FSMA

What You Need to Know

About the Food Safety
Modernization Act

July 2016
Time Sensitive Material
 What You Need to Know About FSMA
July 2016 - Time Sensitive Material

1. What is FSMA? • Food Safety Modernization Act

• Biggest change in food regulations since the Food Drug and Cosmetic Act
(FD&C Act) was established in 1938
o FSMA is an amendment to the FD&C Act
• Includes requirements for industry
• Includes requirements for the FDA that do not directly apply to industry
o Work cooperatively with other agencies in the US and in foreign
countries
o Generate progress reports for Congress
• There are four segments to FSMA
o Title I: Preventing Food Safety Problems (Sections 101-116)
o Title II: Detecting and Responding to Food Safety Problems (Sections
201-211)
o Title III: Improving Food Safety in Imported Foods (Sections 301-309)
o Title IV: Miscellaneous Provisions (Sections 401-405)

2. Why is FSMA • Significant failures in food safety in recent years

o Major recalls
needed? o Major outbreaks
• Increased risks
o Increased issues with food allergens
o More resilient and more virulent microorganisms

3. Who does FSMA • FSMA is an amendment to the FD&C Act, therefore it applies to sites that
fall under the FD&C Act.
apply to? • It applies to sites and products that are under FDA jurisdiction, including
foreign facilities that export to the USA.
• It does not apply to USDA-regulated products.
• Within FSMA there are some requirements that are food category specific:
o Part 112, Standards for the Growing, Harvesting, Packing, and
Holding of Produce for Human Consumption
o Section 113, New Dietary Ingredients
o Section 114, Guidance Relating to Post Harvest Processing of Raw
Oysters
o Section 116, Alcohol-Related Facilities
• Specific exemptions are included within the sections
o Examples of food sector categories that are included in some of the
exemptions are packaging manufacturers, manufacturers of
dietary supplements, and manufacturers of low-acid canned foods
1
4. When did FSMA • FSMA was signed into law by President Obama on January 4, 2011
• At that time all sections of the Act became law and were considered
go into effect? enforceable.
o Some sections did not require any further regulation and were readily
understood and enforced.
o Some sections, while currently enforceable as written, are subject to
further rulemaking in which additional, more prescriptive requirements
will be added.
o The rules that are not yet finalized are:
»» Section 302 – Voluntary Qualified Importer Program
»» Section 303 – Authority to Require Import Certifications for Food
»» Section 307 – Accreditation of Third-Party Auditors
• Proposed rule published July 2013
• Proposed and supplemental rules represent FDA’s
current thinking on an issue and are not law nor regulation
until final publication in the Federal Register.

What is the Rulemaking Process?

Bill is passed by the House/Senate

President signs the Act

The Act is ENFORCEABLE Proposed rules are written to

by the FDA further describe requirements

Proposed rules are published

and comment is sought from
the public

Final rules are published,

including compliance
timelines

Final rules are ENFORCED by

the FDA

2
5. What sections Title I – Preventing Food Safety Problems
Section 101 – Inspection of Records
apply directly Section 102 – Registration of Food Facilities
to the food Section 103 – Hazard Analysis and Risk-Based Preventive Controls
Section 105 – Standards for Produce Safety
industry? Section 106 – Mitigation Strategies to Protect Food Against Intentional
Adulteration
Section 107 – Authority to Collect Fees
Section 111 – Sanitary Transportation of Food
Section 112 – Food Allergy and Anaphylaxis Management
Section 113 – New Dietary Ingredients
Section 114 – Requirements for Guidance Relating to Post-Harvest
Processing of Raw Oysters
Section 116 – Alcohol-Related Facilities

Title II – Detecting and Responding to Food Safety Problems

Section 201 – Targeting of Inspection Resources for Domestic Facilities,
Foreign Facilities, and Ports of Entry
Section 202 – Laboratory Accreditation for Analyses of Foods
Section 204 – Enhancing Tracking and Tracing of Food and Recordkeeping
Section 206 – Mandatory Recall Authority
Section 207 – Administrative Detention of Food
Section 211 – Improving the Reportable Food Registry

Title III – Improving the Safety of Imported Foods

Section 301 – Foreign Supplier Verification Program
Section 302 – Voluntary Qualified Importer Program
Section 303 – Authority to Require Import Certifications for Food
Section 304 – Prior Notice of Imported Food Shipments
Section 306 – Inspection of Foreign Food Facilities
Section 307 – Accreditation of Third-Party Auditors

Title IV - Miscellaneous
Section 402 – Employee Protections

6. What does • Records access that was in place prior to FSMA and is still in effect includes:
o The authority to inspect records of interstate shipment, proof of FDA
industry need to registration, and records in plain sight
know about o The authority to inspect HACCP records for seafood and juice
o The authority to inspect thermal processing records for LACF (low-acid
Section 101 – canned foods)
• What has changed?
Inspection of
Records?

3
 o Under the Bioterrorism Act of 2002, the FDA also gained the authority
to inspect records if there is credible evidence that the product will cause
serious adverse health consequences or death to humans or animals
(known as the SAHCODHA threshold). Under FSMA, the threshold has
been lowered. Rather than having to obtain credible evidence, the FDA
simply needs reasonable belief that the product will cause SAHCODHA,
in order to have authority to inspect records.
◊ Reasonable belief is a much lower threshold.
◊ It means that once suspect products are identified, “similar products”
will meet the reasonable belief criteria.
◊ Reasonable belief may come from gaps or errors in documentation.
o Records associated with Foreign Supplier Verification and Preventive
Controls are expected to be part of the readily available records once
those corresponding rules are published and enforced
• The company’s procedures for handling regulatory inspections should be
updated to reflect this new authority and lower threshold. Responsible
personnel should be trained to the new standard.

