NSAC's Blog
Who is Subject to FDA’s New FSMA Food Facilities Rule? – Part 3
September 23, 2015
This is the final post in our multi-part series analyzing FDA’s recently released Preventive Controls Rule for Human Food, and the rules and requirements for farms and facilities that may fall under its purview. The first post analyzed those farms and food enterprises that are exempt from the rule. The second post looked at exemptions from certain parts of the rule for farm mixed-type facilities and small-scale facilities. This post explores the requirements for facilities that are fully covered by the rules, including alternate requirements for facilities that supply from farms and small facilities.
As we’ve covered in our earlier posts, farms and small local food businesses may not be subject to any of the Food and Drug Administration’s (FDA) new Preventive Controls Rule because they are exempt from registration. Or, they may be exempt from certain portions of the rule due to their small sales volume or the types of value-added processing they’re doing on their farm.
This post addresses those farm mixed-type facilities and facilities that are not exempt from the rule’s requirements and are subject to the full Preventive Controls Rule (aka the “HARPC” requirements). It provides details on what’s required, the staggered compliance timelines, the relevance of third party audits, and alternate requirements for facilities that are supplying ingredients from qualified farms and facilities.
What is HARPC?
The Food Safety Modernization Act (FSMA) required FDA to develop regulations for “Hazard Analysis and Risk-based Preventive Controls” (HARPC) requirements at food facilities. These requirements include a hazard analysis and the implementation and monitoring of preventive controls to ensure that hazards are addressed. These HARPC requirements must be written and documented in a food safety plan at a facility. The HARPC requirements make up the bulk of the new requirements that facilities must comply with in the Preventive Controls Rule. The HARPC requirements are based on and are similar to a “HACCP” – Hazard Analysis and Critical Control Points – approach, but there are differences.
Food Safety Plan
1. Prepared by a Preventive Controls Qualified Individual
The first HARPC requirement is that facilities must prepare – or have prepared – and implement a written food safety plan, and the plan must have been written or overseen by a one or more “preventive controls qualified individuals.” A preventive controls qualified individual is:
A qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or is otherwise qualified through job experience to develop and apply a food safety system.
Remember from our last post, a qualified individual is:
A person who has the education, training, or experience (or a combination thereof) necessary to manufacture, process, pack, or hold clean and safe food as appropriate to the individual’s assigned duties. A qualified individual may be, but is not required to be, an employee of the establishment.
So the distinction between a preventive controls qualified individual and a regular qualified individual is that a qualified individual must have the education, training, or experience necessary to do his or her job at the facility; a preventive controls qualified individual, on the other hand, must have had specific training in how to develop and implement a food safety system, or must be otherwise qualified through job experience to do so. At this time, FDA has not provided information on how an individual’s job experience will be assessed as equivalent to taking a training program.
The preventive controls qualified individual has additional responsibilities in overseeing activities related to implementing the food safety plan.
2. Contents of a Food Safety Plan
The written food safety plan must include:
- Hazard analysis;
- Preventive controls;
- Supply chain program;
- Recall plan;
- Procedures for monitoring the implementation of the preventive controls;
- Procedures for taking corrective actions; and
- Verification procedures.
We will broadly describe each of these categories below. Please note that the information below does not detail the entirety of what is contained in the rules. Rather, these topics are painted in broad strokes, and we have provided links to sections of the rule were you can see the requirements in their entirety.
To fill in the gaps between the regulations and what you have to do to comply, we will be providing more information on what’s required as FDA issues guidance documents on HARPC, as well as information on training programs and educational materials as they become available.
Hazard Analysis
The hazard analysis component of the food safety plan identifies and evaluates any “known or reasonably foreseeable” hazards for each type of food that is manufactured, processed, packed, or held at the facility, to determine whether there are any hazards that require a preventive control to minimize their likelihood of occurrence.
A known or reasonably foreseeable hazard could be naturally occurring or unintentionally introduced, and could include: biological hazards (e.g. microbiological hazards, environmental pathogens), chemical hazards (e.g. pesticide residue, food allergens), and physical hazards (e.g. glass, stones).
The hazard analysis must include an evaluation of the hazards identified that assesses the severity of the illness or injury that could result if the hazard were to occur, and the probability that the hazard would occur if preventive controls weren’t in place.
