Small Business Preventive Controls Compliance Soon Due

With two years having passed since the Federal Register publication of FSMA’s Preventive Controls rules, September 17, 2017, marks the date by which small businesses are to be in compliance with the Human Foods rule and the cGMPs of the Animal Foods rule. While there has been a great deal of discussion and coverage of the rules in various FDA and industry publications, much of the general “how-to” information has dwindled since September 2016 when the general compliance came due.

So to provide assistance to small businesses as you work to ensure you are in compliance, this column reviews some of the key elements of the Preventive Controls rule, changes from previous regulatory requirements, and areas the industry has been finding to be of the greatest challenge (i.e., the Food Safety Plan, environmental monitoring and controls, and recordkeeping).

Essentially, the Preventive Controls rule requires that you create and maintain a written food safety plan, perform a hazard analysis, institute preventive controls for the mitigation of those hazards, monitor controls, conduct verification activities to ensure controls are effective, take appropriate corrective actions, manage your supply chain, and maintain records documenting it all.

While FDA has built flexibility into the rule to allow food facilities to consider the nature of the preventive control, its facility, and its food safety system in establishing preventive controls, there are some areas of lesser flexibility or new specifications. So, a few of the key need-to-knows of the rule are:

• GMPs are no longer guidance; they are regulation.
• Training is now a regulatory requirement which must follow FDA-recognized curricula and be documented.
• Every food facility must have a preventive controls qualified individual (PCQI) with FDA-specified qualifications in training or experience. It is the PCQI’s responsibility to develop and oversee the food safety plan, perform the hazard analysis, and assign preventive controls.
• Environmental controls and monitoring are a critical component of the rule, as substantiated by the 150 to 200 environmental samples FDA is taking in food facilities during some of its inspections.
• Food facilities are required to use only approved suppliers by implementing a risk-based supply chain program to significantly minimize or prevent hazards in raw materials/ingredients for which it identifies a hazard requiring a control.
• The animal food rule establishes cGMPs for animal food production, with facilities that further process a byproduct for animal-food use allowed to follow either the human food or animal food cGMPs.
• Recordkeeping is a regulatory requirement and an area in which FDA’s access has been significantly increased. It often is said: “If you didn’t document it, it didn’t happen.” With the new PC rules, that is further expanded to: “If you document it, it better have happened like it was written”; and “If that documentation is not onsite or accessible when FDA requests it, it didn’t happen.”

However, implementing FSMA’s preventive controls should be more of an update of your current practices and standards (albeit now completely written out and documented) than the creation of new. As I’ve said in the past: If you are already doing things right and implementing food safety practices, FSMA compliance will simply mean extending your thinking and adding preventive controls based on risk.

In fact, if you’ve been doing things right, it is likely that none of what you currently have will need to be recreated. If you have implemented practices such as HACCP and environmental controls, you can likely roll it right into the written food safety plan, simply expanding it to include the Hazard Analysis Risk-Based Preventive Control (HARPC) requirements of FSMA.

What “expanding” will be needed? While this will, of course, be different for every facility, you can determine where you need to add risk-based preventive controls through a three-step review/action plan:

1. Look at each area of your operation, asking, “Do I have a risk?”
2. Where potential risk is found, ask, “Does this require a preventive control?”
3. If it does, and there’s not one in place, determine what the control should be, write it into your food safety plan, and implement it.

Although small (and very small) businesses were given a longer timeframe to implement the provisions of the rule, it is no less important that preventive controls be established and followed for the small runs of local businesses than for the massive runs of global businesses. In fact, smaller companies have the advantage of FDA guidance having been published a year before compliance was due (rather than a couple weeks, as was the case for the first round of compliance), and the ability to follow in the wake of lessons learned during the first year of compliance.