“Is your food safety plan ready for a U.S. Food and Drug Administration (FDA) inspection?”

As a consultant, I like to ask this question when I visit a company to audit their food safety program. The answer I get is always “yes.” I smile politely and begin my work to see if that is really true. Sometimes, it is close to ready, but I always find issues that surprise them. It’s those hidden land mines that can bring down your business. You need to root these issues out before FDA finds them for you.

Did you know that the average cost of a recall is now over $30 million? That is actual cost; it doesn’t include losses to brand value, lawsuits, and lost sales. If your food safety plan is not up to par, a recall could be the result. You could end up with FDA issuing you an Inspectional Observations Form 483. Another serious outcome is a Warning Letter addressed to your CEO listing the inspection findings for everyone to see on FDA’s website. It’s a threat to your business that you must keep from happening in the first place.

I specialize in making sure that companies are ready for an FDA Food Safety Modernization Act (FSMA) regulatory inspection. I want to share with you some of my top observations to help you take action and improve your food safety plan. The seeds for your destruction lie hidden in your food safety plan. Find and fix them before it blows up in your face.

Fatal Flaw Number 1: Your food safety plan is your old Hazard Analysis and Critical Control Points (HACCP) plan dressed up in new clothing.

I see this one all the time. In some instances, the changeover was just an exercise in “find and replace” in the documents. “HACCP plan” is switched out to “food safety plan” in a quick search and they call it a day. But it’s not a perfect switch, and something will get missed. When I find old references to HACCP that shouldn’t be there, it tells me exactly how much work went into developing a company’s new food safety plan. It makes you look unprofessional and not serious about food safety.

FSMA is the perfect opportunity to go back and revise your whole program. Most likely, the old HACCP plan was written by someone who left the company years ago, and their assumptions and reasoning for how it was set up have been lost to the passage of time. Why did they choose the hazards they did? What processes have changed since then? What new risks are out there? Was this person actually qualified to write the plan?

Bite the bullet and start from scratch. Go out and get updated training, read the regulations for yourself, build a new food safety team, and redo the whole program. You can’t take a shortcut here; your entire program is based on this work.

Fatal Flaw Number 2: Your Hazard Analysis documentation is incomplete.

Sorry to say it, but it’s most likely true. This is a big red flag for FDA when they look at your plan. This was the second leading cause of FDA violations in 2020. You need to address all the hazards FDA is expecting to find for your product category. Remember, they are trained in what to look for and now have experience reviewing real plans. If you are bringing in an ingredient that is known to harbor Salmonella, you had better have it on your hazard list. If it’s not there, expect a lot of questions.

I have reviewed programs that list spoilage organisms as a food safety risk. These plans made the mistake of confusing food safety with food quality. This will raise eyebrows at FDA and can get you in hot water quickly if you mess up this one. How so?

Let’s say your specification says that yeast and mold levels in the product need to be below 10 CFU per gram. Testing shows that it’s at 30 CFU per gram. If you list this as a food safety issue, it means that you have a violative product and you need to take immediate and drastic actions to address the problem. Has the product shipped? You could be in a recall situation according to your food safety plan. A recall for something that is not a health hazard. Remember, you are responsible for saying what is a food safety risk, not FDA.

The Hazard Analysis is the most important part of your program. You need to clearly understand what is a food safety risk and what is not.

Fatal Flaw Number 3: Your plan doesn’t separate food safety and food quality.

How you handle food safety and what you do for food quality need to be completely separated in your quality system programs. This sounds like the last point I made, but it covers a wider scope involving what FDA is legally allowed to review. If you make the mistake of listing out food quality items in your food safety plans and the documents used to support them, you are inviting FDA to look at all elements of your program. Why open yourself up to extra scrutiny?

