FSMA’s Final Rules — Round 2

The Produce Safety Rule

© LeszekCzerwonka | Thinkstock.com

While the Food Safety Modernization Act is a historical document as a whole, its “Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption”—better known as The Produce Safety Rule (http://1.usa.gov/1GWO4me)—is a key component that earns FSMA the designation of “first in history.”

For the first time, FDA has defined farm and on-farm activities; and, for the first time, these farms and on-farm activities have regulations developed specifically for them, said Produce Marketing Association Vice President of Food Safety and Technology Jim Gorny.

“The produce safety rule focuses exclusively on farms,” Gorny said. “It sets clear rules of conduct for them,” bringing the same accountability to farms that has existed for years in food processing plants. “For the first time, we have an implementation regulation for farms.”

The definitions detail what is a farm and what is not a farm. But that doesn’t mean that food operations not defined as farms are not under any regulation, Gorny said. “If you don’t meet the definition of farm, you’re under the preventive controls rule.”

Although the preventive controls rule carries complexities and new requirements for processors, much of it is simply intensification, documentation, and validation of what was already set under prior regulation, GMPs, and guidance, with the added focus on prevention vs. reaction, he said.

But because the produce safety rule brings a major sea change for farms—and the fact that the rule needs to be applied to 300 different produce items—meaning 300 different processes, Gorny said, it is expected that this segment of the industry will have a steeper learning curve. Recognizing the complexity and scope of the rule, FDA also took this into consideration in setting compliance dates, he added. Large farms have two years (from the effective date of Jan. 26, 2016) to comply, small farms have three years, and very small farms have four years. Additionally, all farms get an extra two years to comply with the water rules.

SUPPLY CHAIN IMPACT. There are also exemptions and exclusions to the rule, such as those for farms with less than $25,000 in sales, produce that is rarely consumed raw (e.g., potatoes), and produce that will undergo further robust processing (e.g., canned tomatoes).

While such exemptions and exclusions make it easier on the affected farms, “that will be the hard part for food processors,” Gorny said. They will need to know which of their suppliers are exempt, then determine what will need to be done not only to ensure the safety of their food, but to ensure they are complying with FSMA’s supply chain requirements and documentation.

Because of this, it is also likely that farms that are exempt from regulation will not be exempt from FSMA-equivalent requirements of their downstream customers. “A lot of buyers will still require you to follow FDA requirements, even if you are exempt,” Gorny said of the farms.

Gorny sees the most contentious areas of the rule as being the defined distinctions between primary and secondary farms, the agricultural water provisions, and the biological soil amendments—all of which are key components of the new law. (See more on the agricultural water provisions in Legislative Update, page 8.)

The agricultural water provisions are very prescriptive, Gorny said. And while he understands what FDA tried to do with regard to open water sources, he doesn’t agree with the basis of the water quality standards. “Generic E. coli is not an indicator of pathogens,” he said. “They’ve taken a faulty indicator and created a very complex regulatory structure around it.

“I’m a little disappointed in that, but it’s the best indicator we have at this point,” he said. And, because it is regulation, it is set in stone and difficult to change or update. Instead, Gorny said, FDA could have provided a “safe-harbor” of practices in compliance with the rule, or created guidance with such specifications—which is easier to update.

THE TRAINING CHALLENGE. Even with the complexities of that provision, Gorny believes the greatest challenge in rule implementation will come in complying with the training provisions. Although training is standard in food plants, and it is a good thing, “farms didn’t have to do it in the past,” he said, and there is a lot of training required. There has to be at least one trained supervisor and all personnel have to be trained in personal hygiene.

The challenge also comes from the fact that there are so many different types and sizes—from small Amish plots to family organic acreage to large corporate conglomerates. “You can’t put produce farms in a box,” he said. And it is this very fact that leads to the complexity of the rule and the need for each farm to individually determine where it fits into the big picture—and if it’s in or out. “We all complain that the rules are lengthy and complex; but if they weren’t, we would complain that they were one size fits all,” Gorny said. “FDA has done its best to define the differences and provide flexibility.

Will farms be ready when the compliance dates hit? “Some are already doing it, some will be surprised,” he said. “My advice is to get started now. Take a look at your food safety program, then implement one or two things [from the rule] each season.”

The full Produce Safety Rule is available at http://1.usa.gov/1GWO4me.

Foreign Supplier Verification Program

When the Foreign Supplier Verification Program (FSVP) for Importers of Food for Humans and Animals rule first came to light in the 2011 enacting of FSMA, there was a lot of consternation in the industry because of the expected challenges of its implementation, said Mark Mansour, an attorney with Mayer Brown who focuses his practice on FDA regulatory matters. The Act set forth a mandate for FDA to develop the program, but it provided no mechanism to assess how difficult it would be for the agency to create the program and set verification standards, nor for industry to conduct the verification, Brown said.

This would be a particular challenge because the industry would not have to verify just its suppliers, but also its suppliers’ suppliers, likely requiring companies to hire a lot of new resources. Although the intervening years did see FDA development of FSVP, as set forth in the final rule, along with an increase in industry’s traceability initiatives—and enforced recordkeeping—both domestic and foreign, the challenges for industry remain. Essentially, as explained in a previous Legislative Update (July/August 2015) by Dr. David Acheson, founder and president of The Acheson Group and former FDA associate commissioner for foods, “FSVP is about supply-chain risk control. If you are an importer subject to FSVP, you will need to build a program that ensures your suppliers are meeting FDA requirements, including all the new ones of FSMA. This will include risk analysis and a process to ensure that your suppliers are following the rules. It also will be accompanied by a great need for recordkeeping so you can show FDA during an inspection that you are meeting the requirements.”