• As part of the Bioterrorism Act of 2002, food facilities were required to

7. What does register with the FDA and provide updates to the registration when there were
industry need to changes. The purpose of the registration is to provide information to the FDA
to facilitate with inspections and investigations in the event of an outbreak
know about and/or recall.
Section 102 – • The industry often failed to keep site information current with the registry, so
under FSMA, re-registration requirements have been added.
Registration of • Facilities are still required to register any new sites and re-register when there
Food Facilities? are updates.
• In addition, sites are required to re-register every 2 years. The re-registration
period is from October 1 – December 31 in even numbered years.
• Sites that are not registered or re-registered may be required to recall foods
processed and distributed without registration. Unregistered sites are also
subject to fines.
• Food facility registration is no longer referred to as Bioterrorism registration.
• Under FSMA, the FDA has the right to suspend a facility’s registration. This
right was first exercised in November 2012.

4
8. What does • Final rule published September 17, 2015, with most businesses compliant in
one year (September 17, 2016)
industry need to • The rule provides for later compliance dates for small and very small
know about businesses
• The preventive controls and the cGMP revisions have been codified in a new
Section 103 – section of Title 21 of the Code of Federal Regulations, Part 117
o Part 110 will be removed and reserved effective September 17, 2018
Current Good • The rule contains the following sections
Manufacturing o Subpart A - General Provisions
o Subpart B - Current Good Manufacturing Practice
Practices, Hazard o Subpart C - Hazard Analysis and Risk-Based Preventive Controls (HARPC)
Analysis and o Subpart D - Modified Requirements
o Subpart E - Withdrawal of Qualified Facility Exemption
Risk-Based o Subpart F – Requirements Applying to Records That Must Be
Preventive Established and Maintained
o Subpart G – Supply-Chain Program
Controls for • General provisions you must know
Human Food o New definitions and terminology to understand and apply to the rule
o Different levels of qualifications for personnel engaged in manufacturing,
(HARPC)? processing, packing, or holding of food depending on the position
◊ Qualified employees
◊ Supervisors of qualified employees
◊ Preventive Controls Qualified Individual (PCQI) is responsible for:
• Preparing the food safety plan (HARPC plan)
• Validating the preventive controls
• Reviewing records for implementation and effectiveness
• Reviewing corrective actions
• Performing the required reanalysis
◊ How does someone become a PCQI?
• Completes training under a recognized curriculum
• Is otherwise qualified through a combination of education,
training, or experience
◊ Qualified auditor
• Key modifications to current GMPs
o Non-binding provisions contained in Part 110 have been deleted or
made binding in Part 117
o Allergen cross-contact prevention is a requirement for major food
allergens
o All employees involved in manufacturing, processing, packing, or holding
of food will have to be trained to be Qualified Individuals for their
respective positions

5
 • What is HARPC?
o Is it HACCP?
◊ No. It is very similar to HACCP, but it includes additional elements.
o Do I need to modify my HACCP plan to comply with HARPC or do I
need both HACCP and HARPC?
◊ The FDA requires either HACCP (juice and seafood) or HARPC
depending on product type. They do not require both.
◊ Customers and foreign governments may require a HACCP
program and may not accept a HARPC program. In these cases, it
may be in a company’s best interest to maintain both.
o What are the additional elements in a HARPC program that are not in
HACCP?
◊ Hazards
»» The Act has outlined 12 hazard categories. HACCP has
identified three hazard categories. Upon closer look, most of the
12 hazard categories fall into the HACCP three category approach:

HARPC HACCP
Biological Biological
* The examples of sources
of radiological hazards that
Chemical Chemical
are listed in the proposed Physical Physical
rule are water and nuclear Radiological* No equivalent category
accident.
**Economically motivated
Natural toxins Chemical
adulteration (EMA), only Pesticides Chemical
concerned with food safety Drug residues Chemical
hazards, not those that affect
value or quality. Should focus
Decomposition Chemical
on situations where there has Parasites Biological
been a pattern of EMA in the Allergens Chemical
past. (Example: melamine)
Unapproved food and color additives Chemical
Economically motivated adulteration ** No equivalent category
• Hazard Evaluation and Risk-Based Preventive Controls
o “Known or reasonably foreseeable hazards” are evaluated (risk analysis)
to identify hazards requiring preventive controls associated with raw
materials, ingredients, process, and environment.
o The risk analysis is an assessment of severity of the illness or injury if the
hazard was to occur and the likelihood that the hazard will occur in the
absence of preventive controls
o The hazard evaluation must consider the effect of the following on the
safety of the finished food for the intended consumer:
◊ The formulation of the food
◊ The condition, function, and design of the facility and equipment
◊ Raw materials and other ingredients
◊ Transportation practices

