Is FSMA Finally Final?

By Lisa Lupo

Although it has been more than eight years since the passage of the Food Safety Modernization Act (FSMA), and July brings the last of the general compliance dates for the seven major rules of FSMA, it seems that it will be a long while — if ever — before we can say that FSMA is finally final.

Not only are there some requirements yet to be written (e.g., Produce Safety Rule water standards), small and very small business compliance dates outstanding, and inadvertent non-compliance to be corrected, FDA Deputy Commissioner for Food Policy and Response Frank Yiannas is transitioning the industry from a food safety modernization act to a food safety modernization culture. Following is an overview of the seven major rules of FSMA, where the industry stands with each, and how it is transitioning to a new era.

PREVENTIVE CONTROLS (PC) RULES (FOR HUMAN AND ANIMAL FOODS). As the foundation of FSMA, the PC rules are the most extensive and complex. As such, there are some sections of the rule which seem to be causing the most difficulty for the industry and are, said The Acheson Group Senior Manager of Food Safety Christopher Snabes, the most common areas of inadvertent non-compliance. These include:

• Incomplete hazard analysis such as failure to perform a process hazard analysis; to identify where any re-work is coming from and going to; and/or to include radiological concerns, EMAs, and recognition of inherently intrinsic pathogens for an ingredient.
• Process PC validation studies are either not being conducted, are incomplete, and/or do not have proof that they were reviewed by the PCQI for acceptability.
• Incomplete or non-existent signatures on the Food Safety Plan and verification records.
• Lack of facility ownership of a supply-chain preventive control (if it is called out for a facility). Currently, if a facility is depending on a supply-chain preventive control, the supply chain needs to be fully vetted and documented at the facility with a written list of approved suppliers, along with explanation and documentation of how approval is attained for the hazard being controlled. FDA is currently exploring a two-tier inspection system whereby a corporate headquarters can maintain the supply-chain system in place for all facilities under its umbrella.
• Lack of a recall plan. Facilities often either have no plan at all, have only an incomplete plan, or the business assumes that the traceability SOP is sufficient for a recall plan. (It isn’t.) Additionally, too many corporate headquarters assume the corporate recall plan is sufficient for every facility under its umbrella. Currently, each facility is required to have a recall plan in place. FDA is currently exploring a two-tier inspection system for this as well, whereby a corporate headquarters can have a recall plan in place for all facilities under its umbrella.
• Failure to practice/enforce GMPs. This is particularly challenging for facilities with high employee turnover rates.
• Failure to properly treat the human food to animal food stream. Any human food destined for animal food use needs to be properly identified, handled, and stored.
• Lack of or incomplete letters of assurance: Companies that are not controlling a known hazard and are depending on a downstream entity to control the hazard with a preventive control often have few to no written letters of assurance between the parties detailing this step.

With such failures being seen across a number of industry establishments, it is critical that facilities assess their practices and processes for compliance. To do so, Snabes said, “Take a holistic look at the entire plan, facility, and food safety culture. Don’t depend on an audit checklist; don’t depend on a single food safety scheme auditor to make sure you meet all aspects of FSMA.”

Rather, Snabes recommended that facilities have a trained, well-engaged preventive controls, food defense, or FSVP Qualified Individual (PCQI, FDQI, FSVP QI) or trained produce grower who works with an independent consultant. Together, they should review your facility and plans, openly work with your entire food safety team, and look for opportunities where the facility can improve and close the gaps of compliance.

The PC Rules are not the only ones for which (often inadvertent) non-compliance is being seen:

• Sanitary Transport. “We have seen some companies under the Human and/or Animal Food Preventive Controls Rule not fully complying with or understanding what they need to do with the Sanitary Transport Rule,” Snabes said. This is evident in the documentation of training and understanding of which party is responsible for the training.
• Produce Safety. As the Produce Safety Rule (PSR) had the compliance dates for the agricultural water provisions delayed until 2022 for the largest companies, this rule remains incomplete. However, Snabes said, “It is encouraging to note that several leafy green producers are taking proactive steps now, and not waiting for the compliance date to go into effect, to produce safe crops.”

From the regulatory side of the picture, PSR inspections began this spring, largely conducted by the states, said FDA Deputy Commissioner for Food Policy and Response Frank Yiannas in the Town Hall presentation at the Food Safety Summit in May. He also noted that FDA is taking a hard look at the water standards and is working with trade groups on developing these. Both of the recent romaine lettuce outbreaks had a water connection, he said, adding, “This water connection is very important. I can’t overstate the importance of water.”

• Intentional Adulteration (IA). With general compliance to the IA Rule due in July, large businesses are expected to have a written Food Defense Plan in place along with other requirements of the rule. However, this is currently the most incomplete rule by the industry, Snabes said. Part of the reason is that many companies are waiting for FDA to publish the third and final guidance document for the rule; additionally, the vulnerability assessment training has just been released, which many companies need to have a Food Defense Qualified Individual — as required by the rule.

Because of this lack of readiness, FDA received numerous letters asking for an extension on compliance, Yiannas said. However, FDA decided to keep the date as set, he said, but the agency will hold off on IA inspections until Spring 2020, and inspectors will educate while they inspect.

• FSVP. Although most food companies are aware of FSMA, many importers who do not process food still need a Foreign Supply Verification Plan. “From my experience,” Snabes said, “This is one of the most overlooked rules.”

And it is an area on which FDA is focusing. FSVP inspections began in June 2017 with almost 1,500 conducted to date, and, Yiannas said, “We will do more FSVP inspections this year than last.”

• Accredited Third-Party Certification. Certification bodies are continuing to be accredited under FDA’s voluntary Accredited Third-Party Certification Program. This accreditation means that the companies have been given the authority to conduct food safety audits and issue food and facility certifications for foreign food facilities. The certifications can establish eligibility for participation in the Voluntary Qualified Importer Program (VQIP), which offers expedited review and entry of food, and fulfills the “rare and specific circumstances” under which FDA may require that an imported product be certified to prevent a potentially harmful food from entering the U.S.

FSMA FINAL? While various aspects of FSMA may be complete or nearing completion, FSMA compliance can never really be “finally final” in a food facility. As Snabes explained, “FSMA specifically states that the plans, and all moving parts, need to be reviewed and updated when needed, and all verification records need to be reviewed appropriately by the appropriate trained individual within the proper time frame (usually within seven days).”

Additionally, Yiannas has made it clear that the modernization of food safety will be an ongoing endeavor. “For me,” he said, “food safety modernization was never an act that was passed in 2011, it was a vision. It’s the idea that together we have to continue to improve our food safety approach.”

Additional evidence of this is FDA’s current focus, led by Yiannas, on the Blueprint for a New Era of Smarter Food Safety which, he said, “Will continue to be FSMA-based, but has to be technology enabled.” The world is becoming so digitized and food safety needs to keep pace with that. Digitization won’t solve everything, but it will help, he said. While blockchain, which Yiannas spearheaded during his previous global food safety role at Walmart, is likely to be at least an option in FDA’s traceability initiatives, he also noted the potential application of artificial intelligence (AI), for which a pilot is currently being conducted on imports. The goal is to determine if the system can be augmented to learn dynamically and be a predictive tool — which would then be shared with the industry.

Seeing the lack of traceability as the “Achilles heel of the industry,” Yiannas said, “We will advance track and trace of foods in a significant way.” But, he added, “It’s transparency we’re after, not just traceability.”

The author is Editor of QA magazine. She can be reached at llupo@gie.net.