On September 19, 2014, the FDA released the  proposed FSMA rule changes. Since then the public dialogue has been immense and it's not about to stop any time soon. The discussion about changes and demand for clarifications will continue as FDA writes the final Food Safety Modernization Act (FSMA) rules.

FSMA Becomes Proactive

Although there are uncertainties in play, we know the objectives for FSMA will not change. The primary goal is to move from being reactive to preventive for any actual or potential food safety issue termed a "Severe Adverse Health Consequence or Death in Humans or Animals (SACHODHA)" event in the marketplace. Therefore, changes to FSMA will be focused on food processors and distributors of products associated with Class 1 recalls (SAHCODHA hazard). 

What This Means in Application

The proposed FSMA changes want to encourage a more proactive approach in preventing unsanitary conditions and crosscontact contamination. So, the proposed rules will require a broader approach to identification and monitoring of risks in the food manufacturing process, including: 

• Food Safety Programs
• Supplier Controls
• Process Steps
• Operational Practices

At minimum, this will require a risk-based analysis for hazards that will be controlled by the good manufacturing practices (GMPs), HACCP plan, process controls, and a supplier verification program.

Our Focus

This post focuses on FDA response to the public commentary and discusses a practical understanding of the proposed changes contained in the following sections:

• Section IX: Overall Framework for Hazard Analysis and Risk-Based Preventive Controls (HARPC) for human food processors and the process for identifying preventive controls (PCs)
• Section XI: Potential Requirements for a Supplier Program which are the foundation for FSMA implementation; and other sections such as
• Section X: Proposed Requirements for Product Testing and Environmental Testing due to nature and importance if included in the final rules.

Defining HARPC

“The primary goal is to move from being reactive to preventive for any actual or potential food safety issue. ”

HACCP vs. HARPC

It is important to understand that HACCP is not the same as HARPC, but together they will enhance food safety through additional food safety programs and supplier controls that are monitored and verified similar to a Critical Control Point (CCP).  Regulated HACCP (Hazard Analysis and Critical Control Point) is considered to be a success story in the production of high-risk foods. The FDA has even applied these principles to “other than critical control points (CCPs)” in a company’s day-to-day operations.

The regulatory focus for HARPC is to reduce the number of Class 1 recalls due to undeclared allergens and pathogenic bacteria such as Salmonella and Listeria. FDA defines a Class 1 recall as “a situation in which there is a reasonable probability that the use of or exposure to a volative product will cause serious adverse health consequences or death” (SAHCODHA hazard).

What is a Hazard Under HARPC?

The rationale for HARPC can be traced to regulated HACCP for seafood (21 CFR part 123) and juice (21 CFR part 120). In those regulations they defined a hazard as a “known or reasonably foreseeable hazard” was “reasonably likely to occur”. This phrase and definition has caused confusion as it is derived from HACCP hazard analysis terminology to identify potential Critical Control Points (CCPs) and not preventive controls.

In response, FDA has proposed the use of the term “significant hazard.”

“Significant hazard would mean a known or reasonably foreseeable hazard for which a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would, based on the outcome of a hazard analysis, establish controls to significantly minimize or prevent the hazard in a food and components to manage those controls (such as monitoring, corrections or corrective actions, verification and records) as appropriate to the food, the facility, and the nature of the control.”

From this statement, FDA has clarified that the “known or reasonably foreseeable hazard” would apply to the facility conditions, type of food product, and raw materials. The minimal criteria to be applied to control significant hazards for a facility’s plant conditions and type of food product is listed in Table 1.

Determining Your Plant's Hazards under HARPC

FDA has suggested that determining a significant hazard would be a two-step hazard analysis process:

1. List the known or reasonably foreseeable biological, chemical, and physical hazards associated with the facility and the food product. For HARPC, additional chemical hazards such as radiological, natural toxins, pesticides, drug residues, food additives/colors, and decomposition would need to be added to the raw material hazard analysis and include economically motivated adulteration (EMA).
2.  Evaluate the importance of a preventive control (PC) to significantly minimize or prevent the hazard from occurring, and evaluate what level of monitoring and record keeping would be necessary to achieve effective control. The level of importance would be based on the severity of the illness or injury and the likelihood of occurrence if this hazard was not adequately monitored. In other words, not all preventative controls will have documented monitoring, only the most important programs for raw materials, plant conditions, and food safety programs that prevent “significant hazards” from occurring.

(Author’s note: Quotations are taken directly from FDA documents, but are subject to further change when the final rules are issued.)

Domestic Supplier Control

A supplier control program (i.e., supplier verification), would require the identification of any “significant hazards” during hazard analysis and deciding what entity will be controlling the identified hazard. This could be the supplier to the supplier (sub-supplier), the receiving entity (processor or distribution), or the customer. It is expected that there will be additional changes in the Supplier Verification Program as the comment period for this and the Foreign Supplier Verification Program (FSVP) are finalized.

