Puzzle and maze, two businessmen standing in front of the maze door of the question mark

FSMA: A Few Frequently Asked Questions

Denis Storey
July 25, 2019

On Demand Webinar: Food Regulations 101

Watch the Recording

On Demand Webinar: Food Regulations 101

FDA attorney Marc Sanchez discusses the primary regulatory agencies in the United States, what’s regulated and why, sources of law, and practical suggestions to put that regulatory knowledge into practice.

Watch the Recording

FDA Attorney Marc Sanchez is a frequent national speaker on FDA compliance issues affecting the food, dietary supplement, and medical device industries, and is also widely considered a leading voice in understanding the Food Safety Modernization Act (FSMA).

TraceGains has compiled our community's most urgent questions regarding the extensive FSMA rules and sat down with Marc for a healthy discussion.

Q: If FSMA is not affecting USDA and meat production, is the BRCGS audit process going to skip over the food fraud area in meat processing facilities?

Marc: This is part of the frustration with the way our food system is organized. If you have a facility that is a combination of USDA and FDA, you'll have the periodic inspection of the FDA, and you'll also have the mandatory inspection from the Food Safety and Inspection Service (FSIS). This means you are going to be subject to two standards.

When you do a third-party audit, it's likely to skip over those areas as well, unless the third party is elevating it to a level to accommodate that. FSMA skips meat production, which will need to adhere to the old standard and what we currently have, whereas FSMA will be for everything else.

Q: How will the changes impact outside contract service providers like pest control and contract cleaners?

Marc: We're going to have to reevaluate how we look at these third-party contractors to ensure there is not a risk present there, whether it be physical or chemical. We're not going to bring those third-party vendors into the jurisdiction of the FDA, but we may need to change the way we handle how they come into the facility or change how we monitor what they are using when they are in the facility (chemical or physical).

We also need to make sure these vendors are part of the hazard analysis because the hazard analysis isn't solely focused on microbial contamination, but rather focused on every gamut of contamination. The analysis needs to account for this, even if it's something as simple as different instructions for how they are supposed to be within the facility or different documentation for what they're using. 

Q: Does the FSMA effective date depend on company size? If so, how does it work?

Marc: It does depend on size and the particular rule. It's not a universal answer, but in general, what we see is a two-tiered system used. If you're a small business, you have so much time as compared to a very small business. For example, in the preventive controls rule, a small business is defined as fewer than 500 full-time equivalent employees, and a very small business is defined as averaging less than one million a year adjusted for inflation; and is based on three years' worth of records. Exact [guidelines] can be found here, but the FDA has more detailed explanations on what defines the business size under each published rule.

Q: How does a very small company (maybe three people) meet the very large requirements of FSMA?

Marc: This would probably qualify as a small business or a very small business, depending on sales. What that means is that you'll have more time to determine how the rules apply and more time to evaluate whether there are particular exemptions from one or more of the rules that may apply to your operations.

Additionally, you need to be looking at hazards that are specific to your operation. So, if you're relying on larger suppliers for certain materials that are performing more robust testing and monitoring, then maybe you can do less. But being compliant largely depends on taking the time and utilizing all of the time allotted to ensure you're absolutely ready for it.

Q: How does Hazard Analysis and Risk-based Preventive Controls (HARPC) compare to Threat Assessment and Critical Control Points (TACCP) or Vulnerability Assessment and Critical Control Points (VACCP)?

Marc: What we're looking at with TACCP is food defense in terms of intentional adulteration that's typically behavior based, and with VACCP, we're looking at vulnerabilities of intentional adulteration, which are typically economically motivated. Those are treated separately away from the FSMA Preventive Controls rules.

If we identify a vulnerability or a threat of intentional adulteration, we actually have to look at the intentional adulteration food defense rule, which might be the most complexly written rule that we have just because it's such an odd concept to address. If you do identify a risk within your food safety plan, you would probably want to tie that into your food defense plan under that adulteration rule.

Q: If a facility is USDA and not FDA, but has suppliers that are FDA, does the USDA facility need to follow FSMA?

Marc: The only time you're going to need to follow FSMA is if you are an FDA registered facility. If you're not registered with the FDA, chances are none of this applies to you, even if your suppliers are. 

Q: What would a direct importer of ingredients that receive further processing to manufacture finished products be subject to under foreign vendor certifications?

Marc: This comes down to what's unique under the Foreign Supplier Verification Program (FSVP) rule. One of the main questions we ask when we're doing the food safety plan under the FSVP program is who controls the risk. There are two answers. Either you, the importer, or your customer. If you are importing an ingredient that goes on to a finished product for further processing, typically, the answer is that the consumer controls the risk. Additionally, you're going to still have an obligation under FSVP to make sure that the customer is controlling the risk.

Q: Will you go into more detail as to what constitutes a Qualified Individual (QI)? It's understood that it's by experience and training, but how does one quantify experience as an auditor? 

Marc: We do know that the QI needs to be able to understand the risks that are specific to a particular food. For example, if you've worked your whole career in cheese, you know all the ins and outs of potential risks associated with cheese. If then you decide to work for a dietary supplement company, your qualifications may not be enough to be a QI in this particular instance. So we do know that it's product-specific, and training-specific. 

Q: What if your company receives pre-blended ingredients. How would you assess the risk if it's already pre-blended?

Marc: This is why each facility will have its own food safety plan. Additionally, this means you would have to really qualify the supplier and make sure that the supplier is following their own food safety plan as well and verifying that they have verification processes in place for their suppliers of ingredients.

You need to go down the supply chain and document how each of those suppliers are complying with regulations because ultimately, you're relying on their food safety plan and hazard analysis to ensure that the product you're receiving is as safe as if you had blended it yourself.

Q: Will employees who are already Hazard Analysis Critical Care Point (HACCP) certified also be required to be HARPC certified?

Marc: There's not going to be an equivalent certification system where you are Preventive Controls Certified. You're going to be subject to that QI standard. And that's not necessarily a certification the FDA is going to give; it's more of a requirement that you're going to have to assess and do. This is also where the third-party accreditation rule comes in. Because you may get some accreditation through that third party, you are in some way accredited through the FDA because the FDA has approved that person to accredit you.

Q: Some suppliers have indicated that their preventative maintenance policies, supplier approval programs, and control of non-conformities/procedures are proprietary information. These policies and programs are often covered through audits. If that is the case, is the audit alone sufficient? 

Marc: Part of what we're seeing with FSMA is more and more integration with suppliers. In the past you might have chosen ingredients based on the highest quality or the cheapest price. Now we're seeing that if you really want to be in compliance and control the risk, you're going to need a supplier with more than just a great ingredient or a great price. You're going to need some cooperation as well. This will probably be among some of the growing pains with FSMA - the integration with suppliers.

Q: Does FSMA apply to food contact packaging manufacturers?

Marc: Indirect food additive compliance may have some modified requirements in it, so check to see if there are any modifications. We're not changing the approval process for the indirect food additives, so we still want to make sure we're conducting a hazard analysis to ensure we're identifying risks associated with materials used.

If you're looking to clear up more gray areas, and you'd like to receive additional insight into the basics of FSMA from Marc Sanchez, TraceGains is proud to showcase his expertise in our on demand webinar titled: Food Regulations 101, here .