The Food Safety Modernization Act (FSMA)

It is important that each food processor fully understand their responsibilities and comply with all applicable federal and local food safety regulations. The information presented here by Penn State is for reference only and may not be inclusive of a processor's full responsibilities.

This article provides an overview of the federal Food Safety Modernization Act (FMSA). The most significant component for most food processors is the Preventive Controls for Human Food Rule. This article reviews aspects of this rule that apply to all processors, the definition of a facility that qualifies for an exemption from having a full food safety plan, and the elements required in a Food Safety Plan.

The Food Safety Modernization Act (FSMA) is sweeping legislation designed to protect the American public by focusing the food manufacturer on preventing illness rather than responding to outbreaks after people are already sick. The Act was passed in 2011 to address the fact that there were over 48 million illnesses per year in the U.S. caused by food that could largely have been prevented with better manufacturing, packaging, distribution, and holding practices. The broad scope of FSMA regulations across the entire food safety supply has required years to bring to fruition, and implementation is ongoing.

The Background and Focus of the Food Safety Modernization Act

The Food Safety Modernization Act included new regulations and new authority for the FDA to enforce these regulations under five major areas.

Prevention

A key feature of FSMA was the legislative mandate to require comprehensive, science-based preventive controls across the food supply. There are seven rules that address different aspects of the food supply. A brief description of each rule is provided below with the link to the FDA website. More information can also be found on these FSMA topics on the Extension website.

• Preventive Controls for Human Food. Establishes minimum safety standards for manufacturing, processing, packing, and holding of human food, including employee training requirements, Good Manufacturing Practices (GMPs), and Hazard Analysis and Risk-based Preventive Controls. More details on this rule are covered later in this article. For processors that already have a Hazard Analysis and Critical Control Point (HAACP) plan in place, this article on Understanding FSMA: HACCP, HARPC and the Preventive Controls for Human Food Rule will help clarify the difference between these programs and the terminology used in each. This article on the Preventive Controls Rule on Human Food highlights other Penn State resources on this rule, including training opportunities.
• Preventive Controls for Food for Animals. Establishes minimum safety standards for the production of food for animals. The Extension website has an article and a video on Understanding FSMA - The Preventive Controls for Animal Food Rule that discusses who is covered under this rule and the requirements for compliance. This article on Preventive Controls Rule for Animal Food highlights other Penn State resources on this rule, including training opportunities.
• Standards for Produce Safety. This rule sets forth safety standards for the safe growing, harvesting, packing, and holding of fruits and vegetables. The Extension website has numerous articles and tools to help produce growers understand and comply with the regulations, starting with this introductory article on Understanding FSMA: The Produce Safety Rule.
• Foreign Supplier Verification Program (FSVP) for Importers of Food for Humans and Animals. This rule establishes the requirements for foreign suppliers to verify that they meet the U.S. food safety requirements and become approved suppliers. The Extension article Food Safety Modernization Act - Foreign Supplier Verification Program (FSVP) Rule has more details and resources to help you understand this rule.
• Accredited Third-Party Certification Bodies To Conduct Food Safety Audits and To Issue Certifications. This rule establishes a framework, procedures, and requirements for the certification of third-party parties to conduct food safety audits. The need for traceability of ingredients by manufacturers and of products by retailers has resulted in an increased need for third-party, independent audits of food safety practices, which must be done by a qualified individual.
• Sanitary Transportation of Animal and Human Food. This rule applies to shippers and those involved with transporting food by rail or motor vehicle. It addresses design of vehicles, refrigeration, and sanitation practices to ensure safe transportation of food. The article Sanitary Transportation of Human and Animal Food has more information, and there is an online course you can take at your own pace for training on this rule.
• Mitigation Strategies to Protect Food Against Intentional Adulteration. This rule is aimed at preventing wide-scale harm through intentional adulteration of the food supply through the development of food defense plans. This article can help you understand the rule and develop a food defense plan for your facility.

