The Food Safety Modernization Act (FSMA), described by the U.S. Food and Drug Administration (FDA) as the most sweeping reform of our food safety laws in more than 70 years, was signed into law by President Barack Obama on January 4, 2011. It aims to ensure the U.S. food supply is safe by shifting the focus from responding to contamination to preventing it. The law allows FDA to regulate through enforcement the prevention of food safety problems before rather than after they occur. The requirements of the law could be summarized as an “active managerial control rule” because it requires, for the first time, documentation that active managerial control of all food safety hazards that can reasonably occur in a food manufacturing plant has occurred. So even though the current FDA inspections (pre-FSMA enforcement) of a food plant theoretically do the same at the time of the inspection (auditing the current manufacturing process that day), the new rules allow inspectors to use the documentation of control to retrospectively audit all the food production in a facility before the audit date as well.

FSMA implementation will be the largest change in the food industry that has ever been implemented and enforced by FDA. FSMA implementation processes and compliance tools will also be the largest investment many companies will make over the next 5 years. Each food corporation will be required to implement these rules in each of its food manufacturing facilities for any ingredient and/or product made for human (and animal) consumption. Food distributors will also fall under FSMA, owing to new transportation and traceability of food source requirements. The rules require a supplier approval and verification program as well for each buyer along the supply chain up to but not including retail/foodservice and sales establishments.

The Food Safety Plan
The foundation for the implementation of FSMA will be the establishment of a food safety plan and its direct application in each food manufacturing facility under ownership of the food company. Each food company that manufactures food will be required to develop and maintain a written food safety plan that has defined all of its food safety hazards and modes of prevention. FDA has a legislative mandate to require comprehensive, science-based preventive controls of food safety hazards across the food supply, and each facility will therefore be required to demonstrate to FDA inspectors the past and present operations of each element of the food safety plan (Figure 1). The food safety plan must be developed by a food safety professional (either staff or contracted). In some cases, environmental monitoring and product testing must be part of the food safety plan. Most importantly, FDA will have the authority to approve or disapprove a food safety plan based on its accuracy and who developed the plan.

The food safety plan will probably require six major components to demonstrate a program to actively manage the food safety hazards in all food manufacturing facilities (see “FSMA Food Safety Plan Requirements”).

At the core of the food safety plan is a new process that requires identification and prevention of all reasonably foreseeable food safety hazards—whether naturally occuring or unintentionally introduced into the facility—not just those identified by Hazard Analysis and Critical Control Points (HACCP) methods. This new process is called Hazard Analysis and Risk-Based Preventive Controls (HARPC). While the food safety plan must describe the current knowledge base that the food company uses to prevent food safety issues in each of its manufactured foods, HARPC is the process and plan the food company uses in each of its facilities to implement its food safety plan.
 

The validation of preventive controls of each HARPC plan in each facility must be done by a qualified individual before the food safety plan is implemented or whenever there is a need to reanalyze it. It must include collecting and evaluating scientific and technical information to support each HARPC plan. The monitoring of the plan must be verified, as must decisions about proper corrective actions. All verification and validation activities must be documented.

What Is HARPC?
Simply stated, it is the system used to control the different hazards found in different facilities that manufacture food. Each food manufacturing facility owned and operated by a food company must have its own HARPC plan if there are any differences in the foods it manufactures between facilities. The food company must include each validated HARPC plan for each of its facilities in its food safety plan.

How does the “HA” in HARPC differ from the “HA” in HACCP?

The use of HACCP by all segments of the food supply chain has become the recognized system used to minimize the chance of a known potential hazard becoming a food safety problem. It is a globally recognized standard, having been adopted by the Codex Alimentarius Commission in its document entitled CODEX General Principles for Food Hygiene (CAC/RCP1-1969, rev.4-2003). Codex recommends HACCP as an approach to enhance food safety. While HACCP is a recognized global standard, HARPC is a U.S. standard (Table 1).

The seven principles of HACCP are well known, used often by the food industry and include the following:

1.    Conduct a Hazard Analysis

2.    Identify CCPs

3.    Establish critical limits

4.    Establish monitoring actions

5.    Establish corrective actions

6.    Establish verification procedures

7.    Establish a record-keeping system

The hazards for HACCP have been clearly documented in Seafood HACCP and Juice HACCP. Microbiological hazards have been defined in the Thermally Processed Low-Acid Foods Packaged in Hermetically Sealed Containers standards of FDA. The facilities that are required to comply with Juice and Seafood HACCP are exempt from HARPC. The exemption for HARPC for Thermally Processed Low-Acid Foods Packaged in Hermetically Sealed Containers applies only to the microbiological hazards (Part 113, Chapter 21, Code of Federal Regulations).

