June 25, 2012
Hazard Analysis and Risk-Based Preventive Controls — Required as of July
3, 2012, for Most FDA-Regulated Facilities
As of July 3, 2012, companies that manufacture, process, package or
hold food products regulated by the U.S. Food and Drug Administration (FDA) are
required to identify potential hazards, implement preventive controls to
minimize each of the hazards, monitor the performance of the controls and
maintain records substantiating the monitoring and compliance with each control.
Although such risk-based preventive controls have been required in
USDA-regulated facilities since 1996, the Food Safety Modernization Act (FSMA),
enacted January 4, 2011, imposes this requirement for the first time in most
FDA-regulated facilities.
Section 103 of the FSMA amends the Food, Drug and Cosmetic Act by imposing
for the first time a requirement for risk-based preventive controls to address
hazards to which the company’s food products or processes may be vulnerable. As
with much of the FSMA, Section 103 focuses on the means of preventing production
and distribution of adulterated and mislabeled food products rather than
detection of contaminated food products in commerce and corrective actions.
The FSMA’s newly implemented requirement of risk-based preventive controls is
not merely limited to enactment of a Hazard Analysis and Critical Control Points
(HACCP) program, but rather will likely necessitate a combination of a HACCP
program with Current Good Manufacturing Practices, Sanitation Standard Operating
Procedures, hygiene training, environmental sampling and controls, supplier
verification, recall plans, and allergen controls and labeling. This is simply
not a one-policy-fits-all requirement. A company’s Food Safety Plan should be
composed of multiple policies and procedures that are specifically tailored to
address the unique risks associated with a specific food product and the
associated processes that may vary by plant, or even by line.
The first step to implementing the required Food Safety Plan is to conduct a
hazard analysis identifying the potential hazards specific to the food product
and processes, taking into account the facility and product history. Potential
hazards can range from biological contaminants; to physical contaminants (e.g.,
foreign objects); to radiological pathogens and natural toxins (e.g., aflatoxins);
to allergens; to natural hazards; to unintentional hazards; to labeling
concerns; to intentional hazards (food defense). The Food Safety Plan should
encompass not only a HACCP program but also a Food Defense Plan. Food Defense
refers to countermeasures designed to avoid intentional contamination of food
due to sabotage, terrorism or other intentional means.
Once known and reasonably foreseeable hazards are identified, written plans
addressing preventative controls for each of the potential hazards must be
devised. As mentioned, the written plans may take many forms and are not limited
to a single policy or procedure. Complying with the requirement of risk-based
preventative controls will usually necessitate, but is not limited to,
implementation of a HACCP program. As many companies that voluntarily
implemented HACCP plans before this legislative mandate can attest, developing
and adhering to a HACCP plan can be time consuming and expensive. As with a
HACCP program, the effectiveness of each countermeasure in the Food Defense Plan
must be validated in writing, which may require outside testing or retention of
consultants. A company must also reanalyze each of the implemented preventive
controls at least once every three years or whenever there is a significant
change in the company’s activities that creates a reasonable potential for a new
hazard or an increase in an identified hazard, whichever comes earlier. A
company must also establish procedures for corrective actions if the preventive
controls are not implemented properly or are ineffective. The corrective actions
must be documented.
In addition to requiring implementation of a Food Safety Plan, the FSMA
Section 103 expands the documentation a company must maintain. Implementation of
the plans, validation of the countermeasures, monitoring compliance with the
plans and corrective actions must be documented. A company must maintain
documented records monitoring its preventive controls and verifying compliance
with the countermeasures for at least two years. All such records must be
provided to the FDA upon request, which is likely to occur during FDA
inspections. This raises concerns over dissemination of proprietary processes,
formulations and information to the public through Freedom of Information Act
requests. When drafting the various policies that compose a company’s Food
Safety Plan, it is imperative that, to the extent possible, proprietary
processes and formulations are not codified in the policies or plans. It is also
important to clearly designate all proprietary documents as such.
There are limited exceptions exempting FDA-regulated facilities from the
requirements of Section 103. When the FSMA was considered, substantial debate
concerning its effect on small companies occurred. Many advocating on behalf of
small farms and producers targeting local and regional markets argued that the
more onerous provisions of Section 103 were not only unnecessary but would also
put them at a substantial economic disadvantage. These lobbying efforts proved
effective, since the FSMA exempts certain facilities from compliance, referred
to as “qualified facilities.” A “qualified facility” for purposes of this
exemption is one that sells less than $500,000 in food annually and, within a
three-year period, sells the bulk of its product directly to consumers or
restaurants or retail food establishments located in the same state or within
275 miles of the qualified facility. Also exempt from Section 103 requirements
are seafood, juice and low-acid canned food facilities already subject to HACCP
programs and those facilities subject to the requirements for produce safety.
The new requirements imposed by Section 103 are substantial and require
careful, advance planning. Having helped companies develop these plans and
having defended them in court, McGuireWoods LLP’s food and beverage industry
team stands ready to assist.