FDA will be issuing detailed guidance on the hazard analysis and preventive controls, but it’s important to note that the hazard analysis could determine that there are no hazards requiring preventive controls. In such an instance, the hazard analysis must still be written out, and must document support for the determination that preventive controls are not needed. FDA has indicated a few instances where that might happen.
The first would be for facilities that are only doing food processing activities from FDA’s identified list of low-risk food/activity combinations. In the previous post, we discussed how farm mixed-type facilities could be exempt from HARPC if they only perform the types of activity/food combinations FDA has identified as low risk. FDA states in the preamble to the PC Rule that:
An off-farm facility that makes sugar from sugarcane or sugar beets can consider the findings of the section 103(c)(1)(C) RA (i.e., that this is a low-risk activity/food combination) in determining whether there are any hazards requiring a preventive control. A facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components.
So presumably an off-farm facility engaging in processing activities that FDA has identified as low-risk could point to FDA’s analysis of those activities to support a determination that the facility does not need to go beyond the hazard analysis component of the food safety plan.
A second type of facility that may be able to determine that it is not required to establish the full preventive controls and associated management components (e.g. monitoring, verification, corrective actions), is an operation that packs and holds produce, but is not a farm that is exempt from registering. The rule allows such operations to follow the Produce Rule instead of CGMPs and elsewhere in the preamble to the rule, FDA notes that such operations’ HARPC plan would largely involve following the Produce Rule’s requirements for packing and holding produce, for example by:
Draw[ing] from the provisions of the produce safety rule in developing its food safety plan and establishing preventive control management components that are appropriate in light of the nature of the preventive controls and their role in the facility’s food safety system…
[W]e expect that the food safety plan for an off-farm packinghouse would focus on a few key preventive controls, including some that would have counterparts in the proposed produce safety rule, such as maintaining and monitoring the temperature of water used during packing. We also expect that an off-farm packinghouse would establish sanitation controls to address the cleanliness of food-contact surfaces (including food-contact surfaces of utensils and equipment) and the prevention of cross-contamination from insanitary objects and from personnel to food, food-packaging material, and other food-contact surfaces.
Despite this language, there are concerns that – under this regulatory structure – off-farm packing operations that perform the same activities as produce packing operations located on farms will be held to different standards despite doing the same activities. FDA acknowledges in the preamble that there are requirements in the PC Rule that do not have counterparts in the Produce Rule (e.g. environmental monitoring and product testing), but that it would be “uncommon” for operations that solely pack and hold intact produce to have these verification activities as part of their food safety plan.
To address the concerns surrounding this issue and the interplay between Produce and PC Rule requirements, we expect FDA will come out with additional information regarding the HARPC requirements specifically as they relate to the off-farm packing and holding of produce.
Preventive Controls
As part of the food safety plan, the facility must establish (and implement) written preventive controls for each known or reasonably foreseeable hazard identified in the hazard analysis, which include:
- Process controls (e.g. heating, acidifying, or refrigerating);
- Food allergen controls (e.g. avoiding cross contact during storage or handling; labeling);
- Sanitation controls (e.g. keeping food contact surfaces clean);
- Supply chain controls (e.g the supply chain program, discussed below);
- A recall plan; and
- Other controls as appropriate (e.g hygiene training for employees).
There are instances where you may not be required to implement a preventive control even if a hazard requiring a preventive control has been identified. For example, if the type of food couldn’t be consumed without application of an appropriate control (e.g. raw agriculture commodities such as coffee beans), or if you have received and documented certain written assurances from your customers, implementing a preventive control is not required.
Recall Plan
You must establish written recall plans for foods that you have identified as having a hazard that requires a preventive control.
Preventive Control Management
You are required to establish certain management components for the preventive controls that are part of your written food safety plan. These managements components — which include monitoring, corrective actions, and verification — are intended to ensure the effectiveness of the preventive control.
The supply chain program (described in more detail below) is also subject to management components, which include corrective actions, record review, and reanalysis.
Each of these types of management components are required only “as appropriate to the nature of the preventive control and its role in the facility’s food safety system.”
In the preamble to the PC Rule, FDA acknowledges that this language is intended to provide flexibility for the facility to only do those monitoring, corrective, or verification activities that are relevant to the facility, and that not all of the management components will be necessary except “as appropriate to the facility, the food, and the nature of the preventive control.”
