The FSMA Scramble: What Applies and How Do I Do It?

Ever since completing my term as FDA associate commissioner of foods, I have sat on QA’s Advisory Board, through which I began contributing this bi-monthly Legislative Update column. For nearly as long, I have posted a weekly blog on my achesongroup.com website. The topics of and responses to that blog, which is also distributed as an e-newsletter, frequently provide a basis for the topics selected for this column. And that is exactly the case in this issue.

If you receive the e-newsletter, you will have seen my April blog entitled The FSMA Scramble. I came up with this phrase because so many people I’ve spoken with — from small companies to large multi-nationals — are scratching their heads over their processes and trying to figure out what they are doing right and what needs to be changed — by September. Trade associations are saying their members have no idea whether they fall under the preventive controls (PC) or produce safety rule; and even FDA seems to be unsure about it all. Agency officials are saying they understand that everyone is working on a learning curve (including themselves) and this will be taken into consideration come September. However, I just received a call from a citrus-packing client, whom we understood to be exempt from the PC rule, who said an FDA inspector told him they needed to be registered with FDA and in compliance with the FSMA PC rule come September.

I’d certainly call all this a “scramble” (which just sounds so much nicer than “chaos”). And whether or not you’ve already seen and read my blog, I think this column will be of interest to you, as it provides some variation on the topic, with a concise look at the key points of The FSMA Scramble.

But let’s start with the why and the what: Because the rules are complex and interrelated — and, as of this writing, we have not seen any guidance from FDA other than for qualified facilities (those with less than $1m in food sales), much of the industry is scrambling to understand the provisions of the rules and the relevant application in their plants — let alone working to comply. And of all the rules, it seems the one that is most cumbersome is the one for which the deadline is fastest approaching: the preventive controls rule; in particular, the supply-chain and environmental-monitoring requirements, and the shift from HACCP to HARPC. So let’s take a look at those.

THE SUPPLY CHAIN SCRAMBLE. Until I received the call from the citrus packer, I had thought that it shouldn’t be too difficult for an establishment to determine if it is a manufacturer, processor, packer, or holder of food plant under the PC rule for human food (or animal food) or a primary farm under the produce safety rule. As it turns out, the interpretation of those rules and their exemptions is apparently a bit less solid than I had thought. Now, add to that, the need to determine the applicable rule, and know all the applicable provisions, for all your suppliers to verify that they are FSMA compliant — making your supply-chain program compliant. For example, if your supply chain includes any ingredients from a farm (and whose doesn’t?), what do you need to know to verify their compliance?

FDA seems to acknowledge this itself in its establishing of separate compliance dates for supply-chain provisions “so that a food facility will not be required to comply with the supply-chain program provisions before its supplier is required to comply with the preventive controls for human food rule or the produce safety rule.” And in its exemptions based on downstream activity: “A facility will not be required to implement a preventive control when an identified hazard will be controlled by a subsequent entity such as a customer or other processor.”

So now, you not only need to figure out what applies in your facility, but how the activities of your upstream and downstream chain impact it. While FDA’s comments make sense, they still cause quite a scramble for facilities attempting to get everything in line before the due dates hit — and FDA arrives at the door to inspect against the new rules.

THE ENVIRONMENTAL MONITORING SCRAMBLE. The preventive controls final rule added environmental monitoring requirements (to which FDA only alluded in the proposed rule), considering it and product testing to be possible verification activities … but ones that “are only required as appropriate to the food, facility, nature of the preventive control, and the role of that control in the facility’s food safety system.” It also stated, “Environmental monitoring generally would be required if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control.” Which simply elicited industry’s next questions: Exactly what is considered to be a ready-to-eat food? Will each inspector have a different perspective on this?

Regardless, though, environmental monitoring essentially comes down to preventing risk, as discussed in the next section:

THE HACCP TO HARPC SCRAMBLE. Probably the greatest challenge in transitioning from HACCP to HARPC (FSMA’s Hazard Analysis Risk-Based Preventive Control requirements) is understanding the difference. Having addressed this shift in my Legislative Update column “FSMA Compliance = Update Not Create” (QA March/April 2016, http://bit.ly/23oVR6F), my general guidance on this is: If you have implemented food safety practices in your plant such as HACCP — and what you’ve done is right, HARPC compliance is pretty much a matter of taking it a step further.

That is, instead of focusing on single steps (CCPs) to control hazards, view all of your plant processes as a whole, and then conduct a hazard analysis to determine the risk-based controls you need to put in place to prevent the hazards from occurring: i.e., HARPC.

So, for environmental monitoring, you would analyze: What risks are inherent in the environment? How can these be prevented? In many cases, that answer is sanitation based. While neither your sanitation program nor its testing are CCPs, a lack of either poses a potential risk.

Part of the scramble of HARPC is defining these somewhat subjective risks and hoping the FDA inspector is of the same mind, or that your written verification, validation, and food-safety plan are enough to get him or her to see your perspective. Or at least initiate a discussion and resolution — rather than immediately issuing a 483, or worse, a Warning Letter.

UNSCRAMBLING FSMA. As anyone knows who has begun the process of unscrambling FSMA for compliance, these are just a few of the challenges being faced. And, unfortunately, neither I, nor any other industry consultant, has an absolute answer until we see the guidance documents when they are finally issued by FDA. And, until we see how the FDA inspectors are interpreting these new regulations. I do, however, want to acknowledge and reference FDA’s Technical Assistance Network (http://1.usa.gov/1KItIxw), through which FSMA-related questions can be submitted to the Agency, and which FDA will be tracking to help it prioritize FSMA policy, guidance, and training. Additionally, FDA has collaborated with the Food Safety Preventive Controls Alliance ((http://www.iit.edu/ifsh/alliance) to establish training and technical assistance programs.

So until we get FDA’s guidance, I would recommend that you simply continue to do what you can to understand the rules, apply what you can to your facility — then check out the listed FDA resources and seek the expertise of knowledgeable consultants to help you unscramble the rest.

David Acheson is the Founder and CEO of The Acheson Group.