The clock is ticking. Most food facilities face a September deadline for complying with regulations set out by the Food and Drug Administration (FDA) that enforce the Food Safety Modernization Act (FSMA). The new rules mark a sweeping change for FDA and the food facilities it regulates. In an exclusive Baking & Snack Q&A, two AIB International managers of global innovation — Cornelius Hugo and Len Steed — offer their insight into what it will take to get bakers ready.

Baking & Snack: Very small businesses, those averaging less than $1 million in annual sales, have three years to comply; however, the records qualifying these companies as very small should have been in place by Jan. 1, 2016. Small businesses, those with fewer than 500 full-time employees, have two years. All others have one year. Where should companies be in their compliance programs by March?

Cornelius Hugo: 21 CFR 110.117 – Current Good Manufacturing Practice, Hazard Analysis and Risk-Based Preventive Controls for Human Food (Section 103 of FSMA; also known as the Preventive Controls rule) went into effect on Sept. 17, 2015.

Len Steed: Companies should recognize that they have until Sept. 17, 2016, to come into compliance. They should establish a team responsible for making a successful transition to FSMA on time. Every plant should set up a Gantt chart or project schedule to assure they are in compliance on or about Sept. 17, 2016. This will allow them to prioritize what needs to be done by set dates in order to achieve compliance in the most efficient and logical path and manage the progress.

Mr. Hugo: A preventive controls qualified individual (PCQI) should be identified within the organization and attend approved Food Safety Preventive Controls Alliance (FSPCA) training. Although a PCQI can be otherwise qualified by work experience, education or training, it is not fully known what the expectations will be for companies that chose not to attend the approved training. In addition to the PCQI, the company will have to ensure that the personnel performing food safety activities and the supervisor in charge of verifying these activities are qualified to perform these activities. AIB is an approved training provider for the FSPCA Preventive Controls for Human Food course.

Another important milestone after you have performed Hazard Analysis and Risk-Based Preventive Controls (HARPC) hazard analysis is to implement and review your preventive control records to ensure that they accurately portray the sanitary conditions at your plant and any improvements to those programs. It is assumed that the success of your preventive controls will be judged by the authenticity of your records and your ability to demonstrate that improvements are being made.

HARPC seems to be very open-ended, and the agency talks a lot about flexibility. What does this mean to the baker or snack food maker being inspected under the new regulations?

Mr. Steed: While Hazard Analysis Critical Control Points (HACCP) was very prescriptive in terms of the corrective actions to be taken when a food safety failure occurred at a Critical Control Point, HARPC allows the food safety team to set up steps for deciding what to do in case of such failure of each Preventive Control (PC) identified. These include correcting the problem that caused the failure, finding the root cause and eliminating it, evaluating the product for safety, releasing the product only if there is verifiable evidence that its safety was not compromised, and documenting.

Not all PCs will need to be managed with the same level of rigor and frequency. Based on the risk analysis the PCQI that each plant must have, needs to decide how and when the management elements of the PC will be implemented and with what frequency. These elements include monitoring, the correction and corrective actions mentioned above, verification (including validation), frequencies and documentation.

Mr. Hugo: There will be flexibility, particularly on minor GMP issues and the expectations for documenting corrections for these minor issues. However, for preventable recalls such as undeclared allergens and controls for pathogenic bacteria in ready-to-eat food, there will not be flexibility for documenting effective plant programs that prevent these types of recalls. The amount of recalls with undeclared allergens in bakery products would appear to make them a high risk product which would require fully documented preventive control(s) that have proven to be effective.

How did FSMA change the responsibilities of top managers with respect to food safety?

Mr. Steed: In a very significant way. The food safety plan that each plant has to develop and implement must be signed by the facility manager. Such signature implies responsibility for the plan and accountability in case something goes wrong. Under FSMA, FDA has new legal authority to undertake criminal trials with managers deemed to have neglected food safety issues in their plants.

FDA has carried out some 14 criminal cases and is now subpoenaing records to ascertain whether upper management was negligent. FSMA has given FDA legal authority to proceed rigorously against upper management not carrying out their due diligence in regard to food safety.

Mr. Hugo: The site executive or manager will ultimately be responsible for the hazard analysis and risk-based preventive controls, and the rule requires that this person sign these documents referred to as the company’s food safety plans. FSMA regulations puts the responsibility for day-to-day food safety requirements squarely on the site manager and supervisors verifying that the plant does not have any unsanitary conditions and if so, they are immediately corrected, product is evaluated and the conditions are prevented from reoccurring.

What aspect of FSMA do you see as being the most challenging to bakers and snack food companies? (FYI: Many are working on kill step validation protocols now.)

Mr. Steed: Understanding that their products are ready-to-eat (RTE) foods as defined under the HARPC rule, which in turn will demand a more rigorous environmental monitoring program, especially after the kill step. Also, understand that 44% of food recalls are due to undeclared allergens, in violation of the labeling laws. Cross-contact with allergens is too common due to weak preventive actions and procedures. Facilities will have to undertake an allergen cross-contact review according to the new Good Manufacturing Practices (GMPs) outlined under Part 117, which identifies 24 instances where allergen cross-contact potential needs to be address and controlled, and develop and implement a fail-proof allergen labeling program.

Mr. Hugo: Kill step validation will be another huge concern that will be applicable to most types of bakery and snack food products that have raw materials that were not processed to control identified hazards, such as pathogenic bacteria. AIB has a brand new tool to empower bakeries to validate their food safety preventive controls. The Baking Process Kill Step Calculator helps bakers evaluate the lethality of their process for destruction of Salmonella spp. in a variety of products.

If a company has plant conditions for allergen cross contact or different allergens in their products, they are required to ensure that effective preventive controls are in place to prevent cross-contact in processing areas and to prevent undeclared allergens through proper label control programs from the inception of the label and into plant operations from receiving through packaging. 

What is the single most important step a baker can take to get ready for FSMA?

Mr. Steed: Become familiar with the intent and scope of the applicable rules, such as HARPC for human food, the Foreign Supplier Verification program if they import raw materials, ingredients and packaging materials, and the Specific Mitigation Strategies (food defense). Set up a transition team to develop and implementation the plan. Educate and train personnel at all levels, starting with the PCQI. Understand that plant managers will be held accountable.