With Some Extensions, FSMA Is in Effect. Are You Ready?

The first of the compliance dates for FSMA is in the books, and with it came midnight-hour reprieves for some through extended deadlines, relief for others in the form of five chapters of draft guidance, and questions remaining for many with FDA’s promise of nine more guidance chapters to be published at some point and modified farm definitions to be considered.

EXTENSIONS AND DEFINITIONS. Of the seven compliance date extensions that FDA made, four focused specifically on farms, with extensions made to align the dates for farms conducting similar activities as under the Produce Safety rule and/or included in FDA’s plan to consider modifying the definition of a farm, i.e., to address ownership issues, “coloring” activities, and cotton-industry ginning concerns.

As such, it has set the earliest compliance dates as being late January 2018 for certain operations that:

• Would be secondary-activities farms except that they do not meet the ownership criterion, and thus are under the preventive controls rule.
• Color raw agricultural commodities.
• Are solely engaged in cotton ginning that provide products without further processing for use as animal food.

With its deadline extension for secondary-activities farms, FDA has provided some desperately needed clarification on manufacturing and processing versus farm activities, i.e., “Am I a farm or am I not a farm?”

That is, a secondary-activities farm qualifies even if it does not meet the ownership criterion if the operation:

• Is not located on a primary production farm;
• Is devoted to harvesting, packing, and/or holding of raw agricultural commodities;
• And is under common ownership with the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested or packed, and/or is held by the operation.

However, as even FDA indicates in its plans to consider farm definition modifications, there are still a lot of unanswered questions. My advice to those struggling with this is get started anyway. Don’t sit out the extended timeframe waiting for FDA’s definition; instead, pick a lane that you can justify and makes sense based on what has been published, then plan to make adjustments as needed when we hear more from FDA.

Other extensions granted by FDA were a two-year extension for provisions that allow for modified requirements or exemptions if a hazard is validated as being controlled downstream, and two years for the importation of food-contact substances under the FSVP rule. The extended time of both also provides time for FDA to consider the best approach to address feasibility concerns.

Additionally, FDA created a single compliance date, September 17, 2018, for facilities producing Grade “A” milk products to comply with all requirements, and clarified that covered farms under the Produce Safety rule must begin sampling and testing untreated surface water no later than the compliance date (January 26, 2018). FDA clarified that it does not mean the two- to four-year testing must be completed by that date.

For some, these extended compliance dates will be helpful. My view is that at least some of the deadline extensions, such as that for the letters of assurance, are a reflection of FDA really not knowing how to enforce the requirements.

But an extension is an extension whatever the reason.

THE FOOD SAFETY PLAN. With the food safety plan (FSP) being the heart of the Preventive Controls rule, which is, essentially, the heart of FSMA as a whole, FDA devoted the first chapter of its 14-chapter draft guidance to this. Not only does it provide guidance on the writing of the FSP, it compares the FSP with HACCP, drawing out the similarities and differences. (In this article, we address only the FSP writing; for a discussion of FSP vs. HACCP, see my online article, FDA Begins to Clarify the PC Rule [bit.ly/2d8Aysp].) However, be sure to understand that a FSP is not the same as HACCP.

FDA defines the FSP as consisting of “the primary documents in a preventive controls food safety system that provides a systematic approach to the identification of food safety hazards that must be controlled to prevent or minimize the likelihood of foodborne illness or injury.”

So, what does that mean in application? The FSP is a collection of written documents — that can be of any format and consolidated in a single location (e.g., a binder or folder) or tabulated then located in various sites in the plant. But, either way, it must include a hazard analysis of all ingredients and process/manufacturing steps to identify hazards requiring a preventive control; what the preventive control(s) are for each, along with a recall plan; and the procedures for implementation monitoring, corrective action, and verification.

Additionally, the analysis must be written, even if you have not identified any hazards that require preventive controls; and the FSP must be signed and dated by the owner, operator or agent in charge of the facility once completed and whenever modified.

FDA also makes it clear that the FSP is intended to only cover hazards that are capable of causing illness or injury, not simply “undesirable” conditions (e.g., insects, hair, filth, spoilage, etc.) unless any of these directly affect food safety. However, such hazards do need to be analyzed and the hazard analysis document included in the FSP.

There also is some discussion of the “preventive controls qualified individual” (PCQI), including the fact the FSP is to be developed by a PCQI with the education, recognized training, and/or experience to develop and apply a food safety system. However, it leaves it to industry to consult the rule and/or connect with the Food Safety Preventive Controls Alliance for complete information.

The FSP must be reanalyzed at least once every three years, and the applicable portions reanalyzed anytime there is a system or equipment change, new information about applicable potential hazards, an unanticipated food safety problem; a preventive control, combination of preventive controls; or the FSP is found to be ineffective.

STILL NOT READY? If you have found that the compliance date has come and gone and you are still not ready, your first step should be to move compliance to the very top of your priority list and get all applicable persons involved to get it moving. The second step should be to take a close look at all the compliance dates that apply to you, including the new extensions, and prioritize based on those.

Your third step should be to not panic or let your team get overstressed. With the new mandates, the complexity of some aspects of the rule, and the late issuance of any guidance, a lack of absolute compliance may be understandable if FDA shows up at your door. I would hope that the inspectors will exert a lot of enforcement discretion, and realize we are all in a learning curve and are in this together, but you do need to ensure you know the mandates of the rule and exactly what applies to you; be in compliance as much as possible; and be prepared to show FDA what you do have, explain exactly what you don’t have, why you don’t have it, and what you are doing to have it ASAP.

With all that said, you also need to remember that the compliance date is the date by which compliance is required. So you can’t sit back and relax thinking partial compliance is good enough and FDA is unlikely to show up at your facility right away anyway. FDA is knocking on someone’s door today.