6
 ◊ Manufacturing/processing procedures
◊ Packaging activities and labeling activities
◊ Storage and distribution
◊ Intended or reasonably foreseeable use
◊ Sanitation, including employee hygiene
◊ Any other relevant factors, such as the temporal (e.g., weather-
related) nature of some hazards (e.g., levels of some natural toxins)
o Decide what entity or entities in the food supply chain will control
hazards needing preventive controls (i.e., direct supplier, supplier to the
direct supplier, receiving facility, customer, or customer to the customer)
◊ Hazards controlled prior to the receiving facility must have a supply
chain program, including supplier verification activities, such as
audits, sampling/testing, review of supplier’s food safety records, and
supplier’s compliance history
◊ Suppliers not controlling hazards must provide written notification
to customers that the “product is not controlled for the [name of the
hazard]”
• Preventive controls
o A PC is an appropriate procedure, practice, and process that
“significantly minimizes or prevents” an identified hazard.
o Examples of preventive controls listed in the Act are:
◊ Process controls
◊ Sanitation of food-contact surfaces
◊ Environmental monitoring for ready-to-eat (RTE) products
◊ Food allergen controls, including labeling
◊ cGMPs to prevent unsanitary conditions
◊ Supply chain controls
◊ Recall plan
o In addition, any other control that significantly minimizes or prevents a
specific hazard would be considered a preventive control
o Identified PCs must be validated as effective with four exceptions
o All preventive controls must have monitoring, corrective action,
verification, and recordkeeping.
• Reanalysis
o The rule requires a reanalysis of the food safety plan or parts of it under
the following conditions.
◊ Food Safety Plan every three years
◊ Whenever significant change occurs at your facility
◊ Whenever you become aware of new information about potential
hazards associated with the food
◊ Whenever an unanticipated food safety problem
◊ Whenever you find a preventive control or combination of controls is
ineffective
◊ Whenever changes are made they must be validated as effective
• Food safety plan
o The results of the HARPC evaluation must be documented in a written
food safety plan regardless of the results
7
 ◊ Hazard analysis
◊ Preventive controls
◊ Supply chain program
◊ Recall plan
◊ Procedures for monitoring the implementation of preventive controls
◊ Corrective action procedures
◊ Verification procedures including validation as appropriate
• Records (evidence of effective food safety plan)
o The Rule requires a facility to establish and maintain the following
records:
◊ Written food safety plan
◊ Documentation for not establishing a preventive control for an
identified hazard
◊ Monitoring, corrective action, verification, supply chain program, and
training records
◊ Verification records include: validation, verification of monitoring,
verification of corrective actions, calibration of process monitoring
and verification instruments, product testing, environmental
monitoring, records review, reanalysis of the food safety plan
◊ Supply chain program records applicable to a plant’s food safety plan
when the hazard is controlled prior to receipt, i.e. the supplier
• Exemptions and Modifications
o Products excluded from HARPC and supply chain program in the Act:
◊ Seafood (already falls under regulated HACCP)
◊ Juice (already falls under regulated HACCP)
◊ There is a partial exclusion in the Act for thermally processed low-
acid foods packaged in hermetically sealed containers
• Microbiological hazards do not need to be assessed with these
products as requirements for microbial control are covered
under existing legislation.
◊ Dietary supplements
◊ Activities subject to the produce rule
◊ Alcoholic beverages
◊ Facilities solely engaged in the storage of packaged food not
exposed to the environment
»» The rule excludes warehouses in which the product is fully
enclosed in packaging and does not require temperature
controls.
»» The proposed rule has modified requirements for warehouses
that have product that is fully enclosed, but requires refrigeration
for food safety.
»» Hazard analysis would not be required, but temperature
monitoring would be.
◊ Qualified facility
◊ Farms, and activities within the “farm” definition conducted on “farm
mixed-type facilities”
◊ Specific low risk, on farm activities performed by a small/very small
business
8
 o “Includes, but is not limited to” is replaced with “includes”
◊ “Adulteration within the meaning of the Act” is replaced with
“adulteration”
• Packaging Material Considerations
o Domestic packaging material plants are exempt from registering with
the FDA and are exempt from complying with subpart C, Hazard
Analysis and Risk-Based Preventive Controls
o However, in subpart B, Current Good Manufacturing Practices,
registered plants must comply with 117.180 Processes and controls,
a)(2) “Appropriate quality control operations must be employed to
ensure that food is suitable for human consumption and that food
packaging materials are safe and suitable.”

9. What does • Final rule published on September 17, 2015

• Companies generally must comply with the Current Good Manufacturing
industry need to Practice (cGMP) requirements by September 19, 2016, and with the
know about HARPC requirements by September 18, 2017.
• The rule provides later compliance dates for small and very small
Part 507 –Current businesses for certain types of facilities (e.g., qualified facilities, facilities
Good Manufac- subject to the Pasteurized Milk Ordinance [for human HARPC rule], and for
certain provisions [e.g., the supply-chain program]).
turing Practice, • The rule contains the following sections
o Subpart A - General Provisions
Hazard Analysis, o Subpart B - Current Good Manufacturing Practice
and Risk-Based o Subpart C - Hazard Analysis and Risk-Based Preventive Controls
(HARPC)
Preventive Controls o Subpart D - Withdrawal of a Qualified Facility Exemption
for Animal Food o Subpart E - Supply Chain Program
o Subpart F - Requirements Applying to Records That Must Be Established
(HARPC)? and Maintained
• General provisions you must know
o New definitions and terminology to understand and apply the rule
o Different levels of qualifications for personnel engaged in
manufacturing, processing, packing, or holding of food depending on
their position
◊ Qualified employees
◊ Supervisors of qualified employees
◊ Preventive Controls Qualified Individual
»» Responsible for developing, implementing, managing, and
updating food safety plan(s)
◊ Qualified auditor
• Key modifications to current GMPs
o Human food by-products destined for animal food must
◊ Be held and shipped under sanitary conditions to prevent
contamination
9
 ◊ Be labeled with common name
◊ Have containers and bulk vehicle inspections prior to use
o FDA has finalized baseline cGMP standards for producing safe animal
food that takes into consideration the unique aspect for the animal food
industry and provides flexibility for the diverse types of processors
o Further process of a by-product (e.g. drying, pelletizing, heat treatment,
etc.) will require compliance with human or animal food cGMP
◊ Unless the process is a qualified facility a hazard analysis and
preventive control evaluation will be required even if preventive
controls would not need to be established
o All employees involved in manufacturing, processing, packing, or
holding of food will have to be trained to be qualified Individuals for their
respective positions
• HARPC
o Covered facilities must establish a food safety system that includes
analysis of hazards and risk-based preventive controls. A food safety
plan includes:
o Hazard analysis considering
◊ Naturally and unintentional known or reasonably foreseeable
hazards
◊ Intentionally introduced for economic gain if applicable to food
safety
o Preventive control measures established to ensure hazards are minimized
or prevented
o Management elements to provide flexibility and assurance that controls
are effective, include:
◊ Monitoring procedures (e.g. temperature control) to prevent
harmful bacteria growth
◊ Corrective actions are documented to prevent reoccurrence and
product is evaluated to prevent adulterated food from entering
commerce
◊ Corrections for minor issues occurring during animal food
production
◊ Verification activities include:
• Scientific validation that preventive controls are effective
• Assessing monitoring and corrective action for consistency and
effectiveness
• Product testing and environmental monitoring as appropriate
for the product, facility and the nature of the preventive control
o Recall plan
o Supply chain program
◊ Must have risk-based supply chain program for hazards controlled
by the supplier
◊ A supplier chain program is not required if the hazard is controlled
by the animal food facility, another entity in the food chain, or its
customer