A large contributor to mistakes in this area goes back once again to recycling your old HACCP plan. If you revised your entire food safety plan for FSMA regulatory compliance (as you should), you are going to find where the two were mixed in the past. The operator logs on the floor probably have elements of food safety listed, such as CCP checks alongside quality or operational items. Examples would be seal checks on the packaging or cases made per hour as a quality check. If you combine them, FDA can take a look at all of them. Separate out your CCP checks from everything else. The only things in your food safety documents should be food safety. Look at everything in your program for this mistake. You’ll be surprised by what you find.

Figure 1. Inspectional Observations (click image to enlarge)

Fatal Flaw Number 4: You don’t understand the Foreign Supplier Verification Program requirements.

Take a good look at Figure 1 created from FDA data downloaded at their website. This is what FDA cited companies for when they inspected food plants in 2020. Focus on the leading cause of violations, Foreign Supplier Verification Programs (FSVP). FSVP requires that you undertake very specific activities regarding your foreign suppliers, and you must document them in your plan. In 2019, this was also the leading violation with 298 instances, and now it’s up to 514 violations. Here are questions you should be asking in your plan review:

• Who is the importer of record when the item enters the country?
• What is the address of the registered agent?
• Who is controlling the hazards identified in the supplier’s food safety plan?
• What are the criteria for monitoring your approved suppliers?
• Who is submitting the paperwork for U.S. Customs and Border Protection?
• What code is filled out on the importation paperwork?
• Whose Data Universal Numbering System number is being used?

FDA has been pretty forgiving on this to date, but public presentations from the agency signal that they are frustrated with the level of compliance. The graph above backs up my point. If FDA goes to the listed address for an inspection and it’s an empty building, they are not going to be pleased when they do catch up with you. This often-misunderstood section of FSMA regulation needs to be addressed and many companies are at risk. How robust is your FSVP?

Fatal Flaw Number 5: You don’t have a food safety plan for managing co-packing activity.

This is an area of confusion for companies around who is actually responsible for FSMA compliance.

Let’s look at it in two scenarios.

Scenario 1: You are the co-packer making products for another company at your facility.

This one really illustrates the lack of knowledge around the new requirements of the regulations. You need to understand what risks are coming into your plant and document them in your food safety plan. Do you know what the ingredients are and where they come from? Are the incoming materials a threat from an allergen standpoint? What does the customer’s food safety plan address? Are you expected to control a hazard likely to occur?

In the past, a wall was put up that limited your access. That wall was called “proprietary and confidential information.” Your customers did not want to tell you what they were bringing into your plant to protect their formulas and trade secrets. You cannot accept that deflection any longer. You absolutely have to know what is coming in. FDA views this as your product, and you need to show how you manage food safety for co-packed products as if they were your own.

Scenario 2: You are the company having your product made at a co-packer.

This is like the last one, but now the roles are reversed. You need to provide everything your co-pack partner needs to manage food safety. They need to understand what you have done to protect your product and what you expect them to do. What do they do when FDA shows up at their plant while they are making your product? What if they have a recall that could impact your company? What if they change processes in their plant? What data do you have access to? How will you protect your proprietary formulas and operational data? Who makes the decisions on food safety? Do you have a contract in place that specifies these requirements? I strongly suggest you create a co-packer manual in addition to contracts to cover your requirements.

Fatal Flaw Number 6: You didn’t document credentials, sources, and research material for the Hazard Analysis activity.

You need to show how and why you came to the conclusions you did within your food safety plan. What objective credentials does the team have regarding food safety? What are the scientific materials, experts, and references used? What research papers did you cite? How do you actually know that a certain water activity protects your product from microbial growth? What data do you have to show that the pH of the product retards the growth of microorganisms? What records do you have for the risk of your product and past recalls in the marketplace? How do you check for allergens? How do you keep up to date on emerging threats? How do you use this information to keep your plan alive and up to date?

The expertise and job knowledge of the team won’t be good enough for FDA if they challenge the analysis. List all the sources and information your team used to reach their conclusions. FDA is going to want to see them.

Fatal Flaw Number 7: Your food safety documentation is hard to follow and confusing.