Inspection and Compliance

FDA has been given authority to provide oversight to ensure the food industry is complying with mandated food safety practices and preventive controls. Specifically through:

• Mandated inspections. High-risk facilities are to be inspected at least every 3 years. High-risk facilities are those that process foods known to have associations with foodborne illness. An example of this is dairy products, because even if the finished products are pasteurized, the facility is receiving raw milk, which is known to be associated with pathogens.
• Access to records for review. An inspector can ask to review your records, including documentation of employee training, sanitation records, and other documents supporting your food safety program, and you are legally obligated to provide them.
• Require testing by accredited labs. Certain food testing must be carried out by laboratories that are accredited by the FDA to ensure the testing meets FDA standards. An example of this is the testing of a food to address a safety problem.

Response

FDA was given new authority under FSMA to respond to situations so they can protect public safety, including:

• Authority to mandate a recall of unsafe food if a company does not do so voluntarily
• Expanded authority to detain suspect food
• Ability to suspend a food facility's registration
• Require enhanced product traceability and recall plans. A recall plan should go at least one step back and one step forward so a manufacturer or retailer can quickly locate and control all suspect products in case of a product recall.

Imports

FDA will ensure that imported products meet U.S. standards by increasing importer accountability, implementing a voluntary qualified importer program, and using third-party certifications.

Enhanced Partnerships

FSMA builds a framework for establishing formal collaborations with local, regional, national, and international agencies to achieve public health goals.

Preventive Controls for Human Food (21 CFR 117)

The Preventive Controls for Human Food Final Rule sets requirements that food manufacturers must follow to produce safe food. These requirements are outlined in Title 21 Part 117 of the Code of Federal Regulations (21 CFR 117), Current Good Manufacturing Practices, Hazard Analysis and Risk-based Preventive Controls for Human Food, which is divided into the following seven subparts.

Subpart A - General Provisions. Subpart A applies to all food processors and contains an extensive list of definitions used in the regulations, outlines training requirements for individuals that are qualified to handle food, and identifies processors that are exempt from some of these regulations, such as those following mandatory HACCP programs like the seafood industry or those that meet the definition of a "Qualified Facility" as defined in this subpart.

Subpart B - Current Good Manufacturing Practices. Subpart B applies to all manufacturers and defines the Good Manufacturing Practices (GMPs) for personnel, plant and ground, sanitary operations, sanitary facilities and controls, equipment and utensils, processes and controls, warehousing and distribution, holding and distribution of human food by-products for use as animal food, and defect action levels.

Subpart C - Hazard Analysis and Risk-based Preventive Controls. Subpart C applies to manufacturers that need to have a food safety plan, which are considered to be "Covered Facilities." Qualified Facilities that meet the requirements for exemption, as defined in Subpart A, may be subject to some sections of Subpart C. The topics covered in Subpart C include the food safety plan, hazard analysis, preventive controls, recall plans, preventive control management components, monitoring, corrective actions and corrections, verification, validation, verification of implementation and effectiveness, reanalysis, and the implementation records required.

Subpart D - Modified Requirements. Subpart D applies to manufacturers that are considered "Qualified Facilities" based on the products they make or their size. This section outlines the modified requirements that apply to a qualified facility, and those that apply to a facility solely engaged in the storage of unexposed packaged food.

Subpart E - Withdrawal of a Qualified Facility Exemption. Subpart E applies to manufacturers that are "Qualified Facilities." This section contains information on circumstances that may lead the FDA to withdraw a qualified facility exemption, the procedures and timelines for the withdrawal of the exemption and the appeal processes, and reinstatement of the qualified facility exemption.

Subpart F - Requirements Applying to Records That Must Be Established and Maintained. Subpart F applies to all records kept under FSMA and includes the general requirements for records (e.g., records are original, not copies, they are legible, etc.), requirements applying to the food safety plan, record retention, and use of existing records.