10
 ◊ Raw materials and ingredients requiring a preventive control prior
to the receiving facility must come from an approved supplier
o Exemptions from animal food preventive controls
◊ Operations meeting the “farm” definitions as clarified in the
Preventive Controls for Human Food Final Rule

10. What does industry • The final rule for produce safety was published November 27, 2015
• The rule applies to domestic and imported produce
need to know • It does not apply to:
o Produce that is seldom eaten raw
about o Produce for on-farm or personal use
Section 105 (Part o FDA-exempt produce that will receive commercial processing that
adequately reduces pathogens of public health concern
112) - Standards • The rule provides a qualified exemption and modified requirements for
for the Growing, eligible farms
• FDA focuses on six routes of contamination:
Harvesting, Packing,
and Holding of 1. Agricultural water
• Two sets of criteria for microbial water quality based on the presence of
Produce for Human generic E. coli, which can indicate the presence of fecal contamination
Consumption o Applies to:
◊ Water used for handwashing and water directly touching product
during or after harvest
◊ Water used on food contact surfaces
◊ Water used for ice in contact with produce
o Must discontinue use and complete corrective action before reuse if
generic E. coli is detected
o Prohibits use of untreated surface water for any of above uses
o Establish a second numerical criteria for agricultural water used for
growing produce other than spouts
o Establishes generic E. coli water testing protocol for surface and ground
water sources
2. Biological soil amendments
• FDA risk assessment will establish minimum number of days raw manure as
a soil amendment that can be applied prior to harvesting to minimize the risk
of contamination
o Current practices under the US Department of Agriculture’s (USDA)
National Organic Program Standards are acceptable pending FDA risk
assessment
◊ USDA requires 120 days if crops contact the soil and 90 days if crops
do not contact the soil
o Requires that untreated biological soil amendments of animal origin be
applied in a manner that does not contaminate covered or uncovered
produce

11
 3. Domesticated and wild animals
• Raw manure:
o Requires covered farms to visually examine the growing area and all
covered produce to be harvested, regardless of the harvest method
o Requires farms to perform additional assessments during the growing
season to identify significant areas of potential contamination and
voluntarily apply a waiting period between grazing and harvest depending
on type of produce/commodity being produced
• Stabilized compost:
o Microbial standards that set limits on detectable amounts of bacteria
(including Listeria monocytogenes, Salmonella spp., fecal coliforms, and E.
coli 0157:H7) have been established for processes used to treat biological
soil amendments, including manure
o Two examples of scientifically valid composting methods that meet those
standards are included in the rule
o Stabilized compost prepared using one of these methods must be applied
in a manner that minimizes the potential for contact with produce during
and after application
4. Sprouts
• Prevent the introduction of dangerous microbes into or onto seeds or beans
used for sprouting
• Testing irrigation water from each batch of in-process sprouts for certain
pathogens which cannot enter commerce until these required tests are
completed with negative results
• Testing the growing, harvesting, packing, and holding environment for the
presence of Listeria species or Listeria monocytogenes
• Taking corrective actions if spent sprout irrigation water, sprouts, and/or an
environmental sample tests positive
• Sprout operations will have less time to come into compliance with the rule than
farms growing other produce (one to three years to comply based on the size of
the operation with no additional time to meet the water requirements)
5. Worker training, health, and hygiene
• Prevent ill or infected persons from contaminating produce and food contact
surfaces
• Use hygienic practices (hand washing) when touching covered produce and
food contact surfaces
• Farm workers and supervisors must be trained on the importance of health
and hygiene
• Farm workers who handle covered produce and food contact surfaces and
their supervisors, must have the required combination of training, education
and experience necessary to perform their assigned responsibilities
6. Equipment, tools, and buildings
• Establish standards and sanitation requirements for equipment, tools, and
buildings to prevent produce contamination
• Adequate toilet and handwashing facilities
• Required measures to prevent contamination of covered product and food contact
surfaces including storage, maintenance, and cleaning of equipment and tools
12
11. What does industry • Final rule published on May 27, 2016
o Effective for very small businesses on July 26, 2021
need to know about o Effective for small businesses on July 26, 2020
Section 106 - o Effective for all other businesses on July 26, 2019
• The Mitigation Strategies to Protect Food Against Intentional Adulteration is
Mitigation codified in Code of Federal Regulations, section 21, parts 11 and 121
• The rule contains the following sections:
Strategies to o Subpart A General Provisions
Protect Food o Subpart B Reserved
o Subpart C Food Defense Measures
Against Intentional o Subpart D Requirements Applying to Records That Must Be Established &
Adulteration Maintained
o Subpart E Compliance
General Provisions You Must Know
• New definitions and terminology to understand and apply to the rule
• Different levels of qualifications for personnel engaged in Food Defense
Measures
1. Individuals assigned to an actionable process steps-Be a qualified
individual as that term is defined in 121.3--i.e., have the appropriate
education, training, or experience (or a combination thereof) necessary to
properly implement the mitigation strategy or combination of mitigation
strategies at the actionable process step; and receive training in food
defense awareness.
2. (Similar to PCQI) Qualifications of individuals for certain activities
described in paragraph (c)(3) of this section. Have successfully completed
training for the specific function at least equivalent to that received
under a standardized curriculum recognized as adequate by FDA or be
otherwise qualified through job experience to conduct the activities. Job
experience may qualify an individual to perform these functions if such
experience has provided an individual with knowledge at least equivalent
to that provided through the standardized curriculum. This individual may
be, but is not required to be, an employee of the facility. One or more
qualified individuals must do or oversee:
o The preparation of the food defense plan
o The conduct of a vulnerability assessment
o The identification and explanation of the mitigation strategies
o Reanalysis
3. Additional qualifications of supervisory personnel. Responsibility for
ensuring compliance by individuals with the requirements of this part
must be clearly assigned to supervisory personnel with a combination of
education, training, and experience necessary to supervise the activities.

