The Food Safety Modernization Act

Editor’s Note: This is the second in a series on the industry impacts of the Food Safety Modernization Act by QA Advisory Board Member and former FDA Commissioner, Dr. David Acheson, Managing Director, Food and Import Safety Practice, Leavitt Partners.

Prevention rather than reaction is not a new concept to the food safety world. However, until the recent passage of the Food Safety Modernization Act (FSMA), regulatory requirements for preventive controls were minimal. The exception to this was for processors of seafood, juice, and low-acid canned food who were already required to have preventive controls in place and to maintain a hazards analysis and critical control point (HACCP) plan. Many other types of operations have HACCP or HACCP-like preventive controls in place as a matter of best industry practice; however, under FSMA, preventive controls will be mandatory for FDA-registered firms, and HACCP will be only one part of the requirement.

The new legislation does not change the requirements for facilities already operating under HACCP; however, all registered foreign and domestic facilities will now be required to implement preventive controls and maintain a food safety plan. Within a year and half of enactment, FDA is required to issue regulations to establish science-based standards for conducting a hazard analysis, implementing preventive controls and documenting implementation of preventive controls. To ensure ongoing compliance with U.S. laws and regulations as new requirements are put into place, industry should be aware of the requirements in the preventive controls provision and begin conducting a gap analysis to assess existing programs or begin implementing new programs before the requirements take effect.

All registered facilities in the United States and abroad that manufacture, process, pack, hold, or distribute food that are required to register with the FDA as part of the 2004 Bioterrorism Act will be required to comply with the preventive controls provisions. The legislation provides for exemptions or modified requirements for “qualified facilities.” To be considered a qualified facility, the operation must meet the definition of a “very small business,” as defined in the preventive control regulation yet to be issued by FDA. To qualify, the average annual monetary value of the food manufactured, processed, packed, or held at the facility over the last three years must be less than $500,000 and the value of food that is sold directly to consumers, restaurants, or retail facilities that are within the same state as the facility or within 275 miles of the facility must exceed the value of food manufactured, processed, packed, or held by the facility that is sold to all other purchasers.

While qualified facilities are not subject to the new preventive controls requirements, they will be required to submit to FDA documentation that demonstrates that they have identified hazards, implemented preventive controls, and are monitoring to ensure the controls are effective or document that the facility is in compliance with state, local, county, or other non-federal food safety laws and any additional documentation required by FDA. In addition, FDA may provide exemptions for certain facilities that are engaged only in specific types of on-farm manufacturing, processing, packing, or holding activities that FDA determines to be low risk. Much of the detail will emerge as FDA begins to publish draft regulations, so this topic needs to be watched carefully by all registered firms large and small.

Compliance with the preventive controls provision will require all registered facilities that do not meet the exemption criteria above to evaluate hazards, implement preventive controls to mitigate those hazards, validate that the preventive controls create the desired reduction in risk, monitor that the preventive controls are working properly, and document their preventive strategy in a food safety plan, as detailed below.
 

Hazard Analysis:
Registered facilities will be required to conduct an analysis of all hazards present in their facility, including biological, chemical, physical, and radiological hazards. This includes hazards that occur naturally, are unintentionally introduced, or are intentionally introduced, including by acts of terrorism.
 

Preventive Controls:
For all identified hazards, preventive controls will need to be ascertained and implemented to assure that all hazards will be significantly minimized or prevented and the food produced by a facility is not adulterated or misbranded. The legislation defines preventive controls as “those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent” hazards.
 

Monitor Preventive Controls:
Facilities will need to monitor the effectiveness of the preventive controls and establish corrective action procedures to address any situation where the preventive controls fail to adequately control the risks and to assure that affected food is prevented from entering into commerce.
 

Verify Preventive Controls: Facilities will need to validate and document that the preventive controls have the desired effect in reducing risk. As FDA develops and establishes new performance standards, facilities will need to ensure the preventive controls result in a reduction consistent with established performance standards. For example, if a peanut butter manufacturer has determined that the roasting step for the nuts is an important preventive control, it will have to validate that the settings on the roaster are providing the degree of prevention expected (e.g. X log reduction in pathogens). The manufacturer will have to verify that the equipment is operating within the designated parameters; monitor the various elements (e.g. dwell time, temperature, belt speed, and nut bed depth); and develop a series of corrective actions that address situations when the monitoring indicates that the desired outcome is not being met.
 