Subpart G - Supply-chain Program. Subpart G applies to covered facilities that have a full food safety plan. This subpart includes the requirements to establish and implement a supply-chain program, use of approved suppliers, conducting supplier verification activities, and supply-chain program documentation.

Requirements for All Processors

Two key requirements of the Preventive Controls for Human Food Rule that apply to ALL processors are employee training and adherence to Good Manufacturing Practices (GMPs).

Another important aspect that is pervasive in all of FSMA is that "if it wasn't documented, it wasn't done." Documentation is critical to proving that something was done--just because there is a procedure for something, it doesn't mean that the procedure was done. Written documentation in some type of record or log is needed to show that an activity was completed. The contents of the record or log depend on the type of log. For example, an employee training log would need to have the employee name, the type of training conducted, who did the training, the date of the training and maybe a training certificate if available, whereas a pasteurization monitoring record will have the identification of the pasteurizer, the time and date the monitoring activity was recorded, the information being monitored (pasteurization time, temperature), the initials or signature of the person who is doing the monitoring (pasteurizer operator) and the initials or signature of the person who is verifying the pasteurization record (supervisor), and the date the verification was done.

Training

FSMA requires that all individuals involved in the manufacture, processing, packing or holding of food be a "Qualified Individual." A Qualified Individual is one that is trained in basic food safety and personal hygiene practices, and has the education, experience and/or training to correctly and safely perform the duties of their assigned jobs. FSMA also defines a "Preventive Controls Qualified Individual (PCQI)", who is an individual that is responsible for developing and implementing food safety plans. This individual has specialized training in food safety and risk-based preventive control systems.

All training must be documented. There is no set format for a training record or log, but a manufacturer needs to be able to show an FDA inspector the training documentation for all individuals working in the facility. It is good practice to have a training log for each employee or a spreadsheet for all employees that identifies the employee name, the type of training conducted, who did the training, the date of the training, and a training certificate if available. Training may be done in-house or by outside trainers. It is also possible that people may have "on-the-job" training, or have been working at their job for many years which gives them the experience they need to do the job, and these situations can be noted on their employee record.

Good Manufacturing Practices (GMPs)

All food processing facilities must have safe and sanitary conditions for the manufacturing, processing, packing or holding of food. This is accomplished by following the Good Manufacturing Practices (GMPs) described in Subpart B. Personnel topics such as handwashing, wearing of hairnets, and clean uniforms are most often thought of as GMPs. However, GMPs extend into best practices for sanitary operations such as cleaning practices, equipment and utensils such as using food grade materials and equipment that is not damaged, as well as to plants and grounds such as proper storage of trash so that it does not contaminate the food or the facility. Resources for helping processors with GMPs and training opportunities in these areas can be found on the Extension website on the Commercial Food Processing and the Dairy Foods Processing pages.

Covered Facilities and Facilities Qualified for Exemption

FDA realized that the development and implementation of a food safety plan and associated documentation represent a burden for small businesses and created exemptions to help ease the situation. The full definitions and responsibilities of food processing facilities are found in the regulations, and a simplified explanation is provided here.

A "Covered Facility" is any processor that manufactures, processes, packs, or holds food from one or more ingredients, using a variety of processes that are defined in Subpart A. A Covered Facility must establish and implement a food safety system that includes a hazard analysis and risk-based preventive controls as defined in Subpart C.

A "Qualified Facility" is defined as:

• A business with average annual sales of less than $500,000 per year, during the previous 3-year period, and at least half the sales to a qualified end-user, defined as consumers, local retailers, or restaurants (within the same state or within 275 miles) OR
• A very small business with sales averaging less than $1,000,000 per year, adjusted for inflation, during the previous 3-year period, for the sales of human food plus the market value of human food manufactured, processed, packed, or held without sale.