Currently, the options for controlling significant hazards associated with raw materials are:

• The supplier to the receiving facility (processor) controls the hazard.
  • The supplier to the processor’s supplier controls the hazard (termed sub-supplier).
• The receiving facility controls the hazard.
• The customer of the receiving facility controls the hazard.
• A combination of these options controls the hazard through supplier verification or other verification activities.

Table 2 provides a summary of when the receiving facility would need or not need to have a Supplier Verification Program to control the identified hazards.

Raw Materials

If a company identifies significant hazards in its raw materials and ingredients controlled by the supplier or sub-supplier, the receiving facility will need to have a documented Supplier Verification Program (SVP). The current requirements for content are:

• Supplier Verification Requirements  
  • Documented hazard analysis and records for identifying significant hazards in raw materials and ingredients.
  • Documented supplier verification procedures and records.
  • Annual on-site audit by a “qualified auditor” to review the supplier’s procedures, conclusions, and effectiveness of any necessary corrective action(s).
• After the initial audit, the receiving facility (processor) can elect to require less than annual audits but must conduct other verification activities to ensure hazard control is adequate.
• FDA would not have access to the full audit report, but could have access to audit conclusions and corrective actions.
  • If the receiving facility (processor) does not get product directly from the supplier, then it must conduct verification activities with that supplier.
• Verification activities will be based on:
  • Severity of the hazard.
  • Review of preventive controls at the point they are applied (e.g., sub-supplier, supplier, customer, or other entity).
  • Effectiveness of the supplier’s food safety programs.
• The supplier’s food safety performance history.
  • The supplier’s compliance with FDA regulations.
  • Other factors such as storage and transportation requirements controlling the significant hazard.

The Supplier Verifcation Program is meant to ensure that only approved suppliers are used for raw materials that have significant hazards. It appears that there will not be a need to have an approved supplier list for raw materials with significant hazards, but there must
be evidence that only approved suppliers are used. The term “qualified auditor” has not been defined and doesn't mention any specific third-party audit schemes that could be used to verify suppliers, but this and other clarifications are expected in the final rule.

(Author’s note: The FSVP rule was not reviewed in this article, but its requirements are expected to be very similar to the supplier verification requirements contained in HARPC.)

Product Testing & Environmental Monitoring

The requirements for product testing and environmental monitoring as a verification activity to verify that preventive controls are effective will be clarified in the final rule. Currently, FDA has provided flexibility for both requirements in that these programs would not be prescriptive and would be implemented “as appropriate for the food, the facility, and the nature of the preventive control" being verified. 

Ready-to-Eat Products

The term “product testing” would apply to testing for ingredients and in-process and finished product. For ready-to-eat (RTE) product, FDA has stated that the type of product testing could be appropriate because there is not a kill step for certain types of foods.

FDA proposes that environmental testing would be appropriate for RTE product that does not receive a “treatment to minimize environmental pathogens” and is exposed prior to packaging. In both cases, if testing is being done to verify preventive controls are effective, the procedures, corrective actions, and records of testing would have to be kept.

Preventive Controls

Individual preventive controls are also termed “food safety plans” and should be monitored relative to the importance of the conclusions of the risk-based hazard analysis. The term “flexibility” is used in response to the industry suggestion for a “sliding scale” in that all preventive controls do not have to be monitored the same way. In other words, not all preventive controls will require documented monitoring, corrective action, and validation or verification activities. 

Furthermore, the verification activities to judge the effectiveness of the preventive controls can be conducted “as appropriate for the facility, the food, and the nature of the preventive control.” For companies operating under a documented food safety system, it is likely that most food safety preventive controls are already documented, but will need to be verified as FSMA-compliant. 

Important Due Dates

On August 30, 2015, the final rule for Section 103, Hazard Analysis and Risk Based Preventive Controls for Human Food (HARPC) is to be issued and allow approximately one year for companies to be compliant with implementation of food safety preventive controls.

Imported foods and Food Supplier Verification Programs (FSVP) are contained in sections 301, 302, and 303 and will be subject to the HARPC preventive controls with an issue date of October 31, 2015. Although further changes and clarifications will occur as the final rules are issued, it is apparent that the process for identifying preventive controls associated with “significant hazards” should be completed by early 2015. 

Preparing for FSMA

For companies that already have documented food safety procedures and participate in third-party audits or an internal audit program, it is likely that many of the potential preventive controls are documented and on a verification schedule. The challenge for these companies is to determine which preventive controls should be HARPC-monitored. The absence of effective monitoring would pose an unacceptable food safety risk for the company, potentially resulting in a Class 1 recall or regulatory action.

If you receive FDA’s recall notifications, you know that undeclared allergens occur frequently and more often in certain types of foods. Any preventive programs controlling undeclared allergens (e.g., label verification at packaging, preventing allergen cross-contact in processing, proper cleaning during allergen changeover cleaning, or supplier verification
for undeclared allergens) should be considered as directed by the risk-based hazard analysis. The same logic would apply for any significant hazards that are associated
with your type of raw materials, process environment, and type of finished product. The time to start preparing for FDA’s HARPC requirements is now.