The FDA Food Safety Modernization Act (FSMA) originated in the mid-2000s, when approximately 48 million people were getting sick, 128,000 were hospitalized, and 3,000 died annually from foodborne diseases, according to the Centers for Disease Control (CDC). This resulted in a significant public health burden that is largely preventable.

Signed into law by President Obama on January 4, 2011, FSMA aims to ensure that the food supply is safe—from responding to contamination to prevention. The Act represents the most sweeping reform of our food safety laws in more than 70 years.

New Rulemaking

Since its passage, food and food-related industries have been waiting for a number of new rules to be published under FSMA. The new rules being published for enforcement will complement the existing rules in place prior to 2011 and rules that were enforceable at the signing of FSMA, including meeting all of the established requirements under 21 CFR Section 110. These include Inspection of Records; Registration of Food Facilities; FDA Performance Standards; and Authority to Collect Fees, Mandatory Recall Authority, and Administrative Detention.

After numerous delays in rulemaking, court-ordered deadlines for finalizing and publishing seven foundational new rules were established for 2015/2016. Not surprisingly, the FDA declared 2015 “The Year of FSMA” at their FSMA Kickoff Meeting for industry stakeholders on April 23, 2015. The new rules include the following final and pending dates:

*Later dates or applicability may be provided for very small companies (i.e., Produce Rule and must be checked and confirmed for each company and rule under compliance ($250K-$10M))
**Dates may be subject to change
***cGMP refers to Current GMPs under FSMA or ones that are current and updated within the past two years

Enforcement

With these new FSMA rules, all issues related to the processing and distribution of safe food will be enforceable by the FDA. This broad authority includes the use of other agencies for enforcement and eliminates the need for the FDA to require judicial approval for investigations, accessing information, issuing recalls, ordering detention of product, suspending business registrations, levying fines, and controlling the food supply chain to ensure safety of food for the public.

Compliance Requirements

Establishing the rulemaking deadlines is the first step toward implementing the law. Compliance dates—up to one year or longer after publication—require companies to then develop the appropriate programs to meet FDA Guidance Documents pending release. These Guidance Documents are intended to assist the industry in program development; however, there is little confidence that these will be issued in a timely manner. Thus, with compliance commencing by September, companies must establish their own programs and use Guidance Documents for eventual comparison.

As the new FSMA rules are published, all companies that process food products must determine their compliance requirements to ensure the distribution of only pure and unadulterated food product. Each company must assess all aspects of FSMA to first determine which rules are specific to them, their business, and their supply chain and, second, how to best comply. This is challenging as these programs will be new and not previously tested for compliance. A gap assessment will help these companies determine requirements and then develop the required compliance programs by the established dates.

Food Defense and Safety Plan

There is one common need across all requirements and FSMA rules to consider by proactively creating a Food Defense and Safety Plan — or updating a current one. Taking a proactive approach to food defense will not only make FSMA adherence less daunting for organizations, but it will also ensure that they are working to avoid the risks associated with food adulteration and contamination.

This also aligns with other existing laws already in place, as site food defense is an imperative required by other laws. Security programs must be established, if they are not already implemented. FSMA includes one rule against deliberate contamination of food. The FDA and other authorized agencies will look to see if programs are established and that the company has assessed risks, controls access, has an alert system, and has an audit program that is functioning to plan.

Companies must take action to include these within their Food Defense and Safety Plan:

• Ensure the building, premises, and processes meet existing physical and defense requirements
• Verify employees understand the company’s FDA/FSMA requirements with visible evidence
• Assess and audit the written Food Safety Plans and look for gaps/areas to close
• Ensure the integrity of the internal audit program to FDA/FSMA and food safety requirements
• Confirm that the company is prepared to provide documentation in 24 hours, if requested by the FDA
• Ensure that all suppliers and indemnity are effectively tracked, monitored, and evaluated
• Prove traceability and maintain a mock recall program for any recall circumstance

Food Safety Management System (FSMS)

Based on the complexity and broad nature of the FSMA rules, it is also recommended that companies move forward with updates to their Food Safety Management Systems (FSMS), which can be adjusted when the final rules are issued. Certification to one of the Global Food Safety Initiative’s (GFSI) benchmarked standards provides some level of compliance, including security and defense.

Preventive Controls

Preventive controls require a final processor or distributor to ensure that the supply chain has effective programs. Preventive controls must go back to the origin of each material. Ultimately, all food ingredients and materials must be included to meet preventive control requirements.

FDA seeks for companies to assess risks and implement preventive controls in their supply chain. For this, companies must understand where the risks are and if appropriate controls are implemented. A key issue to consider is how regulators and suppliers have different senses of what appropriate controls really are for this important goal of FSMA.

Based on evolving practices, it is necessary to take a proactive approach to determining the preventive controls to implement based on risk-based strategies and product/supply chain risk.

Qualified Individuals

Another key aspect of FSMA and a change to past FDA requirements is to establish and maintain Qualified Individuals and Food Safety Lead/Teams to ensure that each location’s food safety system is adequately managed. Key requirements include the following:

• Identify a qualified lead food site operator at all times
• Be ready for an inspection with a well-scripted inspection program
• Keep the communication list within the company current, including regulatory service providers
• Food Safety Lead must be present during food operations for release of safe food
• Qualified back-ups must be established for the primary Food Safety Qualified Individual or Lead

Actions to Take

Any processor of food product or material needs to determine compliance requirements to implement the appropriate FSMA programs. The best method for determining program development needs is to conduct an action-oriented gap assessment of current programs to FSMA requirements. Due to the Act’s complexity, this process should begin well in advance of final compliance dates. If programs are not currently in development, they must be shortly to avoid the potential of non-compliance to FDA, customers, and the supply chain.

Be Prepared

The following checklists can help guide the development and implementation of a food safety plan to help satisfy the new FSMA requirements for Rule 1, Preventive Controls.