The clock is ticking. Most food facilities face a September deadline for complying with regulations set out by the Food and Drug Administration (FDA) that enforce the Food Safety Modernization Act (FSMA).

Actually, FDA’s final rule covering preventive controls for the safety of human foods is effective now, having been published in the Federal Register of Sept. 17, 2015. And now means now.

“I would hope that most food facilities are on the way to compliance already,” said Jack Payne, vice-president, product management and solutions consulting, Aptean Inc., a provider of enterprise resources planning systems. “The scope of the rules has been known for three years or more, even if the actual regulations were only recently finalized and published. Documentation of preventive control plans should be in place now.”

Food safety experts such as Len Steed, manager, global innovation, AIB International, urge immediate action. “Companies should establish a team responsible for a successful transition to FSMA on time,” he said. “Every plant should set up a Gantt chart or project schedule to ensure they are in compliance on or about Sept. 17. This will allow them to prioritize what needs to be done by set dates in order to achieve compliance in the most efficient and logical path and manage the progress.”

Mr. Payne added, “If I’m a food manufacturer and don’t have a plan by now, then I’m in trouble.”

A different approach

FSMA marks a sweeping change for FDA. It places the job of preventing foodborne illness on the shoulders of food processing facilities, and its rules are different than those of past FDA regulations. “It takes the function of Hazard Analysis Critical Control Points (HACCP) and makes it law,” said Justin Hamilton, senior project engineer/project manager, foods and consumer products group, Burns & McDonnell, a civil engineering firm with a practice among consumer packaged goods clients. “HACCP is the foundation of preventive controls. FSMA marks a sweeping change for FDA.”

It takes many HACCP components — for example, implementation of prerequisite programs, current Good Manufacturing Practices (cGMPs), analysis of potential problems and documentation — but shifts control measures into a prevention mode called Hazard Analysis and Risk-Based Preventive Controls (HARCP).

“FSMA compliance with its emphasis on risk prevention is different than HACCP,” said Robert Brackett, PhD, vice-president and director of the Institute for Food Safety and Health (IFSH) at Illinois Institute of Technology.

Food facilities are required to implement written preventive controls plans. To establish the plan, the facility must evaluate hazards that could affect food safety; identify what preventive steps, or controls, will be put in place to minimize or prevent the hazard; describe how these controls will be monitored to ensure they are working; maintain routine records of such monitoring; and specify what actions the facility will take to correct problems that arise.

HARCP is not as prescriptive as HACCP, according to Mr. Steed. “[This approach] allows the food safety team to set up steps for deciding what to do in case of failure of each preventive control identified. These include correcting the problem that caused the failure; finding the root cause and eliminating it; evaluating the product for safety; releasing the product only if there is verifiable evidence that its safety was not compromised; and documenting.”

The foundation is prevention and response. “Most bakers and other food processors rightly put emphasis on prevention in their food safety programs,” Mr. Payne said, “but they also have to know how to act when problems occur and how to implement recalls effectively.”

Another big difference involves records access. FSMA beefed this up, giving FDA the authority to request the facility’s food safety plans and records that document the implementation of such plans. It can dive deeper into records of companies that process, pack or hold high-risk foods.

Additionally, laboratories that supply test services to food facilities must be accredited.

FSMA empowered FDA to give imported foods and food ingredients greater scrutiny. Regulations address importer accountability and third-party certification, and they offer the Voluntary Qualified Importer program. The law gives FDA the authority to refuse foreign foods entry into the US if the agency is denied access by the processing facility or the country in which it is located.

If things go wrong, and a company fails to voluntarily remove unsafe food from the market after an FDA request, the agency can mandate such action. “It’s important to do recalls correctly and promptly,” Mr. Payne said. “Under the law’s expanded administrative detention provision, if you don’t do your recall within a precise time, all your products can be pulled by FDA as potentially in violation.”

FDA can suspend the processing facility’s registration if it determines that the food made there poses a reasonable probability of serious adverse health consequences or death.

