After a wait of nearly 5 years, multiple drafts, public comments and even a court order, the U.S. Food and Drug Administration (FDA) has published final versions of two of the cornerstone regulations its implementation of the Food Safety Management Act (FSMA). Described as the largest overhaul of this country’s food safety laws in more than 70 years, FSMA was intended change the focus of food safety in this country from being reactive to preventive. It also sought to look at food safety from a more global perspective, coordinating with other countries that also enforce stringent food safety practices and prevent products from entering this country that do not meet the same safety criteria as those manufactured here.

Overall, FSMA is built around what FDA refers to as its 7 Pillars. These Pillars include Preventive Controls for Human Food, Preventive Controls for Animal Food, Produce Safety, Sanitary Transportation, Food Defense, Foreign Supplier Verification and Third-Party Auditor Rules. The preventive control rules for both human and animal food were released by FDA and published in the Federal Register on September 17, 2015. The final regulations reflect FDA’s responsiveness to comments raised by industry participants and consumers. A high level overview of the primary components of the rule relating to preventive controls for human food is discussed here.

I.    Written Food Safety Plan
Covered facilities, those required to register with FDA as a food “facility,” will now be required to create a very particularized written food safety plan and continually insure its enforcement and effectiveness. Every step in the process must be documented, including the reasons behind each decision to act or to not act.

A.    Creation of the Plan
The primary component steps in creating a food safety plan include conducting a Hazard Analysis and designing preventive controls. In an effort to allow flexibility for a manufacturer to design a safety plan that meets the unique needs of both its food product and its facility, the rule is in places left intentionally vague. In fact, FDA has declined to provide even a sample plan. It is clear that a manufacturer must analyze each of its facilities and create separate written safety plans for each.

The first necessary step is to perform a Hazard Analysis. Hazards must be identified that are either known or reasonably foreseeable, including biological, chemical and physical hazards. Hazards might be present in or around food because they occur naturally, are unintentionally introduced or are intentionally introduced for purposes of adulterating the food for an economic gain.

Once hazards are identified, preventive controls must be designed and implemented to provide assurance that the risk of that hazard will be significantly minimized or prevented so that food adulteration can be avoided. A preventive control could include a change to a manufacturing process such as food allergen and sanitation controls. If a hazard is identified that can only be preventively controlled by another participant in the food chain, a supply-chain program can be developed that will verify that the participant with the ability to prevent the hazard does so. Preventive controls will also include a mandated written recall plan for any food presenting a potential significant hazard. In more simple terms, a written recall plan is always a good idea.

Many manufacturers and safety analysts are operating under the misunderstanding that a Hazard Analysis and Critical Control Points (HACCP) analysis or HACCP plan will satisfy the requirements of the new FSMA requirements. That is not necessarily the case. The requirements under FSMA and HACCP are distinguishable. While overlap may exist, simply following an existing HACCP plan will run afoul of the requirements of the FSMA safety plan.

B.    Management of the Food Safety Plan and Its Components
To insure that the Hazard Analysis is and remains an accurate assessment of risk and that the preventive controls remain effective, ongoing management of the food safety plan is required. Management of that plan includes monitoring activities, corrective actions and verifications.

Monitoring activities can be as varied as the preventive controls themselves. The underlying goal is to simply confirm that the preventive controls are properly implemented and are consistently performed. Corrections or corrective actions must be taken whenever it is determined that the preventive controls are not being consistently performed or that there is some problem that has occurred in implementing the preventive control. Effective monitoring will identify when corrective action needs to be taken. A facility must then take appropriate action to reduce the likelihood that the problem will recur, make sure that all affected food is evaluated and, if adulterated, is not permitted to enter into commerce.

The last component of managing a food safety plan is referred to as verification. Verification can be viewed as an oversight audit. It is a review process which insures that every step of the food safety plan and its management are performed, appropriate and documented. Unlike monitoring, which makes sure that the designed preventive control is performed, verification confirms that the preventive control is effective in controlling the hazard it was designed to address. Verification of the preventive controls may include environmental testing, end product testing or other scientific confirmation. Verification must confirm that monitoring activities are occurring, that corrective actions are taken and that the entire plan and its procedures are re-evaluated as appropriate. Even when working well, a facility’s written safety plan must be re-evaluated every 3 years.

C.    Persons Qualified to Design and Manage Safety Plans
Every step from the identification of hazards through the creation and implementation of the written safety plan must be performed or overseen by a preventive controls qualified individual. To meet the definition of a preventive controls qualified individual, one must either successfully complete an FDA-approved standardized curriculum or have equivalent experience. Unfortunately, because the standardized curriculum has not yet been completed, equivalent experience also can’t be measured. It is the stated intent that following publication of these rules that curriculum will be finalized and training programs developed by FDA in partnership with particular industry alliances: The Produce Safety Alliance; Food Safety Preventive Controls Alliance and Sprout Safety Alliance.

II.    Current Good Manufacturing Practices
Manufacturers of human food have long been subject to industry standards referred to as Current Good Manufacturing Practices (cGMPs). While changes in science and technology have evolved, the cGMP standards had not been formally updated since 1986. While the revisions to cGMP provisions are not significant, there are a few changes to note. Individuals involved in manufacturing, processing, packing or holding food now have mandated requirements for the education and training of their employees in the area of food hygiene, food protection, employee health and personal hygiene, as those may impact the safety of food products. Specific record keeping is required to document the training.

FDA has for some time taken the position that GMPs should address allergen cross-contact. That position is now made specific in the revisions to cGMPs. Finally, the much-publicized debate relating to human food by-products being used in animal food will now be addressed, but are specifically contained in preventive controls for animal foods.

III.    Compliance Deadlines
The deadlines for facilities handling human food to become FSMA compliant are staggered over several years:

• Very small businesses (averaging less than less than $1 million per year in both annual sales of human food plus the market value of human food manufactured, processed, packed and held without sale) – 3 years.

• Businesses subject to the Pasteurized Milk Ordinance – 3 years.

• Small businesses (fewer than 500 full-time equivalent employees) – 2 years

• All other businesses – 1 year

FDA will be issuing guidance documents in the near future. On October 20, 2015, a public meeting will be held during which FDA will discuss its plans for the implementation of these preventive controls. Attendance at the public meeting is also available online at www.fda.gov/Food/GuidanceRegulation/FSMA/ucm461791.htm.

Kathy Hardee, Esq., is co-chair of the Food & Agriculture Industry Group at Polsinelli, PC, which is composed of a team of attorneys from every legal practice area and who each have a focused background in the food industry.