The food safety plan itself needs to be concise and it needs to be self-contained. If FDA invokes their authority under the regulations and decides they want to make a copy and take it with them, they can do so. The acid test for this is to pretend that FDA has made this request. It should be crystal clear which documents are part of the plan and which are not. Can you go to the photocopier and run off the documents easily? Are they marked “confidential and proprietary”? Who can authorize this for your company? How does your legal team vet this prior to release? Do you have a procedure in place to follow? If you can’t answer these questions, you have a problem.

Remember, your plan and documentation will be reviewed by more people than just the FDA investigator who came to your plant. A scientist at the agency’s Center for Food Safety and Applied Nutrition or other regulatory agencies may take a look to see if your program is robust and protects public health. They need a clear and easy program to read that expresses how you control food safety regardless of whether you’re on hand to respond. If you have to be there to explain it, it’s not ready. Your food safety plan needs to speak for itself without you there to defend it.

Fatal Flaw Number 8: Your plan doesn’t explain how corporate manages food safety.

FDA knows that a lot of important programs are not managed at your plant. Systems such as supplier approval, policies, FSVP, Customs and Border Protection filings, label review, food safety claims, recall management, and many others are not controlled at the plant. Consequently, FDA has instituted what are known as “FSMA Tier 2 Audits” to go directly to your corporate offices and review these programs in person. Are the parties at corporate aware of their part in food safety? Do they know what to do if FDA shows up? Are they trained and prepared to speak about food safety with FDA? Who is responsible for managing this? You need to understand this at the plant level and have people at corporate ready to help when FDA starts asking these questions. Explain how this works in your food safety plan. 

Fatal Flaw Number 9: Your plan does not take the actual intended consumer into account.

Every HACCP and food safety plan I have reviewed always says the same thing when you get to the product profile section. That’s where you identify your intended consumers. Who are you selling your product to? When I get to the section, it always reads, “General population.” Really? Are you sure? Everyone puts this in because it’s easier to say your product is for healthy people without special requirements than addressing the actual intended consumers in your plan. This is a major mistake, and FDA will probably challenge it in particular circumstances. For example, if you manufacture popsicles, they are a product made specifically for kids. The marketing is for kids, the packaging is for kids, it is manufactured for kids. Everyone knows that the intended consumer for popsicles is children, and it needs to be stated in your food safety plan. Your plan needs to reflect the extra layers of control necessary to protect a group of people with a higher risk level for illness than the general population. You need to consider tighter specs and a more aggressive approach to food safety. FDA is going to push you on this, and you must be prepared.

Fatal Flaw Number 10: Your plan doesn’t tell your food safety story.

Two things are important above all else in your food safety plan. Why you do what you do and more importantly, a question most people never consider: What are the things you don’t do?

What do I mean by this?

Here’s an example. You have a long list of suppliers; some are at a higher risk for food safety, others are less. You should have a supplier approval program that takes this into account. Different audit requirements, different sampling programs, and different corrective action expectations. You need to be able to explain to FDA why you have different levels of scrutiny. Think about it; it’s exactly what FDA does. They audit facilities in high-risk sectors much more than low-risk ones. It’s an intelligent way to use limited inspection resources. Show them that you do the same thing. Paint a picture of your program and use the documents to show how it’s done. Be proud of your program and how your company protects the public and your brands.

Closing Thoughts

Did I give you a few things to think about? If any of these hit close to home, you need to go back and work on your food safety plan immediately. FDA can show up at any minute, and you need to be ready. The good news is that you are not alone in the dark, hoping for the best. Your food safety plan is too important to leave to chance. 

Find and reach out to experts, who can help you quickly fix these issues. Find the errors or omissions in your plan before FDA finds them and writes you up. Food safety is something that we all face together as an industry, and we are only as strong as the weakest link. Don’t reinvent the wheel; call on experts to accelerate your knowledge and protect your consumers and your business. It’s a small investment for what you gain in return.