1. Monitoring
You are required to monitor preventive controls with “adequate frequency to provide assurance that they consistently performed.” The monitoring component of the food safety plan must include written procedures for monitoring preventive controls (for example, checking the temperature of the refrigerator for foods that require temperature control), including the frequency with which they are to be performed, and a process for documenting that they are being performed.
2. Corrective Actions
The corrective action component of the food safety plan must include procedures that will be taken if preventive controls are not properly implemented. For example, corrective action procedures must describe the steps that will be taken to identify and correct the problem; reduce the likelihood that the problem will recur; evaluate the safety of the affected food; and, prevent any affected food from entering commerce if its safety cannot be evaluated.
3. Verification
Verification activities are required for many components of the food safety plan. In particular, you must verify that the preventive controls are being consistently implemented and are effectively and significantly minimizing or preventing the hazards. Such verification activities include:
– Calibration of monitoring instruments;
– Product testing (for a pathogen or other appropriate indicator organism);
– Environmental monitoring (only for facilities making ready-to-eat/RTE foods where an environmental pathogen has been identified as a hazard requiring a preventive controls) by collecting and testing environmental samples; and
– Record review.
As with other preventive control management components, verification activities should be selected “as appropriate to the nature of the preventive control and its role in the facility’s food safety system,” and other verification activities can be selected aside from those listed above as appropriate.
FDA heard from many stakeholders during the proposed rule stage about the costs associated with environmental monitoring and product testing, and their questionable role – in particular – for facilities that are only packing and holding produce. In response, FDA acknowledges in the preamble to the rule that:
We do not expect either product testing or environmental monitoring to be common in facilities that process, pack, or hold produce RACs. We agree that there would be little or no benefit to product testing or environmental monitoring in facilities that pack or hold produce RACs that are rarely consumed raw, such as potatoes.
We expect that many facilities that process, pack, or hold produce RACs that are RTE foods may conclude, as a result of their hazard analysis, that neither product testing nor environmental monitoring is warranted.
We also expect that many facilities that process, pack, or hold produce RACs that are RTE foods will conclude that the limitations of product testing when applied to produce reduce the value of product testing for their products and would direct their resources to food safety practices and verification measures other than product testing.
Supply Chain Program
If a facility is receiving raw materials or ingredients from a supplier, and the facility has identified a hazard related to those ingredients that requires a “supply chain control” (i.e. where the hazard is supposed to be controlled by the supplier before receipt by the facility), then the receiving facility must establish a supply chain program.
If the facility receives raw produce that it uses in processing ready-to eat (RTE) foods, and it receives the produce through a distributor – rather than directly from the farm that grows the produce and is subject to food safety requirements under the Produce Rule – then the facility is also responsible for verifying that the distributor verified the food safety practices of the farm, or the facility must review the farm’s documentation itself to verify that the farm is applying the necessary food safety preventive controls during production and harvest of the produce.
So this component of the HARPC plan would probably not apply to a farm mixed-type facility that is processing foods that it grows itself – for example, making fresh salsa from the farm’s own produce. If, however, the farm sources tomatoes for the fresh salsa from another farm, then the supply chain program would likely be required.
If, on the other hand, the farm was sourcing tomatillos for salsa, then it likely would not need the supply chain program because the farm making the salsa would be cooking the tomatillos. Therefore it is up to that farm to significantly minimize any hazards associated with the tomatillos by properly cooking them.
Now take the situation of a food hub that is aggregating produce from local farms and processing it for use in school cafeterias. If, for example, the food hub is sourcing carrots and peeling them to be eaten raw, then the supply chain program would likely be required as part of the food hub’s compliance with the PC Rule. If the food hub was only sourcing and peeling produce that was then treated with a “kill step” (e.g. winter squash or potatoes, which must be cooked before eating), then the food hub would likely not have to implement the supply chain program component of the HARPC requirements.
Keep in mind that if the food hub is a “qualified facility” — that is, grossing less than $1 million in sales — then it is not required to follow the full HARPC requirements, including the supply chain program. However, other modified requirements do apply. See our last post for more on the requirements that apply to qualified facilities.
Approved Suppliers
Under the rule, facilities can only source raw materials/ingredients for which they have identified hazards requiring preventive controls from “approved” suppliers. An approved supplier is one that the receiving facility has determined (and documented that determination) is applying the necessary preventive controls to significantly minimize or prevent the hazard before the facility receives the raw material/ingredient.
