FSMA in Plain English
FSMA stands for Food Safety Modernization Act. The FSMA rule, a law effective in 2017, is a law and is complex. For answers on questions about how it applies to your specific company and other details, you will want to learn more about the details and exceptions of the law. But, in order to help you get familiar with FSMA, we’d like to explain the basics in plain english. From here, you can dive deeper as required.
What is FSMA?
FSMA is a US law, written with the goal of reducing food borne illness and deaths in the US. According to the CDC, an estimated 48 million people in the United States (1 in 6 Americans) get sick, 128,000 are hospitalized, and 3,000 die each year from preventable food borne diseases.
FSMA is designed to reduce the risk of food borne illness to individuals but it also protects your business against the damage a food safety event can cause in terms of economic and repetitional loss.
Does FSMA apply to my company?
It is likely that it applies to your company if: you manufacture, process, pack or hold human food for consumption in the United States. This applies to companies in the U.S. as well as companies outside of the U.S. who export to the U.S.
You are subject to the rule if you are required to register with the FDA under section 415 of the Federal Food, Drug, and Cosmetic Act.
- Human Food (21 CFR 117)
- Animal Food (21 CFR 507)
Some entities are exempted:
- Alcoholic beverages
- Dietary supplements
- Storage of packaged food (no exposure to the environment)
- USDA-regulated products
Because there are exemptions and modified requirements and as the rule is complex, if you suspect that you may be exempt, you will want to read the rule for details or consult legal advisors.
How can I get FSMA certified?
There is no certification available or required. What is necessary is to comply with the requirements of the rule. The FDA can inspect your facility and will check to make sure you are meeting the requirements. They will look at your Food Safety Plan and will want to see that it was written by a trained PCQI.
What does FSMA require?
What is new and unique about the Preventive Controls Rule is that it focuses on preventing food safety incidents instead of reacting to them after they happen. It requires a food safety plan that includes preventive controls in addition to the process controls you will find in traditional HACCP plans.
In addition to critical limits in your HACCP plan, you will establish parameters and values to monitor preventive controls. The preventive controls rule includes controls that have not typically been included in HACCP programs. They are: allergen controls, sanitation controls and supply chain controls.
The Food Safety Plan must include:
Identify any known or reasonably foreseeable biological, chemical, and physical hazard and determine if any of those hazards require a preventive control and must consider:
- The formulation of the food;
- The condition, function, and design of the facility and equipment;
- Raw materials and other ingredients;
- Transportation practices;
- Manufacturing/processing procedures;
- Packaging activities and labeling activities;
- Storage and distribution;
- Intended or reasonably foreseeable use;
- Sanitation, including employee hygiene; and
- Any other relevant factors, such as the temporal (e.g., weather-related) nature of some hazards (e.g., levels of some natural toxins).
- Facility and product/process specific
If the hazard analysis identified a hazard requiring a preventive control, you must implement risk-based measures to significantly minimize or prevent food safety hazards
Types of Preventive Controls:
- Process Controls (equivalent to CCPs)
- Allergen Controls (human food only)
- Sanitation Controls
- Supply Chain Controls
Risk-based supply chain program
If you identify any hazards related to ingredients purchased from your supplier and if you depend on the supplier to control that hazard, you must have a supply-chain control program with verification activities.
- Evaluate suppliers for approval
- Establish written procedures for receiving and use of approved suppliers
- Conduct appropriate supplier verification activities
A recall plan
Written recall plan including the procedures detailing steps you will take to perform a recall and assigning responsibility for performing them. You will need this if your hazard analysis identifies a hazard requiring a preventive control.
- The Food Safety Plan must be signed by the owner, operator, or agent in charge, upon completion and after any modification
- Records related to the Food Safety Plan
- must be accurate, indelible, and legible
- must be signed, dated, and properly identified
- must be kept for at least 2 years
- subject to FDA review
What if we already have a HACCP plan?