13
 What must be done?
• Develop a written food defense plan
o The plan must include written:
◊ Vulnerability assessment
◊ Mitigation strategies
◊ Procedures for food defense monitoring
◊ Procedures for food defense corrective actions
◊ Procedures for food defense verification
◊ Records - all implementation documents for the food defense plan
Vulnerability Assessment Requirements
• Conduct a vulnerability assessment for each type of food that is
manufactured, processed, packed, or held in your facility (similar to the
preventive controls assessment, but focusing on food defense). Consider
including biological, chemical, radiological, and physical contaminants.
• The assessment must consider three factors
1. The potential public health impact (if a contaminant is introduced)
2. The degree of physical access to the product
3. The ability of an attacker to successfully contaminate the product
• The assessment must consider an inside attacker
• Must be written regardless of outcome
Mitigation Strategy Requirements
• Identify and implement mitigation strategies for each actionable process step
for vulnerabilities identified during the assessment
• The mitigation strategy must be written and provide assurance that that
the identified vulnerability will be significantly minimized or prevented from
occurring
• Mitigation strategies (known as mitigation management components) must
include food defense:
o Monitoring procedure and documentation
o Corrective actions procedures and documentation
o Verification procedures and documentation
Food Defense Monitoring Requirements
• Food defense monitoring procedures must be written
• Food defense monitoring must include the frequency required to ensure the
mitigation strategy is performed consistently
• Food defense monitoring must be documented
Food Defense Corrective Action Requirements
• Food defense corrective action procedures must:
o be written and describe the steps to take when a mitigation strategy fails
o identify and correct the problem
o reduce the likelihood of the problem from reoccurring when necessary
• Food defense corrective actions must be documented

14
Food Defense Verification Requirements
• Food defense verification must show that the food defense monitoring
procedures are being conducted
• Food defense verification must show that food defense corrective actions were
appropriate and followed
• Food defense verification must be demonstrated for the reanalysis of the food
defense plan
• Food defense verification procedures must be written and documented
Reanalysis Requirements
• The food defense plan must be reanalyzed at a minimum of every three years or
o When significant changes are made that can create new vulnerabilities or
increase in a current vulnerability
o When new information becomes available about potential vulnerabilities
o Whenever mitigation strategies or the food defense plan as a whole are
not implemented appropriately
o Whenever FDA requires a reanalysis
Records Requirements
• All records must be:
o kept as true original copies
o created at the time of the activity
o maintained for two years
o presented to the FDA within 24 hours upon written or oral request
o Records required by this part will be protected from public disclosure to the
extent allowable under part 20 of this chapter
Exemptions
• Very small business
o Except that a very small business must, upon request, provide for official
review documentation sufficient to show that the facility meets this
exemption. Documentation must be retained for 2 years.
• The holding of food, except the holding of food in liquid storage tanks
• Packing, re-packing, labeling, or re-labeling of food where the container that
directly contacts the food remains intact
• Activities of a farm that are subject to the Produce Safety Rule
• Alcoholic beverages
• The manufacturing, processing, packing, or holding of food for animals
• On-farm manufacturing, processing, packing, or holding of the following
foods on a farm mixed-type facility, when conducted by a small or very small
business if such activities are the only activities conducted by the business
• Eggs (in-shell, other than raw agricultural commodities, e.g., pasteurized)
• Game meats (whole or cut, not ground or shredded, without secondary
ingredients)

15
12. What does industry • Although the Act allows the FDA to collect fees for inspection, the approach
has been to focus on collecting fees only for re-inspection
need to know about • 2016 re-inspection fees
Section 107 – o Domestic sites: $221/hour/inspector
o Foreign sites: $315/hour/inspector
Authority to • These fees can apply to multiple inspectors at a single site.
• These fees also apply to travel time to the facility.
Collect Fees? • So far, the FDA has not acted on their ability to collect fees.

