A few weeks ago, TraceGains held its third annual customer conference in beautiful Colorado. We were privileged to hear from so many great presenters, one of which was Nancy Sharlach, Lead Instructor for FSPCA/HACCP and Registered SQF Consultant/President of Soterian Systems, who discussed the importance of a well-designed and well-implemented Food Safety Plan.
One of the main components to the Food Safety Modernization Act’s (FSMA) Preventive Controls rule is the Food Safety Plan(s) required. Nancy emphasized the fact that it’s not just called HARPC as so many people refer to it as, but rather the Food Safety Plan because of the fact that these plans encompass so much more. In essence, the industry is going from HACCP to preventive controls.
During her presentation, Nancy asked the attendees in the room to raise their hands if their company had already developed a food safety plan to meet FSMA requirements. With looming deadlines for a majority of companies approaching in September, it was interesting to see that only about one third of the audience shot their hands in the air.
Implementation Strategy for FSMA’s Preventive Controls Rule for Human Food
What this article aims to do is break down the “how” when it comes to FSMA and the Food Safety Plan(s). One of the problems regarding FSMA today is that it’s a catch-all and a lot of people don’t necessarily understand what is specifically needed, or better yet, they ask themselves, “What do I have to do?”
FSMA isn’t the only risk-based program within the food and beverage industry. We all know about the U.S. space program, the low-acid canned food regulations, HACCP for seafood and juice, USDA HACCP regulations, Codex (which is for GFSI), and NCIMS Dairy HACCP. So FSMA isn’t really something new, it it just repackaging how to approach risk-based programs.
What the image above depicts are the additional elements that come into play with the Food Safety Plan – it’s more than just a HACCP plan. The Food Safety Plan includes all of your Good Manufacturing Practices (GMPs), all of your prerequisites, all of your recall plans, all of your non-compliance corrective action programs, all together in one outline.
With the Food Safety Plan, your process controls (supply chain, allergen, sanitation, etc.) can either be a traditional prerequisite program, or they can now be elevated to a CCP (critical control point) status, which is a big shift for those tasked with monitoring CCPs. This concept is what is meant by preventive controls.
6 Main Points to Get FSMA Implemented
There are the six main steps to keep in mind as you start to make realistic plans towards FSMA compliance, and these are the steps you need to be considering:
1. Senior Management Commitment (Corporate and/or Facility)
If you do not have adequate resources allocated (funding, employees, communication and awareness), your journey to FSMA compliance is not going to be successful. This is something companies have encountered when it comes to the Global Food Safety Initiative (GFSI) as well. Management commitment is required for GFSI. And while larger companies are more prepared for FSMA, there are smaller companies that aren’t even certified to a GFSI scheme, which makes it more difficult to understand what it’s like to have commitment from management and a culture around food safety.
When management is committed, they provide leadership, accountability and awareness to your company’s FSMA initiatives and evolution, while also creating the right culture around food safety from the top down.
Additionally, when companies have allocated resources appropriately, it allows the Preventive Controls Qualified Individual (PCQI) to develop, implement, and train employees for full FSMA Preventive Controls implementation and compliance. If you do not have senior management’s commitment, the chances of money being spent on training and other necessities diminishes.
2. Attend Preventive Controls Qualified Individual (PCQI) Training (or equivalent)
According to the FDA, you must have successfully completed training in the development and application of risk-based preventive controls at least equivalent to what is achieved through the standardized curriculum recognized as adequate by FDA (no other qualified courses other than those provided by the Food Safety Preventive Controls Alliance are offered at this time) (117.180(c)(1)) or is otherwise qualified through job experience to develop and apply a food safety system. Additionally – and an interesting point – companies are allowed to have an external consultant as their PCQI.
The advice TraceGains gives to those who ask is to just go through the PCQI training course to avoid dealing with ensuring your qualifications meet what the FDA expects, especially since the defined equivalency is still up in the air.
And of course, as with everything FSMA related, all of this training (or equivalency materials) must be documented with adequate and up-to-date records to include date, type of training, person(s) trained, etc.
If you’re looking to achieve certification, TraceGains has experience working with food safety subject-matter experts who are conducting PCQI training in the U.S. and Canada. Soterian Systems based in Denver and Food Industry Consulting, Inc. (FIC) based in Toronto are two training providers TraceGains recommends.
