The U.S. Food and Drug Administration (FDA) has used a modern approach under the Food Safety Modernization Act (FSMA), because after all, FSMA stands for the Food Safety Modernization Act. FDA has provided help to industry in the form of curricula for courses, had their personnel trained in the same training courses as industry, listened to industry’s concerns about deadlines and other specific compliance challenges, and included flexibility. FDA has emphasized they are “educating while they regulate.” But the final FSMA rules have been in place for almost 3 years now, and FDA has said they will not be in the ‘educate while regulating’ mode forever. FDA inspections under FSMA will become more and more commonplace, and enforcement will follow.

Importing and manufacturing companies are still discovering the intricacies and complexities of the rules and exemptions, especially as FDA issues policies and guidance documents, with extended deadlines and enforcement discretion related to the FSMA regulations.

There are seven implementing regulations, “rules,” under FSMA. FDA issued the final rule for “Current Good Manufacturing Practices and Risk-Based Preventive Controls for Human Food” and the rule for animal foods (the PC rules) in September 2015, and the first compliance date was September 2016. FDA issued the Foreign Supplier Verification Programs (FSVP) rule in November 2015, and the first compliance date was May 2017. The other four ‘foundational’ rules under FSMA are the Produce Safety rule, the Sanitary Transportation rule, the Intentional Adulteration rule, and Accredited Third-Party Certification.

The following italicized sentences are examples of only seven of the numerous erroneous assumptions one might hear in discussions with industry and importers about FSMA. Although these seven examples of assumptions may not be ‘deadly,’ they are certainly problematic. Assumptions like those below illustrate why adequate training is essential for your understanding of the rules so that you can ensure compliance for your particular business situation. Test your knowledge as you read each statement and consider why it is not true. Also consider these questions in view of your suppliers: In other words, you will want to ask yourself, “Have all my foreign and domestic suppliers under the FSMA definition (farms or facilities, not brokers), properly evaluated their status and taken appropriate compliance action under FSMA?”

1. Customer assurance and disclosure: “I am assuming that since FDA has indicated ‘enforcement discretion’ for 2 years after the customer assurance provisions compliance dates, a manufacturing facility for human food with less than 500 employees and a manufacturing facility for animal food with more than 500 employees can wait until September 2019 to begin their disclosure of hazards not being controlled.”

No, FDA did realize that supply chains are usually more complex than the typical supplier, processing facility, and customer. In many cases, there are multiple processors and other intermediaries within a typical supply chain. Thus, FDA announced extensions of dates for obtaining customer assurance of control of hazards, under 117.36. However, entities must disclose hazards that are not controlled, and in documents of trade accompanying the food. FDA did not extend the timeline for the disclosure requirement. FDA stated that entities seeking additional detail on its policy regarding its intent not to enforce the regulatory provisions discussed in the August 2016 final rule should consult the January 2018 final guidance “Policy Regarding Certain Entities Subject to the Current Good Manufacturing Practice and Preventive Controls, Produce Safety, and/or Foreign Supplier Verification Programs: Guidance for Industry.”[1] Keep in mind that together these three provisions—disclosure, obtaining customer assurance, and ensuring that the entity acts consistently with the assurance—are intended to provide assurance that food for further processing will be processed to control the identified hazard before it reaches consumers, and “customer” means a commercial customer, not a consumer.

2. Exemption and LACF: “I assume that I don’t need a food safety plan under the PC rule for the low acid canned food (LACF) that I manufacture because LACFs are exempt from FSMA.”

No, but someone might make that assumption; the exemption can be confusing. The list of exemptions for compliance with preventive controls (subpart C) and supply chain (subpart G) listed in 21 C.F.R. part 117.5 does include activities subject to part 113, when the facility is required to comply with and is in compliance with part 113.

But you must read further: The paragraph goes on to include a statement that the exemption is applicable only with respect to the microbiological hazards under part 113. A Hazard Analysis must be conducted, all other hazards must be considered, and a food safety plan must be developed and documented.

3. Impact of subsidiary and affiliate companies: “My facility is an older manufacturing facility for juice and sports beverages recently purchased by another manufacturer who is expanding my facility to include additional lines. I am preparing my attestation as a qualified facility under the PC rules since my sales of sports beverages, excluding juice, over the last 3 years have averaged just under 1 million dollars and I am assuming I need comply only with Current Good Manufacturing Practices.”

Why is this assumption wrong? If you have a parent, subsidiary, or other affiliated company, the sales of those companies must be included also in determining qualification. Another aspect of the above assumption is that you must consider all human food manufactured, sold, and held. The small manufacturer must add in sales of juice in calculating that facility’s total sales; it would not be a qualified facility even if it were stand-alone without affiliates.

4. Impact of being a co-manufacturer with private label brand owners: “As a co-manufacturer, I am not going to have to take any action under the PC rule since the brand owner specifies which suppliers I must use. Also, the contract with our brand owner does not allow us to obtain information they consider confidential, for example, audits of suppliers. Therefore, I am assuming I can rely completely on the brand owner to conduct the Hazard Analysis, and for hazards requiring a supply chain control, to handle all supplier approval and verification activities, and I need do nothing, even if there is a hazard requiring a supply chain preventive control in an ingredient for which the brand owner specifies the supplier.”

