Jeffrey T. Barach, PhD; Principal, Barach Enterprises, LLC

Jeffrey Barach is a food scientist who has been active in research and development, regulatory liaison activities, teaching, problem solving, and trouble shooting for the food industry for over thirty years. He routinely participates as a consultant in planning, development, and management of special projects and programs for the food industry on health and safety issues, production of foods, regulatory compliance issues, and training. He is a subject matter expert (SME) on issues related to food safety modernization, biotechnology, food irradiation, nanotechnology, and other new processing and testing technologies. Dr. Barach was formerly with Grocery Manufacturers Association as head of their Science Policy Group and previously directed the GMA Laboratory in Washington, D.C. His education includes receiving his MS and PhD in food science from North Carolina State University and his undergraduate degree in Chemistry from the University of North Carolina. Dr. Barach is also a lecturer, lead instructor training professional and educator in food safety and food sanitation, with a focus on HACCP and FSMA food safety systems.

The author has met and worked with many outstanding food scientists from industry, academia, and the regulatory agencies in his career. He is grateful to those that shared their expertise, wisdom, and knowledge with him. He also is pleased to share his knowledge, as a teacher, with his many students and fellow colleagues. Hopefully, this guide book will extend that desired ambition of knowledge sharing. Special thanks goes to his wife Kathy and to those that helped him with the review of this publication. Their encouragement and suggestions are kindly taken and greatly appreciated.

1.1 Introduction

President Obama signed the Food Safety Modernization Act of 2011 (FSMA) in response to Congress' efforts to address the food safety issue demands of a broad coalition of stakeholders – including produce growers, food processors, retailers, and consumers who were disturbed by a series of illness outbreaks and contamination incidents. These significant foodborne illness events, which involved both domestic and imported foods, undermined consumer confidence and imposed harmful and costly disruptions on consumers and food producers. Many believed that these events would be largely preventable if new laws were developed and implemented that utilized best practices for preventing food safety problems.

The bills and subsequent law was focused on making these practices the norm for all domestic FDA‐regulated products in the United States (U.S.) market. Congress and the FDA realized that a significant portion of the food consumed in the U.S. is produced in foreign countries. They recognized the need to address food safety at a global scale to address the wide range of food, ingredients, and commodities the U.S. imports from over 200 countries and territories.

For both domestic and foreign food, FSMA regulatory mandates keyed in on two proven basic principles of food safety that could address the concerning incidents of food safety problems and the growing diversity of the global food supply. The new rules were, in principle, to be a scientific assessment of risk and were to implement controls that would prevent significant food safety problems, rather than just to react to them after the fact.

FSMA regulations (Fed. Reg., 2015) explicitly recognize the food safety role of the food industry while giving regulatory authority to the FDA. With that, it rests on a third core principle that empowers those who produce food for the commercial market to have the responsibility and capability to make it safe in accordance with recognized best practices for preventing harmful contamination and preventing food safety hazards.

FSMA uses a risk‐based strategy and preventive controls to achieve its broad goals by fundamentally changing FDA’s food safety role and redefining its relationship with other participants in the food system. These broad steps toward modernizing food safety are fundamentally sound and inherently necessary in the global environment and under existing resource limitations if food safety goals are to be achieved.

The language of FSMA is consistent with the Hazard Analysis Critical Control Points (HACCP) approach. In the U.S., HACCP is required for many foods, including meat and poultry, seafood and juice (NACMCF, 1997; see Appendix B). Regulations within the European Economic Community require HACCP plans. Likewise, the Codex Alimentarius Commission notes that HACCP is a tool to assess hazards and establish control systems that focus on prevention rather than relying mainly on end‐product testing. The keystone of FSMA, like HACCP, is the development of risk‐based preventive controls for food facilities. Food facilities are required to develop and implement a written plan for preventive controls and a written recall plan.

This involves:

1. Evaluating the hazards that could affect food safety;
2. Specifying what preventive steps, or controls, will be put in place to significantly minimize or prevent the hazards;
3. Specifying how the facility will monitor these controls to ensure they are working;
4. Maintaining routine records of the monitoring, and
5. Specifying what actions the facility will take to correct problems that arise.

The final rule implements the requirements of FSMA for covered facilities to establish and implement a food safety system that includes sound sanitation programs, a hazard analysis, and risk‐based preventive controls. Specifically, the rule establishes requirements for:

• A written food safety plan;
• Hazard analysis;
• Preventive controls;
• Monitoring;
• Corrective actions and corrections;
• Verification;
• Supply‐chain program;
• Recall plan; and
• Associated records.

However, in order for the food safety plan to be effective, it must be built on a strong foundation of current good manufacturing practices (cGMPs). FSMA addresses cGMPs in the new rules under the Subpart B provisions. The importance of having effective and well implemented cGMPs can't be overstated. Many of the problems associated with low‐moisture foods, such as peanut butter, that lead to foodborne illnesses were because of poor basic sanitation practices.