To approve a supplier, the receiving facility must conduct (and document) certain supplier verification activities, which could include:
- Onsite audits;
- Sampling and testing of the raw material or ingredient;
- Review of the supplier’s relevant food safety records; and
- Other activities based on supplier performance and the risk associated with the raw material or other ingredient.
To determine which supplier verification activity is most appropriate, the receiving facility must consider a number of factors:
- The hazard analysis of the food, including the nature of the hazard that is controlled before the facility receives the raw material/ingredient;
- The entity or entities that will be applying controls for the hazards before the facility receives the raw material/ingredient;
- Supplier performance, including:
- The supplier’s procedures, processes, and practices related to the safety of the raw material and other ingredients;
- Applicable FDA food safety regulations and information relevant to the supplier’s compliance with those regulations (e.g. FDA compliance actions related to food safety); and
- The supplier’s food safety history relevant to the raw materials or other ingredients that the receiving facility receives from the supplier (e.g. audit results relating to the safety of the food, and responsiveness of the supplier in correcting problems); and
- Any other factors as appropriate and necessary, such as storage and transportation practices.
However, if the supplier is a qualified facility or an exempt or qualified exempt farm under the Produce Rule, then the considerations regarding supplier performance can be limited to the supplier’s compliance history.
Onsite Audits
If the hazard is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death, then FDA requires the receiving facility to either conduct an audit of the supplier, or review documentation of an audit that the supplier recently passed. The receiving facility must do this before accepting raw materials/ingredients from the supplier, and on an annual basis thereafter.
However, the facility does not have to require their suppliers to be annually audited, and can instead make a written determination that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled.
The results of an inspection may be substituted for an onsite audit, provided that the inspection was conducted within 1 year of the date that the onsite audit would have been required to be conducted.
Audits must be done by a qualified auditor, defined as “a person who is a qualified individual as defined in this part and has technical expertise obtained through education, training, or experience (or a combination thereof) necessary to perform the auditing function…”
Examples of potential qualified auditors include government employees and auditors that have been accredited through the forthcoming third party auditor rule (which establishes a certification/accreditation of auditors for foreign producers).
The onsite audit does not have to be done by a third party. The receiving facility’s employees can be qualified auditors, which means the receiving facility can perform the audit itself. However, first-party audits are not an acceptable supplier verification activity. Second-party or group audits are not explicitly approved in the rule, but presumably are acceptable as well.
The rule contains some contradictory language regarding whether a third party audit is required – or if some alternative to a third party audit will also suffice – and NSAC urges FDA to provide clarity regarding the role of third party audits in satisfying the supply chain program requirements. We discuss the issue of alternatives to third party audits below.
Alternatives to an Audit for Qualified Farms and Facilities
If a supplier is a qualified facility or an exempt or qualified exempt farm under the Produce Rule, then an audit is not required.
Rather, for qualified facilities, the receiving facility need only obtain the same attestations of the qualified facility that are required by FDA:
- Written assurance (before approving the supplier, and annually thereafter) that the supplier satisfies the status of a qualified facility, and
- Written assurance that the supplier is producing the raw material/ingredient in compliance with applicable FDA food safety regulation (at least every two years), including:
- a brief description of the preventive controls that the supplier is implementing to control the applicable hazard in the food; or
- a statement that the facility is in compliance with State, local, county, tribal, or other applicable non-Federal food safety law.
For suppliers that are produce farms but are exempt or qualified exempt farms under the Produce Rule, the receiving facility must:
- Obtain a written assurance (before approving the supplier and then annually thereafter) that the raw material/ingredient provided by the farm is not subject to the Produce Rule because the farm is exempt/qualified exempt; and
- Obtains a written assurance (at least every two years) that the farm acknowledges that its food is subject to section 402 of the Federal Food, Drug, and Cosmetic Act.
NSAC raised strong opposition to the supply chain program during the proposed rule stage because requiring an onsite audit of a supply clearly contradicts FSMA’s statutory language. The statute includes a provision originally sponsored by Senator Michael Bennet (D-CO) that prohibits FDA from requiring a farm or facility to be audited to verify compliance with the rules.
FDA maintains that this audit requirement under the supply chain program does not violate that statutory language because it does not directly require supplying farms and facilities to get audited to verify compliance with their respective food safety rule (whether the PC Rule or Produce Rule). Rather, it requires receiving facilities to require their suppliers to be audited.
