One Month from FSMA Deadline for Preventive Controls — Final Preparations

For most U.S. citizens September 19, 2016 will pass just as any other day would. But for management of food processors with over 500 employees the date is probably top-of-mind right now. This is the “compliance date” (deadline) for most large companies that manufacture, process, pack, or hold food for human consumption, by which they have to comply with the Preventive Controls rule of the Food Safety Modernization Act. Whether your company falls into this category, or you still have more time to prepare, here are some tips for preparing.

Training

Training is always the starting point. Whether a company is becoming HACCP certified for the first time, pursuing GFSI certification, or working to ensure compliance with FSMA requirements, the first step is understanding the requirements. That’s why providing training on these various subjects is a high priority for DFA, and it’s why we offer a wide range of training topics.

With the Preventive Controls rule, there is a course approved by the FDA called the PCQI course, that we are strongly recommending companies send employees to. The term PCQI refers to a “preventive controls qualified individual.” The regulation requires that those responsible for food safety at a food company attend this course, or demonstrate in some other way that they have equivalent knowledgeable / competence regarding FSMA compliance. To date we have already conducted about 10 PCQI courses, with excellent involvement from the food industry, and we’re planning to continue offering courses for the foreseeable future. If your employees need to attend this course, please have them check out our events page or contact us about future courses.

In addition to the “PCQI” on staff, any employees who perform tasks that may product safety need to meet the requirement of being a “qualified individual” for the role they fill. This means establishing formal training program for various tasks such as sanitation, equipment operators, warehouse employees, quality control, and other key roles in the organization. As we always say with food safety, “if you don’t write it down, it didn’t happen.” Because FDA requires that employees be trained appropriate to their role, we recommend that your company begin keeping records of training and other qualifications to help demonstrate employee competence.

Good Manufacturing Practices and Allergen Control

In our opinion, the majority of DFA’s members and other customers have excellent GMP programs in place and don’t have much to worry about with the new regulation. Most changes to the GMP regulations were minor. One significant difference is a new focus on control of food allergen “cross contact.” In 2015, one half of all recalls were due to issues related to allergens. This includes the unintentional presence of a major food allergen (one of the “big 8”), as well as quite a few issues that food companies had with mislabeling of product. So food allergen control will likely be a significant focus for the FDA in the near future. Even those companies that only process one commodity or that don’t process any allergens, still have risk. Employees to manage who are a potential source of allergens – break food or what they ate at home before work can become a contamination source. Additionally in many cases ingredients are unintentional sources of allergens or inadequate cleaning or storage practices become an issue.

Another nuance found in the GMP section of the regulation, which we have been mentioning when we conduct the PCQI training, is that companies need to obtain letters of guarantee from their suppliers of cleaning and sanitation chemicals. The letters need to indicate that these compounds meet relevant regulatory requirements for a food processing environment.

Food Safety Plan

…required controls for companies are not all the same. The controls your company has to implement hinges entirely on hazards identified through hazard analysis, based on current scientific understanding.

Chances are, your company already has some sort of documented programs regarding its food safety programs. However there are some very specific requirements laid out in the regulation which your company may or may not currently meet. This includes many HACCP-based systems, such as conducting a hazard analysis, and putting monitoring controls, verification, and validation into place. However the structure of these programs is a little bit different. Again, the best way to understand these requirements is to attend the PCQI training.

One key thing to understand is that required controls for companies are not all the same. The controls your company has to implement hinges entirely on hazards identified through hazard analysis, based on current scientific understanding. This is why it’s so critical to “do your homework” in understanding potential hazards in the products you produce, based on the nature of those products and historical recalls. Useful resources include FDA’s database of past recalls, the RASFF system in Europe, and USP’s historical databases for food fraud and food safety issues.

A question that comes up often at our PCQI training is “So, do I need both a HACCP plan >and a FSMA food safety plan?” Our opinion is no. Based on discussions we’ve had with FDA, meetings we’ve participated in, and our understanding of the regulation, we feel strongly that a single food safety program can meet the requirements laid out in the various criteria your company is working to meet.

Who’s Your Supplier?

Examples abound of issues that have arisen in the food industry with ingredients that were contaminated, and had a cascading effect of recalls on products the items were used in. These include the well-known Peanut Corporation of America, as well as other more recent examples such as the peanut protein in cumin, Salmonella in black pepper, and E. Coli in Gold Medal flour. Food processors have increasingly begun to recognize that the supply chain bears significant potential risks, which need to be well understood and controlled. This means again “doing your homework” as noted above, through hazard analysis, to thoroughly understand the inherent risks in the items your company handles. Based on this understanding appropriate controls must be put into place.

A significant change for the food industry will be the requirement that companies know who their suppliers are so they can manage them accordingly. Just buying a commodity from the open market, for instance through a distributor, is no longer enough. Companies need to know who their supplier is – and brokers do not meet the definition of a supplier. Although this may be a significant change in some cases, it’s rooted in practicality. If your company receives products produced by a food processor that has had a recall or FDA warning letter in the recent past, or if they are otherwise questionable, wouldn’t you want to be aware of it?

Lastly: Your Checklist

The biggest challenge to companies in attaining FSMA compliance may not be any one specific requirement or section of the regulation. Many companies we’ve spoken with are struggling with how to manage the long list of tasks they need to complete, and make sure they’re completed adequately. The best advice we can offer is to apply some basic project management techniques. Identify primary tasks to complete, including sub-tasks. Assign action items and dates, ideally estimating the estimated number of hours needed to complete each item.   Identify any additional resources needed based on these action items; this includes capital items and investment in software (for instance, document control software). Meet regularly to review tasks and track progress, identifying and discussing at-risk items. Finally, celebrate wins with the team when items are completed – this helps keep everyone motivated.

Finally, here are a few items that need to be on your “to-do list.”

• Determine which compliance dates apply to your operation
• Establish training programs and begin to execute
• Evaluate current GMP programs and identify any gaps
• Update hazard analysis, determining “Preventive Controls”
• Ensure appropriate measures are in place and documented for Preventive Controls
• Review retention of records (2 years minimum, recommend more) to ensure adequacy and that records are readily available
• Ensure company records include the facility address, and ensure that the food safety plan is signed by the person with the most authority on-site.

As always, let us know if we can help! We can provide custom training, consulting, and we can audit your programs to help you make sure that any notable gaps are identified.

Various Deadlines for Compliance with Sections of Preventive Controls Rule

* Dates vary, in some cases multiple dates apply