A Qualified Facility must submit an attestation stating the facility meets the definition of a Qualified Facility and that they have identified the potential hazards and are implementing and monitoring preventive controls, or they are in compliance with other applicable non-Federal food safety laws. The FDA has provided guidelines for small businesses to help them determine if they are qualified for exemption and to fill out the attestation form. It should be noted that if a facility loses its exempt status due to a recall or other situation determined by the FDA, they will then need to develop a full food safety plan.

Small dairy food processors should note that even if you qualify for an exemption based on sales, dairy products are known to be associated with pathogens and human illness. Best practices for public safety indicate the need to conduct a comprehensive hazard analysis and develop and implement appropriate preventive controls to manage the hazards associated with your specific products and processes.

Elements of a Food Safety Plan

The development and maintenance of food safety plans to control hazards to protect public safety is the core principle of The Preventive Controls for Human Food Rule. The food safety plan is built on the premise that your company already has the appropriate GMPs (Subpart B) and prerequisite programs in place to maintain a sanitary environment for food handling. Subparts C-G are associated with food safety plans and include the key elements required in food safety plans, record-keeping practices, supply-chain control program, and information on exemptions from these regulations.

An important underpinning of the hazard analysis is that a scientifically justified risk assessment of the specific product and process is used to determine the appropriate preventive controls needed in a food safety plan. Therefore, products or processes with a higher inherent or introduced risk to public safety will need more controls and oversight.

The Preventive Controls for Human Foods Rule requires that food safety plans for "covered facilities" be prepared, or overseen, by one or more "Preventive Controls Qualified Individuals (PCQI)". A PCQI has received specialized training in understanding the elements of a food safety plan, the use of preventive controls, rather than critical control points, to effectively manage hazards, monitoring and documentation procedures, and hands-on practice of these skills. Contact your local university, regulatory personnel, trade organization, or consultant for more information on available PCQI training courses. A food safety plan for "qualified facilities" does not need to be written by a PCQI, although training to understand how to write a food safety plan is recommended.

The food safety plan is specific to the product and processes used. It is common for a company to have more than one food safety plan, but with common information in each plan. For example, a dairy manufacturing yogurt and ice cream will have a separate plan for each product because of the different nature of these products, but the process controls around the pasteurization step will be the same. A company may have a separate food safety plan for vanilla and plain flavors of ice cream and another one for flavors containing allergens, or a cheesemaker may have a different food safety plan for making Cheddar cheese and Swiss cheese because of the use of a warm aging room for eye development during Swiss manufacture.

To accommodate the uniqueness of individual facilities, the FDA has determined the required elements that need to be included in a Food Safety Plan, but does not require the information to be presented using a defined format or template. This flexibility allows each facility to determine a system that works best for them. However, the use of uniform templates will make it easier for a company to develop its food safety plan, and easier for an FDA inspector to review the plan. Resources for food safety templates include the Food Safety and Preventive Controls Alliance, the FDA's food safety plan builder (PC version only), the FDA Reader site, Penn State Extension Food Safety Plans for Small-Scale Cheesemakers, which is applicable to other small-scale dairy processors, and other universities and trade organizations.

A Food Safety Plan is a written document that is updated every 3 years, or when necessary due to a change in ingredients, equipment, or process. A food safety plan contains the following core elements:

Hazard Analysis. The "hazard analysis" is both an activity and a form, confusing as it may be. The hazard analysis as the activity is the process used to assess the raw materials, processes, and other activities associated with processing food from the time ingredients arrive at your plant until the finished product leaves your control. The hazard analysis is a two-step process. The first step is the identification of the biological, chemical, and physical hazards that may occur naturally, or be intentionally or unintentionally introduced, or enhanced, at any point in the process. The second step is to determine the severity of the situation that would result if the hazard was not controlled, and how likely the situation is to occur. The results of the hazard evaluation will determine which preventive controls are needed to effectively manage the hazard. The hazard analysis is also the form on which the results of the activity are recorded.

Preventive Controls. These are procedures, practices, and processes used to prevent or minimize a hazard, as identified in the hazard analysis.

