The Importance of Records Under FSMA

The FSMA changes facing U.S. food manufacturers and processors and foreign exporters to the U.S. are quite challenging. FSMA’s most recent final rule, Part 117 Current Good Manufacturing Practice, Hazard Analysis and Risk-Based Preventive Controls for Human Food, as well as other proposed rules affecting foreign suppliers, transportation, produce, and food defense demand a more rigorous and encompassing food safety approach to food manufacturing and distribution. These rules, combined with the broader legal authority of FDA to regulate food safety, will put pressure on the food industry to make food safety a priority and demonstrate, by means of records, that appropriate food safety measures are being implemented and documented throughout the supply chain.

The scale of records that will have to be established and maintained under Part 117 is quite extensive. When you also consider the requirements that apply to such records, FDA’s legal authority to access such records, the implications of such new authority, and what food manufacturers/processors need to do to achieve auditable records to meet FDA’s food safety expectations, it can be quite easy to become overwhelmed.
 

Required Records.

While many of the records required by the new rules of FSMA are already being generated by different participants in the food supply chain, new ones will have to be developed, established, and maintained to meet all of the records requirements. Basically, these requirements can be divided into three sets:

• Records to demonstrate effective application of food safety preventive controls to minimize or prevent a hazard being controlled by the supplier, prior to the “receiving facility” (e.g., the plant, the manufacturer/processor) receiving such raw material or ingredient.
• Records to demonstrate the implementation of the receiving facility’s food safety plan (i.e., records of every preventive control identified as necessary to prevent or minimize known or reasonable foreseeable hazards).
• Records to demonstrate that an identified hazard is being controlled by the customer of the receiving facility, or by entities beyond the first customer.

The overall impact of this new records requirement should be evident. It establishes a document trail which enables food safety tracking from farm-to-fork. With some exemptions, participants in the food chain will have to determine who will control a given hazard needing a preventive control and what that control will be. To determine the specific preventive control and who will undertake such control, the HARPC analysis will have to include raw materials and ingredients with known or reasonable foreseeable hazards, the plant, and the product being distributed to its customers.

Whether a given facility will have to establish and maintain all three sets of records, or two, or only one, will depend on the type of product it produces, where in the food chain it is located, and the results of its hazard analysis and risk-based preventive controls evaluation.
 

Hazards Controlled Prior to the Receiving Facility.

If the hazard analysis concludes that a hazard will be controlled by the supplier of the receiving facility, the receiving facility must establish a written supply-chain program. (If the receiving facility is an importer, the importer would establish a Foreign Supplier Verification Program to achieve the same expectations as the domestic supply chain program.) The records documenting the implementation and performance of such a program include:

• Documentation of the approval of a supplier. To approve a supplier, the receiving facility must evaluate the known or reasonable foreseeable hazards associated with the product(s), and determine whether a preventive control(s) needs to be applied by the supplier(s), as well as the compliance history of the supplier(s) with food safety regulations. If the analysis determines that no preventive control is required by the supplier, then a supply chain program is not needed.
• Documentation of supplier verification activities. The appropriate verification activities and the frequency of implementation will be determined based on the results of the approval of a given supplier that is going to implement a preventive control for a specific hazard. These include:
  • Initial and annual onsite audits for the control of a hazard for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans (SAHCDHA). This documentation must include:
    • Name of the supplier.
    • Documentation of the audit procedures.
    • The dates the audit was conducted.
    • The conclusions of the audit.
    • The corrective actions taken in response to significant deficiencies identified during the audit.
    • Documentation that the audit was conducted by a qualified auditor.
  • Documentation of sampling and testing.
    • Identification of raw material or ingredient tested.
    • Number of samples tested.
    • Identification of analytical method and test conducted.
    • Date the test was conducted and date of the report.
    • The results of the testing.
    • Corrective action taken in response to detection of a hazard.
    • Identification of laboratory conducting the testing.
  • Documentation of the review of the supplier’s relevant food safety records.
    • The name of the supplier whose records were reviewed.
    • The date of the review.
    • The nature of the records reviewed.
    • The conclusions of the review.
    • The corrective actions in response to significant deficiencies identified during the review.
  • Documentation of other verification activities, as appropriate.
  • Documentation of any determination that less frequent onsite audits provide assurance that the hazard(s) is controlled.
  • Written procedure for receiving raw materials and ingredients and records demonstrating the use these procedures.
  • If the supplier is a qualified facility, alternative supplier verification activities and documentation can be provided. In general terms, the documentation must include:
    • A written assurance that the supplier is a qualified facility before approving the facility, and on an annual basis thereafter.
    • Written assurance that the supplier is producing the product according to applicable food safety regulations. These must be specified.
  • The written results of a federal, state, local, tribal, territorial, or food safety authority of another country, recognized as equivalent to the U.S., can be substituted for the annual onsite audit, under certain conditions.
  • Documentation of actions taken with respect to supplier non-conformance.
  • Verification and documentation of a supply chain-applied control can be carried out by another entity other than the receiving facility; however the receiving facility must review and document the review of such records. Examples include the results of sampling and testing by the supplier and the results of an audit undertaken by an independent qualified auditor.
  • Documentation of reanalysis.
     

Hazards Controlled by Receiving Facility.

