FSMA in Plain English

FSMA stands for Food Safety Modernization Act. The FSMA rule, a law effective in 2017, is a law and is complex. For answers on questions about how it applies to your specific company and other details, you will want to learn more about the details and exceptions of the law. But, in order to help you get familiar with FSMA, we’d like to explain the basics in plain english. From here, you can dive deeper as required.

What is FSMA?

FSMA is a US law, written with the goal of reducing food borne illness and deaths in the US. According to the CDC, an estimated 48 million people in the United States (1 in 6 Americans) get sick, 128,000 are hospitalized, and 3,000 die each year from preventable food borne diseases.

FSMA is designed to reduce the risk of food borne illness to individuals but it also protects your business against the damage a food safety event can cause in terms of economic and repetitional loss.

Does FSMA apply to my company?

It is likely that it applies to your company if: you manufacture, process, pack or hold human food for consumption in the United States. This applies to companies in the U.S. as well as companies outside of the U.S. who export to the U.S.

You are subject to the rule if you are required to register with the FDA under section 415 of the Federal Food, Drug, and Cosmetic Act.

Human Food (21 CFR 117)
Animal Food (21 CFR 507)

Some entities are exempted:

Juice
Seafood
Alcoholic beverages
Dietary supplements
Farms
Storage of packaged food (no exposure to the environment)
USDA-regulated products

Because there are exemptions and modified requirements and as the rule is complex, if you suspect that you may be exempt, you will want to read the rule for details or consult legal advisors.

How can I get FSMA certified?

There is no certification available or required. What is necessary is to comply with the requirements of the rule. The FDA can inspect your facility and will check to make sure you are meeting the requirements. They will look at your Food Safety Plan and will want to see that it was written by a trained PCQI.

What does FSMA require?

What is new and unique about the Preventive Controls Rule is that it focuses on preventing food safety incidents instead of reacting to them after they happen. It requires a food safety plan that includes preventive controls in addition to the process controls you will find in traditional HACCP plans.

In addition to critical limits in your HACCP plan, you will establish parameters and values to monitor preventive controls. The preventive controls rule includes controls that have not typically been included in HACCP programs. They are: allergen controls, sanitation controls and supply chain controls.

The Food Safety Plan must include:

Hazard analysis

Identify any known or reasonably foreseeable biological, chemical, and physical hazard and determine if any of those hazards require a preventive control and must consider:

The formulation of the food;
The condition, function, and design of the facility and equipment;
Raw materials and other ingredients;
Transportation practices;
Manufacturing/processing procedures;
Packaging activities and labeling activities;
Storage and distribution;
Intended or reasonably foreseeable use;
Sanitation, including employee hygiene; and
Any other relevant factors, such as the temporal (e.g., weather-related) nature of some hazards (e.g., levels of some natural toxins).
Facility and product/process specific

Preventive controls

If the hazard analysis identified a hazard requiring a preventive control, you must implement risk-based measures to significantly minimize or prevent food safety hazards

Types of Preventive Controls:

- Process Controls (equivalent to CCPs)
- Allergen Controls (human food only)
- Sanitation Controls
- Supply Chain Controls
- others

Risk-based supply chain program

If you identify any hazards related to ingredients purchased from your supplier and if you depend on the supplier to control that hazard, you must have a supply-chain control program with verification activities.

- Evaluate suppliers for approval
- Establish written procedures for receiving and use of approved suppliers
- Conduct appropriate supplier verification activities

A recall plan

Written recall plan including the procedures detailing steps you will take to perform a recall and assigning responsibility for performing them. You will need this if your hazard analysis identifies a hazard requiring a preventive control.

Record keeping

The Food Safety Plan must be signed by the owner, operator, or agent in charge, upon completion and after any modification
Records related to the Food Safety Plan
- must be accurate, indelible, and legible
- must be signed, dated, and properly identified
- must be kept for at least 2 years
- subject to FDA review

What if we already have a HACCP plan?

