Prevention Instead of Correction: FDA Implements New System for Food Safety Regulation

The FDA Food Safety Modernization Act (FSMA) became law in January 2011 with the primary intent of redirecting the country’s food safety regulatory regime to a system that identifies and prevents hazards in the food supply chain instead of a reactionary system based largely on enforcement and punishment. A few pieces of FSMA became effective immediately, for example: providing FDA with legal authority to order a mandatory recall; authorizing FDA to suspend a food facility’s registration and, essentially, all of its operations for serious food safety violations; and providing FDA with greater access to company records during facility inspections. However, these were merely extensions of FDA’s pre-existing enforcement powers.

The heart of FSMA lies in food safety regulations first proposed by FDA in 2013, then published in final form in fall 2015, after extensive public comment. The most widely applicable set of regulations, and also the most comprehensive, require the food industry to implement hazard analysis and risk-based preventive controls (HARPC) measures at food facilities. The HARPC regulations for human foods are extensive, but they generally address three core requirements: 1) a food safety plan; 2) a supplier verification program; and 3) a recall plan.

Food Safety Plan

The HARPC regulations require food companies to implement written food safety plans addressing:

• Hazard analysis—Identification of known or reasonably foreseeable hazards that could lead to adulterated (i.e., unsafe) food.

• Preventive controls—Measures required to ensure hazards will be minimized or prevented.

• Monitoring—Procedures designed to provide assurances that preventive controls are consistently performed.

• Corrective actions and corrections—Steps to be taken to timely identify and correct minor, isolated problems that may occur during food production.

• Verification—Activities to ensure preventive controls are consistently implemented and are effective.

These regulations do not impose a one-size-fits-all system. Instead, FDA allows food companies some flexibility to develop food safety plans tailored to the risks associated with their own products and operations. For example, the HARPC regulations include a broad requirement to verify that preventive controls are consistently implemented and are effectively and significantly minimizing hazards. This can be achieved by various methods, such as pathogen testing on finished products “as appropriate" to the food facility and the food at issue. The manufacturer is able to determine whether or not finished product testing is necessary, which might not be the case for foods that undergo a kill step at a critical phase during the production process.

Food safety plans must be developed by a “qualified individual" who must complete training in risk-based preventive controls or must otherwise be qualified through prior work experience to develop and apply a food safety plan. The qualified individual is responsible for applying the food safety plan, monitoring preventive controls, reviewing food safety records, and reanalyzing the plan every three years and whenever there is significant change in the facility’s activities.

Supplier Verification

The HARPC regulations also require food manufacturing and processing facilities to implement a risk-based supply chain program to ensure the control of hazards in raw materials and ingredients when the control is applied by a supplier. Each food facility must approve its suppliers and determine appropriate supplier verification activities based on considerations such as the nature of the hazard, the supplier’s own processes and procedures, and the supplier’s compliance history, including FDA warning letters and import alerts. Annual onsite audits of the supplier are required if consumer exposure to the hazard is reasonably likely to lead to serious adverse health consequences, except where a written determination has been made that other verification activities and/or less frequent onsite audits provide adequate assurances that the hazard is controlled. Other verification activities might include periodic sampling and testing of raw materials or review of the supplier’s relevant food safety records.

Recall Plan

All food facilities must implement a written recall plan describing the steps to be taken for: 1) notifying the direct consignees of the food being recalled, including how to return or dispose of the affected food; 2) notifying the public about any hazard presented by the food when appropriate to protect public health; 3) conducting effectiveness checks to verify the recall is carried out; and 4) appropriately disposing of recalled food. Each of these steps has been part of FDA’s voluntary recall program for many years. However, food companies must now have a written plan in place before conducting a recall.

Compliance

Much of the food industry will be required to implement the HARPC regulations by September 2016, though compliance deadlines are staggered for different businesses. For all requirements except the Supply Chain Program, the deadlines are:

• Very Small Businesses: Sept. 17, 2018. (However, records to support status as a “very small business" were required by Jan. 1, 2016. “Very small business" means less than US$1 million per year, adjusted for inflation, in both annual sales of human food plus the market value of human food manufactured, processed, packed or held without sale. They are exempt from many aspects of the HARPC regulations.)

• Businesses subject to the Pasteurized Milk Ordinance: Sept. 17, 2018.

• Small Businesses: Sept.17, 2017. (“Small Business" means fewer than 500 full-time equivalent employees.)

• All other businesses: Sept. 17, 2016.

Compliance dates for the supplier verification supply-chain program are staggered using a matrix based on the size of the business receiving the raw materials and whether or not the supplier is subject to the preventive controls regulations.

Enforcement

FDA stated at public hearings that it does not intend to issue warning letters during a facility’s first year of mandatory compliance. Instead, the agency plans to issue “information letters" based on observations made at facility inspections. FDA used this same approach when it first implemented hazard analysis and critical control point (HACCP) regulations for seafood and juice producers. Warning letters will likely start to trickle after this one-year period, then increase over time.

Antonio Gallegos ([email protected], [303] 685-7489) is an attorney in the Denver office of the international law firm of Greenberg Traurig LLP (gtlaw.com). His practice concentrates on legal issues affecting the food, beverage, dietary supplement, cosmetic and medical device industries. This article is issued for informational purposes only, and is not intended to be construed or used as general legal advice nor as a solicitation of any type.