FDA Proposed Rules Reset FSMA’s Preventive Controls

Public commentary and FDA responses to the supplemental rule changes issued September 19, 2014, are truly significant, and the dialogue for changes and clarifications will continue as FDA writes the final Food Safety Modernization Act (FSMA) rules. Although there are uncertainties in play, we know that the objectives for FSMA will not change. The primary goal is to move from reactive to preventive for any actual or potential food safety issue termed a Severe Adverse Health Consequence or Death in Humans or Animals (SACHODHA) event in the marketplace.

Identification and monitoring of preventive controls will be applied to food safety programs, supplier controls, process steps, and operational practices to prevent unsanitary conditions and cross-contact contamination. At minimum, this will require a risk-based analysis for hazards to be controlled by the good manufacturing practices (GMPs), HACCP plan, process controls, and a supplier verification program.

The regulatory focus will be food processors and distributors of products associated with Class 1 recalls (SAHCODHA). This article focuses on FDA response to the public commentary and discusses a practical understanding of the proposed changes contained in Section IX: Overall Framework for Hazard Analysis and Risk-Based Preventive Controls (HARPC) for human food processors and the process for identifying preventive controls (PCs); Section XI: Potential Requirements for a Supplier Program which are the foundation for FSMA implementation; and other sections such as Section X: Proposed Requirements for Product Testing and Environmental Testing due to nature and importance if included in the final rules. (Author’s note: Quotations are taken directly from FDA documents, but are subject to further change when the final rules are issued.)
 

Defining HARPC.

Regulated HACCP (Hazard Analysis and Critical Control Point) is considered to be a success story in the production of high-risk foods. FDA has applied these principles to “other than critical control points (CCPs)” in a company’s day-to-day operations. It is important to understand that HACCP is not the same as HARPC, but together they will enhance food safety through additional food safety programs and supplier controls that are monitored and verified similar to a CCP.

The regulatory focus for HARPC is to reduce the number of Class 1 recalls due to undeclared allergens and pathogenic bacteria such as Salmonella and Listeria. FDA defines a Class 1 recall as “a situation in which there is a reasonable probability that the use of or exposure to a violative product will cause serious adverse health consequences or death” (SAHCODHA hazard).

The rationale for HARPC can be traced to regulated HACCP for seafood (21 CFR part 123) and juice (21 CFR part 120) (i.e., whether a “known or reasonably foreseeable hazard” was “reasonably likely to occur”). This phrase and definition has caused confusion as it is derived from HACCP hazard analysis terminology to identify potential CCPs and not preventive controls. In response, FDA has proposed the use of the term “significant hazard.” “Significant hazard would mean a known or reasonably foreseeable hazard for which a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would, based on the outcome of a hazard analysis, establish controls to significantly minimize or prevent the hazard in a food and components to manage those controls (such as monitoring, corrections or corrective actions, verification and records) as appropriate to the food, the facility, and the nature of the control.” From this statement, FDA has clarified that the “known or reasonably foreseeable hazard” would apply to the facility conditions, type of food product, and raw materials. The minimal criteria to be applied to control significant hazards for a facility’s plant conditions and type of food product is listed in Table 1.

FDA has suggested that determining a significant hazard would be a two-step hazard analysis process:

1. List the known or reasonably foreseeable biological, chemical, and physical hazards associated with the facility and the food product. For HARPC, additional chemical hazards such as radiological, natural toxins, pesticides, drug residues, food additives/colors, and decomposition would need to be added to the raw material hazard analysis and include economically motivated adulteration (EMA).
2. Evaluate the importance of a preventive control (PC) to significantly minimize or prevent the hazard from occurring, and evaluate what level of monitoring and recordkeeping would be necessary to achieve effective control. The level of importance would be based on the severity of the illness or injury and the likelihood of occurrence if this hazard was not adequately monitored. In other words, not all PCs will have documented monitoring, only the most important programs for raw materials, plant conditions, and food safety programs that prevent “significant hazards” from occurring.
   
    

Domestic Supplier Control.

The evaluation for having a supplier control program (i.e., supplier verification), would be based on the identification of a “significant hazard” during hazard analysis and then deciding what entity will be controlling the identified hazard. This could be the supplier to the supplier (sub-supplier), the receiving entity (processor or distribution), or the customer. It is expected that there will be additional changes in the Supplier Verification Program as the comment period for this and the Foreign Supplier Verification Program (FSVP) are finalized.

Currently, the options for controlling significant hazards associated with raw materials are:

• The supplier to the receiving facility (processor) controls the hazard.
  • The supplier to the processor’s supplier controls the hazard (termed sub-supplier).
• The receiving facility controls the hazard.
• The customer of the receiving facility controls the hazard.
• A combination of these options controls the hazard through supplier verification or other verification activities.
   

