Unfinished Business: Answering Your Questions About FSMA Inspection Readiness

By Sam Lewis

Be sure to watch the entire web chat or read part one, part two, and part three of this series

Food Online hosted a web chat, Food For Thought: How To Always Be FSMA Inspection Ready, featuring Elizabeth Fawell, a food law attorney at Hogan Lovells U.S., LLP; and Samantha Cooper, senior manager of food safety and quality assurance at the Grocery Manufacturers Association. In this 45-minute live Q&A, Fawell and Cooper answered the audience’s questions about preparing for FDA inspections. While the session was educational and informative, there wasn’t enough time to answer every question. Here, Fawell and Cooper address the unanswered questions from the web chat.

Note: These responses are provided for informational purposes only and do not constitute legal advice. Companies are encouraged to consult with legal counsel regarding compliance with FDA requirements.

Food Online: Raquel asks, “Will the FDA offer advance notice of upcoming and inspection types? How much notice will be given for each inspection type?”

Fawell/Cooper: No advanced notice will be given for a domestic Preventive Controls or current good manufacturing practice (cGMP) inspection, but advanced notice is provided for foreign facility inspections. Currently, the FDA is providing advance notice for (foreign Supplier Verification Program (FSVP) inspections, though the agency does not plan to continue this practice in perpetuity.

Food Online: Karla asks, “What things are necessary have to the inspection? What should I have on hand to be prepared?”

Fawell/Cooper: A preventive controls inspection under the cGMP, Hazard Analysis, and Risk-Based Preventive Controls for Human Food rule will involve an in-depth records review, as well as observations of the implementation of your written programs and review of the facility for CGMPs. The record-keeping requirements are listed in the regulation and include your Food Safety Plan and implementation records. You should be prepared to show the agency each of the records you are required to keep under the relevant regulation.

Food Online: Ted asks, “What steps does a contract cleaning service need to take to be FSMA compliant if already meeting all third-party auditing and USDA standards?”

Fawell/Cooper: The Preventive Controls regulations apply to businesses — either in the U.S. or any other country — that are required to register with the FDA as a food facility because they manufacture/process, pack, or hold food for consumption in the U.S. Businesses that do not manufacture, process, pack, or hold food for consumption in the U.S. are not covered by the Preventive Controls requirements. If you provide cleaning services to food facilities, your customers may ask you to perform cleaning and/or sanitation activities to help them comply with their own FSMA requirements.

Food Online: Alamarra asks, “Will the river of regulations and interpretation of regulations ever slow down or stop? For a small business that doesn’t have dedicated resources, this is very overwhelming. How can we manage this?”

Fawell/Cooper: The introduction and implementation of FSMA regulations may seem overwhelming to some small businesses with limited resources, and it will take time to incorporate the regulations into your existing programs. That’s why the FDA provided longer compliance timeframes for small and very-small businesses. It’s important to utilize reliable resources to help understand the new requirements, which in turn should make it less overwhelming. There are great resources for all of the FSMA rules on the FDA FSMA website, FDA draft guidance, and small-entity compliance guides have begun to be released. For technical questions, the FDA has the FDA Technical Assistance Network (TAN). Helpful curricula for the Preventive Controls for Human Food, Preventive Controls for Animal Food, and Foreign Supplier Verification Programs have been developed by the Food Safety Preventive Controls Alliance.

Food Online: Doreen asks, “Do you know of a model food safety plan or template for creating one for a dairy manufacturing plant?”

Fawell/Cooper: The FDA recently released a Food Safety Plan Builder designed to help facilities with the development of food safety plans. Some industry groups also are working to develop model plans for their members. One caution regarding templates or models of food safety plans for pre-existing facilities: your food safety plan should be tailored to your facility, products and processes.

Food Online: Bill asks, “What is the regulation regarding a co-packer that makes products for us under USDA regulation, but we ourselves are only under the FDA? For example, we have a co-packer who makes meat products for us, but we do not make meat products ourselves.”

Fawell/Cooper: The Preventive Controls regulations apply to businesses — either in the U.S. or any other country — that are required to register with the FDA as food facilities because they manufacture, process, pack, or hold food for consumption in the U.S. The USDA-regulated product made by the co-packer would not be under FDA oversight.

Food Online: Lawrence asks, “We had a good FDA inspection in January last year. We have three employees and are very small. We use ingredients that come from all over the world. How do we assure that the supply lines for ingredients from all over the world have adequate quality systems?”

Fawell/Cooper: Supply chain oversight is addressed in Subpart G of the Preventive Controls for Human Food rule (Subpart E of the Preventive Controls for Animal Food rule) and in the FSVP rule. These regulations set out what is required to verify that suppliers are producing safe food in compliance with FDA requirements. Importantly, the regulations also explain when supplier verification is needed (e.g., when a hazard in raw material or ingredient is controlled before its receipt).

Food Online: Jeff asks, “If a plant manufacturers something and sells it to a customer for export, does the manufacturer’s plant need to comply with FSMA rules?”