This is another example of an incorrect assumption: Remember that the supply chain provisions in 21 C.F.R. part 117 subpart G, part 507 subpart E, and FSVP include evaluating and approving suppliers and determining and conducting appropriate supplier verification activities. These provisions do allow the flexibility of conducting of activities by an entity other than the supplier, as long as the receiving facility reviews and assesses documentation of that activity. Also, FDA has provided additional flexibility to industry to allow time for contracts to be changed to allow this sharing, with an intent not to take enforcement action until November 6, 2019. See the November 2017 “Supply Chain Program requirements and Co-Manufacturer Supplier Approval and Verification for Human Food and Animal Food: Guidance for Industry.”[2]

However, there are still a number of actions a co-manufacturer must take. In this above cited guidance, FDA (Center for Veterinary Medicine in the Center for Food Safety and Applied Nutrition) also stated that the co-manufacturer must not only follow “written procedures for receiving raw materials and other ingredients and documenting use of the procedures,” but that the co-manufacturer must conduct a Hazard Analysis of the food, include in its food safety plan a description that the brand owner is considering supplier performance, and conduct any needed activities not conducted by the brand owner such as sampling and testing. The following example is given by FDA of when it does not intend to take enforcement action until November 2019: “…when an audit is determined to be the appropriate supplier verification activity but a co-manufacturer does not independently obtain a supplier audit or review the conclusions of a supplier audit obtained and reviewed by the brand owner, the co-manufacturer’s food safety plan states that the brand owner will obtain and review audits of the supplier, and the co-manufacturer conducts any other necessary supplier verification activities (e.g., sampling and testing of the raw material or other ingredient).”

5. Import exemption for some countries: “Since the only foods I import are final products from Canada with no additional processing in the U.S., I am under the assumption I have no actions required.”

Unfortunately, this another incorrect assumption. Canada, as well as New Zealand and Australia, are exempt from FSMA’s FSVP because they are under a Systems Recognition Agreement, and no Hazard Analysis of the food and no supplier evaluation for approval and verification must be conducted. However, there are still certain actions required for certain foods from a foreign supplier in a country whose food safety system has been recognized as comparable or determined to be the equivalent of the U.S. system. These foods are subject to modified requirements under FSVP, namely, before importing, there must be determination and documentation that the foreign supplier is in good compliance standing with the appropriate foreign food safety authority, and, after importing, you must continue to monitor whether the foreign supplier is in good compliance standing with that foreign food safety authority. Further, if should you become aware of any information indicating that the hazards associated with the food you import are not being significantly minimized or prevented, you are required to promptly take corrective action. For all of these actions, you must maintain records.

Remember that you cannot import unless you are identified with your data universal numbering system number as the FSVP importer on the Customs and Border Protection entry filing, FDA will see you as being responsible for all FSVP activities and will visit or otherwise request your FSVP records to review for compliance.

6. Exempt foods and qualified facility determination: “I have imported an average of under $1 million in Asian condiments for seafood for the last 3 years. These condiments supplement my sales of seafood that I also import in large quantities, well over $1 million per year. The seafood is exempt from FSVP, so I am under the assumption that I don’t need to include seafood sales in my attestation as a very small business; I have very limited actions under FSVP since I am a very small business.”

This assumption is for imported food under FSVP but is similar to assumption #3 above, which is related to the PC rule. All human food, even exempt food like that under Seafood HACCP, must be considered in the calculation of value of imported human food. The importer making the assumption above will fall under full FSVP unless there is another reason it would qualify for modified requirements, such as if importing from certain small suppliers.

7. Food contact substances and requirements: “Even though food contact substances meet the FDA definition of food, as a manufacturing facility, I don’t need a supply chain applied control for food contact substances under the PC rule. But as an importer under the FSVP rule, FDA extended my compliance date for food contact substances by 2 years compared to other foods.

Why is this a wrong assumption? This is an example of an assumption that can actually make you work harder than you need to. Here the assumption is wrong. Initially there was a 2-year extension, but actually there is even better news: Take a look at the policy issued January 2018. FDA has indicated they “intend to exercise enforcement discretion for food contact substances in regard to the FSVP requirements.”

There are many other examples of misinterpretation. For example, assumptions can be made about the applicability of the modified requirements under part 117.206 related to a facility solely engaged in the storage of unexposed packaged food. FDA has issued guidance on the “solely engaged” requirements related to Current Good Manufacturing Practices and preventive controls under parts 117 and 507. Essentially all activities must be exempt for the establishment to be exempt, and there are requirements that apply in certain situations, for example, time/temperature control. Consult the guidance for more information.

Confusion can also exist between rules, for example, on what is exempt. Dietary supplements are exempt from the PC rules, so an assumption might be that “I don’t need to worry about FSVP since I import only dietary supplements and they are exempt from the PC rules.” Dietary supplements, however, are within the scope of applicability of the FSVP rule.

As you can see, the FSMA rules are quite complex. You may want to reconsider your actions needed, including checking with your suppliers to ensure they are not making erroneous assumptions, since FDA is already checking the compliance of FSVP importers and domestic and foreign manufacturers and processors to FSMA.

Rachel Montgomery is a Food Safety Preventive Controls Alliance Lead Instructor (Human Foods Certificate # 32c592bd, Animal Foods Certificate # 1bd2c691, Foreign Supplier Certification Programs, FSVP, Certificate # f3830814), with over 30 years of experience as a food safety executive in large-scale manufacturing in the fermentation industry. She is the principal of Simple Compliance Solutions, LLC and a Registered Microbiologist (National Registry of Certified Microbiologists). She can be contacted at RMontgomerySCS@gmail.com or www.FSMAComplianceTraining.com for more information.

References
1. www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/ucm590646.htm.
2. www.fda.gov/downloads/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/UCM583490.pdf.