Sep 10, 2015

Food Safety Modernization Act Preventive Controls rule now final

FDA said the final rule has elements of both the original and supplemental proposals, in addition to new requirements that are the outgrowth of public input received during the comment period for both proposals. For example, it said flexibility has been built into key requirements, including control of the supply chain, and the definition of farms— which are exempt from these regulations— has significantly changed to reflect modern farming practices.

Below is FDA’s summary of key requirements in four areas.

Covered facilities must establish and implement a food safety system that includes an analysis of hazards and risk-based preventive controls. The rule sets requirements for a written food safety plan that includes:

Hazard analysis: The first step is hazard identification, which must consider known or reasonably foreseeable biological, chemical and physical hazards. These hazards could be present because they occur naturally, are unintentionally introduced or are intentionally introduced for economic gain (if they affect the safety of the food).

Preventive controls: These measures are required to ensure that hazards requiring a preventive control will be minimized or prevented. They include process, food allergen and sanitation controls, as well as supply-chain controls and a recall plan.

Oversight and management of preventive controls. The final rule provides flexibility in the steps needed to ensure that preventive controls are effective and to correct problems that may arise.

• Monitoring: These procedures are designed to provide assurance that preventive controls are consistently performed. Monitoring is conducted as appropriate to the preventive control. For example, monitoring of a heat process to kill pathogens would include actual temperature values and be more frequent than monitoring preventive maintenance activities used to minimize metal hazards, which could be a simple record of the date on which the activity took place.
• Corrective actions and corrections: Corrections are steps taken to timely identify and correct a minor, isolated problem that occurs during food production. Corrective actions include actions to identify a problem with preventive control implementation, to reduce the likelihood the problem will recur, evaluate affected food for safety and prevent it from entering commerce. Corrective actions must be documented with records.
• Verification: These activities are required to ensure that preventive controls are consistently implemented and effective. They include validating with scientific evidence that a preventive control is capable of effectively controlling an identified hazard; calibration (or accuracy checks) of process monitoring and verification instruments such as thermometers; and reviewing records to verify that monitoring and corrective actions (if necessary) are being conducted.

  Product testing and environmental monitoring are possible verification activities but are only required as appropriate to the food, facility, nature of the preventive control, and the role of that control in the facility’s food safety system. Environmental monitoring generally would be required if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control.

The definition of a farm” is clarified to cover two types of farm operations. Operations defined as farms are not subject to the preventive controls rule.

Primary Production Farm: This is an operation under one management in one general, but not necessarily contiguous, location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities. This kind of farm can pack or hold raw agricultural commodities such as fresh produce and may conduct certain manufacturing/processing activities, such as dehydrating grapes to produce raisins and packaging and labeling raisins.

The supplemental rule proposed, and the final rule includes, a change to expand the definition of “farm” to include packing or holding raw agricultural commodities (such as fresh produce) that are grown on a farm under a different ownership. The final rule also includes within the “farm” definition companies that solely harvest crops from farms.

Secondary Activities Farm: This is an operation not located on the Primary Production Farm that is devoted to harvesting, packing and/or holding raw agricultural commodities. It must be majority owned by the Primary Production Farm that supplies the majority of the raw agricultural commodities harvested, packed, or held by the Secondary Activities Farm.

This definition for a Secondary Activities Farm was provided, in part, so that farmers involved in certain formerly off-farm packing now fit under the definition of “farm,” as the packing is still part of the farming operation. In addition to off-farm produce packing operations, another example of a Secondary Activities Farm could be an operation in which nuts are hulled and dehydrated by an operation not located at the orchard before going to a processing plant. If the farmer that owns the orchards and supplies the majority of the nuts is a majority owner of the hulling/dehydrating facility, that operation is a Secondary Activities Farm.

Primary Production and Secondary Activities Farms conducting activities on produce covered by the Produce Safety Rule will be required to comply with that rule.

Supply-chain program is more flexible, with separate compliance dates established.

The rule mandates that a manufacturing/processing facility have a risk-based supply chain program for those raw material and other ingredients for which it has identified a hazard requiring a supply-chain applied control. Manufacturing/processing facilities that control a hazard using preventive controls, or who follow requirements applicable when relying on a customer to controls hazards, do not need to have a supply-chain program for that hazard.

Covered food facilities are responsible for ensuring that these foods are received only from approved suppliers, or on a temporary basis from unapproved suppliers whose materials are subject to verification activities before being accepted for use. (Approved suppliers are those approved by the facility after a consideration of factors that include a hazard analysis of the food, the entity that will be controlling that hazard, and supplier performance.)

A facility will not be required to implement a preventive control when an identified hazard will be controlled by a subsequent entity such as a customer or other processor. The facility will have to disclose that the food is “not processed to control (identified hazard)” and obtain written assurance from its customer regarding certain actions the customer agrees to take.

Another entity in the supply chain, such as a broker or distributor, can conduct supplier verification activities, but the receiving facility must review and assess that entity’s documentation of the verification of control of the hazard.

Separate compliance dates have been established for the supply-chain program provisions so that a food facility will not be required to comply with the supply-chain program provisions before its supplier is required to comply with the preventive controls for human food rule or the produce safety rule.

Current Good Manufacturing Practices (CGMPs) are updated and clarified.

The final rule does not include nonbinding provisions, which are more appropriate for guidance.

Some of the previously nonbinding provisions, such as education and training, are now binding.

• Management is required to ensure that all employees who manufacture, process, pack or hold food are qualified to perform their assigned duties.
• Such employees must have the necessary combination of education, training, and/or experience necessary to manufacture, process, pack or hold clean and safe food. Individuals must receive training in the principles of food hygiene and food safety, including the importance of employee health and hygiene.
• Note that there are similar requirements related to preventive controls.

The FDA’s longstanding position that CGMPs address allergen cross-contact is now explicit in the regulatory text.

Compliance Dates

Compliance dates for businesses are staggered over several years after publication of the final rule.

• Very small businesses(averaging less than $1 million per year (adjusted for inflation) in both annual sales of human food plus the market value of human food manufactured, processed, packed, or held without sale): Three years, except for records to support its status as a very small business (January 1, 2016).
• Businesses subject to the Pasteurized Milk Ordinance(compliance dates extended to allow time for changes to the PMO safety standards that incorporate the requirements of this preventive controls rule): Three years
• Small businesses(a business with fewer than 500 full-time equivalent employees): Two years
• All other businesses: One year

Compliance dates after publication of the final rule for the requirements of the supply chain program:

• Receiving facility is a small business and its supplier will not be subject to the human preventive controls rule or the produce safety rule: Two years
• Receiving facility is a small business and its supplier will be subject to the human preventive controls rule or the produce safety rule: Two years or six months after the supplier is required to comply with the applicable rule, whichever is later
• Receiving facility is not a small or very small business and its supplier will not be subject to the human preventive controls rule or the produce safety rule: 18 months
• Receiving facility is not a small or very small business and its supplier will be subject to the human preventive controls rule or the produce safety rule: Six months after the supplier is required to comply with the applicable rule

Watch this website for updates, analysis and reaction to the final Preventive Controls Rule.

“