• Process controls have some type of defined parameter that is monitored, such as pasteurization time and temperature conditions, or metal detection. Process controls may be based on Standard Operating Procedures (SOPs) with the minimum or maximum values specified. In dairy plants that have current HACCP systems, critical control points are usually considered process controls.
• Sanitation controls are the use of sanitation practices to minimize hazards in the food processing area. Sanitation controls may be based on Sanitation Standard Operating Procedures (SSOPs) and may be validated using an environmental testing program.
• Allergen controls are focused on preventing cross-contamination of non-allergen products by allergens and ensuring that allergen warnings are correctly identified on product labels.
• Supply-chain controls are required if an ingredient contains a hazard that needs to be controlled at the supplier level. Supply-chain controls include pre-approving or auditing suppliers and product specifications. If a hazard known to be associated with an ingredient will be controlled by your processing, or further downstream, then a supply-chain program is not required. For example, an artisan cheesemaker who buys milk would need a supply-chain control if they were making aged, raw milk cheese to ensure that no pathogens were present in the milk before cheesemaking, but if they were making pasteurized cheese, the pasteurization process would control any potential pathogen hazards, so a supply-chain control program would not be needed.

Monitoring and Oversight. These are the steps and documentation needed to ensure that the preventive controls are working effectively and to correct problems as they occur.

• Monitoring activities, frequency, and the associated records are identified in the written preventive controls procedures. The monitoring frequency must be adequate to ensure that the preventive controls are working.
• Corrective Actions are written procedures, with associated records, that are followed in the event that there is a loss of control and a product is suspected to be hazardous. Corrective action procedures have steps to regain control of the process, determine the status and disposition of the product in question, and take action to ensure the situation does not happen again. Corrections are steps that can be taken quickly to address a minor loss of control situation that can be easily remedied.
• Verification ensures that the monitoring of the preventive controls and corrective actions are being conducted appropriately and to ensure that the preventive controls are effectively managing hazards. Verification can be thought of as "am I doing what I said I would do to manage the hazard?" For example, if your food safety plan says that you will calibrate your thermometers every 2 weeks and you review your monitoring records to verify this and discover that you are calibrating every 4 weeks, then you are not doing what you said you would do.
• Validation is conducted to ensure that the preventive controls used to manage hazards are appropriate and adequate for the situation. Validation can be thought of as "am I doing the right thing to manage the hazard?" For example, if you were to use HTST pasteurization at 160°F for 20 seconds, this would not be correct, because the science-based regulations for legal pasteurization are at least 161°F for 15 seconds, and you would not be meeting the minimum temperature requirement for safety, even though you were pasteurizing longer than the minimum time.

Record Keeping. Documentation of procedures, monitoring records and logs, implementation records, and employee training logs are just some of the paperwork that is associated with a food safety system. If the safety of your product is ever called into question, these documents are the proof that your food safety system was operating properly. Remember, if it wasn't documented, it wasn't done. The format of the documents is up to the processor, but the records do need to be original paper or electronic documents. They should contain:

• Document name
• Company name and location
• Date and time of activity
• Actual, real-time measurement or observation (not just "OK")
• Product identification, where appropriate
• Signature or initials of the person performing the monitoring activity
• Signature or initials of the person performing the verification activity

Documents should be retained for at least 2 years, or longer if appropriate. An example is the manufacture of a 2-year-aged Cheddar, which is released to the public after 2 years, but is expected to be in the marketplace for some time after its release. Records should be maintained as long as product is available to consumers in case of a recall. Records must be available for review upon request by regulatory personnel.

Recall Plan. A recall plan is required for any food that has been identified to have a known hazard as determined in the hazard analysis. A recall plan contains the information needed to notify customers of the problem and what to do with the suspect product, track and retrieve your product from warehouses and the marketplace, determine the cause of the problem, appropriately dispose of the product, and document and close the recall. The importance of maintaining traceability of incoming ingredients and supplies, their use in finished products, and distribution of product lots is key to having a quick recall.