New FSMA Rule Will Be Costly For Processed Food Industry

Brief Overview of CGMPs

The FDA currently regulates the safety of the manufacturing, packing and holding of human food under CGMPs, set forth at Title 21 Code of Federal Regulations Part 110. The regulations were last revised in 1986 and are broadly written such that they can be applied to recently developed food production systems that were not envisioned at the time of their promulgation. In its present form, Part 110 covers food industry personnel, plants and grounds; sanitary facilities, controls, and operations; equipment and utensils; warehousing, and distribution; and natural or unavoidable defect levels.

The CGMPs are not tailored to individual facilities and do not necessarily require food facilities to so tailor them. CGMPs do not require a food facility to identify and prevent risks. Instead, the FDA has broadly defined the ways in which most food facilities operate (e.g., through personnel hygiene and facility sanitation requirements — without heed to any specific risks that might be relevant to a particular facility).

A significant change in the food industry since the CGMPs regulations were last revised is the rise in popularity and availability of ready-to-eat ("RTE") foods. Increasingly, consumers are purchasing foods that need little or no preparation or cooking before consumption. If these foods are contaminated with pathogens, such as listeria monocytogenes or salmonella, there is often no consumer preparation step that will reduce or eliminate the hazard.

Brief Overview of Hazard Analysis and Risk-Based Preventive Controls

The FSMA was signed into law on Jan. 4, 2011, and granted the FDA new authority, including a mandate to require science-based preventive controls throughout the food supply chain, including imports, and enhanced existing authority regarding inspection, compliance, outbreak response and recalls. The FSMA represents a dramatic change in the long-standing food safety regulatory framework, requiring the FDA to move from a food safety approach that reacted to potential harm after an illness outbreak or a finding of adulteration to a preventative framework that puts great responsibility on industry to identify potential risks to the safety of the food supply and to counter the risks before harm occurs. The HARPC final rule implements Section 103 of the FSMA, which added Section 418 to the Federal Food, Drug, and Cosmetic Act, and will likely have the greatest impact on the operations of food facilities.

The final rule imposes HARPC requirements on facilities that manufacture, process, pack or hold human food for consumption in the United States; in other words, facilities required to register with the FDA under Section 415 of the FD&C Act. Several types of food facilities are exempt from the HARPC final rule, including, low-acid canned food and acidified food facilities, juice and seafood hazard analysis critical control point facilities, dietary supplement facilities and certain small businesses, among others.

The central principles of HARPC are hazard analysis and the implementation of risk-based preventive controls. Under the hazard analysis requirement, a facility must identify known or reasonably foreseeable hazards that may be present in the food handled at that facility (including biological, chemical and physical hazards). From those identified hazards, the facility determines the “hazards that require a preventive control”; that is, the hazards for which a person knowledgeable about the safe manufacturing, processing, packing or holding of food would establish one or more preventive controls to significantly minimize or prevent the hazard.

Once hazards that require a preventive control are identified, a facility must implement preventive controls to provide assurances the hazards are significantly minimized or prevented and that food manufactured, processed, packed or held by the facility will not be adulterated or misbranded for failure to label a food allergen. Preventive controls are facility and food-specific, and may include process controls, food allergen controls, sanitation controls, supply-chain controls, the recall plan and other controls. Preventive controls are not required under a number of circumstances, including, where the food could not be consumed without application of an appropriate control (e.g., coffee beans); where the facility relies on a customer to ensure that the identified hazard will be significantly minimized or prevented and the customer annually confirms in writing that it is doing so; and where the facility has established, documented and implemented a system that ensures control of the hazards in the food at a subsequent distribution step.

After preventive controls are developed, a facility must develop effective monitoring procedures. To that end, a facility must establish and implement written procedures for monitoring the preventive controls. For example, a facility implementing equipment check controls to prevent metal fragment contamination may monitor the control’s effectiveness by using a metal detector with appropriate sensitivity on the production line. A facility must also establish and implement written corrective action procedures that must be taken if preventive controls are found to be ineffective.

Once preventive controls and monitoring and corrective action plans are developed, they must be validated. In the context of the preventive controls and their role in the facility’s food safety system, a facility must validate the adequacy of the preventive controls implemented in accordance with HARPC’s requirements and must verify that monitoring and corrective action procedures are appropriately implemented. However, no validation is required for a number of controls, including food allergen controls, sanitation controls, the recall plan and the supply-chain program. Other preventive controls may avoid validation if an appropriate written justification is prepared demonstrating why validation is inapplicable.