There are some very real costs involved. Consider the matter of inspections. With FSMA now in effect, every food manufacturing facility registered in the US can expect to be inspected periodically. The frequency is determined according to risk. All those making high-risk foods will be inspected within the next five years and every three years thereafter.

Fortunately, bakery products are not typically considered to be high risk, Mr. Payne observed. “Most bakery recalls are due to mislabeling and allergens, although I have seen a few related to bacterial problems involving cream fillings and icings,” he said.

Like previous practice, the initial FDA inspection carries no cost to the facility, but then things change. If problems are found that require a second visit, FDA can charge the company for the hours that the inspector — or inspectors — is present in the facility, no matter how many times they have to return to make sure a compliance problem has been addressed.

What flexibility means

FSMA provides more leigh way than previous regulatory schemes, softening the blow of the new mandatory aspects. “The flexibility included the additional time for compliance under rulemaking,” explained Bill Bremer, principal, Kestrel Management, a provider of operational risk management services. “Additionally, the compliance deadline will vary depending on the size of the company; however, in all cases, a company’s compliance must meet the requirements of their customers.”

Working through the rulemaking process, FDA asked for feedback from the public, industry groups and affected companies. “It incorporated a lot of what it learned about best practices in food processing,” Mr. Payne said.

Among the things the agency learned was that one size does not fit all. “The food facility operator can choose the preventive control for their process,” Dr. Brackett explained. “In some cases, it may be that their ingredient supplier has preventive controls in place. But the key thing is that the facility will need to document why they chose this particular preventive control, how it is being implemented and the results of applying it.”

Mr. Steed explained, “Not all preventive controls will need to be managed with the same level of rigor and frequency.” Considerable freedom is allowed to decide monitoring methods, corrective actions, verification, validation, frequency and documentation.

After undertaking a hazard analysis, it may be that the food safety team determines a particular hazard requires no preventive control. If so, “It has to document why there is no need for control,” Dr. Brackett observed. “In other words, why this facility did what it did regarding this particular hazard.”

Such leniency has its limits, according to Cornelius Hugo, manager, global innovation, AIB International. It works for minor cGMP issues and corrections in documenting them. “However, for preventable recalls such as undeclared allergens and controls for pathogenic bacteria in ready-to-eat food, there will not be flexibility for documenting effective plant programs that prevent these type of recalls,” he noted.

There are pros and cons involved, too. “If I were a baker, I would see this open-ended approach as encouraging,” Mr. Payne said. “There is some risk, however, because how I interpret something and how the FDA inspector interprets the same thing may differ. That’s where a third-party inspector can help.”

Bakery, snack challenges

Allergens throw the biggest food safety hurdle at bakers and snack food manufacturers. These foods meet the FSMA definition of ready-to-eat, and many of their ingredients qualify as allergenic to one or another segment of the public. Thus, the new food safety rules demand a more rigorous environmental monitoring program, especially after the kill step. “Under FSMA, the baking industry can expect a lot more attention to be paid to allergen controls,” Dr. Brackett said.

More baked foods are recalled because of allergen labeling problems than for any other reason. “Cross-contact with allergens is too common due to weak preventive actions and procedures,” Mr. Steed said. He directed attention to the new cGMPs outlined under 21 CFR 110. Part 117 identifies 24 instances where allergen cross-contact potential needs to be addressed and controlled.

Allergen labeling plans are important to this effort. Mr. Hugo explained, “If a company has plant conditions for allergen cross-contact or different allergens in its products, it is required … to prevent undeclared allergens through proper label control programs from the inception of the label and into plant operations from receiving through packaging.”

Validation of kill steps will also be necessary to food safety plans for bakery and snack operations. “Kill steps can be important depending on the product risk and must been determined through the preventive control process,” Mr. Bremer said. “These need to be updated with cGMPs that are current for the operations and the food risk as past food safety programs must be updated.”

