Food manufacturing businesses must comply with the Food Safety Modernization Act (FSMA)—the biggest food safety reform in seven decades, which affects the way our foods are grown, harvested and processed. Signed into law in January 2011, FSMA has shifted the U.S.’s focus from responding to foodborne illnesses to preventing them.  

The FDA finalized seven major rules to implement FSMA (see sidebar), which recognizes that ensuring the safety of the food supply is a shared responsibility among many different points in the global supply chain for both human and animal food. The FSMA rules offer clear, specific actions to take at each of these points to prevent contamination. These rules were rolled out over time to ensure that all parts of the supply chain would be able to implement them in time for rule enforcement, most of which are already being enforced. 

To help FDA-regulated facilities adapt to the rules, Robert E. Brackett, vice president and director for the Institute for Food Safety and Health (IFSH) at the Illinois Institute of Technology (IIT), says the idea of creating a public-private partnership to provide training to the FDA-regulated food industry was formulated immediately after the passage of FSMA—even before the FSMA regulations were drafted. 

“Although we didn’t know at that time what the regulations would ultimately look like, we did know that FSMA was going to be different enough from previous efforts—that the regulated industry was going to need help in learning how they must comply,” he says. “In particular, there was concern by many that small and mid-size companies were especially going to be affected. Hence, the notion of putting together an industry/academia/government partnership to provide such training was developed.” 

The concept was not new. Brackett says the Seafood HACCP Alliance had been successfully using the same approach for years, so they modeled the Food Safety Preventive Controls Alliance (FSPCA) on that model. This broad-based public private alliance consists of industry, academic and government stakeholders whose mission is to develop curricula and training as well as outreach programs to support compliance with the prevention-oriented standards of FSMA. However, the shear breadth and size of the affected food industries and diversity of commodities it produces required a more comprehensive approach, Brackett notes. FDA provided funding for the establishment of the FSPCA, with the understanding that after the funding cycle ended, the FSPCA would be financially self-sustaining, Brackett says. “To that end, the alliance developed a business plan that would identify various sources of revenue, but primarily certificate fees, to sustain its future activities,” he says. 

Because the FDA phased in the rule implementation over several years, manufacturers of all sizes have had the time to comply. According to Brackett, enforcement of FSMA has not had an adverse impact on production for most food companies. He says that many companies already had robust, HACCP-based programs in place, which could be modified quickly to comply with the Preventive Controls for Human and Animal foods rules. Also, because the FDA eased into its investigation and inspection programs—“educating while regulating”—it gave industry time to learn FDA expectations and comply accordingly. “This is not to say that industry always agreed with conclusions of inspections,” he says.

If a disagreement happens during an FDA inspection, it is important to be able to have an informed and candid conversation with the inspector. Melanie Neumann, executive vice president and general counsel at Matrix Sciences, a third party laboratory and food safety risk management company, offers the following example: 

Say a manufacturer of soy lecithin identifies Listeria as a pathogen of concern in its hazard analysis but not Salmonella. FDA has issued Draft Guidance to Industry on known hazards associated with product categories, known to the industry as “Appendix 1.”  Appendix 1 lists Salmonella as a hazard of concern relating to soy lecithin products.  As such, FDA’s expectation is that a manufacturer would place appropriate preventive controls to control this hazard. Neumann says, “If there is a food safety hazard that is likely to cause someone illness or injury if it was left uncontrolled (absent one or more preventive controls), then you are expected to put one or more controls in place. If you haven’t done that, you have to be able to explain to the inspector why you haven’t. Something to the effect of, ‘I know you think Salmonella is a risk in my product, but here’s why it is not,’ and then use science to back up your argument.  Whatever your reason is, you have to be able to support it with documentation and credible data and have that healthy debate with the inspector.”

She says the leading FSMA violations are missing a significant safety hazard of concern in your hazard analysis that should be controlled, and lack of documentation and recordkeeping. “You can have the best food safety plan and hazard analysis. It can be correct on every level. But if you’re not monitoring and verifying that those controls are actually working the way you said they were going to work and have documented corrective actions when things do go outside the guardrails, then [the food safety plan] is probably not worth the paper it’s written on,” she says.

Brackett agrees. He says most food processors needed to do very little to adapt their actual production practices to meet FSMA requirements, particularly large companies who already had robust food safety programs in place. What many companies (particularly small- and medium-sized companies) did need to change significantly was how they documented their food safety programs. 

“By this, I mean development of required written food safety plans, recordkeeping procedures, validation and verification of processes and supply chain management,” Brackett says. “Moreover, processors must now provide a scientific basis for their control measures—how did they know that what they were doing controlled the hazard?” he asks.

Referencing the soy lecithin example, Neumann says, “There are times you can say, ‘we are not controlling the Salmonella hazard, and here’s why. Here’s the science. Here’s the data that is peer-reviewed. There was a robust challenge study.” If you present the science and data and the real-time documentation of your controls, you have a good argument for doing what you are supposed to be doing under these rules.

She continues, “If something goes wrong—and things still can despite all of that good application and execution, sometimes bad things happen to good companies—you have a recall anyway. But, at least you can show it wasn’t caused by lack of attention to what is required to be included in these plans under applicable regulations. It wasn’t just because you didn’t take the time to fulfill the regulatory expectations.”

