:

• Directly notify the direct consignees of the food being recalled, including how to return or dispose of the affected food;
• To protect public health, notify the public about any hazard presented by the food when appropriate;
• Conduct effectiveness checks to verify that the recall is carried out; and
• Appropriately dispose of recalled food (e.g., through reprocessing, reworking, diverting to use that does not present a safety concern, or destroying the food).

Record Keeping

The facility must establish and maintain the following records documenting the implementation of the food safety plan:

• Documentation of the basis for not establishing preventive control;
• Records that document the monitoring of preventive controls;
• Records that document corrective actions;
• Records that document verification including those related to validation, verification of monitoring, verification of corrective actions, calibration of process monitoring and verification instruments, product testing, environmental testing, records review, and system review;
• Records that document the supply-chain program; and
• Records that document applicable training for the preventive controls qualified individual and the qualified auditor.

Records applicable for the documented food safety plan must be kept as original records or true copies such as photocopies, pictures, scanned copies, microfilm, microfiche, or other accurate reproductions of the original records or electronic records. Records must contain the actual values and observations obtained during monitoring and verification activities. Records must be accurate, indelible, and legible.

Records must be created concurrently with the performance of the activity documented and be as detailed as necessary to provide a history of work performed. They must include information adequate to identify the plant or facility (E.g., the name and when necessary, the location of the plant or facility), the date, and when appropriate, the time of the activity documented, the signature or initials of the person performing the activity, and where appropriate, the identity of the product and the lot code if any.

The owner, operator, or agent in charge of the facility must sign and date the food safety plan upon initial completion and following any modification.

All records must be retained at the plant or facility for at least two years after the date they were prepared.

Records that relate to the general adequacy of the equipment or processes being used by a facility, including the results of scientific studies and evaluations, must be retained by the facility for at least two years after their use is discontinued (E.g., because the facility has updated the documented food safety plan or records that document validation of the documented food safety plan).

Offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of the request for official review. Electronic records are considered to be onsite if they are accessible from an onsite location. The food safety plan must remain onsite. If the facility is closed for a prolonged period, the food safety plan may be transferred to some other reasonably accessible location but must be returned to the plant or facility within 24 hours for official review upon request. All records must be promptly available to a duly authorized representative of the Secretary of Health and Human Services for official review and copying upon oral or documented request. Records obtained by FDA are subject to public disclosure within the scope of related legislation. Existing records (E.g., records that are kept to comply with other Federal, State, or Local regulations or for any other reason) does not need to be duplicated if they contain all of the required information. The information does not need to be kept in one set of records. If existing records contain some of the required information, any new information required may be kept either separately or combined with the existing records.

Any documented assurance must include the effective date, printed names, and signatures of authorized officials and must include:

• Acknowledgment that the facility that provides the documented assurance assumes legal responsibility to act consistently with the assurance and document its actions taken to satisfy the documented assurance; and
• Provision that if the assurance is terminated in writing by either entity, responsibility for compliance with the applicable provisions of this part reverts to the manufacturer/processor as of the date of termination.

If your food business supplies foodstuffs manufactured to a customer’s specifications, it is important to consider any specific FDA FSMA Development requirements in relation to their items.