(This is Part 2 -- if you missed Part 1, you can find it here.)
Provisions of FSMA
FSMA is a complex piece of legislation, and there are a great many regulations that make up the final requirements. Perhaps the best place to find details in on the FDA website under FSMA Frequently Asked Questions. For the purposes of this article, though, we will zero in on particular areas that SAP customers have asked about since the passage of the act, to be followed by specific recommended solutions and timelines. But as a first step, let’s look at a fundamental change in regulatory philosophy that drives FSMA, and how that change affects the practical steps that you must take to be in full compliance with the law.
Under the regulations in effect prior to 2011, the FDA had very limited powers to enforce food safety. For example, the FDA could not order a recall of product – all recalls were voluntary, no matter how egregious the problems. This meant that very often, a necessary recall did not happen, or was delayed and ineffective. FSMA changed that – the FDA can now mandate a recall if the company involved does not voluntarily comply with recommendations, and can levy fines and other penalties for non-compliance, including criminal penalties in some cases.
In addition, the FDA now has the power of administrative detention, that is, they may quarantine products at any point in the food chain. This is to ensure that a suspect lot of food does not get to the consumer even after it has been flagged as problematic. And in severe cases, the FDA can withdraw registration, effectively shutting down a manufacturing plant or other facility. Furthermore, the FDA can require the production of records on 24-hour notice, particularly lot tracking and tracing records.
But the FDA has said repeatedly that they expect drastic orders to be rare, and that a well-regulated food safety system must rely on the active cooperation of all parties involved, including both federal and state agencies. Workers in the food chain must be the first line of defense, and must be proactively seeking to keep the food supply safe and wholesome. This is an important change in regulatory philosophy – the FDA is now trying to prevent incidents from happening in the first place, rather than cleaning up afterwards. That in turn means that an FDA inspection will normally focus on the implementation and execution of adequate food safety plans, specifically Hazard Analysis and Risk-Based Preventve Controls, which supplement the older HACCP plans.
Five Key FSMA Rules
At SAP and Deloitte, we have identified five important areas where software can be especially helpful in meeting FSMA requirements:
- Traceability and Recall Execution – integrate your documents and processes to enhance traceability – real-time traceability backward and forward through the supply chain – this is a critical requirement for any food safety program.
- Records access – you are now required not just to keep records, but to produce them on 24 hours notice. Although these records can be paper-based, it is difficult to see how most companies can fulfill this requirement without digitizing most or all of their records.
- Hazard analysis, risk-based preventive controls, and corrective action – perform risk assessment, create CAPAs, document results, and manage policies, procedures, and related content.
- Food defense – perform risk assessment, document results, and manage policies, procedures, and related content, including both structured and unstructured data.
- Foreign supplier verification – support audits of 3rd party suppliers and internal facilities.
Timeline
The clock isn’t just ticking, the alarm has gone off, several times in fact. Some of the provisions mentioned above have been in effect for years, and the FDA will expect to see compliance, or at least a compliance plan, very soon. A quick look at the FSMA compliance timeline:
2011Mandatory Recall Execution Final Rule: Requires mandatory review of current recall and replacement strategies to ensure removal of recalled product from commerce expeditiously; provides FDA broader authority to execute a mandatory recall; FDA can order a recall of a product if the company refuses to execute a voluntary recall. Effective date: January, 2011.
2014 Record keeping and document management Final Rule: Gives FDA broad authority to review company records; documents related to Food safety need to be accessed rapidly (must be provided within 24 hours); requires 2-year retention period for required documents. Effective date: April, 2014. [i]
2016 Preventive Controls Final Rule: Requires companies to implement a written Food Safety plan that includes Hazard Analysis and Risk-Based Preventive Controls; records must document corrective actions, monitoring, verification/validation of process preventive controls and training; records must be accessible within 24 hours of request for official review. Effective date: 9/17/2016 (General Compliance). [ii]
2017 Sanitary Transportation Final Rule: Requires companies to have Information Exchange procedures about prior cargos, cleaning, temperature control as appropriate to the shipping situation; require companies to have documented carrier personnel training; applicable to shippers, carriers and receivers by motor/rail, not by air/ship transportation. Effective date: 31March, 2017. [iii]
2017 Foreign Supplier Verification Program (FSVP) Final Rule: Requires importers to perform certain risk-based activities, to verify that food imported into the United States has been produced in a manner that meets applicable U.S. safety standards; requires companies to determine for which of their suppliers they are the FSVP importer; require companies to verify that foreign supplier facilities meet FDA FSMA Preventative Controls and Produce Safety Rules, to verify food safety activities and maintain records. Effective date: 1 May, 2017. [iv]
2017 Accreditation of 3rd Party Certification Final Rule: Third-party certification bodies accredited under this program are required to perform unannounced facility audits, and auditors must notify FDA upon discovering a condition that could cause or contribute to a serious risk to public health. Effective date: 31 May, 2017. [v]
2017 Food Defense – Protect Food Against Intentional Adulteration Proposed Rule: Requires companies to prepare and implement a written food defense plan that addresses potentially significant vulnerabilities in a food operation; personnel and supervisors assigned to the actionable process steps are to be trained in food defense awareness and in their responsibilities for implementing focused mitigation strategies. Effective date: 31 May, 2017. [vi]
2017 Standards for Produce Safety Final Rule: Requires farm or produce growers to ensure agricultural water quality; document biological soil amendments; record domestic and wild animal interaction; detail growing, harvesting, packing and holding data; and maintain equipment, tools and building records, worker training, health and hygiene records. Effective date: 31 October, 2017. [vii]
Food Fraud
In addition, there are implicit and explicit requirements of FSMA regarding food fraud. Of course, food and other FDA-regulated products must be properly labeled – if the package says “beef”, the contents should be beef and not horse meat. It has long been difficult or impossible to determine the identity of many food ingredients quickly enough to be able to pull them from the food chain before they reach the consumer. In part, this is due to the acceleration of the movement of goods in the supply chain, especially when the good are perishable. DNA testing has been available for some time, but is not generally fast enough to be helpful. But new faster tests are now available, and the FDA has said that they will require more stringent identity testing in the near future. Rapid DNA testing of incoming raw materials, for example, is now available from Tru-ID, and is especially important for expensive materials like coffee, cocoa and olive oil, which are all frequent targets of fraudulent substitution.
Next Up
In the third and final part of this blog, we will have a look at solutions that SAP and our partners have developed to help you deal with these FSMA requirements. Remember, some provisions are already in effect, and many more are coming into effect in the near future. Be sure you are in compliance!
(This is Part 2 -- to read Part 3, click here.)
Join us at our upcoming Consumer Products Best Practices event in Chicago, 3-5 October, where we will discussing and demonstrating our Food Safety software. You can register here.
[i] Record Keeping Final Rule, FDA: https://www.federalregister.gov/articles/2014/04/04/2014-07550/establishment-maintenance-and-availability-of-records-amendment-to-record-availability-requirements
[ii] Preventive Controls Final Rule, FDA: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm334115.htm
[iii] Sanitary Transportation Final Rule, FDA: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm383763.htm
[iv] Foreign Supplier Verification Final Rule, FDA: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm361902.htm
[v] Third Party Certification Final rule, FDA: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm361903.htm
[vi] Intentional Adulteration Final Rule, FDA: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm378628.htm
[vii] Product Safety Final Rule, FDA: http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm334114.htm