On May 27, 2016 FDA released a Food Safety Modernization Act (FSMA) final rule for mitigation strategies to protect food from intentional adulteration. With some exceptions discussed below, both domestic and foreign companies that are required to register with FDA as food facilities under the Federal Food, Drug, and Cosmetic (FD&C) Act are covered. However, FDA has designed the rule to primarily cover larger companies.
The rule requires each covered facility to prepare and implement a food defense plan. This plan identifies vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions, and verification. Moreover, a reanalysis is required every three years or when certain criteria are met, including mitigation strategies that are determined to be improperly implemented.
The rule focuses on four areas:
- Vulnerability Assessment. Identification of vulnerabilities and actionable process steps for each type of food manufactured, processed, packed or held at the food facility. Additionally, these elements must be evaluated at each step based on (a) the severity and scale of the potential impact on public health; (b) the physical access to the product; and (c) the ability to successfully contaminate the product.
- Mitigation Strategies. FDA requires tailored strategies be implemented at each actionable process step.
- Mitigation Strategy Management. Related to the above, steps are needed to ensure proper implementation. For example, monitoring, corrective actions, and verification are specifically discussed by FDA.
- Training and Recordkeeping. Personnel assigned to vulnerable areas receive appropriate training. Additionally, facilities must maintain records for food defense monitoring, corrective actions, and verification activities.
FDA acknowledged that this rule "is a first of its kind" and education/outreach are critical. Businesses have three years to comply with the final rule once published, unless the business can be classified as a very small business or small business. Specifically:
- Very small businesses (those averaging less than $10 million, adjusted for inflation, in the previous three-year period) along with modified requirements, which is within five years after publication
- Small businesses (employing fewer than 500 persons) must comply four years after the publication of the final rule
FDA provides for a number of exceptions, including:
- Farms
- Holding food (except the holding of food in liquid storage tanks)
- Foods for animals
- Alcoholic beverages under certain conditions
- Packing, re-packing, labeling or re-labeling of food where the container that directly contacts the food remains intact
- Very small businesses (While exempt, the business would be required to provide to FDA, upon request, documentation to demonstrate that the business is very small.)
The FDA rule reflects increased regulatory standards and scrutiny in the food and supply chains over the past few years. Those subject to the new FSMA final rule should consider whether existing participation in programs like the US Customs-Trade Partnership Against Terrorism (CTPAT) or other corporate governance compliance initiatives (such as anti-corruption/bribery vetting of third parties). Practically, companies may be able to leverage present compliance efforts to address some of the new FSMA standards.
For additional information regarding this rule, please contact one of the article authors.