13. What does industry Section 416 of FD&C Act requires sanitary transportation practices. Under FSMA,
the FDA is tasked with writing regulations that define these sanitary practices.
need to know about • The final rule was published April 2016 with compliance date 12 months later.
Section 111 – • Key elements of the proposed rule are:
o Entities and their corresponding responsibilities to ensure “sanitary
Sanitary transportation practices” (STP) have been defined as shippers, loaders,
Transportation of carriers and receivers.
o Vehicles and transportation equipment: Requires design and sanitary
Human and Animal maintenance of vehicles and transportation equipment to prevent food
from becoming unsafe during transportation operations.
Food? o Transportation operations: Must be conducted under such conditions
and controls necessary to prevent the food from becoming unsafe, such
as temperature control, segregation of food from non-food, cross-contact
prevention, or other protective measures.
o Information exchange: Written procedures and agreements between
shipper, loader, carrier, and receiver to assure food safety during
transportation operations. Procedures cover sanitary design and
maintenance of transportation vehicles, specifications for cleaning/
sanitizing of vehicles, prior cargos, cleaning of equipment, inspection of
vehicles and temperature control.
o Training: Documented training of carrier personnel in sanitary
transportation practices is maintained.
o Records: Procedures and records related to vehicles and transportation
equipment, transportation operations, information exchange and training
must be maintained for a period of 12 months.
• Shelf-stable foods in completely sealed packaging are exempt, as well as
non-covered businesses, certain foods which will not be transported for
consumption in the U.S., and food located in facilities that are regulated by
the USDA (meat, poultry eggs).

16
14. What does • This section applies to schools and educational institutions
• FDA is to provide food allergy management guidelines
industry need • Note: Allergen control measures for manufacturers and distribution centers
to know about are considered under Section 103.

Section 112 –
Food Allergy and
Anaphylaxis
Management?

15. What does • Within FSMA, the FDA was tasked with publishing a guidance document to
clarify when a manufacturer or distributor of a dietary ingredient or a dietary
industry need to supplement should provide evidence to the FDA that the supplement is safe
know about • Draft guidance was published July 2011

Section 113 –
New Dietary
Ingredients?

16. What does • The FDA is to conduct a study and publish a report on post-harvest
processing of raw oysters.
industry need to • The report is expected to influence changes in the Seafood HACCP
know about Requirements outlined in 21 CFR Part 123.
Section 114 –
Requirements
for Guidance
Relating to Post
Harvest
Processing
of Raw Oysters?

17
17. What does • The section outlines which parts of FSMA are applicable to alcohol-related
facilities.
industry need to • An alcohol-related facility is defined by the Federal Alcohol Administration Act
know about and includes distilled spirits, wine, and malt beverages.
• The sections of FSMA applicable to alcohol-related facilities are:
Section 116 – o Section 102 – Food Facility Registration
o Section 206 – Mandatory Recall Authority
Alcohol-related o Section 207 – Administrative Detention
Facilities? o Section 302 – Voluntary Qualified Importer
o Section 304 – Prior Notice of Imported Food Shipments
o Section 402 – Employee Protections
o Section 403 – Jurisdiction/Authorities
◊ Nothing in FSMA alters the jurisdiction and authorities of the
Alcohol and Tobacco Tax and Trade Bureau
o Section 404 – Compliance with International Agreements
◊ Nothing in FSMA will be inconsistent with the World Trade
Organization

18. What does • FDA is to identify high-risk and non high-risk facilities in order to prioritize
facilities for inspection.
industry need to • High-risk facilities are targeted for inspection at least every three years.
know about • Non high-risk facilities are targeted for inspection at least every seven years.
• Risk factors are:
Section 201 – o The type of food has been associated with a Class I recall
o The type of food has been associated with outbreaks
Targeting o The facility has a history of OAI violations
of Inspection o The facility has a history of VAI non-compliance
o The rigor and effectiveness of the facility’s HARPC program
Resources for o Years since last inspection at the facility
Domestic • The most frequent type of Class I recall is undeclared allergen. Types of foods
associated with allergen recalls include: bakery, chocolate/candy/confections,
Facilities, ice cream, and snack foods. These foods have not been previously viewed as
Foreign high-risk using traditional criteria, such as water activity and pH. However,
with these new criteria, additional foods will fall under the high-risk category.
Facilities, and • Section 201 also requires doubling the number of foreign facility inspections
Ports of Entry? each year with a minimum of 600 inspections in the year 2011.

18
19. What does • The FDA is tasked with identifying a list of accredited labs
• The list was to be published no later than January 4, 2013, but this date has
industry need passed.
to know about • These labs are the ones approved to do testing on behalf of the FDA.
• Manufacturers are not required to use these labs for routine testing. However,
Section 202 – these labs are to be used when dealing with a suspected food safety problem
that involves the FDA.
Laboratory
Accreditation
for Analyses of
Foods?

20. What does • The IFT (Institute of Food Technology) was appointed to conduct pilot trace
programs
industry need to • Three traces were done:
know about o Tomatoes
o Frozen Kung-Pao Style Dish
Section 204 – o Jarred peanut butter and dry, packaged peanuts
Enhancing • Based on the study, IFT has made recommendations to improve traceability.
• The FDA is expected to make rules for high-risk facilities regarding
Tracking and traceability. If product tracing plans are a requirement of the rule, facilities
Tracing of will be required to share their plans during a routine FDA inspection.

