FSMA Frequently Asked Question & Answers
Frequently Asked Q & A
The following is offered for informational purposes and does not constitute legal advice. Official interpretations of FDA rules can be obtained by submitting an inquiry to FDA’s Technical Assistance Network (TAN).
For scientific and technical questions (e.g., related to hazards, test methods, etc.), reach out to the Technical Assistance Network of the Food Safety Preventive Controls Alliance.
Stay involved with United Fresh and join our food safety community list. If you are a United Fresh member and interested please contact Erin Grether.
Have a question you’d like to see addressed here? Contact Dr. Jennifer McEntire.
General FSMA Questions
What is the Food Safety Modernization Act (FSMA)?
FSMA is a law that changes many aspects of how food is regulated in the United States. FSMA was passed by the US Congress in late 2010, and signed into law by President Obama in early 2011. FDA must implement the law, issuing rules and regulations that are based on the law. It will take decades before the full effect of FSMA is felt.
There are several broad chapters (called Titles) within FSMA, each of which has several sections. They are:
Includes authorities related to the Preventive Controls rules and Produce Safety Rule, intentional adulteration, sanitary transportation, and facility registration
Includes authorities for laboratory accreditation, traceability, and mandatory recall authority
TITLE III–IMPROVING THE SAFETY OF IMPORTED FOOD
Includes authorities related to the Foreign Supplier Verification Program, prior notice, accreditation of third-party auditors, and the voluntary qualified importer program.
TITLE IV–MISCELLANEOUS PROVISIONS
Many sections authorize FDA, or occasionally another part of the US government, to develop rules and regulations or issue guidance or policy with an overarching objective of improved food safety.
Who Needs to Comply with the Food Safety Modernization Act (FSMA)?
The different sections of FSMA apply to different types of operations and different parts of the supply chain. You need to read each rule to determine if it applies to you. However, if you are involved in the food supply chain, chances are that at least one of the FSMA-related rules will apply to you.
When Do I Need to be FSMA Compliant?
Because of the number of activities FDA must conduct, and the wide variety of issues that FSMA addresses, each with different timeframes and different scopes, companies should not seek to evaluate their “FSMA – compliance”. Rather, companies should look at each individual rule (such as the Preventive Controls Rule or Produce Safety Rule) and determine the extent to which it applies to their operation(s). Each rule has different implementation dates, and the dates often depend on business size. The Grocery Manufacturers Association has posted compliance dates, but the tables do not include deadline extensions announced in August 2016 that apply to certain provisions.
If an inspector holds me to the rule requirements before my compliance date has passed, or thinks I am subject to a different rule than I believe I fall under, what can I do?
Unfortunately, FDA does not currently have an appeals process. FDA has stated that such issues should be brought to the attention of the District. Bear in mind that the rules are as new to the inspectors as they are to industry. United Fresh is always available to talk through specific issues and refer you to experts who may be able to provide further assistance.
FSMA vs GFSI: If I am certified to a GFSI Benchmarked Scheme, am I good?
Not necessarily, although you are probably close. Don’t expect FDA to accept your certification in lieu of a regulatory inspection. However, your facility may be considered “lower risk” compared to one that has not been audited and therefore you may be subject to inspection less frequently.
SQF had their farm (module 7) as well as processing (modules 2 and 11) audits compared to the produce safety and preventive controls rules, respectively. http://www.sqfi.com/suppliers/fsma-resource-page/
For each SQF audit, the report presents all the elements of the SQF audit, and then notes the corresponding requirements of the rule. The very last page notes the parts of the rule that are not covered by the SQF audit.
FSSC22000 also had their GFSI-benchmarked processing audit evaluated: http://www.fssc22000.com/documents/graphics/dynamic/home/1.xml?lang=en
Some of the key differences between the Preventive Controls rule and the GFSI-benchmarked audits pertain to “supply chain controls”. The circumstances under which FDA requires a supply chain preventive control are limited, but when it is required, the process is more prescriptive than the audit schemes and there is a heavy recordkeeping burden. Additionally, FDA’s intentional adulteration rule, which won’t go into effect for a few years, is also different from most GFSI audits.
