The Food Safety Modernization Act (FSMA)

The Food Safety Modernization (FSMA) is sweeping legislation that puts into place mandatory prevention-based controls across the food supply to protect public safety and prevent illness.
The Food Safety Modernization Act (FSMA) - Articles


Photo by Roychan Kruawan

The Food Safety Modernization Act (FSMA) is sweeping legislation designed to protect the American public by focusing on preventing illness rather than responding to outbreaks after people are already sick. The Act was passed in 2011 to address the fact that there are over 48 million illnesses per year in the U.S. that are caused by food, and these could largely be prevented with better manufacturing, packaging, distribution, and holding practices.

As with all legislation, much time passes from the time Act is approved until the final rules and implementation mechanisms are in place. The broad scope of FSMA across the entirety of the food safety supply has required years to bring the regulations to fruition, and its implementation is ongoing. The newness and scope of the legislation brings growing pains and feelings of uncertainty from the all sides of the industry and regulatory spectrum. The best we can do is to work our way together through the new legislation, understand that communication can be better on all sides, do our best to be timely and complete with meeting requirements, and remember we are doing this to protect the safety of all of our consumers.

All activities surrounding FSMA are designed to improve food safety and protect the public, but probably the most significant component for food processors is the Preventive Controls for Human Food Final Rule. This rule sets new standards that all food processors must meet with regard to employee qualifications and training, good manufacturing practices, hazard analysis, preventative controls, food safety plans and related activities. The rule contains exemptions for some types and sizes of processors, and staggered compliance dates based on company size. An important underpinning of FSMA is that a company's food safety plan and preventive controls needs are based on a scientifically-justified risk assessment of the company's products and processes. Therefore, products or processes with a higher inherent or introduced risk to public safety (illness) will need more controls and oversight. Milk has a long association of causing human illness, and therefore, all dairy processors should develop a food safety plan that starts with a comprehensive hazard analysis to determine the preventive controls that will effectively manage the hazards associated with the dairy products they make.

The Focus of FSMA

In the spirit of protecting the public health across the entire food supply, FSMA focuses new or expanded regulations and authority in five areas.


FDA has a legislative mandate to require comprehensive, science-based preventive controls across the food supply. Seven rules address different aspects of the food supply:

Inspection and Compliance

FDA has been give authority to provide oversight to ensure the food industry is complying with mandated food safety practices and preventive controls by

  • Mandated inspections (at least every 3 years for high-risk facilities)
  • Access to records for review (food safety and others)
  • Require testing by accredited labs


FDA was given new authorities under FSMA to help protect public safety, including

  • Authority to mandate a recall
  • Expanded authority to detain suspect food
  • Ability to suspend a food facility's registration
  • Require enhanced product traceability and recall plans

A solid Recall Plan should go at least one-step back and one-step forward so you can quickly locate and control all suspect product in the case of a supplier issue causing the recall.


FDA will ensure that imported products meet U.S. standards by

  • Increasing importer accountability
  • Voluntary qualified importer program
  • Third-party certifications

Enhanced Partnerships

FSMA builds a framework for establishing formal collaborations with local, regional, national, and international agencies to achieve public health goals.

Preventive Controls for Human Food (21 CFR 117)

The Preventive Controls for Human Food Final Rule sets new standards that all food processors must meet with regard to facility registration, updated good manufacturing practices, employee qualifications and training, hazard analysis, risk-based preventive controls, food safety plans and related activities. These requirements are outlined in Part 117 of the Code of Federal Regulations, Current Good Manufacturing Practices, Hazard Analysis and Risk-based Preventive Controls for Human Food, which replaces Part 110 Current Good Manufacturing Practices.

Key provisions of the Preventive Controls for Human Food rule are:

  • All employees that handle food must be trained in food safety, personal hygiene, and their specific job duties,
  • All food processing facilities must have safe and sanitary conditions for the manufacturing, processing, packing or holding of food (Good Manufacturing Practices, GMPs)
  • Covered food processing facilities must establish and implement a food safety plan that includes a science-based risk assessment and risk-based preventive controls to manage hazards, including supply-control and recall programs; some exemptions apply

It is important that each food processor fully understands their responsibilities under these food safety regulations. The summary of requirements presented here by Penn State is for reference only and may not be inclusive of a processor's full responsibilities.