Food and
Recordkeeping?

21. What does • Prior to FSMA recalls were voluntary.

• Under FSMA, if a facility refuses to voluntarily recall suspect product, the FDA
industry need can mandate the recall.
to know about o The facility will be subject to civil penalties.
o If the recall involves alcohol, the FDA must first give the Alcohol and
Section 206 – Tobacco Tax Trade Bureau the opportunity to cease distribution first.
Mandatory • New authority was used for the first time in February 2013.

Recall
Authority?

19
22. What does • The FDA has maintained the authority to detain (hold) food since the
implementation of the Bioterrorism Act of 2002.
industry need to • What has changed under FSMA?
know about o The threshold required to hold the food has been lowered. Previously, the
FDA had the authority to detain food if there was credible evidence that
Section 207 – the food would cause SAHCODHA. The new threshold is that there is
reasonable belief that the food will cause SAHCODHA.
Administrative • The FDA has the right to detain product for 30 days.
Detention of
Food?

23. What does • The Reportable Food Registry (RFR) was established in September 2009.
• Additional requirements were added to the RFR under FSMA.
industry need to • When reporting a reportable food, additional information must be provided:
o Description of the food
know about o Affected product identification codes
Section 211 – o Contact information for the responsible party
• Grocery stores are required to post consumer notifications for reportable
Improving foods that they sold.
the Reportable
Food Registry?

24. What does • The final rule for foreign supplier verification was published on November 27, 2015
• Generally, importers will have to come into compliance 18 months after the
industry need to publication date.
know about • The rule entails a fundamental shift in oversight of imported foods from one
relying on inspection/examination of imported foods at the port of entry,
Section 301 – and reaction to market failures to a system that places the responsibility of
preventing food safety failures on the importers and their foreign suppliers.
Foreign • Importer means the US owner or consignee of an article of food that is being
Supplier offered for import into the United States. If there is no US owner or consignee
of an article of food at the time of US entry, the importer is the US agent
Verification or representative of the foreign owner or consignee at the time of entry, as
Program? confirmed in a signed statement of consent to serve as the importer under this
subpart.
o For each line entry of food product offered for importation into the United
States, the importer’s name, email address, and unique facility identifier
recognized as acceptable by FDA and identifying the importer of the food
must be provided electronically when filing entry with US Customs and
Border Protection.

20
• Foreign supplier means, for an article of food, the establishment that
manufactures/processes the food, raises the animal, or grows the food that
is exported to the United States without further manufacturing/processing
by another establishment, except for further manufacturing/processing that
consists solely of the addition of labeling or any similar activity of a de
minimis nature.
• A qualified individual must develop the FSVP and perform the activities
required by the program. A qualified individual must have the education,
training, or experience (or a combination thereof) necessary to perform their
assigned activities and must be able to read and understand the language of
any records that must be reviewed in performing an activity.
• All importers of food for human and animals, unless specifically exempt or
subject to modified requirements, will be required to develop, maintain,
and follow a standard risk-based FSVP to ensure that the food they import
is produced in a manner that “provides the same level of public health
protection as the preventive controls or produce regulations, and to ensure
that the supplier’s food is not adulterated and is not misbranded with respect
to allergen labeling”. These requirements are:
o For each food imported and supplier of such food, undertake a risk
evaluation to approve/disapprove the supplier, including:
◊ Determining known or reasonably foreseeable hazard for each food.
◊ Evaluating the risk posed by a food, based on the hazard analysis
of the food (probability x severity) and the foreign supplier’s
compliance performance history. The risk evaluation can be done
by another entity, as long as the importer reviews and assesses the
relevant documentation.
◊ For approved suppliers, determining appropriate verification activities
and frequencies based on the specific results of the product risk
analysis and the supplier’s performance review. These include onsite
audits, sampling and testing, effectiveness of corrective actions, and
review of supplier’s relevant food safety records and compliance history.
o Conducting supplier verification activities.
◊ Verification activities can be carried out by another entity than the
importer (but not the foreign supplier, except sampling and testing), as
long as the importer reviews and assesses the relevant documentation.
o An initial and future annual audits to the supplier’s facility is required if
“there is a reasonable probability that exposure to the hazard controlled
by the foreign supplier will result in serious adverse health consequences
or death to humans and animals (SAHCODHA).”
◊ Such audit must be carried out by a qualified auditor.
◊ The audit can be carried out by another entity than the importer (but
not the foreign supplier), as long as the importer reviews and assesses
the relevant documentation.
◊ The importer can choose not to carry out an annual onsite audit, as
long as the importer documents how such alternative choice is
appropriate and provides the adequate assurances that the foreign
supplier is producing the food in accordance with applicable US
standards.
21
 o Conducting corrective actions. Reviews of complaints, instances of
adulteration, or misbranding and carrying out appropriate corrective
actions, which could include discontinuing the use of a foreign supplier.
o Establishing and following written procedures to ensure that the importer is
importing foods from approved foreign suppliers, or when necessary on a
temporary basis, from an unapproved supplier whose food is subjected to
adequate verification activities prior to being imported.
• The rule contains certain modified requirements for the following situations:
o Dietary supplements and dietary supplement components subject to
existing dietary supplement cGMP regulations.
o Very small importers and importers of food from certain small foreign
suppliers.
o A foreign supplier in a country whose food safety system has been
recognized as comparable or determined to be equivalent of the US
system.
• The rule contains exemptions for the following situations:
o If it is determined and documented that the type of food (e.g., raw
agricultural commodities such as cocoa beans and coffee beans) could
not be consumed without application of an appropriate control.
o If the importer relies on its customer to ensure that the identified hazard
will be significantly minimized or prevented and the importer and complies
with certain documentation requirements.
• Food categories not covered by the FSVP, include:
o Juice and fishery products, subject to and in compliance with their
respective HACCP rules
o Food for research and evaluation
o Food for personal consumption
o Alcoholic beverages
o Food imported for further processing and subsequent export
o LACF, with respect to microbiological hazards, covered under different
regulation
o Meat, poultry and egg products regulated by the USDA
• The FSVP or a specific component must be promptly reevaluated and such
activity documented when the importer becomes aware of compliance
problems with his foreign suppliers. The complete FSVP must be reevaluated
no less than every 3 years. Periodic or complete reevaluations of the FSVP
and its components can be carried out by an entity (other than the foreign
supplier), as long as the importer reviews and assesses the results, including
that the activity was carried out by a qualified individual.
• The FSVP records must be retained for at least two years; these records must
be made available to the FDA upon request.