Fawell/Cooper: The Preventive Controls regulations apply to businesses — either in the U.S. or any other country — that are required to register with FDA as food facilities because they manufacture, process, pack, or hold food for consumption in the U.S. The FDA’s facility registration regulations address when foreign facilities are required to register.

Food Online: John asks, “What is the latest on how the FDA is approaching supplier verification where corporate HQ, rather than the plant, manages the relationship with the supplier and conducts verification activities?”

Fawell/Cooper: FDA investigators are in the early stages of incorporating supply-chain preventive controls into facility inspections. Though it’s common for a corporate headquarters to manage suppliers, determine and possibly conduct verification activities on behalf of the company’s plants, it’s still too early in preventive control inspections to say how this role of corporate is going to be addressed during inspections.

Food Online: Daniel asks, “We're a co-packing facility that does not deal directly with ingredients suppliers. Our customer acts as a broker, which, in turn provide us Letter of Guarantee along with COA for ingredients. Would we have to obtain additional documentation from each supplier to meet compliance? We're considered a small business with fewer than 500 employees.”

Fawell/Cooper: Contract-manufacturing is complex, and using your question as just one example demonstrates the variety of relationships that may exist between the contract manufacturer, brand owner, supplier, customer, or other parties. We should expect to see some guidance on contract-manufacturing in the supply-chain program draft guidance document from the FDA.

Food Online: Tom has two questions; first, “If you are Seafood HACCP Trained, do you have to have Preventive Controls training also? Had some conversations, seems to be confusion for FDA-regulated seafood facilities.” He also asks, “Is environmental monitoring for foods processed required for foods processed under 21CFR113 LACF?”

Fawell/Cooper: The FDA recently posted a guidance document, Guidance for Industry: Seafood HACCP and the FDA Food Safety Modernization Act. In the guidance, you’ll be able to learn how FSMA affects you if you fall under Seafood HACCP. The other guidance that will help with your second question is Guidance for Industry: Low-Acid Foods Packaged in Hermetically Sealed Containers (LACF) Regulation and the FDA Food Safety Modernization Act.

Food Online: Michelle asks, “How does the FDA define RTE (ready-to-eat) vs. non-RTE? I have seen differences in what the USDA and the FDA considers RTE.”

Fawell/Cooper: From the Preventive Controls for Human Food rule, RTE means “any food that is normally eaten in its raw state or any other food, including a processed food, for which it is reasonably foreseeable that the food will be eaten without further processing that would significantly minimize biological hazards.” Non-RTE was not defined in the rule.

Food Online: John asks, “Are standard operation procedures (SOP) a good way to show preventive controls?”

Fawell/Cooper: SOPs may be helpful to show your preventive control, but it may not be enough. A preventive control includes the written procedures, practices, and processes to ensure the identified hazard is significantly minimized or prevented. Management components for the preventive control are also required, and include monitoring, corrective actions and corrections, and verification procedures and associated records.

Food Online: Dave asks, “I feel my HACCP program is a good one. I have always included preventive measures. How do I "upgrade" to a HARPC program to satisfy the FDA even though I have been told by auditors my program looks fine?”

Fawell/Cooper: Preventive controls go beyond a HACCP Program. Typically in a HACCP plan, identified hazards are controlled at critical control points (CCPs). Now, in a Food Safety Plan, additional controls may be needed for allergens, sanitation, and your suppliers, and not all preventive controls are CCPs. Though you may feel like your current HACCP plan is fine, and you’ve always had preventive measures, it’s important to review your existing programs against the regulatory requirements. The FSPCA’s PCQI training may be a helpful resource to better understand how to modify your program to adapt for the Preventive Controls rule.

Food Online: Beatriz asks, “Pathogen samples collected from food-making environments taken by FDA inspectors: how are they handling products and samples during inspections?”

Fawell/Cooper: When the FDA collects samples, the agency will provide the facility with a receipt for the samples on a Form FDA 484. The agency will provide the results of the testing of the samples to the facility on a Form FDA 1551. When the FDA collects samples, you should consider whether you want to take duplicate samples. You also should consider whether you want to hold product while awaiting the FDA’s test results. If you don’t receive test results from the FDA in a timely manner, you should contact the agency and request the results. Should you choose not to hold product and the FDA’s testing come back positive, the agency may encourage you to conduct a recall.

Food Online: Colleen asks, “What are the most common areas food manufacturers are forgetting to address or glancing over?”

Fawell/Cooper: Record organization. Record review is a huge part of an inspection, and it’s important that a facility is prepared and organized before an FDA investigator arrives. Having a good record-keeping system and ensuring that the records you have are complete and organized will help facilitate a smooth inspection, in addition to demonstrating to the FDA that you are manufacturing safe food.  

Food Online: “Does FSMA require third-party GFSI reports or are the audit certificates sufficient proof of compliance?”

Fawell/Cooper: FSMA does not require third-party GFSI reports or audit certificates. Your proof of compliance with FSMA will be determined through an FDA inspection. Audits are one type of supplier verification activity. Audits conducted to verify supplier compliance under FSVP or the Preventive Controls rule can be second or third party audits and do not need to be GFSI audits. The requirements for audits are outlined in the regulations.