US FSMA Final Rule on cGMP, Hazard Analysis and Risk Based Preventive Control


Posted By: Selerant RSA

 

With the enactment of Food Safety Modernization Act (FSMA), it is understood that there will be a number of rules to be issued by the FDA, with the ultimate goal to improve public health.

Previously, we published an overview of general changes FSMA has introduced.

To this effect, the FDA has issued a final rule titled “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food”.  

Main requirements of the rule

 

(a). Covered facilities should establish a documented food safety plan and actively implement the same. The food safety plan should be based on hazard analysis and risk based preventive controls.

- Hazard analysis must take into account known, identified biological, chemical and physical hazards and those that may get introduced into the product unintentionally or intentionally.

- The written risk based preventive controls plan should cover:

(i). hazards that could affect food safety

(ii). what preventive steps or controls will be put in place to minimize or prevent a food safety risk

(iii). the manners of monitoring the identified risks

(iv). records related to monitoring the risks

(v). contingency plan in case of a problem

- At the outset, preventive control steps may seem similar to Hazard Analysis and Critical Control Point (HACCP) system. The main difference between the two is that, in HACCP, one would identify Critical Control Points (CCP’s) and assign them critical limits to monitor, whereas in the preventive control plan of FDA, facilities will have to look outside of the CCP’s, with CCP’s and monitor them collectively. The similarities between the two remain the same for monitoring, validating, documenting and verifying hazards / risks, corrections and corrective actions. For more information on FDA’s Prevention rules, click here.

- The FDA cites product testing and environment testing (e.g. pathogens) as examples a facility could adopt to monitor the consistency of its performance against risk based preventive control program. The frequency of testing would have to be defined by the facility depending upon the criticality of the manufactured product.

- The FDA also requires that a qualified individual within the facilities, called “preventive controls qualified individual”  prepares, monitors and oversees the Food Safety Plan. This individual will also be charged with validation of the processes identified during prevention control and review records.

(b). Farms have been distinguished into 2 types: primary production farm and secondary activities farm and they are exempt from prevention control rule.

- Primary Production farm: The farm will focus solely on growing, harvesting of crops, raising animals or a combination of these. This farm may hold produce and also pack and label them.

- Secondary activities farm: The farm should not be in the same premises as the primary, but should be majority owned by the primary farm. Activities performed here can include but not limited to: packing, hulling, dehydration etc.

- The farms will have to continue complying with Produce Safety Rule. This rule has not been finalized yet and is at review stage following closure of comment period. Draft rules covered the below aspects:

(i). Water Quality Standard and testing is more flexible

(ii). Manure strategy to be further studied

(iii).Covered farms better defined

(iv). Withdrawal of qualified exemptions process further clarified

(v). Clarifying provisions on wild animals

- The FDA will allow enough time for the farms to comply with the rules and in association with USDA, state agriculture departments, alliances will provide assistance once the rules.

(c). Supply chain program of the manufacturer should be flexible

- Under this requirement, the manufacturer will have to exercise greater control over raw materials and may bring them under Risk based prevention control program if there is an identified hazard.

- The covered facilities should buy food products only from approved suppliers (Approved Supplier: those approved by the facility after a consideration of factors that include a hazard analysis of the food, the entity that will be controlling that hazard, and supplier performance).

- Facilities are exempt from having a risk based preventive control program, if a hazard/ risk identified is being controlled by a customer or another processor. To this effect, the facilities should declare “not processed to control (identified hazard)”.

- Brokers and Distributors are also empowered to conduct supplier verification, depending upon the verification of their documents.

- The manner of complying with this rule for the facilities are such that their suppliers will need to comply first.

(d). Current Good Manufacturing Practices should be updated and clarified periodically

- Under this provision, some requirements are binding on the management, such as:

(i). Employees who work within manufacturing, processing, packing and storage of foods are qualified for their assigned duty

(ii). Employees must have the necessary training, qualification not only for their jobs but also in principles of food safety, food hygiene, personal health and hygiene.

- The cGMP should also address allergen cross contamination.

Compliance dates for the rules

 

This depends upon the turnover of the business. The rule classifies the businesses as 4 types and defines compliance dates accordingly:

Very small business (< $1 million/ year turnover): 3 years

Businesses subject to Pasteurized Milk Ordinance- 3 years

Small businesses (< 500 full time employees): 2 years

All other businesses: 1 year

Separate compliance dates are also applicable to the supply chain program as follows:

  • Receiving facility is a small business and its supplier will not be subject to the human preventive controls rule or the produce safety rule: Two years
  • Receiving facility is a small business and its supplier will be subject to the human preventive controls rule or the produce safety rule: Two years or six months after the supplier is required to comply with the applicable rule, whichever is later
  • Receiving facility is not a small or very small business and its supplier will not be subject to the human preventive controls rule or the produce safety rule: 18 months
  • Receiving facility is not a small or very small business and its supplier will be subject to the human preventive controls rule or the produce safety rule: Six months after the supplier is required to comply with the applicable rule

Assistance to the industry

 

Being a major law that will have long reaching impact on food safety, the FDA will publish guidance documents to help stakeholders understand and implement the provisions of the rule.

Next steps

 

The FDA has in the past held public meetings, webinars to make the law reach far and wide. With respect to the final rule described above, FDA will be holding a public meeting, for more detail please go here.