22
25. What does • FDA must establish a voluntary program for importers that provides for
expedited review and entry of foods from participating importers. Eligibility is
industry need to limited to, among other things, importers offering food from certified facilities.
know about • As the name suggests, this is a voluntary, not a mandatory program.
• It is available to US importers of foreign foods.
Section 302 – • It provides for expedited review and importation.
• Both the importer and the foreign supplier must qualify.
Voluntary Qualified o Importer must submit an application to FDA
Importer Program? o There will be fees associated with this use of this program
o The foreign facility must have certification
• The FDA will consider:
o Risk of the food
o Compliance history of the foreign supplier
o Compliance history of the importer
o Regulatory system at country of export
o Importer practices: recordkeeping, testing, inspections and audits,
traceability, temperature control
• Rulemaking is pending.

• FDA has the authority to require that imported foods with a known food safety
26. What does risk be accompanied by a certification or other assurance of compliance as a
industry need to condition of entry into the United States.
• The intent of the certificate is to assure that the food complies with FDA
know about regulations.
Section 303 – • The certificate will be provided by the exporting countries government or an
approved/accredited representative.
Authority to • The requirement may be risk-based.
Require Import o Certificates may only be required from certain regions
o Certificates may only be required for certain types of foods
Certifications for • There will be penalties for falsified certificates.
Food? • Rulemaking is required for this section.

23
27. What does • The requirement to provide advance notice to the FDA before importing a
food went into effect under the Bioterrorism Act of 2002.
industry need to • The new addition under FSMA is the requirement to list any country to which
know about the food has been refused entry before being shipped to the US.

Section 304 –
Prior Notice of
Imported Food
Shipments?

28. What does • The FDA has the authority to inspect foreign establishments, including
factories and warehouses.
industry need to • If a foreign facility refuses an FDA inspection, its product will be refused entry
into the US.
know about
Section 306 –
Inspection
of Foreign Food
Facilities?

29. What does • The proposed rule for accreditation of third-party auditors was published in
July 2013.
industry need to • The proposed rule establishes a program for accreditation of third-party
auditors (certification bodies), to conduct food safety audits and issue
know about certifications of foreign facilities and the foods for humans and animals they
Section 307 – produce.
• The Rule does not provide specific accreditation standards to be imposed on
Accreditation auditors/certification bodies. These standards are expected in a seperate rule
of Third-Party or guidance document.
• The Rule distinguishes between regulatory audits and consultative audits.
Auditors? o Regulatory audit
◊ Determine whether eligible entity complies with FDA regulations;
◊ Used to determine whether food can be certified for import to the US.
◊ Unannounced audit
◊ May include sampling (product and environmental)

24
 ◊ Report would have to be made available in English to FDA within 45
days with immediate reporting of issues that could result in serious
health risk
o Consultative audit
◊ Evaluate compliance to FDA and industry standards
◊ Internal purposes only
◊ Not available to FDA except under “special records access” or if the
audit is used as part of foreign supplier verification
• A third-party auditor/certification body would be prohibited from using an
audit agent to conduct a regulatory audit if the agent has been in the
facility within the past 13 months for either a consultative or regulatory audit.
The requirement could be waived under certain conditions.

30. What does • This is whistleblower protection.

• An employee cannot be discriminated against for reporting FSMA violations.
industry need to
know about
Section 402 –
Employee
Protection?

25
Contact AIB International
World Headquarters

Information US/Canada Office

1213 Bakers Way
Manhattan, Kansas 66502
Call us to speak with Phone: +1-785-537-4750
one of our service or 1-800-633-5137
representatives or Fax: +1-785-537-1493
technical experts or visit www.aibonline.org
us at
www.aibonline.org Latin America Office
info@aibonline.org AIB International
México S de RL de CV
Phone: +1-52-442-135-0912
+1-785-537-4750
Email: aiblatinamerica@aibonline.org
americalatina.aibonline.org

Asia-Pacific Office
Email: info@aibonline.org

Europe, Middle East, Africa Office

AIB International, Inc.
PO Box 11, Randalls Road
Leatherhead, Surrey
KT22 7YZ, UK
Phone: +44-1372-360553
Fax: +44-1372-361869
www.aibonline.org

China Office
AIB Food Technical Consulting (Shanghai) Co. Ltd
AIB Shanghai Office, Room 813
West Zone of Modern
Traffic Business Building
No. 218 Hengfeng Road
Shanghai, China
Postal Code: 200070
Phone: 86-21-60959606
Fax: 86-21-60959605
www.aibchina.org