1.2 FSMA Sanitation and cGMPs

Several steps to modernize cGMPs have been incorporated in FSMA rules. For a better understanding of these developments, it may be helpful to recap where these initiatives originated. As background, the FDA issued a white paper in 2005, titled “Food cGMP Modernization – A Focus on Food Safety,” to address significant changes that had occurred both in industry and in the science and technology of food safety. The last time cGMPs were revised was in the mid 1980s. As FSMA regulations were being formulated by FDA, it became apparent that new food safety regulations should combine this earlier cGMP effort with the new initiative that was focused on preventive controls. This strategy led to the rewrite of 21 CFR Part 110 into 21 CFR Part 117 (Subpart B). Rather than having FDA pursue further modernization of cGMPs as a separate task, almost all stakeholders agreed with incorporating those improvement activities within the FSMA framework. As a result, the new FSMA rules for human foods are titled “Current Good Manufacturing Practice, Hazard Analysis, and Risk‐Based Preventive Controls for Human Food” to included both cGMP and preventive control updates.

Under the FSMA framework, cGMPs are revised and industry responsibilities are clarified. The rule states what must be done in a facility to control sanitation, and the language in the regulation was updated, such as using the term “must” instead of “shall.” As with HACCP programs, requirements under cGMPs are included for personnel, plant and grounds, sanitary operations, sanitary facilities and controls, equipment and utensils, processes and controls, warehousing, and distribution. The cGMPs were modified to clarify that certain provisions requiring protection against contamination of food also require protection against allergen cross‐contact. Regulations also now require cleaning of non‐food‐contact surfaces as frequently as necessary to protect against contamination of food and food‐contact surfaces. Additionally, food‐contact surfaces used for manufacturing/processing or holding low‐moisture food must be in a clean, dry, and sanitary condition at the time of use. The rules place emphasis on education and training to ensure employees have the knowledge and/or experience necessary to make and produce safe food.

The following is a summary of the major components of FSMA regulations regarding cGMPs:

1.3 FSMA Preventive Controls

HACCP is the predecessor of FSMA. Both approaches have the goal of establishing a food safety system that will provide the environment for safe food production. That includes cGMPs and controls to prevent the food product from becoming adulterated by any known or foreseeable hazards coming from the foods or hazards resulting from faulty manufacturing operations. Contamination of food products typically comes from one of three different sources: 1) ingredients, 2) the processing environment, including equipment, or 3) people. A major difference between FSMA and HACCP is that HACCP is focused mainly on processing controls (called critical control points) while FSMA expands the aspects of controls to include allergen preventive controls, sanitation preventive controls, and supplier controls, as well as maintaining the importance process controls.

FSMA focuses on identifying hazards that are then mitigated by specific types of preventive controls. It requires a written analysis of potential hazards to determine if they are known or reasonably foreseeable and if they are severe enough to require a preventive control to be implemented. The first part of hazard analysis is the identification of potential biological, chemical (including radiological), and physical hazards that may be associated with the facility or the food. These hazards may occur naturally, may be unintentionally introduced, or may be intentionally introduced for economic gain. Controls are needed to manage the hazards introduced from these sources. With the significant hazards identified, preventive controls (of the types described above) are assigned and managed by plant personnel through well developed and documented actions and procedures. FSMA also requires a written Food Safety Plan, and if hazards are identified that need preventive controls, they are included in the plan. The Food Safety Plan is the primary document that guides the preventive controls of the food safety system.

FSMA details the requirements and contents of the Food Safety Plan:

1.4 Process Controls

Process controls for biological hazards depend on the organism(s) of public health significance, the characteristics of the food, and the process used to product the food. In many foods that have a high‐moisture environment, pathogenic vegetative cells like E. coli O157:H7 and Salmonella are fairly easily killed during processing by heating or cooking. In low‐moisture foods, however, Salmonella has unique thermal‐resistance and durability characteristics that need to be carefully considered in the context of developing the food safety controls where Salmonella can survive. For pathogens that produce bacterial spores that can survive heat and outgrow, producing toxic food, a different control approach is necessary. If the spore‐forming organism of public health concern is Clostridium botulinium, FSMA recognizes that well established regulations already exist in 21 CFR Part 113 and an exemption allows low‐acid canners to control this biological hazard using those regulations (see Part 177.5). Other toxin‐producing spore formers, such a Clostridium perfringens and Bacillus cereus require a different control approach, usually a cooling temperature control. When the hazard analysis indicates a pathogen hazard, there are many factors in deciding the appropriate process control. The type of organism (vegetative cell or spore), the nature and characteristics of the pathogen, the condition of the food product (e.g., moisture, pH, a_w) and other factors need to be considered. This may not be a simple task, given all the factors and variables involved. Often designing the proper process control may require the input from subject‐matter experts such as a microbiologist, a process authority, a consultant and/or other food scientists.

