FSMA Roundup: An Overview Of The FDA's Seven Major Rules

By Rick Barham, food safety specialist, Registrar Corp

In 2011, President Obama signed FSMA — a body of regulatory works that quickly became the most sweeping reform of the U.S. food safety system in over 70 years — into law. The FDA published seven major rules under FSMA, each of which created new requirements that put more responsibility on industry to prevent contamination of the U.S. food supply rather than reacting to it. This article will review all of FSMA’s seven final rules and briefly cover points of compliance, as well as each rule’s compliance dates.

Preventive Controls Rules for Human and Animal Food

Proposed: January 2013 (Human) and October 2013 (Animal)                            
Finalized: September 17, 2015
Compliance Dates:

• Very-small businesses (businesses that have less than $1,000,000 in total annual sales of human food, adjusted for inflation): September 2018
   
• Businesses subject to the Pasteurized Milk Ordinance: September 2018
   
• Small businesses (businesses with fewer than 500 full-time equivalent employees): September 2017
   
• All other businesses: September 2016

The FDA's Preventive Controls Rules apply to all facilities required to register with the FDA as a food facility, unless covered by an exemption (See page 19 of the final rule for a complete list of exemptions). A covered facility must implement a written Food Safety Plan that identifies known or reasonably foreseeable biological, chemical, and physical hazards related to foods in the facility. For each identified hazard, the Food Safety Plan must determine whether the hazard requires preventive controls and, if so, outline preventive controls to minimize or prevent that hazard.

While similar to other food safety programs, such as HACCP, ISO 22000, or BRC, these plans do not satisfy the requirement of having an FDA Food Safety Plan. A Preventive Controls Qualified Individual (QI) must create or oversee the development of a facility's Food Safety Plan. The Preventive Controls Qualified Individual may or may not be an employee of the facility.

The Preventive Controls Rules also require covered facilities to approve their raw material and ingredient suppliers when the receiving facility has identified a hazard requiring a preventive control. In approving suppliers, facilities must consider multiple factors, including the supplier’s performance (i.e., compliance with FDA regulations, including FDA warning letters, Import Alerts, etc). Facilities can use the FDA's public databases or a third-party tool to monitor a supplier's status.

Produce Safety Rule

Proposed: January 2013                          
Finalized: November 2015
Compliance Dates: Compliance dates for the FDA's Produce Safety rule depend on a business's size, exemption status, and whether or not the business deals with sprouts. Click here for more information on Produce Safety compliance dates.

The FDA's Produce Safety Rule establishes science-based minimum standards for the safe growing, harvesting, packing, and holding of produce. The rule puts more responsibility on farms to protect their crops from contamination by creating requirements for water quality testing, raw manure application, examining grazing areas, employee health and hygiene training, and more. The rule gives special attention to sprouts due to their frequent association with foodborne illness outbreaks.

Foreign Supplier Verification Program (FSVP) Rule

Proposed: July 2013                  
Finalized: November 2015
Compliance Dates:

The latest of the following dates:

• 18 Months after publication of the final rule  (May 2017) 
   
• For the importation of food from a supplier that is subject to the preventive controls or produce safety rules: six months after the foreign supplier is required to meet the relevant regulations. 
   
• For an importer that is itself a manufacturer or processor subject to the supply-chain program provisions in the preventive controls regulations: the date by which it has to comply with those provisions.

The FSVP rule requires importers to verify their foreign suppliers are producing food in compliance with applicable FDA regulatory requirements. To approve a supplier, an importer must evaluate the risks posed by foods it supplies by determining potential hazards associated with each food, as well as by evaluating the supplier's performance (i.e., FDA compliance history). Importers must then implement an FSVP for each approved supplier and each food imported from that supplier. The rule gives importers the flexibility to choose appropriate verification activities for each food and supplier. Examples of potential verification activities include annual onsite audits of a supplier's facility, sampling and testing a supplier's products, or reviewing a supplier's food safety records.

The FDA defines an importer as "the U.S. owner or consignee of a food offered for import into the United States" for purposes of this rule. If there is no U.S. owner or consignee, the FDA considers the U.S. agency or representative of the foreign owner of consignee at the time of entry to be the importer.