Preventive Control Record keeping and Documentation: 
Facilities will be required to create (and share with FDA inspectors upon request) a written food safety plan that documents and describes the facility’s procedures for complying with the preventive controls provision. All documentation of preventive controls must be kept for a minimum of two years.

Per the language in the FSMA, facilities will need to reanalyze and update their documentation in the written food safety plan whenever a significant change is made in operations that creates reasonable potential for a new hazard, significantly increases potential for a previously identified hazard, or increases a hazard; or it must update the plan at least every three years. Tracking this to determine what the FDA considers to be a “significant change” will be important in the future. As new hazards are recognized by FDA and new scientific developments are made, the agency may require facilities to conduct a reanalysis.

Facilities will also need to be aware and up to date on other FSMA provisions that may impact their hazard analysis, including the establishment of new performance standards by FDA and the development of guidance and regulations on controlling the risks from intentional adulteration.

In addition to having specific preventive controls for each identified hazard, facilities will need to have broad prerequisite programs in place similar to Good Manufacturing Practices (GMPs), which may include:

• Sanitation procedures; 
• Supervisor, manager, and employee hygiene training;
• Environmental monitoring programs to verify the effectiveness of pathogen controls; 
• Food allergen control programs; 
• Recall plans; and
• Supplier verification activities.

Good Manufacturing Practices.
The agency is also looking to modernize the current Good Manufacturing Practices (GMPs), and the final preventive controls regulation will reflect any updates to the GMPs. (Current standards are available at (http://www.fda.gov/Food/GuidanceComplianceRegulatoryInformation/CurrentGoodManufacturingPracticesCGMPs/ucm110877.htm.)
Food manufacturers who want to stay ahead of the new regulations should begin to think about this broad scope of preventive controls including specific hazards and critical control points in their facility, as well as more broadly applied GMPs, and identify where preventive controls are needed to mitigate their specific facility hazards and reduce risks. One suggested approach is to undertake a “gap analysis” in which the current systems are compared with what will likely be required as part of the FSMA. This will then provide firms with insight into areas that need more work in a time frame that is reasonable in terms of ultimate time to compliance.

While the final preventive controls regulation issued by FDA probably will not look exactly like the current HACCP programs for seafood, juice, and low-acid canned food, the existing programs do provide insight for industry on how to begin thinking about and conducting a hazard analysis of their facility. FDA’s Hazard Analysis and Critical Control Point Principles and Application Guidelines (http://www.fda.gov/Food/FoodSafety/HazardAnalysisCriticalControlPointsHACCP/HACCPPrinciplesApplicationGuidelines/default.htm) outlines the process a facility should follow to implement a HACCP plan.

Many of the principles included in the guidelines could be valuable to a facility in conducting an internal assessment in anticipation of the new requirements. For example, facilities should be thinking about developing a team of experts with knowledge and expertise of the food products and processes, similar to the HACCP team. In addition, facilities can currently be documenting processes and thinking about the critical control points in their processes. FDA’s guidelines list examples of questions to be considered when conducting a hazard analysis (Appendix C). While not all questions are applicable to all food products and processes, they provide a good place for a facility to begin identifying all hazards.

Once FDA issues the preventive controls regulations, facilities will likely be required to come into compliance quickly. New authorities given to FDA mean that delays in compliance could result in a facility not being able to offer product for sale in the U.S. or import products into the U.S. Under FSMA, FDA has the authority to suspend a facility’s registration, thus preventing it from entering product into commerce if there is a reasonable probability that the food would cause a serious adverse health consequence or death to human or animals.

By understanding the legislation and the new requirements, facilities will be in a position to provide input to FDA as part of the rule-making process as the regulations are developed and will be able to begin assessing their facilities now to ensure they maintain continuous compliance with U.S. laws and regulations in the changing landscape of food safety. 

Dr. David Acheson is Managing Director, Food and Import Safety Practice, at Leavitt Partners (www. leavittpartners.com). From 2002-2009, Dr. Acheson was with the U.S. Food and Drug Administration (FDA) in a variety of positions culminating as Associate Commissioner for Foods, prior to which he was active as an internist and in academia, with a specialization in foodborne illness. Dr. Acheson can be reached at dacheson@gie.net.