Responsibility for FSMA Preventive Controls: If Not You, Then Who?

We wrote earlier this week about the Food Safety Modernization Act (FSMA) and what it means, from a 30,000 foot perspective, for food companies. Today we are going to dig in a little deeper to one issue that we’ve seen clients wrestle with recently.

One core FSMA requirement is a new process that requires identification and prevention of all reasonably foreseeable food safety hazards – this is called Hazard Analysis and Risk-Based Preventive Controls (HARPC).  Under these HARPC requirements, food facilities must:

• Identify hazards that require application of a preventive control to minimize or eliminate the hazards; and
• Specify when and how each hazard requiring a preventive control will be addressed. For example, the hazard could be the presence of metal fragments from the dicing step of the process, and the preventive control would be metal detection applied toward the end of the process.

Sometimes, however, the preventive control will be applied by an entity other than the food facility (e.g., one of the food facility’s customers, or an entity further down the distribution chain). In these situations, FSMA requires the food facility to take additional steps to ensure that the preventive control will be applied at some point in the distribution chain before the food makes its way to the consumer.

At its most basic, FSMA requires the food facility to disclose in documents that accompany the food that the food

is not processed to control for [identified hazard]” and to receive from their customers on an annual basis written assurances “that the customer has established and is following procedures (identified in the written assurance) that will significantly minimize or prevent the identified hazard.

The regulation requires the food facility to follow these requirements when:

• Their customer is also subject to the PCHFR;
• The customer is not subject to the PCHFR (i.e., qualified facilities and retail food establishments); and
• An entity after the food facility’s customer will apply the preventive control, among other situations.

The requirements shift slightly depending on where in the supply chain the preventive control is applied. FSMA also increased the number and type of records food facilities must keep, and these situations are not exempt.

The entity providing the written assurance must meet certain requirements as well. First, the entity must do what it said it would do in the written assurance and must document those actions. Second, as mentioned above, the written assurance must contain a description of the procedures the entity has adopted and is following. The FDA notes, in the final PCHFR, that the customer does not need to explain the procedures in great detail; in fact, “the customer could merely state that its manufacturing processes include a lethality step for microbial pathogens of concern.”

The other notable requirements include the following:

1. the entity providing the written assurance must acknowledge its legal responsibility to act consistently with the written assurance and to document those actions; and
2. a provision stating that “if the assurance is terminated in writing by either party, responsibility for compliance with the applicable provisions of this part [117] reverts to the manufacturer/processor as of the date of termination.”

This requirement is a big shift for the industry. Not only are food facilities required to create a food safety plan (the HARPC requirement mentioned above), but they also need to gather assurances from their customers that they did not have to do before about issues they may not have needed to expressly address before. Almost all players in the food distribution chain are somehow impacted by FSMA and opening up a conversation about those requirements could prove very valuable.

At the outset, the conversations prompted by these requirements may seem a little intimidating (and understandably so). However, keep in mind that the purpose of FSMA is to shift from a reactionary food system to a prevention-focused food system. Having conversations about what hazards exist and which entity in the supply chain is responsible for addressing each hazard are important conversations to have. Capturing those conversations in writing so everyone is clear on each player’s responsibility are also crucial (and required) documents to have. Remember, we’re all in this together.