Key components of the Food Safety Modernization Act (FSMA) are the obligations placed upon owners and operators of human and animal food facilities to conduct hazard analyses and implement preventive controls that address the identified hazards. These obligations, along with other FSMA requirements, are designed to shift the focus of U.S. food safety away from incident response and toward prevention.  After years of discussion, public comment and even litigation, FDA finalized rules on hazard analysis and preventive controls for human and animal food on Sept. 10. 

The Preventive Controls Rules, as they are generally known, apply to “covered facilities”—those facilities that manufacture, process, pack or hold food. In other words, if the facility is required to register with FDA, the preventive controls rules apply. Excluded, however, are farms, which are defined as operations devoted to growing and harvesting crops, raising animals or any combination. Certain operations conducted on farms, such as packing and storing operations, will not eliminate the exemption, although exempt farming operations may be covered by the Product Safety Rule.

So, what will be required of covered facilities as a result of these final rules? If you’ve been following the path the Preventive Controls Rules have taken through the rulemaking process, you won’t notice too much that is new. The basic obligation is the requirement to develop and maintain a written food safety plan, which includes conducting a hazard analysis, instituting preventive controls, monitoring the implementation and effectiveness of the preventive controls and preparing a recall plan. The rules also make some changes to current good manufacturing processes and impose requirements relating to the development of a supply chain program.

The hazard analysis is conducted to identify “known or reasonably foreseeable biological, chemical and physical hazards,” whether these hazards are introduced into the process naturally, intentionally or unintentionally. Sources of potential hazards include experience with the process and ingredients, as well as “illness data, scientific reports and other information,” and must take into account potential hazards associated with the ingredients, the facility and equipment used, sanitation and hygiene, manufacturing procedures, packaging, labeling, storage, transportation, the intended or reasonably foreseeable use of the product and any other relevant factors. The analysis also includes a consideration of the severity of the potential hazard and the probability of it occurring. 

The facility must prepare and implement a written preventive controls plan that is tailored to minimize or prevent the hazards identified. Key components of the plan include process controls, food allergen controls, sanitation controls, supply chain controls and a recall plan. This obligation is broader than just addressing critical control points; rather it extends to controls other than at critical control points that are “appropriate for food safety.” Of particular note are the supply chain controls, which require the implementation of a risk-based supply chain program for ingredients deemed a hazard from a receiving facility. In some instances, receiving facilities will be required to review and qualify suppliers, and except for under limited circumstances, will be prohibited from accepting product from non-qualified suppliers.

Next, a facility must prepare written procedures designed to verify and document that the preventive controls are working. This includes monitoring of preventive controls, correction (of an individual incident) and corrective action (of a larger problem with the preventive controls) and verification of consistent and effective implementation of preventive controls. Re-analysis of preventive controls is required every three years, or perhaps sooner if certain triggering events occur, which include significant process changes, receipt of new information about a potential hazard, a significant increase in a known hazard or where a preventive control is determined to be ineffective. 

The Preventive Controls Rules also make changes to current good manufacturing processes (CGMPs). It has been almost 30 years since the CGMPs for human food were last modified, and FDA took the current opportunity to transform previously non-binding provisions, like those related to education, training and employee qualification, into binding obligations. With respect to animal food, the rules create first-time CGMPs.

Implementation dates are staggered based on the size of the company involved. For human food, very small businesses (those averaging less than $1 million in annual sales of human food plus the amount of food held for a fee) will have three years to comply, although they must submit records showing that they qualify as a very small business by Jan. 1, 2016. Small businesses, those with less than 500 full-time employees, will have two years to comply. All other businesses have one year to comply. The timelines for animal food are roughly the same for CGMP compliance, but an additional year is added to each category for preventive control compliance. Note also for animal food that the very small business threshold is $2.5 million, not $1 million.

The overall impact on the rules will in large part depend on how proactive a particular business was prior to the rules being finalized. FDA expects that many large facilities are already doing a vast majority of what is now being required. Those facilities may still need to develop additional documentation or tweak procedures. Medium- to smaller-sized facilities likely have more work to do, but they also have more time to get it done. 

Interesting and complicated issues swirl around companies who are not themselves food facilities, but are technology and equipment providers to such facilities. A thorough hazard analysis will require an analysis of the systems and equipment used in manufacturing, storing and distributing food, and that likely means the quality and reliability of such systems and equipment. In worst-case scenarios, questions are raised surrounding liability in the event of the failure of products provided by third parties, which is a question that existing contracts (to the extent there are any) may not address. It’s certainly not too late for companies on all sides of the table to begin thinking about not only how the Preventive Controls Rules impact their businesses, but also whether the rules impact their approach to allocation of liability in their agreements.