That is a great start. Here are some of the things you will need to add to it:
|Element||HACCP Plan||Different in Food Safety Plan|
|Hazard Analysis||Biological, Chemical, Physical Hazards||Chemical hazards included radiological hazards, consideration of economically motivated adulteration|
|Preventive Controls||CCPs for processes||Process CCPs + controls at other points that are not CCPs|
|Parameters and Values||Critical limits at CCPs||Parameters and minimum/maximum values (equivalent to critical limits for process controls)|
|Monitoring||Required for CCPs||Required as appropriate for preventive controls|
|Corrective Actions and Preventions||Corrective actions||Corrective actions or corrections as appropriate|
|Verification including Validation||For process controls||Verification as appropriate for all preventive controls; validation for all process controls; supplier verification required when supplier controls a hazard|
|Records||For process controls||As appropriate for all preventive controls|
|Recall Plan||Not required in the plan||Required when a hazard requiring a preventive control is identified|
Taken from “Hazard Analysis and Risk-based Preventive Controls for Human Food: Draft Guidance for Industry”
What happens if we are not in compliance?
- FDA Warning Letters
- Detentions and Refusals in Port
- Placement on Import Alert List
- Suspension of registration
- Seizure and Injunction
- Civil and criminal charges
- Collateral damage to company image
FDA Enforcement Actions
FDA’s initial approach to the Preventive Controls Rules was to educate industry on the Rules’ requirements by providing training and technical assistance to covered facilities.
When a reasonable amount of time had passed since the initial compliance deadlines, FDA began increasing enforcement efforts via importer audits, facility inspections, and inspections in port.
Failure to adhere to any requirements of a Food Safety Plan can result in an FDA inspection citation. The most cited Preventive Controls problems during Fiscal Year (FY) 2020 were:
- Failure to Identify a Hazard that Requires a Control
- Failure to Identify a Preventive Control When One was Needed
- Failure to write a Food Safety Plan
The above data suggests FDA may review a facility’s Food Safety Plan during an inspection.
Developing and maintaining a compliant Food Safety Plan can help facilities avoid FDA regulatory actions, such as Warning Letters, Import Alerts, and Import Refusals.
What is a PCQI?
A PCQI (Preventive Controls Qualified Individual) is someone who has successfully completed training in the development and application of risk based preventive controls, at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply food safety system.
The PCQI is trained to understand the requirements of the Preventive Controls Rule and to write the Food Safety Plan according to the requirements.
FSPCA is the organization chosen by the FDA to develop an official course curriculum to train the Preventive Controls Qualified Individual (PCQI). They developed a 16-hour course. Originally a classroom course, it is now available in different formats.
- Online webinars
- Blended: online portion followed by online webinar portion
- Fully online, 100% self-paced (Registrar Corp is currently the only provider of the 100% online, self-paced version that is FSPCA approved)
The course teaches the contents of a Food Safety Plan as defined by FSMA, how to develop a Food Safety Plan and the requirements of Preventive Controls for Human Food (or for Animal Food).
Do I have to get trained?
The FDA states that:
The preventive controls for human food final rule specifies that a PCQI is a qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to develop and apply a food safety system. Job experience may qualify an individual to perform these functions if such experience has provided an individual with knowledge at least equivalent to that provided through the standardized curriculum.
However, the rule does not require any specific certifications, including certification by the Food Safety Preventive Controls Alliance (FSPCA). An individual may voluntarily choose to attend the PCQI training provided through the FSPCA, but this is not mandatory. In general, FDA will assess the adequacy of a facility’s food safety plan rather than an individual’s documented qualifications. Deficiencies in the food safety plan indicate that a PCQI may need additional training specific to the rule, irrespective of documented training and experience.
The FSPCA training course teaches what you need to know to understand how to write the plan. Many find it helpful to have the official certificate available to show the inspectors that the PCQI has been trained by the official course.
How can I get help with FSMA compliance?
How Registrar Corp can help
- 100% online and self-paced
- FSPCA Approved
- Registrar Corp staffs Preventive Controls Qualified Individuals that can develop or review your plan for FDA compliance.
- Track your suppliers’ compliance, gauge your suppliers’ risk, and manage your suppliers’ documentation from one simple and secure platform.
FDA has a Technical Assistance Network (TAN) with information on questions related to FSMA
FSMA TAN FAQs