Part 117 Current Good Manufacturing Practices, Hazard Analysis and Risk-based Preventive Controls for Human Food is divided into seven subparts:

  • Subpart A - General Provisions
  • Subpart B - Current Good Manufacturing Practices
  • Subpart C - Hazard Analysis and Risk-based Preventive Controls
  • Subpart D - Modified Requirements
  • Subpart E - Withdrawal of a Qualified Facility Exemption
  • Subpart F - Requirements Applying to Records That Must Be Established and Maintained
  • Subpart G - Supply-chain Program

General Provisions

Subpart A General Provisions applies to all food processors and contains an extensive listing of definitions used in the regulations, outlines training requirements for individuals that are qualified to handle food, and identifies processors that are exempt from some of these regulations, such as those following mandatory HACCP programs like the seafood industry.

FSMA requires that all individuals involved in the manufacture, processing, packing or holding of food be a Qualified Individual, in that they have received training in basic food safety and personal hygiene practices, and have the education, experience and/or training to correctly and safely perform the duties of their assigned jobs.

Note that a Preventive Controls Qualified Individual (PCQI) is an individual who is responsible for developing and implementing food safety plans. This individual has specialized training in food safety and risk-based preventive control systems.

Good Manufacturing Practices

Subpart B Current Good Manufacturing Practices applies to all food processors and contains guidance on best practices for creating and maintaining a safe and sanitary environment for food processing. GMPs are discussed in Federal Regulations .

Food Safety Plans

The development and maintenance of food safety plans to control hazards to protect public safety is a core principal of FSMA. Subparts C - G are associated with food safety plans and include the key elements required in food safety plans, record keeping practices, supply-chain control program, and information on exemptions from these regulations.

A food safety plan is associated with the manufacture, processing, packing, or holding of food, that is, it involves the direct handling of food. The food safety plan is built on the premise that your company already has the appropriate GMPs and prerequisite program in place to maintain a sanitary environment for food handling.

If your facility manufactures more than one type of product, or in some cases different varieties of products, it is likely that a separate hazard analysis will need to be done for each product or type of product. For example, the processing of skim, 2%, and whole milk can be addressed in a single hazard analysis, whereas the processing of eggnog still uses the same HTST system, but now incorporates eggs (allergen) and a blending step so a separate hazard analysis is warranted. When conducting multiple hazard analyses, and potentially developing multiple food safety plans, keep in mind that information can be developed once and then copied and edited as needed. There is no reason to reinvent the wheel all the time, but proof well when copying and pasting to be sure that the correct text goes in the correct place with the correct product.

Covered and Qualified Facilities

FDA realizes that the development and implementation of a food safety plan and associated documentation represents a burden for small businesses, and has developed exemptions and staggered compliance dates to help ease the situation. The full definitions and responsibilities of food processing facilities are found in the regulations. This is a simplified explanation:

  • A Covered Facility is any processor that manufactures, processes, packs or holds food from one or more ingredients, using a variety of processes that are defined in Subpart A.
  • a Qualified Facility is defined as:
  • a business with average annual sales of less than $500,000 per year, during the previous 3-year period, and at least half the sales to consumers, local retailers or restaurants (within the same state or within 275 miles) OR
  • a very small business with sales averaging less than $1,000,000 per year, adjusted for inflation, during the previous 3-year period, for the sales of human food plus the market value of human food manufactured, processed, packed or held without sale.

A Covered Facility must establish and implement a food safety system that includes a hazard analysis and risk-based preventive controls.

A Qualified Facility must submit an attestation stating the facility meets the definition of a Qualified Facility and that they have identified the potential hazards and are implementing and monitoring preventive controls, or they are in compliance with other applicable non-Federal food safety laws.

Small dairy processors should note that even if you qualify for an exemption based on sales, dairy products are known to be associated with pathogens and human illness, and you will therefore still need to conduct a comprehensive hazard analysis and develop and implement appropriate preventive controls to manage the hazards associated with your manufacturing operations.

Compliance Timeline

Covered Facilities, > 500 Employees
cGMP and HARPC9/17/16
Supply-chain program9/17/17
Covered Facilities, 10 - 499 employees
cGMP and HARPC9/17/17
Supply-chain program9/17/17
Qualified Facilities
Begin recording for attestation1/1/16
Submission of attestation12/17/18
Applicable cGMP and PC requirements12/17/18
Grade "A" Milk Processors Operating Under the PMO9/17/18

Required Elements of a Food Safety Plan

The type of food, variety of products, and processes used vary considerably across the food supply. To accommodate the uniqueness of individual facilities, the FDA has determined the required elements that need to be included in a Food Safety Plan, but does not require the information to be presented using a defined format or template. This flexibility allows each facility to determine a system that works best for them. The intention of a food safety plan is the effective use of preventive controls to adequately control hazards associated with the processing of a food product, thereby reducing the risk of causing illness to consumers.