With HARPC, if there are unknown preventive controls for an identified hazard, research must be conducted regarding the preventive controls and their effectiveness validated at each facility for all applicable products and processes. For example, a food manufacturing facility may perform a challenge study of a modified atmosphere packaging process for a processed food product that is using new mixtures of gas partial pressures with unknown impact on the growth of anaerobic spore formers such as Clostridium botulinum. The use of a recognized methodology for conducting a challenge study in this case would be very important. Such guidance can be found in a document prepared by the National Advisory Committee on Microbiological Criteria for Foods entitled Parameters for Determining Inoculated Pack/Challenge Study Parameters, adopted March 20, 2009.

How often does each food facility have to submit or update its HARPC plan and results?

FDA will require that each facility update its HARPC plan every 3 years or whenever there is a significant change at that facility that may increase a potential hazard or introduce a new one, for example, when the facility adds a new allergen as an ingredient that will be used on the same production line as another product that required no previous allergen preventive controls. Additionally, FDA may require an update based on new hazards related to biological, chemical, radiological or terrorist threats that are discovered after an HARPC process has been developed and approved by FDA. There is no statutory requirement to submit a HARPC plan to FDA at any particular time, except when FDA asks a food company to provide a copy of its HARPC plan and any and all records necessary to demonstrate that it has properly implemented it at each facility.

What if a food facility does not use the HARPC process or its use is inadequate?

FDA can take a number enforcement steps. First, FDA can criminally charge a company or person for owning, operating or acting as an agent in charge of a facility not in compliance with HARPC. Second, FDA can issue a public warning letter and/or (for foreign firms) an Import Alert. If food from a noncompliant facility presents a significant food safety risk, FDA could suspend the facility’s food facility registration and thereby prevent the facility from distributing product until FDA has approved a corrective action plan to the HARPC process. In the case of a foreign firm, FDA would likely place the facility on an Import Alert (similar to Import Alert 16-120). A firm listed on this Import Alert would find its food automatically detained at importation, effectively barring it from the U.S. market unless FDA reviews and accepts an adequate food safety plan that uses an effective HARPC process.

Are any food facilities exempt from performing HARPC?

Six major categories of food facilities are exempt from using HARPC. The first major exemption relates to food companies under the exclusive jurisdiction of the U.S. Department of Agriculture (those handling, processing or shipping meat, poultry, pork, eggs, etc.). The second major exemption is for companies subject to FDA’s new Standards for Produce Safety authorities, which were also created by FSMA. This exemption applies to farms, cooperatives, growers, harvesters and other companies handling raw fresh fruits and vegetables. The third major exemption applies to facilities that are subject to and comply with FDA’s Seafood and Juice HACCP regulations. The fourth, more limited, exemption involves low-acid and acidified canned food processors, but only as the regulatory controls govern and control certain aspects of microbiological contamination (e.g., botulism). The fifth group of exempt companies includes those defined as “small” or “very small” businesses. FDA is required to define these terms by regulation. Sixth and last is the group of companies with a previous 3-year average product value of less than $500,000. FDA may also, by future regulations, exempt facilities that solely produce food for animals, store raw agricultural commodities (other than fruits and vegetables) intended for further processing or that store packaged foods that are not exposed to the environment.

Risk-Based Preventive Controls
For each hazard identified in the Hazard Analysis of HARPC as reasonably likely to occur, each food facility must identify and show its own implementation of these preventive controls, including at CCPs, if any, to show FDA inspectors that all hazards identified in the Hazard Analysis will be significantly minimized or prevented. All preventive controls should establish:

•    Parameters associated with the control of the hazard, such as parameters associated with heat processing, acidifying, irradiating and refrigerating foods.

•    The maximum or minimum value, or combination of values, to which any biological, chemical, physical, radiological, natural toxin, pesticide, drug residue, decomposition, parasite, allergen and unapproved food and color additive must be controlled to significantly minimize or prevent a hazard that is reasonably likely to occur.

•    Process controls that must include those procedures, practices and processes performed on a food during manufacturing/processing that are employed to significantly minimize or prevent hazards that are reasonably likely to occur.

•    Food allergen controls that must include those procedures, practices and processes employed to ensure protection of food from cross-contact, including during ingredient storage and use.

•    Labeling of the finished food, including ensuring that the finished food is not misbranded under section 403(w) of the Federal Food, Drug, and Cosmetic Act.

•    Sanitation controls, where necessary, to significantly minimize or prevent hazards that are reasonably likely to occur. These include any environmental pathogen that is reasonably likely to occur in a ready-to-eat food that is exposed to the environment prior to packaging, any microorganism of public health significance that is reasonably likely to occur in a ready-to-eat food due to employee handling and any food allergen hazard. Sanitation controls must include procedures for the cleanliness of food contact surfaces, including food contact surfaces of utensils and equipment, and the prevention of cross-contamination from unsanitary objects, personnel, food packaging material and other food contact surfaces as well as from raw product use in the facility.
 