Accredited Third-Party Certification

Proposed: July 2013                  
Finalized: November 2015
Compliance Dates: N/A (Voluntary)

The Third-Party Certification rule established a voluntary program for the accreditation of third-party certification bodies to conduct food safety audits and issue certifications of foreign facilities and the foods they produce. Under the program, the FDA recognizes what are called accreditation bodies, which then may accredit third-party certification bodies.

Accredited third-party certification bodies can perform two types of audits: consultative and regulatory. A consultative audit is conducted in preparation for a regulatory audit, while a regulatory audit is the basis for certification. Foreign facilities can use certification from a Third-Party Certification Body for two purposes: participation in the FDA's Voluntary Qualified Importer Program (VQIP) or to satisfy a request by the FDA that a food exported to the U.S. be accompanied by this certification (a request that may be made if the FDA suspects a food has the potential to be harmful to U.S. consumers). When a certification body conducts a regulatory audit, it must provide the FDA with a full report on the results of its inspection. The results of a consultative audit may remain private, but a certification body is required to report to the FDA if a consultative audit reveals issues that may pose a serious risk to consumer health.

Sanitary Transportation Rule

Proposed: February 2014                       
Finalized: April 2016
Compliance Dates:

• Small Businesses (businesses other than motor carriers who are not also shippers and/or receivers employing fewer than 500 persons and motor carriers having less than $27.5 million in annual receipts):  April 2018
   
• All other businesses: April 2017

The Sanitary Transportation rule created new requirements for shippers, receivers, loaders, and carriers that transport food in the U.S. by motor or rail vehicle to ensure food is protected during transportation, via both the design and maintenance of transportation vehicles and equipment and by taking appropriate measures to ensure food safety by maintaining proper temperature controls and protecting food from contamination. Shippers, loaders, carriers, and receivers must develop written procedures detailing how they will ensure the safe transportation of food according to their specific requirements under the rule. The Sanitary Transportation rule applies whether or not the food is offered for or enters interstate commerce. 

Intentional Adulteration Rule

Proposed: December 2013     
Finalized: May 2016
Compliance Dates:

• Very-small businesses (a business [including any subsidiaries and affiliates] averaging less than $10,000,000, adjusted for inflation, per year, during the three-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale [e.g., held for a fee].):  May 2021
   
• Small Businesses (a business employing fewer than 500 persons): May 2020
   
• All other businesses: May 2019

As with the FDA's Preventive Controls Rules, the  Intentional Adulteration Rule applies to all facilities required to register with the FDA as a food facility, unless covered by an exemption (see section titled "Exemptions"). The rule requires facilities to develop and implement a written Food Defense Plan that assesses vulnerabilities within the facility, identifies a mitigation strategy for each vulnerability, and identifies monitoring procedures to ensure effectiveness of the mitigation strategies. A QI must prepare a facility's Food Defense Plan.

 

About The Author
Rick Barham holds a Bachelor of Science degree in Animal Science from Virginia Tech and a Bachelor of Science degree in Accounting from Christopher Newport University. Mr. Barham has over 31 years of experience in the Food Safety profession. He acted as Regional Manager for the Virginia Department of Agriculture’s Food Safety Program. He has attended numerous training sessions with the FDA including Good Manufacturing Practice, Application, and Evidence Development; Dietary Supplement GMP; Managing Food Allergens; and Special Processes at Retail. He has also completed certifications or course work in Seafood HACCP, Better Process Control School (LACF and AF), Food Defense, Reduced Oxygen Packaging, HACCP, and held FDA Commission Credentials. He has been honored with numerous awards, including Inspector of the Year in 1992, the Food Safety Task Force Merit Team Award of Excellence in 2002 and FDA Leveraging Collaboration Awards for cooperative investigational work.

Mr. Barham joined Registrar Corp's Food Safety team in 2015. He now assists food facilities to comply with U.S. FDA food safety regulations by reviewing HACCP and Food Safety plans, conducting mock FDA inspections, and more.

Mr. Barham may be contacted by email at rbarham@registrarcorp.com

About Registrar Corp
Registrar Corp is a U.S.-based FDA consulting firm that helps food and beverage companies comply with FDA regulations. Registrar Corp offers assistance with FDA registration, U.S. Agent requirements, labeling compliance, and new requirements under FSMA. Since opening its headquarters in 2003, Registrar Corp has expanded to 20 offices worldwide. Employees include former FDA officials, scientists, and industry experts.