It’s common knowledge that the heat of the oven or fryer destroys pathogenic microorganisms. But proving that it works as a kill step — validating it — is another matter. Mr. Hugo described AIB International’s new tools to help bakeries evaluate food safety preventive controls. The AIB Kill Step Calculator evaluates pathogen risks for production of buns, whole wheat bread and muffins, with cookies the next to be added to the program. It relies on information from data logging equipment that bakeries commonly use to verify oven temperatures.

The design and equipping of food facilities plays a significant part in FSMA compliance. “These are things that are easier to work with early in the design of facilities than later on,” said Richard Wiehe, PE, senior associate mechanical engineer, Burns & McDonnell.

The qualified individual

Getting started means allocating resources, and every registered food facility needs to identify a preventive controls qualified individual (PCQI) to manage the food safety process and the team that will carry out FSMA rules. “You look for a combination of experience and training,” Mr. Payne said.

Finding and training this person should be the first thing a company does, Dr. Brackett emphasized as well. “Then it should assemble a food safety team. The team will work with the qualified individual to build a food safety program,” he said.

Training given this individual should be through a program approved by the Food Safety Preventive Controls Alliance (FSPCA). The broad-based public-private alliance, established in 2011 by a grant from FDA to IFSH, consists of key industry, academic and government stakeholders. Its mission is to support safe food production by developing a nationwide core curriculum, training and outreach programs to assist companies producing human and animal food in complying with FSMA’s preventive controls regulations. The alliance provides technical assistance through training courses, presentations and webinars.

“Although a PCQI can be otherwise qualified by work experience, education or training, it is not fully known what the expectations will be for companies that choose not to attend the approved training,” Mr. Hugo said. In addition to the PCQI, the company must ensure that food safety personnel and their supervisors are qualified to perform such activities. He noted that AIB International is an approved training provider for the FSPCA Preventive Controls for Human Food course.

FDA put in place its Technical Assistance Network (TAN) to advise industry, regulators, academia, consumers and others about implementation of the new regulations. The network is now fully operational and taking inquiries via a special page on the agency’s website, www.fda.gov, or by mail. FDA’s website, in its Food section, carries an extensive library of fact sheets, presentations and archived webinars about FSMA regulations and how they are being implemented.

As deadlines near, a host of webinars and in-person seminars about FSMA topics are now flooding email and mailboxes throughout the food industry.

Do it now

A good way to prepare for FSMA is to get your HACCP plan and cGMPs up to date. Then work to fit them to FSMA regulations.

“One of the first steps is hazard analysis,” Dr. Brackett said. “This may be the most comprehensive and complicated step for bakers, indeed, for all food manufacturers. You may need help from experts, university specialists and others. The results of this analysis will drive the rest of the process.”

Some elements of FSMA are enforceable now, specifically registering of food facilities and establishing a food safety plan. Because two rules won’t be final until later this year, their deadlines for compliance are also delayed, and different timelines affect companies of various sizes. “The first step should be to conduct an analysis of requirements for developing a FSMA compliance plan,” Mr. Bremer said.

Rules involving preventive controls for human foods, the foreign supplier verification program and food defense should be the first FSMA programs to address, according to Mr. Steed. “Set up a transition team to develop and implementation the plan,” he said. “Educate and train personnel at all levels, starting with the PCQI. Understand that plant managers will be held accountable.”

Don’t just write down your HARCP program; run it, and start documenting the results. “Implement and review your preventive control records to ensure that they accurately portray the sanitary conditions at your plant and any improvements to those programs,” Mr. Hugo said. The success of preventive controls will be judged by the authenticity of the facility’s records and its ability to demonstrate that improvements are being made.

“I’ve been to many food facilities in 25 years,” Mr. Payne observed, “but the one I will always remember is the one that required me to take a half-hour class in food safety — and complete a test of my knowledge — before admitting me into the plant. That’s quite a proactive approach on the part of the company. That’s the type of thing companies should do. You can’t get complacent about safe practices.”