One of the requirements of FSMA is that the Food Safety Plan must be prepared, or overseen, by one or more Preventive Controls Qualified Individuals (PCQI). A PCQI has received specialized training in understanding the elements of a food safety plan, the use of preventing controls, rather than critical control points, to effectively manage hazards, monitoring and documentation procedures, and hands-on practice of these skills. Contact your local university, regulatory personnel, trade organization, or consultant for more information on available PCQI training courses.

A Food Safety Plan is written document that is updated every 3 years, or when necessary, and contains:

  • A Hazard Analysis. The hazard analysis is the activity in which you assess the raw materials, processes, and other activities associated with processing food from the time ingredients and supplies arrive at your plant until the finished product leaves your control, to determine what hazards are present and which are of significant risk that they need to be controlled. The hazard analysis is a two step process. The first step is the identification of the biological, chemical (including radiological), and physical hazards that may occur naturally, or be intentionally or unintentionally introduced, or enhanced, at any point in the process. The second step is to determine the severity of the situation that would result if the hazard was not controlled, and how likely the situation is to occur. FSMA requires that the hazard evaluation is based on sound, up-to-date science. The results of the hazard evaluation will identify the preventive controls needed to effectively manage the hazard.
  • Preventive Controls. These are procedures, practices and processes used to prevent or minimize a hazard, as identified in the hazard analysis.
    • Process controls have some type of defined parameter that is monitored, such as pasteurization time and temperature conditions, or metal detection. Process controls may be written as Standard Operating Procedures (SOPs) with the minimum or maximum values specified. In dairy plants that have current HACCP systems, critical control points are often process controls.
    • Sanitation controls are the use of sanitation practices to minimize hazards in the food processing area. Sanitation controls may be written as Sanitation Standard Operating Procedures (SSOPs), and may be validated using an environmental testing program.
    • Allergen controls are focused on preventing cross-contamination of non-allergen products by allergens, and ensuring that allergen warnings are correctly identified on product labels.
    • Supply-chain controls are required if an ingredient contains a hazard that needs to be controlled at the supplier level. Supply-chain controls include pre-approving or auditing suppliers, and product specifications. If a hazard known to be associated with an ingredient will be controlled by your processing, or farther downstream, then a supply-chain program is not required. For example, an artisan cheesemaker who buys milk would need a supply-chain control if they were making aged, raw milk cheese to ensure that no pathogens were present in the milk before cheesemaking, but if they were making pasteurized cheese the pasteurization process would control any potential pathogen hazards, so a supply-chain control program would not be needed.
    • A Recall Plan is required for any food that has been identified to have a known hazard. A recall plan contains the information needed to notify customers of the problem and what to do with the suspect product, track and retrieve your product from warehouses and the marketplace, determine the cause of the problem, appropriately dispose of the product, and document and close the recall. The importance of maintaining traceability of incoming ingredients and supplies, their use in finished products, and distribution of product lots is key to having a quick recall.
  • Monitoring and Oversight consist of the steps needed to ensure that the preventive controls are working effectively and to correct problems as they occur.
    • Monitoring activities, frequency, and the associated records are identified in the written preventive controls procedures. The monitoring frequency must be adequate to ensure that the preventive controls are working.
    • Corrective Actions and Corrections are written procedures, with associated records, that are followed in the event that there is a loss of control and a product is suspected to be hazardous. Corrective action procedures have steps to regain control of the process, determine the status and disposition of the product in question, and take action to ensure the situation to does not happen again. Corrections are steps that can be taken quickly to address a minor loss of control situation that can be easily remedied.
    • Verification ensures that the monitoring of the preventive controls and corrective actions are being conducted appropriately and to ensure that the preventive controls are effectively managing hazards.
    • Validation is conducted to ensure that the preventive controls used to manage hazards are appropriate and adequate for the situation.
  • Record Keeping is a significant aspect of FSMA. Documentation of procedures, monitoring records and logs, implementation records, and employee training logs are just some of the paperwork that is associated with a food safety system. If the safety of your product is ever called into question, these documents are the proof that your food safety system was operating properly.

If it wasn't documented, it wasn't done.

The format of the documents is up to the processor, but the records do need to be original paper or electronic documents. They should contain:

  • Document name
  • Company name and location
  • Date and time of activity
  • Actual, real-time measurement or observation (not just "OK")
  • Product identification, where appropriate
  • Signature or initials of the person performing the monitoring activity
  • Signature or initials of the person performing the verification activity

Documents should be retained for at least 2 years, or longer if appropriate, such as for the manufacture of a aged Cheddar. Records must be available for review upon request by regulatory personnel.