FSMA Compliance = Update Not Create

With FDA having published five of the seven final rules of FSMA, it is industry’s turn to be reviewing those rules, determining what applies, and updating your processes, practices, and documentation to comply. I hope that you noticed that I said “updating,” not “creating.” In most cases, if you are already doing things right and implementing food safety practices, FSMA compliance will simply mean extending your thinking and adding preventive controls based on risk. And in some cases, you will find that complying with one rule automatically puts you in compliance with another.

Let me explain these by answering a few of the questions that I am frequently asked to provide practical food safety solutions.

One of the most common FSMA-related questions is: “If I am a manufacturer importing ingredients to use in my product, do I need to comply with the Foreign Supplier Verification Program rule (FSVP)?” The answer (you’ll be happy, and possibly surprised, to hear) is “No. You don’t.” That is, if you are in compliance with the supply chain requirements of the preventive controls rule, you can ignore FSVP.

So, not surprisingly, the next question generally is: “Then who is FSVP for?” FSVP was written for importers who do not manufacture, process, pack, or hold food, so are not required to be federally registered as a food facility. Those who simply import food and do none of the preceding, are not required to follow the preventive controls rule. However, FDA wants to ensure there are food safety controls throughout the supply chain on all foods in the U.S., no matter where they are manufactured. So, FSVP provides food safety controls for importers who would, otherwise, not be subjected to the rules of FSMA.

Q. What happens to all my current food safety initiatives?

Another key question I frequently hear is: “What do I need to do with my current processes to make them compliant with the new rules? Do I need to start all over to create a food safety plan?”

It is likely that none of what you currently have will need to be recreated … if you are doing things right. If you have implemented practices such as HACCP and environmental controls, and what you’ve done is right, you can likely roll it right into the food safety plan that is required by the preventive controls rule. It is all still relevant, it will just need to be expanded — and written up, as what you currently have is likely just one part of the Hazard Analysis Risk-Based Preventive Control (HARPC) requirements of FSMA. This means you now need to look at the bigger picture, beyond HACCP.

As defined by USDA’s National Advisory Committee on Microbiological Criteria for Foods (NACMCF)  which developed the food industry’s HACCP document, a critical control point is “a step at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce it to an acceptable level.”

While controls should still be applied to these “steps,” HARPC asks that you take a more holistic approach, viewing your entire operation through a risk-based approach that looks not only at specific hazards but at any potential risk of such hazards. Ask: “What hazards do I need to prevent to reduce or eliminate the risk of foodborne illness?”

One example is that of environmental controls in ready-to-eat plants or areas, such as peanut butter. Typical CCPs in peanut butter processing are the temperature and belt speed of the roaster. But if you stop there, you may have addressed a CCP, but you are leaving a lot of risk on the table. After the peanuts are roasted, they will be ground and mixed, then jarred. During this process, the peanuts are exposed to the environment.

What risks are inherent in the environment and how are these controlled? One key answer is the cleanliness and sanitation of the environment. Neither of these are CCPs, but lack of either would pose definite risk, thus they need to be controlled in a risk-based, preventive program that includes environmental monitoring to detect any potential risk, along with the cleaning and sanitation program you likely already have in place.

If you don’t have a thorough, effective cleaning and sanitation program; if you are not conducting environmental monitoring, you are not preventing risk, and you will eventually have a problem.

I want to clarify that FDA doesn’t want you to start putting CCPs everywhere. Adding risk-based controls doesn’t mean trying to squish CCPs into every part of your process. Instead, you need to think beyond the CCP. Think holistically about what HARPC stands for: risk-based preventive controls.

Q. So how do I know where I need to add risk-based preventive controls?

At its simplest, it’s a matter of asking, and answering, your own questions:

• Look at each area of your operation and ask, “Do I have a risk?”
• Where any potential risk is determined, ask, “Does this require a preventive control?”
• If there’s not one in place, it’d better be put in place.

That’s what it means to update your current food safety system and move from HACCP’s CCPs to HARPC’s RPCs.

David Acheson is the Founder and CEO of The Acheson Group.