FDA Attorney Marc Sanchez is a frequent national speaker on FDA compliance issues affecting the food, dietary supplements, and medical devices industries, and is also widely considered a leading voice in understanding the Food Safety Modernization Act (FSMA).
TraceGains recently spoke with Marc on the topic of the Foreign Supplier Verification Program (FSVP).
TG: Would a broker be considered an owner when referring to defining the importer?
Sanchez: The FDA has attempted to the best of its ability to define who the "owner," the "consignee," and the "U.S. agent" would be. In a situation where it's unclear whether the broker fits into any of these categories, one would then need to determine whether the broker has a financial interest in the shipment and/or control over the supply chain. If the broker has neither of those, then they are not going to be an importer for purposes of this rule. This is the standard to use when in doubt.
TG: If a company is fully compliant with the preventive controls for human food rule, what additional actions need to be taken if the company is using foreign raw materials but is not the importer of record?
Sanchez: If you're not the importer of record then this rule doesn't apply to you. The importer that receives the raw materials would be subject to the FSVP rule and they would have the responsibility to make sure their customer is actually in compliance with the preventive controls rule.
There would, however, be a relationship between the importer and the customer. All this means is that there may be some interaction with the importer where the customer is getting questions about what they are doing in terms of compliance with the preventive controls rule and whether or not that's adequate in the supplier's program, therefore ensuring compliance with the FSVP rule.
TG: Must the onsite audit be done by a third party, or can it be completed by a second party?
Sanchez: The onsite audits can be done by two parties and two parties only. They can be done by the importer, the person that we've talked about and defined, or an accredited third-party auditor. The FDA established this rule as a way to accommodate the need for foreign audits.
For example, if a company is importing spices from India, and the company doesn't have a presence in India, then it can rely on an accredited Indian party to conduct that audit.
TG: Are there cases in which only a third-party auditor can perform the onsite audit?
Sanchez: The onsite audit is triggered by a serious hazard, but there is not a separate trigger that then states the hazard can only be verified by a third party. The instances that you may want to use a third-party auditor are when you would like to eliminate an appearance of a conflict of interest.
For example, if a serious hazard is identified, one could approach this from a regulatory standpoint or a strategic standpoint, which could help in providing the company with distance in case something did happen. This is also true for when it comes to all the final FSMA rules. It's not just about regulatory compliance, but each rule also provides an opportunity to be strategic.
TG: With these third-party audits, which certifications will be accepted by the FDA? Will GFSI-recognized certifications be accepted?
Sanchez: This is where GFSI certifications might end up with the accreditation that's needed. The FDA will essentially keep a list of all accredited third parties, and a company should be able ask the third party to verify their registration as an accredited party and verify their accreditation with the FDA. If the third-party auditor cannot supply either of those, then you simply don't use them.
It is believed that some of the bigger certification groups like GFSI won't have an issue. Their certification will carry the accreditation weight because of their registration with the FDA.
TG: If a U.S. company has a manufacturing facility in Mexico, are they subject to the FSVP rule?
Sanchez: The key for the FSVP rule is if product is coming through customs, you're going to have to document compliance. And what the FDA is doing with the FSVP rule is bringing parity to the preventive controls rules. Essentially, the FDA has implemented these new safety standards with the preventive controls rules, but these only apply to domestic facilities. There would then be disparity between domestic facilities adhering to certain standards and foreign facilities not. The FSVP rule rectifies that and ensures all are producing to the same standard, performing hazard analyses, and performing verification of some form.
If product is coming through customs, you're most likely going to get questions related to foreign supplier verification, and the only way to really answer those questions is through documentation compliance.
TG: If a foreign supplier is a subsidiary of the importer, how do you control the bias in conflict of interest during the audit?
Sanchez: The FDA is still determining the relationship of affiliates and where the relationship means that it's not necessarily a third party. One would want to look at the type of hazards, the compliance history of the facility, and the product category in general. There are certain product categories that are inherently more difficult than others. This is, again, where a more strategic approach comes into play.
TG: When a supplier is prepared to present a potential serious hazard, is the onsite audit always required annually? If the hazard is not serious or likely to occur, then how often is the onsite audit required?
Sanchez: If the hazard is not a reasonably likely hazard, then, if the company is being strategic, it's going to go on a "watch list" to suggest that if the hazard does becomes reasonably likely to occur, it will need to be included in the verification program.
If the hazard is not serious, the onsite audit requirement goes away and the company will have to find other appropriate methods of verification (FDA gives testing/sampling and compliance reviews as examples of other appropriate activities).
Additionally, this is where the Preventive Controls Qualified Individual (PCQI) is going to be really important, as this person will be writing the verification program and will be familiar with the type of typical hazards involved and effective ways to control them.
If the hazard is a serious hazard, an annual onsite audit is, at a minimum, what's required by the FDA. This is where strategy can come into play again. Given the type of hazard and complexity, a company may need to do quarterly audits or monthly audits.
TG: A company that deals with coffee doesn't necessarily have a lot of hazards associated with it. For example, raw beans can come from foreign suppliers through importers where they are roasted and packaged for consumers. At this point, who should control risks for molds and other potential hazards?
Sanchez: One first needs to determine who controls the hazard. Does the company and the foreign supplier control this hazard, or is there going to be a customer that will continue to work on this product and control the hazard? In this scenario, the customer will be doing additional roasting, grinding, etc., so the importer's compliance would be verifying the customer's compliance with the preventive controls rule.
Additionally, one could do an analysis to determine if the coffee bean qualifies as a raw agricultural commodity (RAC) under the produce safety rule. If it does, the company is going to have to verify that the supplier is in compliance with the produce safety rule.
TG: If a company is a distributor/packer, who is responsible for verification?
Sanchez: To answer this question, start with the definition and understand how an importer is defined and how control is defined. In this situation, if the company is a distributor/packer and not receiving the product directly in a way that triggers the ownership of the "U.S. consignee" or "U.S. agent" element of the importer definition, then it's going to be subject to the preventive controls rule.
TG: If another importer has identified problems, are the other customers of the foreign supplier informed?
Sanchez: There isn't a requirement to inform others of potential issues and companies might only discover issues if they get to the stage of warning letters or public recalls. There can be, however, situations in which it's really helpful to share a Form 43, but this is definitely an area of cooperation and not necessarily a requirement within the rule.
TG: Where can someone find more information on these specific rules?
Sanchez: You can read the FAQs posted for each of the published rules, but if you're looking for more details regarding your specific operation, chances are, someone asked a similar form of your questions in the public comments section. The FDA is required to publish and respond to all public comments, and you can find them listed under each published rule.
FSVP lead instructor James Chu offers expert advice on how to comply with temporary FSVP policy updates so you can take necessary steps to protect your customers and your brand. Please watch the complimentary webinar here.