In HACCP terminology, using a processing step to kill vegetative pathogens would typically be considered a critical control point (CCP). In FSMA, the concept is the same, and the action is called a process control. The potential hazard from bacterial pathogens and the appropriate mitigating steps would be identified in the hazard analysis with the oversight of the Preventive Control Qualified Individual (PCQI). Preventive controls would then become part of the Food Safety Plan as a process control, if a processing step is used to inactivate the pathogen. For example, a cooking process may be part of a high‐moisture food manufacturing operation. With proper validation, it could be scientifically shown that this heating step will control Salmonella and remove the hazard. The cooking step becomes the point of control to be managed to ensure a Salmonella hazard does not exist for the food product.

When incorporating process controls into the Food Safety Plan, the preventive controls required include only those appropriate to the facility and the food, as determined by hazard analysis. Process controls would typically be at CCPs, similar to HACCP.

1.5 Sanitation Controls

Like process controls, sanitation preventive controls are those determined through a hazard analysis as necessary to significantly minimize or prevent: 1) environmental pathogens in a ready‐to‐eat (RTE) food exposed to the environment prior to packaging where the packaged food does not receive a treatment that would significantly minimize the pathogen; 2) biological hazards in a RTE food due to employee handling; and 3) food allergen hazards. Other aspects of routine (cGMP) sanitation such as pest control and safety of water and employee health do not need to be in a Food Safety Plan unless these programs/procedures are determined to be of a nature where hazards will result unless a preventive control is applied.

In all cases, effective sanitation procedures are a front‐door to back‐door necessity to ensure safe food production. A hazard may be re‐introduced in an open plant environment postprocess. Routine plant sanitation standard operating procedures and specific sanitation preventive controls work together to ensure food safety.

FSMA identifies certain ready‐to‐eat (RTE) foods where environmental monitoring would be appropriate as a verification tool to confirm the effectiveness of the sanitation control. Foods such as peanut butter, dried dairy products for use in RTE foods, and roasted nuts are among the products for which manufacturing operations would need to have an environmental monitoring program when such foods are exposed to the environment. However, FSMA qualifies the need for implementing environmental monitoring as a possible verification activity as being appropriate to the food, facility, nature of the preventive control, and the role of that control in the facility’s food safety system. Environmental monitoring generally would be required if contamination of a RTE food with an environmental pathogen is a hazard requiring a preventive control. If environmental monitoring is used as a verification tool for sanitation controls, the following procedures are recommended by FDA:

Environmental Monitoring Procedures

• Identify test microorganism
• Identify locations (may be guided by zoning*) and number of sites to be tested
• Identify timing and frequency for collecting and testing samples
• Identify test, including the analytical method
• Identify the laboratory conducting testing
• Include corrective action procedures

*(For information about zones and environmental monitoring, see 78 Federal Register 3646 at 3816).

1.6 Supplier Controls

Globalization of the food supply has brought new challenges to the food industry. Fortunately, many of the same practices and procedures used for managing foods and ingredients from domestic suppliers also apply to foreign suppliers. When an identified bacterial hazard is mitigated and controlled within the facility, the burden of controlling the pathogen is taken in‐house. However, when a facility relies on their supplier to control the hazard: for example, if the food operation does not include a thermal processing step, the Food Safety Plan may need to include a supplier control to prevent pathogen‐contaminated source material from entering the plant's operations. Also, when a potential pathogen is passed on to a customer, that customer needs to be alerted to that fact and take proper actions to control the hazard.

Supply‐chain controls, implemented through a supply‐chain program, are required for ingredients or raw materials for which the receiving facility’s hazard analysis identified a hazard requiring a supply‐chain‐applied control. Other preventive controls may be identified as appropriate based on the hazard analysis. FSMA has introduce a regulation for supply chain programs that are designed to be flexible, recognizing that many food operations have many different suppliers both domestically and foreign. The rule mandates that a manufacturing/processing facility have a risk‐based supply chain program for those raw materials and other ingredients for which it has identified a hazard requiring a supply‐chain applied control. Manufacturing/processing facilities that control a hazard using preventive controls, or who follow applicable requirements when relying on a customer to controls hazards, do not need to have a supply‐chain program for that hazard. Covered food facilities are responsible for ensuring that these foods are received only from approved suppliers, or on a temporary basis from unapproved suppliers whose materials are subject to verification activities before being accepted for use. If a facility identifies a hazard that they will not control because the hazard will be controlled by a subsequent entity, such as a customer or other processor, the facility will have to disclose that the food is “not processed to control (identified hazard)” and obtain written assurance from its customer regarding certain actions the customer agrees to take.

The following table summarizes the major differences between a Food Safety Plan vs. a HACCP Plan for human foods:

See also (Fed. Reg., 2015): Table 29, p. 56024.

References

1. 1 Federal Register. 2015. Current Good Manufacturing Practice, Hazard Analysis, and Risk‐Based Preventive Controls for Human Food. Vol. 80, Sept 17, 55908.
2. 2 NACMCF. 1997. HACCP Principles and Application Guidelines, August 14, 1997 (see Appendix B).