Taking a Deep Dive Into the PC Waters of FSMA

If you’ve read anything on FSMA’s Preventive Controls (PC) rules in any media since the issuance of the first proposed rule, and you are a registered firm that needs to comply, you likely know the general requirements of the rules (e.g., you now need to maintain a written food safety plan, perform a hazard analysis, institute preventive controls for the mitigation of those hazards, monitor controls, conduct verification activities to ensure controls are effective, take appropriate corrective actions, manage your supply chain, and maintain records documenting it all). So, rather than reiterate any further on all that, this column will take a deeper dive into some of the aspects of the rule that are lesser known—with a bit of an overview for context.

FDA sees the rule as better protecting public health as we move into the future not only by creating new requirements for hazard analysis and risk-based preventive controls but also by modernizing the cGMPs (which were last updated in 1986), clarifying farm exemptions, and establishing recordkeeping requirements. While there are some changes and updates from the proposed rule, they were not particularly extensive. However, there are a few that will have a distinct impact on some facilities. So, what do I see as the key components of the PC rules of which facilities need to be aware?

On the positive side, FDA has built increased flexibility into the requirements, allowing food facilities to consider the nature of the preventive control, the facility, and its food safety system in establishing preventive controls, and providing flexibility in how a facility controls its supply chain and determines specific records to be kept for monitoring, etc.

There are some areas where there is less flexibility or new specifications in the final rules that I see as particularly critical in the arena of “need to know.” (While the following provides only brief bullet points of these, as necessitated by the parameters of this column, you can find in-depth analysis of each in my blogs, as noted at the end of this column.)

• In the updating of the cGMPs, some previously nonbinding provisions are now binding rules. For example, in the new training requirements, employees who manufacture, process, pack, or hold food must have the necessary combination of food safety education, training, and/or experience in their assigned duties.
• Training is now a regulatory requirement for the first time in history. And that training must follow FDA-recognized curricula and/or be FDA approved. And don’t forget to keep records of all the training.
• There is a new “qualified individual” distinction—the “preventive controls qualified individual.” This is a more highly qualified position/level in the organization with responsibility to oversee the food safety plan, perform the hazard analysis and assign preventive controls. It is defined as “a person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply a food safety system.” Everyone involved in manufacturing, processing, packing or holding food will need to be a qualified individual, based on education/training as applied to their duties—with the assumption that each will be a “qualified individual” for his/her assigned role.
• Environmental monitoring is now mandated in certain facilities, with domestic and foreign facilities required to “institute risk-based environmental monitoring … as appropriate to the food, the facility, and the nature of the preventive controls.” The rules include some particulars associated with the establishment and implementation of written procedures for environmental monitoring, but FDA declined requests to define factors associated with developing a program. This was primarily because of variation in facilities, processes, and products means that the procedures will not be identical from one facility to another.
• There are exemptions and/or modified requirements for warehouses that are solely engaged in the storage of unexposed, packaged foods; however, there are a number of exemptions to the exemptions. That is, the warehouse must be solely engaged in holding activities and the food must be completely unexposed. There are some very specific requirements for both of these. For example, blending of two shipments of the same grain is considered a holding activity, but mixing of two different grains is not, and, although vented cartons are a standard way of shipping some produce, the openings do cause enough exposure to negate the exemption for warehouses holding such products.
• The definition of farms has significantly changed to include primary and secondary farms, with some being exempt and some still required to follow preventive controls rules. This is one area which, while helpful to some, has created some disconnect, as secondary farm requirements are based on ownership rather than public-health risk.
• To “provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented,” a manufacturing/processing facility must implement a risk-based supply chain program for raw materials/ingredients for which it identifies a hazard requiring a control—unless it controls the hazard using preventive controls of the PC rules.
• The animal food rule establishes cGMPs for animal food production, with facilities that further process a byproduct for animal-food use allowed to follow either the human food or animal food cGMPs.

With all this, recordkeeping is probably the most critical aspect of the new rule. It has been said in the past—“If you didn’t document it, it didn’t happen.” With the new PC rules, this is not just a saying, it is a mandate, with the further factor that: “If that documentation is not onsite and accessible when FDA requests it, it didn’t happen.”

For more detailed information on the specifics of the rule, visit Dr. Acheson’s blog page, http://achesongroup.com/blog.