That is a great start. Here are some of the things you will need to add to it:

Element	HACCP Plan	Different in Food Safety Plan
Hazard Analysis	Biological, Chemical, Physical Hazards	Chemical hazards included radiological hazards, consideration of economically motivated adulteration
Preventive Controls	CCPs for processes	Process CCPs + controls at other points that are not CCPs
Parameters and Values	Critical limits at CCPs	Parameters and minimum/maximum values (equivalent to critical limits for process controls)
Monitoring	Required for CCPs	Required as appropriate for preventive controls
Corrective Actions and Preventions	Corrective actions	Corrective actions or corrections as appropriate
Verification including Validation	For process controls	Verification as appropriate for all preventive controls; validation for all process controls; supplier verification required when supplier controls a hazard
Records	For process controls	As appropriate for all preventive controls
Recall Plan	Not required in the plan	Required when a hazard requiring a preventive control is identified

Taken from “Hazard Analysis and Risk-based Preventive Controls for Human Food: Draft Guidance for Industry”

What happens if we are not in compliance?

FDA Warning Letters
Recalls
Detentions and Refusals in Port
Placement on Import Alert List
Suspension of registration
Seizure and Injunction
Civil and criminal charges
Collateral damage to company image

FDA Enforcement Actions

FDA’s initial approach to the Preventive Controls Rules was to educate industry on the Rules’ requirements by providing training and technical assistance to covered facilities.

When a reasonable amount of time had passed since the initial compliance deadlines, FDA began increasing enforcement efforts via importer audits, facility inspections, and inspections in port.

Failure to adhere to any requirements of a Food Safety Plan can result in an FDA inspection citation. The most cited Preventive Controls problems during Fiscal Year (FY) 2020 were:

Failure to Identify a Hazard that Requires a Control
Failure to Identify a Preventive Control When One was Needed
Failure to write a Food Safety Plan

The above data suggests FDA may review a facility’s Food Safety Plan during an inspection.

Developing and maintaining a compliant Food Safety Plan can help facilities avoid FDA regulatory actions, such as Warning Letters, Import Alerts, and Import Refusals.

What is a PCQI?

A PCQI (Preventive Controls Qualified Individual) is someone who has successfully completed training in the development and application of risk based preventive controls, at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply food safety system.

The PCQI is trained to understand the requirements of the Preventive Controls Rule and to write the Food Safety Plan according to the requirements.

PCQI Training

FSPCA is the organization chosen by the FDA to develop an official course curriculum to train the Preventive Controls Qualified Individual (PCQI). They developed a 16-hour course. Originally a classroom course, it is now available in different formats.

Online webinars
Blended: online portion followed by online webinar portion
Fully online, 100% self-paced (Registrar Corp is currently the only provider of the 100% online, self-paced version that is FSPCA approved)

The course teaches the contents of a Food Safety Plan as defined by FSMA, how to develop a Food Safety Plan and the requirements of Preventive Controls for Human Food (or for Animal Food).

Do I have to get trained?

The FDA states that:

The preventive controls for human food final rule specifies that a PCQI is a qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to develop and apply a food safety system. Job experience may qualify an individual to perform these functions if such experience has provided an individual with knowledge at least equivalent to that provided through the standardized curriculum.

However, the rule does not require any specific certifications, including certification by the Food Safety Preventive Controls Alliance (FSPCA). An individual may voluntarily choose to attend the PCQI training provided through the FSPCA, but this is not mandatory. In general, FDA will assess the adequacy of a facility’s food safety plan rather than an individual’s documented qualifications. Deficiencies in the food safety plan indicate that a PCQI may need additional training specific to the rule, irrespective of documented training and experience.

The FSPCA training course teaches what you need to know to understand how to write the plan. Many find it helpful to have the official certificate available to show the inspectors that the PCQI has been trained by the official course.