Matrix Sciences has helped industry with regulatory compliance like developing food safety plans from the inception of FSMA and has worked with companies to help them understand when there is a need for change. Neumann says as they learn about new hazards in products, they revisit to see if that hazard affects a client’s product. “We’re there to help our client put theory to practice, and provide perspective into pragmatic approaches to mitigate risk,” she says.

By now, food processors should have a solid plan in place, including hazard risk analysis, recordkeeping, etc. “What we are seeing now by way of non-compliance is that facilities have done their best to develop a food safety plan but, despite best efforts, missed identifying all applicable hazards that should practically speaking be controlled,” Neumann says. 

The FDA does not tell facilities how to execute a plan. The agency gives companies the “what” and each facility must determine how it is going to implement and monitor the control. This is location and product specific. Neumann says Matrix will go in and play the part of that FDA inspector. 

“We perform mock facility inspections. We review food safety plans, hazard analyses, supporting records, and conduct activities just as if we were the regulator to help companies prepare for an actual inspection where the stakes are obviously higher.”

Monitor, document, verify, repeat 

So, what have companies had to do to implement the FSMA rules? Neumann explains that they have adapted some of their procedures internally from a day-to-day production perspective. These items were elevated in importance under the preventive controls rule, which were not in the traditional HACCP expectations. 

She notes that industry was very good about a critical control point (CCP). It was methodical: Indicate the cook step; note the product needs to cook for X minutes at X temperature; generate an automated temperature monitoring system report that shows the oven maintained that temperature; and have a technician take the internal temperature of the product to verify that it reached temperature and documented it. 

“This CCP is what industry had been used to monitoring for eons,” she says. “Then the FSMA preventive controls rule comes in and notes a few more hazards that need attention.”

Martin Wiedmann, Gellert family professor in food safety, College of Agriculture and Life Sciences at Cornell University, agrees. “We realized that [so many] of the food safety problems in the U.S. were not from the CCP, it was after that critical control point that something happened.” 

He says this is why there are a series of controls and each has more stringent requirements with regard to recordkeeping, verification, etc., to make sure the overall process is documented and monitored better.

For instance, year after year, the number one cause of recalls has been undeclared allergens. Why is that? Allergen controls, sanitation controls and supply chain controls were in the good manufacturing procedures (GMPs), or prerequisite programs. “But they didn’t quite rise up high enough to have that same level of attentiveness,” Neumann says. 

Wiedmann notes there really were very limited requirements around sanitation. “You typically didn’t have to prove anything,” he says. “You just went in and sanitized to the best of your knowledge.”

Now, sanitation is serious. “A distinct positive that FSMA brought to the food industry was the importance of sanitation and the sanitation crews,” Neumann says. Sanitation crews used to be the lowest paid employees, and they worked third shift. “Now, sanitation is extremely important under the preventive controls rule. Sanitation crews are an important lynchpin to ensure the overall program is working and not called into question,” she says. 

“Some companies have moved sanitation from third shift to an early first shift right before first shift begins,” Neumann says. “Some companies now pay a premium for sanitation to get good people who will take the necessary time to clean and sanitize right.”

This is so important, especially concerning that number-one recall—undeclared allergens. Neumann says that same level of attention that went to CCPs prior to FSMA now should be on allergen labeling, allergen cross-contamination in facilities and sanitation controls—particularly when there is an allergen changeover. 

“So, the new rules say we need to rise those things up in importance and treat them just like they are a cook step that kills a pathogen,” she says. “If we were running something with wheat in it and the next product we are going to run doesn’t contain wheat, we better have a pretty heightened eyeball on it and a way to verify that we removed all the wheat off of the line before we changed over with something that doesn’t contain wheat. People can get sick if it is there. Something bad can happen absent a control.” 

This is the new part of the rule; not new to manage, but new to documenting, monitoring and verifying at a level of a historic CCP. This increased rigor is needed to ensure the right product is going in the right package, that the label is accurate and verified. Most importantly, be sure that the person reviewing and verifying these controls is a preventive controls qualified individual (PCQI). 

To comply with FSMA, processors have had to adapt and appoint a PCQI, which is achieved either through formal training like that offered by the collaborative effort of FDA and FSPCA or by substantiating PCQI status by other training, education and experience. Neumann says she always suggests getting the certificate. 

“I always tell people, ‘It’s good information. Even if you have been in the business for 20 years. Get the certificate. Why give FDA a reason to dig deeper into training records?’” 

Another way to comply with the FSMA preventive controls rule is by installing and X-ray scanner or a checkweigher with a metal detector into their operations. According to Jim Renehan, senior marketing manager for WIPOTEC-OCS, a manufacturer and supplier of in-motion weighing and X-ray scanning equipment, says, “Our food customers are using [our] equipment to ensure that a quality product leaves the facility with every package that they ship. This is especially true in customer applications that use our machines for foreign body detection. The metal detectors find one type of contaminant—metal; while the our X-ray scanners can be setup to find many different types of contaminants such as ferrous and non-ferrous metal, rubber, wood, stones, glass and certain types of plastic.” 

He adds, “These customers are keenly aware of the enormous cost of a product recall due to foreign body contamination both in terms of real dollar costs, and the long-term damage a recall can have to a company’s reputation and brand image.”

For more information:

FSPCA, www.ifsh.iit.edu/fspca
Matrix Sciences, www.matrixsciences.com
Wipotec, www.wipotec-ocs.com/us