Farm or Facility: If my company is a farm, and I open a new processing (e.g., slicing, cutting, dicing) facility, is that still considered part of the farm? Or if I have a registered facility, and decide to have a separate small farm, can my registered facility be re-categorized as a secondary activity farm?
No. In the processing example, the types of processing that are included in the farm definition are very limited. Processes such as slicing, dicing, cutting, etc. would require registration with FDA. Registration is location specific; a company as a whole does not register with FDA, each facility would register. Therefore, you can consider that the company is a farm, but it may have a single location that is processing product that is registered with FDA.
If the activities conducted in a registered facility could also be considered in the farm definition, in order to be considered a secondary farm rather than a registered facility, the primary farm must own more than half of the business of the secondary farm AND more than half of the produce handled by the secondary farm must come from the primary farm. Unless the “small farm” provided the majority of produce handled by the registered facility and had majority ownership, the registered facility would remain a registered facility.
Does a packinghouse need to follow the Preventive Controls Rule or the Produce Safety Rule?
It depends. Unless they do any processing, packinghouses located on a farm are subject to the Produce Safety rule and are not required by FDA to have a food safety plan. However, they need to comply with Subpart L of the rule (equipment, tools, buildings and sanitation) as well as other applicable parts of the rule (e.g., agricultural water requirements, hygiene). In contrast, packinghouses that don’t fall under the farm definition, and are required to register with FDA, must have a food safety plan that is developed (or the development overseen) by a Preventive Controls Qualified Individual (PCQI). The approaches of the two rules are quite different, although clearly a packinghouse is a packinghouse, whether on a farm or not. FDA recently issued draft guidance to help companies understand which activities are part of the farm definition and which require facility registration.
United Fresh has been working closely with FDA to ensure that the controls recognized by FDA as adequate to control hazards at packinghouses on a farm should also be adequate for packinghouses that are registered facilities and need a food safety plan. Stay tuned as specialized FSPCA training is developed that is tailored toward packinghouses.
Since several major rules are now finalized, is there still an opportunity to comment?
Once rules are finalized it is extremely difficult to change them. However, we can still help guide FDA toward appropriate enforcement. The primary way to advise FDA will be by commenting on FDA draft guidance documents. We anticipate that there will be dozens of documents issued over the next several years.
Here are the DRAFT guidance documents that were open for public comment:
- Draft Guidance for Industry: Hazard Analysis and Risk-Based Preventive Controls for Human Food
- Draft Guidance for Industry for Classification of Activities as Harvesting, Packing, Holding, or Manufacturing/Processing for Farms and Facilities
- Draft Guidance for Industry #235 – Current Good Manufacturing Practice Requirements for Food for Animals
- Draft Guidance for Industry #239 – Human Food By-Products for Use as Animal Food
A United Fresh workgroup is currently preparing comments on FDA’s Draft Guidance on Control of Listeria monocytogenes in ready-to-eat foods, which will be submitted by July 17, 2017.
Produce Safety Rule
Preventive Controls Rule
Can I rely on my wash water antimicrobial supplier to provide validation data?
Probably, not fully. While you should request information from the antimicrobial supplier regarding efficacy and any validation studies that might have been done, FDA will be checking that the antimicrobial has been validated in your system. This means scientifically demonstrating that cross contamination is limited for the products you are processing under worst case conditions (e.g., fastest flow rate, most heavily soiled, etc.). A paper was recently submitted that describes the required elements and considerations for a robust validation study, and also includes up-to-date technical information on chlorine and peracetic acid. There is no one-size-fits-all formula. Please contact us for individual assistance understanding what kind of data you need to truly validate your process.
If I have a HACCP plan, do I need a food safety plan?
Yes. If you are covered by the Preventive Controls rule you need a food safety plan. Your HACCP plan is probably a good starting point for the FSP, but the FSP may have “preventive controls” that go above and beyond the CCPs in your HACCP plan. For example, the hazard analysis may determine that you need a sanitation preventive control to manage the risk of environmental contamination (e.g., Listeria mhaccp-vs-fsponocytogenes).
Does each facility need a Preventive Controls Qualified Individual (PCQI)? Is that the same as someone who is HACCP trained?