3. Do Existing Programs Meet the Preventive Controls Rule? (HACCP and HARPC Gap Analysis)
This is where the gap analysis between your HACCP plan and your HARPC plan comes into play.
Do your existing documents and programs comply? Within the rule (§ 117.330), FDA does allow for the use of existing records when:
- Existing records (e.g., records that are kept to comply with other Federal, State, or local regulations, or for any other reason) do not need to be duplicated if they contain all of the required information and satisfy the requirements of this subpart
- Existing records may be supplemented as necessary to include all of the required information and satisfy the requirements of this subpart
- The information required by this part does not need to be kept in one set of records. If existing records contain some of the required information, any new information required by this part may be kept either separately or combined with the existing records.
Most will apply for GFSI-certified companies with exceptions of the Preventive Controls outline from the Food Safety Plan/HARPC.
4. Create a Food Safety Plan
How are you going to create your Food Safety Plan? Are you going to create an entirely new Food Safety Plan, or are you going to merge it with your existing HACCP plan? Below is a comparison for what is required for an SQF Food Safety Plan versus one required for FSMA.
There are some differences, but not many. In SQF, or HACCP really, your Food Safety Plan can be written or overseen by an SQF practitioner or a HACCP coordinator, which has to be a fulltime employee. With FSMA, your PCQI does not have to be an employee, but rather, the PCQI can be an outside consultant.
Another key difference is the SQF Food Safety Plan identifies process controls in prerequisite programs, but FSMA’s Food Safety Plan identifies preventive controls. So FDA registered food facilities now require preventive controls, which are similar to CCPs, but more robust.
The last major difference comes with revalidation. With SQF (Codex HACCP), you are required to revalidate your critical food safety limits annually, whereas with FSMA, a reanalysis is done on an as needed basis, but must be done at least every three years.
So in essence, you have two options. You can either update your current HACCP plan to include preventive controls or you can create an entirely new food safety plan separate from your current HACCP plan. Both have to be managed by a HACCP coordinator and a PCQI, which can be the same person as long as they go through the appropriate training.
Regardless of whether you start from scratch or merge the two with your current HACCP plan, preventive controls are required. You must have preventive controls outlined and monitored according to the regulations and requirements, and you must identify your PCQI.
We all understand that if you don’t keep adequate records of programs, these required programs don’t “exist.” Records provide the basic tools to ensure implementation of your food safety system. Records can also unveil trends, hold employees accountable, and provide evidence to the FDA auditors that the system is implemented properly.
Recordkeeping is a crucial step to ensuring compliance. Not only is important to document the main portions of your Food Safety Plan, but it’s also just as important to document every non-conformance, no matter how small. Why? Because that’s what auditors will pick up on. It’s not always the big items that escalate into a corrective action, sometimes it’s the small things you can get dinged on.
6. Adopting Procedures for 24x7 Audit Readiness
If you’re certified to a GFSI scheme, you know you can prepare for months for audits, but do you ever stop to think about preparing for an unannounced FDA audit? With FSMA, the industry will be seeing more inspections and will be seeing more enforcement. A few key items to keep in mind regarding these inspections:
- Be organized and ensure complete food safety plans are developed and fully implemented with preventive controls
- Ensure you have a designated PCQI that has proof of qualifications and has developed and is accountable for the FSMA-compliant Food Safety Plan(s)
- Have the appropriate and required records available
- Practice the inspection scenario with your food safety team and PCQI (mock inspections)
- Ensure there is an internal SOP outlining how to handle and manage regulatory inspections
TraceGains customers frequently report that auditors are “delighted” that documents can be retrieved with a few clicks of the mouse. Whether driven by GFSI (BRC, SQF, etc.), regulations such as FSMA, or key customers like Wal-Mart, Kroger, and Yum! Brands, having both source documents and an instantly searchable database available 24x7 reduces the amount of time you need to prepare for an audit, and speeds and simplifies the actual audit event.
Learn more about how TraceGains can effectively help you manage your FSMA compliance requirements.
And always remember, if it’s not documented, it didn’t happen.