Further, HARPC requires reanalysis of the food safety plan at least once every three years; sooner if warranted by production changes, changes in the hazard profile and/or issues observed during implementation of the current plan (e.g., unanticipated food safety problems, ineffective preventive controls).

HARPC may not end at a company’s facility, as a facility must develop a risk-based supply-chain program for those raw materials and other ingredients for which the receiving facility has identified a hazard requiring a supply-chain-applied control. Supply-chain controls can be verified through on-site audits, sampling and testing of the raw material or other ingredients, and review of the supplier’s relevant food safety records, among other verification steps.

HARPC also imposes training requirements for all persons involved in manufacturing, processing, packing or holding food. A facility’s HARPC food safety plan must be developed and implemented by a “preventive controls qualified individual,” a term defined in the final rule as a qualified individual who has successfully completed specified training in the development and application of risk-based preventive controls or is otherwise qualified through job experience to develop and apply a food safety system. In addition, each individual engaged in manufacturing, processing, packing or holding food must be a “qualified individual;” that is, a person who has the education, training and/or experience necessary to manufacture, process, pack or hold clean and safe food as appropriate to the individual’s assigned duties. Moreover, all supplier audits must be performed by a “qualified auditor.”

Implications for the Food Industry

The HARPC final rule will have a very significant impact on the processed food industry. Most notably, HARPC will consume substantial industry resources and will change the nature of FDA facility inspections. Initially, companies will be required to expend significant resources becoming compliant with the rule. First, companies must acquire the expertise to implement HARPC. This begins by hiring or training a current employee to become a “preventive controls qualified individual,” a term defined in the HARPC final rule. Many activities required by the final rule must be conducted or overseen by such a person. In addition, each individual engaged in manufacturing, processing, packing or holding food must be a “qualified individual” and supplier audits must be conducted by a “qualified auditor.” Consequently, the training and implementation required under the HARPC final rule will consume a significant amount of industry resources.

The resource drain caused by HARPC will not end at implementation. The final rule requires significant verification, monitoring and reanalysis of the preventive controls. Initially, the controls must be verified and then continually monitored. If the monitoring reveals a deviation from specifications that suggests the preventive controls are ineffective, the preventive controls must be revised and revalidated. The entire system must be re-evaluated at least every three years, and sooner if the facility implements changes that impact the preventive controls, e.g., alter production processes or hazard profiles; or experience unanticipated food safety problems or find that preventive controls are ineffective. Accordingly, the significant added costs imposed by the HARPC final rule will continue as long as the facility operates.

HARPC will also change the nature of FDA food facility inspections. CGMPs currently require very little in the way of documentation and record keeping. Thus, routine FDA Inspections are largely observational in nature. The observational nature of FDA inspections will continue, but the extensive record-keeping requirements of the HARPC final rule will introduce a more intensive document review to the inspection process. HARPC requires facilities to maintain a written food safety plan (e.g., written hazard analysis and preventive control plans, among others), a written recall plan, a written monitoring plan and keep records of many of the activities conducted under the food safety plan. For example, records must be kept documenting training, monitoring, corrective actions, verification/validation, safety plan implementation and the supply-chain program. Records of this food safety plan must be maintained for at least two years. HARPC’s extensive record-keeping requirements allow FDA inspectors to review the food safety operation of a food facility and its performance in detail. As a result, the FDA will be able to very clearly determine how a facility’s food safety plan is performing and the agency need not rely on appearing at a facility on a particular day when it happens to be in violation of the FD&C Act. In essence, the facilities will be recording and documenting any violations for FDA to review at its convenience. Of course, if required records are not kept, it is a separate violation of the FD&C Act.

Compliance Dates

The HARPC final rule is effective Nov. 16, 2015. Companies generally have one year from the date of publication to comply with the final rule, i.e., Sept. 19, 2016. Small businesses (i.e., fewer than 500 full-time equivalent employees) must comply within two years, i.e., Sept. 18, 2017. Very small businesses (averaging less than $1 million per year (adjusted for inflation) in both annual sales of human food plus the market value of human food manufactured, processed, packed or held without sale) must comply within three years, i.e., Sept. 17, 2018. There are separate compliance dates applicable to the supply-chain program.

Conclusion

The FDA’s promulgation of the HARPC final rule marks the implementation of a key component of the FSMA. It significantly updates the food safety regulatory framework by introducing a risk-based approach to controlling foodborne hazards. Implementation of HARPC by the food industry will require the application of a substantial amount of resources and it will change the way in which the FDA conducts facility inspections. The ultimate result, however, will likely be a significant reduction in foodborne hazards.

 

This article first appeared on September 25, 2015 in Law360. It is included on KHLaw.com with permission from Law360.