No and no. Each facility covered by the Preventive Controls rule needs to have a food safety plan, and that plan needs to be developed, or have the development overseen by, the PCQI. However, the PCQI could be based at that facility, or at a corporate office, or could even be a consultant. As you look at some of the ongoing responsibilities of the PCQI (e.g., performing or overseeing record review), you may determine that it makes sense to have at least one PCQI at each location. However, this is not a strict requirement. And just because someone has gone through HACCP training does not make them a PCQI. HACCP training provides a great foundation, and the PCQI training developed by the Food Safety Preventive Controls Alliance is inclusive of the seven HACCP principles, but the PCQI must understand the requirements of the Preventive Controls rule, and how to apply the rule to build a food safety plan that goes above and beyond the HACCP plan.
Do I have to conduct environmental monitoring? If so, how do I do that?
The hazard analysis is the foundation for determining the types of controls and preventive controls that are appropriate to your product and facility. The determination that environmental monitoring should be used as a verification tool (it is not a control itself) is based wholly on your hazard analysis. If you produce, pack, or hold a ready-to-eat food (defined by FDA as “any food that is normally eaten in its raw state…for which it is reasonably foreseeable that the food will be eaten without further processing that would significantly minimize biological hazards”) with any exposure to the environment post processing (e.g., holes in a cardboard container), then you need to evaluate the potential for contamination by environmental pathogens. In produce operations, Listeria monocytogenes is usually the organism of greatest concern, but your hazard analysis may identify others. If you determine that the opportunity for contamination warrants the use of a preventive control, such as a sanitation preventive control, hygienic zoning, etc., then you need to determine if environmental monitoring is an appropriate verification tool. If you do choose to conduct environmental monitoring for pathogens, refer to the United Fresh Listeria guidelines for additional information.
Transition time for compliance: If my company used to be a small business (<500 employees) and was recently acquired by a larger business, do I still have until September 2017 to comply with the Preventive Controls Rule?
The small business cut-off of 500 employees does not apply to a facility, it applies to the business. In part of the preamble of the final rule FDA states: “the limit of 500 employees would include all employees of the business rather than be limited to the employees at a particular facility (78 FR 3646<https://www.federalregister.gov/citation/78-FR-3646> at 3701).”
If, as a result of a merger or acquisition, the total number of employees (regardless of the number of facilities) exceeds 500, all facilities are subject to the earliest compliance date.
Foreign Supplier Verification Program
What is the compliance date for FSVP?
As the FSVP importer, you may have several dates you need to keep track of, which will depend on when your foreign supplier needs to comply with the rules that govern them (e.g., Preventive Controls, Produce Safety, or another rule, or no rule). Visit the FDA website to determine your compliance schedule.
If I’m not the importer of record, but use imported products/ ingredients, do I need to comply?
Maybe. The FSVP importer may be different from the importer of record. It depends on whether or not you meet the definition of FSVP importer, which is “U.S. owner or consignee of an article of food that is being offered for import into the United States. If there is no U.S. owner or consignee of an article of food at the time of U.S. entry, the importer is the U.S. agent or representative of the foreign owner or consignee at the time of entry, as confirmed in a signed statement of consent to serve as the importer under this subpart.”
I meet the definition of FSVP importer, but so does my customer (because they have agreed in writing to purchase the imported food from me). They are asking me to sign a statement saying I will bear the responsibilities of the FSVP importer. Is that allowed?
It’s true that in some situations, more than one entity may meet the definition of the FSVP importer. In that case, the supply chain needs to determine who, singularly, will be listed as the FSVP importer for that line of food on the Customs entry form, and be responsible for compliance (hazard analysis, supplier evaluation, approval, and verification activities). Signing a statement at your customer’s request is a business decision. Ensure that such statements recognize the staggered compliance dates (e.g., it is impossible for you to be in compliance by May 2017 if your foreign supplier won’t comply with the Produce Safety Rule until January 2019). Also note that FDA requires records be retained for 2 years. If your supplier asks for a longer retention time, agreeing to that is a business decision; FDA will have access to records for as long as you keep them.
My supplier (or broker, or customer) already conducted a hazard analysis for the product. Can I use that?