Many of the food safety hazards in food manufacturing are well known, due to scientific study and HACCP use in the industry. The industry has applied very successful preventive controls to make food safe using this information. But not all preventive controls are known. This is especially true as each may relate to how the food is sourced, processed, packaged and stored in each facility. Therefore, the food industry can look to various food safety resources for assistance (Table 2). Additionally, a state’s agriculture or health department office may offer classes or other resources to apply known preventive controls to food safety hazards.

Enforcement of FSMA
Once a food safety plan has been developed and has FDA approval, the most likely scenario for FDA enforcement, if any of these rules are violated, will be a required recall of the ingredient or product from any day of production that does not have documentation of preventive controls in the facility’s records upon inspection by the FDA or its state designate. This will include any food ingredient or product in the marketplace up to the best-buy or use-by date regardless of whether the food is possibly adulterated. In addition, all chief executives in food corporations will have new incentives to comply with FDA rules under FSMA. Violation of certain parts of the rules could be considered “prohibited acts” subject to severe penalties that could include fines and imprisonment. Owners and leadership of food companies could be held responsible for any foodborne illness or death related to an ingredient/product produced by their corporation found not to be in compliance with FSMA rules regardless of prior FDA inspection results. This responsibility is similar in manner to the enforcement of financial laws of the Sarbanes-Oxley Act, Section 906. FDA will probably prioritize inspections based on historical compliance of a food company and its facilities with current FDA regulations and on whether the facility produces a high-risk food as defined by FDA. The agency has not released the current list of high-risk foods, but a draft working document can be found at www.fda.gov/Food/GuidanceRegulation/FSMA/ucm380210.htm.   

There will also be new rules on food defense that will be completed by 2016 and enforced beginning in 2017. The Food Defense Rule will effectively require the same process of HARPC for the prevention of intentional adulteration of foods. Although these rules are not completed, they will require even more significant support (those with food defense credentials) to the industry to help food corporations ensure correct implementation and compliance. FDA has stated numerous times during its proposed rules review with industry, “If there are no documents showing preventive controls of hazards for every ingredient/food production in any facility, then FDA will assume no controls are in place,” according to FDA’s public meeting on FSMA implementation strategy held in April 2015.

Get Ready
Ask these questions at the corporate and manufacturing levels of your business:

•    Does your food company use Good Manufacturing Practices and HACCP processes to control food safety hazards in each of your manufacturing facilities?

•    Are these processes written at both the corporate and facility levels?

•    Were these processes validated to control the known hazards?

•    Do your facilities monitor/measure the controls (e.g., CCPs) regularly and record results with any corrective actions noted?

•    Do your facilities update these control processes each time a new product is introduced into production or a significant change is made to ingredients or processing methods?

•    Do your facilities have a recall plan, and do they perform mock recalls to ensure they work properly?

•    Do you currently use a supplier approval/certification process and verification of specifications for each of your suppliers?

•    Do all of your manufacturing facilities follow your current food safety requirements specific to each of the foods they manufacture?

•    Can this be verified for each facility?

•    Would they be able to assist in the development of an HARPC plan for their facility and follow a FSMA-required food safety plan using this HARPC plan?

•    Have you evaluated your current food safety requirements/plans, processes and systems against the food safety plan requirement as defined by FSMA and HARPC requirements?

•    Do you have expert personnel who can develop HARPC plans for each of your facilities and write and implement your food safety plan?

•    Do you have in-house operations expertise to help validate preventive controls of each HARPC plan in each facility?

•    Are you preparing to ensure each facility can monitor its HARPC plan in each food production line in each facility?

•    Can personnel help develop corporate verification processes to ensure the food safety plan is functioning properly in each food facility?

These are only a few important questions the food industry should begin to ask of its operations before FSMA enforcement. If you answered no to any of these questions, it is time to get ready for FSMA implementation now before regulatory enforcement begins. We recommend you start first with building and validating your HARPC plan for each of your food processing facilities. The good news is that if you answered yes to several of these questions, you are on your way to FSMA readiness.

Hal King, Ph.D., is CEO, Public Health Innovations LLC, www.publichealthinnovations.biz, and a member of the Editorial Advisory Board of Food Safety Magazine. He can be reached at halking@pubhealthinnovations.com.

Gary Ades, Ph.D., is president of G&L Consulting Group LLC, www.gandlconsulting.com, and a member of the Editorial Advisory Board of Food Safety Magazine. He can be reached at 479.696.8189 or glades@cox.net.