If the hazard analysis determines that the hazard(s) will be controlled by the receiving facility, then a supply chain program for such hazard is not required. In this case, the receiving facility needs to develop and implement appropriate preventive controls and establish and maintain records documenting implementation. The records that must be established and maintained, include:

• Monitoring of preventive controls.
• Corrective actions (identification and correction of the problem, preventive action to reduce the likelihood that the problem will recur, affected food is evaluated for safety, and affected food is prevented from entering commerce, if it cannot be ensured that the food is not adulterated).
• Validation (as applicable, and before a preventive control becomes operative or when necessary within 90 days after production of the applicable food first begins).
• Verification of monitoring and corrective actions.
• Calibration of process monitoring and verification instruments.
• Product testing.
• Environmental monitoring.
• Records review.
• Reanalysis (every three years or when significant changes occur, a preventive control is deemed ineffective, new hazard information becomes available, or a market failure occurs that might affect the facility).
• Records that document the supply chain program (in case a given hazard is controlled by the supplier of the receiving facility).
• Records that document the training of the preventive control qualified individual and the qualified auditor.
   

The receiving facility is not required to implement a preventive control if:

• It determines that the type of food cannot be consumed without the application of an appropriate control. Examples include cocoa beans, coffee beans, and grains.
• It determines that its customer will apply the required preventive control prior to selling the product to another entity in the food supply chain.
  
   

Hazards Controlled by A Customer or A Successive Entity.

If the manufacturer/processor relies on its first customer to control the identified hazard then the following records must be established and maintained:

• A disclosure in the shipping documents accompanying the food that the product is not processed to control identified hazards.
• An anual written assurance that the customer has established and is following procedures (these must be explained in the written assurance) that will significantly minimize or prevent the identified hazard.

If the manufacturer/processor relies on an entity subsequent to the first customer to control the identified hazard, then the following records must be established and maintained:

• A disclosure in the shipping documents accompanying the food to be shipped to the first customer that the product is not processed to control identified hazards;
• An annual written assurance from the first customer that it will disclose in its shipping documents to its customer that the food is not processed to control identified hazards; and
• That the customer will sell only to another entity that agrees, in writing, to follow procedures (identified in the written assurance) that will significantly minimize or prevent the identified hazard.

In summary, the manufacturer/producer must establish and document a system that ensures control, at a subsequent distribution step, of the hazards in the food product it distributes.
 

Requirements Applying to Records.

The general requirements that apply are that the records must:

• Be kept as original records, true copies, or electronic records.
• Contain actual values and observations.
• Be accurate, indelible, and legible.
• Be created concurrently with performance of the activity documented (must be done in real time).
• Be as detailed as necessary to provide history of work performed.
• Include:
  • Information adequate to identify the plant or facility.
  • The date, and when appropriate time, of the activity documented.
  • The signature or initials of the person performing the activity.
  • When appropriate, the identity of the product and lot code.
• Food safety plan
  • Owner, operator, or agent in charge of facility must sign and date the food safety plan upon initial completion and upon any modification.
• Record retention requirements include:
  • All records must be retained for at least two years.
  • Records related to qualified facilities must be retained as long as necessary to support the status of a facility as a qualified facility.
  • Discontinued records related to changes, including changes to the food safety plan, or validation records must be retained for at least two years.
  • Except for the food safety plan, off-site storage of records is permitted if such records can be retrieved and provided on-site within 24 hours of request for official review. Electronic records are considered to be on-site if they are accessible from an on-site location.
  • If the facility is closed for a prolonged period of time, the food safety plan may be transferred to some other accessible location but must be able to be returned to the plant or facility within 24 hours for official review upon request.
     

FDA’s Record-Access Authority.

Under FSMA, the FDA has the legal right to request any records associated with the manufacturing, processing, packing, or holding of food for human consumption. This includes all records generated under Part 117. All records must be made promptly available to a duly authorized representative of the Secretary of Health and Human Services for official review and copying upon oral or written request.
 

Summary.

So, what does this all mean for a manufacturer or processor in the food supply chain? First, the complete food safety plan will need to faithfully reflect the results of the HARPC evaluation.

Depending on the food product, the location of the plant in the food chain, and where in the food chain the hazards will be controlled, the complete food safety plan may include all three sets of records highlighted in the beginning of this article, or a combination of two of them, depending on the results of the hazard evaluation. For example, the set of records may include a supply chain program with one or more suppliers, plus the food safety plan of the receiving facility containing all the preventive controls required to minimize or prevent hazards in the facility; or the receiving facility’s proper food safety plan and the statement in the shipping documents about the product not being controlled for an identified hazard, plus the customer’s written assurance that such hazard will be controlled before the product is sold further in the food supply chain.

Depending of the results of the HARPC analysis, these additional record requirements to document the effectiveness of preventive controls prior to receiving, within the facility, and after shipping the finished product to a customer will have to be integrated or made part of the current supplier verification program, the current HACCP program and the existing finished product shipping program. The facility will have to find the easiest, yet most effective, way of achieving the integration and management of these new records.

More than ever before, the quality of the records will play a key role in whether a facility will be successful during an inspection by FDA. Since any record must be made available upon oral or written request, FDA has gained unprecedented access to written information. Such additional documented insights will assist an inspector in deciding whether appropriate measures were taken and documented to assure appropriate sanitary and food safety conditions during the manufacturing, processing, packing, or holding of human food. Any record failure associated with an issue critical for food safety will likely lead to official action and consequences. Thus, the integrity of the written programs and documented records is now a critical element to demonstrate compliance with Part 117.

The author is global manager, food safety services innovation, AIB International.