© tcly | Thinkstock.com

Among the challenges is the likelihood of a limited number of suppliers able to meet the verification. For example, Mansour said, any suppliers that cannot perform up to the requirements will need to be replaced. But with whom will importers be able to replace them? There may be no one providing that supply that can be verified as meeting the foreign supplier rule. There has always been mandatory recall of unsafe products—foreign or domestic. But this new rule adds the mandatory verification of food safety, not simply the prevention of unsafe food.

One of the reasons for the rule is the impossibility for FDA to inspect all food facilities that import food into the U.S. “Ninety percent of food ingredients come from abroad,” Mansour said. “If FDA were to inspect every food facility in the world that produces foods or ingredients, it would take 1,600 years to get around the world and back to plant #1.” This is also a key reason for the certifying of third-party auditors (as detailed in the The Third-Party Accreditation Rule, page 43).

Additionally, Mansour could see the U.S. having to face charges of the rule violating trade agreements, similar to that recently imposed by the World Trade Organization for the U.S. Country of Origin Labeling (COOL) policy. For example, will European facilities be willing to open their doors to a U.S. demand of inspection? Mansour asked. Or will U.S.-based facilities start to see “tit-for-tat retaliation” from foreign countries into which they import? Just as COOL came back to bite us, this probably will, too, at some point, he said.

With all that said, what should the industry be doing to comply with the rule? “Make sure you know what you’re getting from where, and keep records of it,” Mansour said. “The onus is on the company to know.”

It is a lot of pressure, but it’s also a lot of what companies are already doing—just more systematic, rigorous, and requiring dedicated resources and updating, he said. “We are essentially being mandated in order to manage the outliers,” Mansour said. A lot of companies are being required to do things because of those that are off the grid; and it has to be that way—FDA can’t discriminate, it has to be required of all.

The full Foreign Supplier Verification Program rule is available at http://1.usa.gov/1GWO4me.

The Third-Party Accreditation Rule

© LiudmylaSupynska | iStock.com

In general, the Accreditation of Third-Party Auditors/Certification Bodies to Conduct Food Safety Audits and to Issue Certifications rule (Third-Party Accreditation) outlines the requirements for an auditor or audit firm to become accredited to conduct food safety audits at foreign entities on behalf of FDA. Successful audits would result in certificates that are one component of the requirements to export foods to the U.S. via the Voluntary Qualified Importer Program (VQIP) or when the food is deemed particularly high risk and FDA requires the certification, explained Stephanie Lopez, president, AIBI-Certification Services.

Additionally, the rule identifies the procedures and requirements for accreditation bodies to be recognized by FDA and to perform accreditations of third-party auditors and audit firms. The rule also defines two types of audits to be performed by the accredited third parties:

• Regulatory Audit: To determine if a facility is in compliance with the FD&C Act, with the results used for determining eligibility for food certification.
• Consultative Audit: In preparation for a regulatory audit under the third-party certification program.

“The final key point is,” Lopez said, “If a condition that could cause or contribute to a serious risk to the public health is identified during a regulatory audit or a consultative audit, the audit firm is required to notify the FDA.”

APPLICABLE INDUSTRY SEGMENTS. Only a small percentage of foreign facilities would require the accredited third parties, she said, including:

• Facilities that are required to register with FDA (exclusive of alcohol or farms) and wish to enter into the VQIP Program on their own accord. This is a completely voluntary program that is anticipated to have user fees. It is not required for export of product into the U.S., rather it is designed to provide expedited services. 
• Manufacturers who produce product for export to the U.S. that is deemed particularly high risk due to product characteristics, facility history, geography, and other key factors. Most are foods subject to Detention without Physical Examination (DWPE).

There is some speculation that foreign entities beyond these will seek certifications under this rule, Lopez added, explaining, “Some experts are predicting that foreign facilities may use VQIP status as a marketing advantage, which would drive interest in the program. In addition, importers may elect to require certification as part of their foreign supplier verification program.” 

Conversely, there are factors that may discourage a foreign entity from seeking the certification, she said. For example, both the regulatory and the consultative audits require notification to FDA if the auditor identifies a condition that could cause or contribute to a serious risk to the public. With many of today’s third-party audits being retailer driven, the retailers’ view of these audits is yet to be seen. Thus, the way in which food safety compliance will be measured will continue to be largely market-driven, Lopez said.

INDUSTRY COMPLIANCE. Although the rule will impact the industry, it does not directly require food manufacturers to do anything differently. Any foreign facility that exports FDA-regulated product to the U.S. must comply with FDA regulations, and this rule does not change that overriding obligation. Rather, Lopez said, “This rule identifies one new way that compliance to FDA regulations by foreign entities may be assessed in the future.” However, she said, “Now, more than ever, food manufacturers need to understand the type of audit(s) they need and to ensure that what they signed up for meets their needs.” Each of the many types of audits in the food industry has its place, and this rule brings two more into the fold. Thus, she said, “It is important for manufacturers to understand that audits that meet regulatory requirements may not meet customer requirements and vice versa.”

The full Third-Party Accreditation Rule is available at http://1.usa.gov/1MPc4so.