Yes, but you need to have it reviewed by a qualified individual who is able to ascertain if the original analysis is adequate. Also, you need to maintain documentation showing which hazards you are relying on the supplier to control (e.g., the hazard analysis, or comparable document).
My supplier is a distributor, aggregator, etc. Who and what am I supposed to verify?
As defined in the rule, the foreign supplier is the one growing or producing the food, and may be more than 1 step back in the supply chain. The rule requires you to verify that that entity is controlling the hazards identified in the hazard analysis as needing control.
The produce I import isn’t covered by the Produce Safety Rule because it’s rarely consumed raw. Aren’t I exempt from FSVP?
No. While the farm may be exempt from PSR, you are not exempt from FSVP. You still need to conduct a hazard analysis of the food, at a minimum, and fulfil the other FSVP requirements based on the hazard analysis.
The rule says that I don’t need to conduct a hazard analysis for produce covered by the Produce Safety Rule. Does this mean I don’t need to do anything to comply?
No. First, you do need to conduct a hazard analysis for any chemical or physical hazards (e.g., if the food is imported from a region where pesticides are not properly applied, or where there is high pollution, you may identify these hazards as needing controls). Second, the reason that you don’t need to evaluate microbiological hazards is because FDA assumes they are there and need to be controlled (through the implementation of the Produce Safety Rule). Therefore, you will always need to conduct verification of a farm growing covered produce (or ensure someone else in the supply chain is verifying the farm).
What will enforcement look like?
This rule is new for everyone, including FDA. We expect that a good faith effort to comply will be viewed favorably during the early stages of inspection and enforcement, even if there are some deficiencies in your program. However, given that FDA is responsible for protecting public health, expect the Agency to take swift action if they feel there is a risk to the US consumer. They have the authority to issue warning letters to importers and put importers, shippers and/or the food on import alert. Other enforcement tools are available to them as well.
Does the Sanitary Transportation final rule require trucks to be cleaned between every haul? Must carriers prove that cleaning occurred? We have our own fleet for shipping, do we need to have an SOP and form to log cleaning and what defines cleaning? Could that be sweeping or would the inside of the trailers need to washed and at what minimum frequency?
Its up to the shipper to specify to the carrier what sanitary specifications need to be met, including any cleaning procedures. The shipper may require cleaning between every haul or may require some other frequency. FDA does not specify a cleaning frequency or method. If requested by the shipper, the carrier must provide information that describes the most recent cleaning if transporting products in bulk.
Must produce be shipped in refrigerated trucks? Who determines what the appropriate temperature should be?
Shippers are responsible for indicating any temperature requirements needed to ensure food safety (not quality). It is up to the shipper to determine if their produce requires temperature control for safety. Note: transportation from farms is not considered a transportation operation covered by the Sanitary Transportation rule and is therefore exempt.
We log an inspection of condition of received products to include signs of contamination, off odors, holes, pest activity, temperature, product inspection, etc…Is there more that needs to be done?
No. In fact, it’s up to loaders to verify the sanitary state of a vehicle before loading it (using the specifications provided by the shippers). Loaders must ensure, for example, that a truck is free of visible evidence of pest infestation before loading the truck. There is no regulatory obligation on the part of the receiver to inspect a vehicle or railcar upon receipt unless it has transported a food requiring temperature control for safety, in which case the receiver must assess that the food was not subject to significant temperature abuse.
Is training required? Who determines what adequate training is?
Yes. If the carrier is responsible for sanitary conditions during transportation operations, training for personnel engaged in transportation operations is required. There is no specific source of training that one must use. There is no frequency for training (it must be provided upon hiring, and as needed thereafter). The training needs to be documented, and must cover topics including awareness of potential food safety problems, basic sanitary transportation practices, and the responsibilities of carriers. FDA is in the process of developing online training that would satisfy this requirement, but other training would also be suitable.
Has FSMA changed traceability requirements?
Not yet. FSMA gives FDA the authority to require additional traceability information for “high risk foods” in order to improve traceability, but the Agency has yet to define “high risk foods” and has not yet proposed what additional information would be required. Stay tuned! In the meantime, follow industry best practice by learning more about the Produce Traceability Initiative (PTI).