Table 2 (below) provides a summary of when the receiving facility would need or not need to have a Supplier Verification Program to control the identified hazards.
 

If a company identifies significant hazards in its raw materials and ingredients controlled by the supplier or sub-supplier, the receiving facility will need to have a documented Supplier Verification Program (SVP). The current requirements for content are:

• Supplier Verification Requirements
  • Documented hazard analysis and records for identifying significant hazards in raw materials and ingredients.
  • Documented supplier verification procedures and records.
  • Annual on-site audit by a “qualified auditor” to review the supplier’s procedures, conclusions, and effectiveness of any necessary corrective action(s).
• After the initial audit, the receiving facility (processor) can elect to require less than annual audits but must conduct other verification activities to ensure hazard control is adequate.
• FDA would not have access to the full audit report, but could have access to audit conclusions and corrective actions.
  • If the receiving facility (processor) does not get product directly from the supplier, then it must conduct verification activities with that supplier.
• Verification activities will be based on:
  • Severity of the hazard.
  • Review of preventive controls at the point they are applied (e.g., sub-supplier, supplier, customer, or other entity).
  • Effectiveness of the supplier’s food safety programs.
• The supplier’s food safety performance history.
  • The supplier’s compliance with FDA regulations.
  • Other factors such as storage and transportation requirements controlling the significant hazard.

The Supplier Verification Program is meant to ensure that only approved suppliers are used for raw materials that have significant hazards. It appears that there will not be a need to have an approved supplier list for raw materials with significant hazards, but there must be evidence that only approved suppliers are used. The term “qualified auditor” has not been defined and doesn’t mention any specific third-party audit schemes that could be used to verify suppliers, but this and other clarifications are expected in the final rule. (Author’s note: The FSVP rule was not reviewed in this article, but its requirements are expected to be very similar to the supplier verification requirements contained in HARPC.)
 

Product Testing and Environmental Monitoring.

The requirements for product testing and environmental monitoring as a verification activity to verify that preventive controls are effective will be clarified in the final rule. Currently, FDA has provided flexibility for both requirements in that these programs would not be prescriptive and would be implemented “as appropriate for the food, the facility, and the nature of the preventive control” being verified.

The term “product testing” would apply to testing for ingredients and in-process and finished product. For ready-to-eat (RTE) product, FDA has stated that the type of product testing could be appropriate because there is not a kill step for certain types of foods. FDA proposes that environmental testing would be appropriate for RTE product that does not receive a “treatment to minimize environmental pathogens” and is exposed prior to packaging. In both cases, if testing is being done to verify preventive controls are effective, the procedures, corrective actions, and records of testing would have to be kept.
 

Preventive Controls.

Individual preventive controls are also termed “food safety plans” and should be monitored relative to the importance of the conclusions of the risk-based hazard analysis. The term “flexibility” is used in response to the industry suggestion for a “sliding scale” in that all preventive controls do not have to be monitored the same way. In other words, not all preventive controls will require documented monitoring, corrective action, and validation or verification activities. Furthermore, the verification activities to judge the effectiveness of the preventive controls can be conducted “as appropriate for the facility, the food, and the nature of the preventive control.” For companies operating under a documented food safety system, it is likely that most food safety preventive controls are already documented, but will need to be verified as FSMA-compliant.

On August 30, 2015, the final rule for Section 103, Hazard Analysis and Risk Based Preventive Controls for Human Food (HARPC) is to be issued and allow approximately one year for companies to be compliant with implementation of food safety preventive controls. Imported foods and FSVP are contained in sections 301, 302, and 303 and will be subject to the HARPC preventive controls with an issue date of October 31, 2015. Although further changes and clarifications will occur as the final rules are issued, it is apparent that the process for identifying preventive controls associated with “significant hazards” should be completed by early 2015.

For companies that already have documented food safety procedures and participate in third-party audits or an internal audit program, it is likely that many of the potential preventive controls are documented and on a verification schedule. The challenge for these companies is to determine which preventive controls should be HARPC-monitored because the absence of effective monitoring would pose an unacceptable food safety risk for the company, potentially resulting in a Class 1 recall or regulatory action.

If you receive FDA’s recall notifications, you know that undeclared allergens occur frequently and more often in certain types of foods. Any preventive programs controlling undeclared allergens (e.g., label verification at packaging, preventing allergen cross-contact in processing, proper cleaning during allergen changeover cleaning, or supplier verification for undeclared allergens) should be considered as directed by the risk-based hazard analysis. The same logic would apply for any significant hazards that are associated with your type of raw materials, process environment, and type of finished product. The time to start preparing for FDA’s HARPC requirements is now.

The author is Global Manager, Food Safety Services Innovation, AIB International.