We find this logic severely flawed. The law does not permit FDA to do indirectly what they are prohibited from doing directly.
We do acknowledge that FDA has provided alternative compliance mechanisms – rather than an onsite audit – for qualified farms and facilities that are suppliers and for receiving facilities that are willing to accept alternative documentation in place of an audit.
NSAC has urged FDA to avoid placing outsized reliance on third party audits as indicators of compliance, and this onsite audit requirement only compounds the concerns that third party audits could become a default regulatory requirement for all farms and small food businesses under FSMA.
Given the significant costs and burdens associated with third party audits, and the rise in innovative and less burdensome certification schemes like GroupGAP, we urge FDA to hold second party audits and other compliance indicators – like industry education and training – to the same estimation as third party audits.
Compliance Timelines
Importantly, the compliance timelines for the supplier program are different than the compliance timelines for the rest of the PC Rule.
Facilities that are small businesses have two years to come into compliance (so, by September 17, 2017) with the majority of the PC Rule. All other facilities have one year to come into compliance (so, by September 17, 2016).
The supply chain requirements, however, have a staggered timeline based on who the supplier is. Because small and very small businesses have more time to come into compliance with the rules (two years for small, three years for very small), facilities that are receiving from them are not required to be in compliance with the supply chain program provisions until their suppliers are required to be in compliance.
FDA has a table in the rule that provides the various compliance dates based on whether the receiving facility is a small business or not, and whether the supplier is a small business or very small business subject to either the Preventive Controls Rule or the Produce Rule. Broadly speaking, the receiving facility is not required to verify its suppliers until six months after the supplier is required to be in compliance with their applicable rule.
General Requirements
1. Records
Records that must be maintained to support the various components of the HARPC plan – including the food safety plan itself, the procedures for carrying out the various steps of the plan, and documentation that the procedures are being executed – are subject to review upon inspection.
Records must be kept as either original records, true copies (i.e. photocopies, pictures, scanned copies, or other accurate reproductions), or as electronic records. This means you are not required to keep all of your records electronically, though you may chose to.
Food safety plans must be kept at the facility. Other records can be stored off-site as long as they can be retrieved and provided for review within 24 hours of being requested.
In general, records must be retained for at least two years after the date they were prepared.
2. Qualified Individuals
The PC Rule establishes requirements applicable to all facilities (whether exempt from the full rule or not) regarding the qualifications of individuals who manufacture, process, pack, or hold food – in other words, the people who work for or at the facility. The requirement applies both to facilities subject to CGMPs and facilities subject to the full HARPC requirements.
This provision requires all individuals engaged in or supervising the manufacturing, processing, packing, and holding food at the facility to be “qualified to perform their assigned duties.” To satisfy this requirement, each individual must be considered a “qualified individual.” That is, they have the education, training, or experience (or some combination of the three) necessary to manufacture, process, pack, or hold clean and safe food as appropriate to their assigned duties.
They also must receive training in the principles of food hygiene and food safety, including the importance of employee health and personal hygiene, again, as appropriate to the food, the facility, and the individual’s assigned duties.
Supervisors must also have the education, training, or experience (or some combination) necessary to supervise the production of clean and safe food.
Facilities must retain records documenting the training provided to employees as required by the rule.
The rule does not specify a specific training program. However, the rule does acknowledge that the Food Safety Preventive Controls Alliance has been funded by FDA to develop a model curriculum that can be used in-house to provide the needed training as can online CGMP or other food safety courses.
Additional Information and Resources
You can view the final regulations and the discussion of comments received on the proposed rule via the Federal Register. You may also be interested in the final rule for animal food facilities.
FDA will be following up on many issues in the final rule by developing guidance documents, which provide more explanation for the regulated industry (and regulators) to use in determining whether and how the final rules apply to a specific situation. FDA is accepting questions and suggestions as they begin to develop these documents. You can submit questions or recommendations to FDA here to assist them in identifying issues that will require further explanation.
NSAC will also be updating our website and “Am I Affected” flowchart to reflect the final rules, designed to help farmers, small food businesses – and the organizations that work with them – understand whether the FSMA rules apply to them and if so, what requirements apply.
You can also read our recent blog posts on FSMA implementation and appropriations issues to learn more.
Categories: Food Safety, Local & Regional Food Systems
[…] PREVENTIVE CONTROLS RULE ANALYSIS PART THREE […]