FSMA Where Have We Come From? Where Are We Going?

As we move into April, 2014, the Food Safety Modernization Act (FSMA) has now been law for a little over three years, having been signed in January 2011. As we all know, some of the rules were enacted immediately, several of which are impactful on the food industry. The increased records inspection authority and administrative detention rules are both alive and well from a regulatory perspective and are being enforced already. FDA has used suspension of registration just once and has not yet used the mandatory recall authority—but almost did a little while ago with pet food.

So while we don’t have a lot of final rules yet, what we do have is the full compendium of the new preventive control expectations for many in the food industry. We have seven proposed rules, some out for comment and some now closed for comment. The seven rules include preventive controls for human foods; preventive controls for animal foods, produce rules; foreign supplier verification program; third party auditor rules; food defense rules, and, most recently, the sanitary transport rule.

Now that we have had the opportunity to read all these new rules, it is evident that the FDA has been consistent in the risk-based, preventive control thinking across all seven of the proposed rules. As mentioned, these rules are touching virtually every sector in the food industry. Yes, there are exceptions related to size of the business, and there are expectations if you undertake various activities; but if you grow food, process food, store food, import food, distribute food, sell food, or, in the context of the latest sanitary transportation rule, ship, transport, or receive food—then FSMA impacts you. The corollary of this is that for many food companies, there are several of the seven proposed rules that will impact your operations.
 

From Reactive to Preventive.

Traditionally, FDA has been a very reactive agency, but as outbreak after outbreak occurred during the last decade, regulators, Congress, industry, and consumers realized it was time to enforce prevention, and that is exactly what FSMA is all about. The seven proposed rules have a number of clear consistencies with regard to that approach, and it is important for food companies impacted by more than one of the new rules to recognize and leverage this.

The fundamental principles of the rules speak to really looking at your risk profile with regard to food. But today you have to think from both the accidental viewpoint (preventive control rule) and from that of a terrorist (food defense rule). If you are an importer for FDA-regulated food, you have to do the same thing—look at the food you are importing and control your supply chain based on risk. The same principle holds for those that ship, transport, or receive food.

The FDA is expecting you to understand your risks to a fair degree of detail; they expect you then to be able to rank those risks and establish process and technology to manage the risk. In the preventive control rule, this may involve cooking a product to an adequate temperature; in food defense, it may involve controlling access. But the basic principle is the same for both.

Aside from being consistent in the way that FDA is expecting the regulated industry to think about risk, the agency also is being consistent about how those impacted by the seven proposed rules need to establish monitoring systems. You have to know if your controls are working pretty much across the board. It is not enough just to implement the control, you have to monitor it on an ongoing basis to know that the control you have implemented is doing what it was intended to do and is controlling the identified risk.
 

Recordkeeping.

Another very consistent theme in the rules is keeping a record of what you are doing. Several of the rules call for a plan of some type (e.g., the two preventive control rules, the foreign supplier verification program, and the food defense rule). So writing a plan is going to become part of the thinking for many food companies.

However, having the plan is not enough—you have to document that you are keeping track of all the moving parts in your plan, and that you record all those important bits of information. The FDA has made it clear that they expect you to do this and they will be looking at those records during routine inspections.

This new expectation for recordkeeping likely will be one of the most costly and difficult things for the food industry to manage moving forward as the rules become final. As noted earlier, if you are a medium-sized food company, you may have to keep records around multiple foods and for multiple rules. For example, if you are making a food for human use that involves importing even one ingredient, and then you are shipping that food to a distribution center, while your scraps go to animal feed, you will likely be impacted by at least five of the proposed seven rules: the preventive control rule for human food, the preventive control rule for animal food, the foreign supplier verification program, the food defense rule, and the sanitary transportation rule. That is a lot to get your head around.

Finally, as we look at all this complexity, there is not all that much time to get the job done. FDA has recently announced specific dates by which the rules will be final and these begin in August 2015, with all but two rules (sanitary transport and food defense) due out in final form by the end of October 2015. These latter two are due out by May 2016. So what this means is that by fall of 2016, these rules will be enforceable.

To some, more than two years away seems like a long time, but remember these rules are very comprehensive and very complicated, and it is highly likely that if you make food you will be hit by many of them at the same time. So don’t wait, get moving now on understanding what you will have to do and which sets of rules will impact you, and start to plan how to implement changes.