United States: Hazard Analysis And Risk-Based Preventive Controls — Required As Of July 3, 2012, For Most FDA-Regulated Facilities

As of July 3, 2012, companies that manufacture, process, package or hold food products regulated by the U.S. Food and Drug Administration (FDA) are required to identify potential hazards, implement preventive controls to minimize each of the hazards, monitor the performance of the controls and maintain records substantiating the monitoring and compliance with each control. Although such risk-based preventive controls have been required in USDA-regulated facilities since 1996, the Food Safety Modernization Act (FSMA), enacted January 4, 2011, imposes this requirement for the first time in most FDA-regulated facilities.

Section 103 of the FSMA amends the Food, Drug and Cosmetic Act by imposing for the first time a requirement for risk-based preventive controls to address hazards to which the company's food products or processes may be vulnerable. As with much of the FSMA, Section 103 focuses on the means of preventing production and distribution of adulterated and mislabeled food products rather than detection of contaminated food products in commerce and corrective actions.

The FSMA's newly implemented requirement of risk-based preventive controls is not merely limited to enactment of a Hazard Analysis and Critical Control Points (HACCP) program, but rather will likely necessitate a combination of a HACCP program with Current Good Manufacturing Practices, Sanitation Standard Operating Procedures, hygiene training, environmental sampling and controls, supplier verification, recall plans, and allergen controls and labeling. This is simply not a one-policy-fits-all requirement. A company's Food Safety Plan should be composed of multiple policies and procedures that are specifically tailored to address the unique risks associated with a specific food product and the associated processes that may vary by plant, or even by line.

The first step to implementing the required Food Safety Plan is to conduct a hazard analysis identifying the potential hazards specific to the food product and processes, taking into account the facility and product history. Potential hazards can range from biological contaminants; to physical contaminants (e.g., foreign objects); to radiological pathogens and natural toxins (e.g., aflatoxins); to allergens; to natural hazards; to unintentional hazards; to labeling concerns; to intentional hazards (food defense). The Food Safety Plan should encompass not only a HACCP program but also a Food Defense Plan. Food Defense refers to countermeasures designed to avoid intentional contamination of food due to sabotage, terrorism or other intentional means.

Once known and reasonably foreseeable hazards are identified, written plans addressing preventative controls for each of the potential hazards must be devised. As mentioned, the written plans may take many forms and are not limited to a single policy or procedure. Complying with the requirement of risk-based preventative controls will usually necessitate, but is not limited to, implementation of a HACCP program. As many companies that voluntarily implemented HACCP plans before this legislative mandate can attest, developing and adhering to a HACCP plan can be time consuming and expensive. As with a HACCP program, the effectiveness of each countermeasure in the Food Defense Plan must be validated in writing, which may require outside testing or retention of consultants. A company must also reanalyze each of the implemented preventive controls at least once every three years or whenever there is a significant change in the company's activities that creates a reasonable potential for a new hazard or an increase in an identified hazard, whichever comes earlier. A company must also establish procedures for corrective actions if the preventive controls are not implemented properly or are ineffective. The corrective actions must be documented.

In addition to requiring implementation of a Food Safety Plan, the FSMA Section 103 expands the documentation a company must maintain. Implementation of the plans, validation of the countermeasures, monitoring compliance with the plans and corrective actions must be documented. A company must maintain documented records monitoring its preventive controls and verifying compliance with the countermeasures for at least two years. All such records must be provided to the FDA upon request, which is likely to occur during FDA inspections. This raises concerns over dissemination of proprietary processes, formulations and information to the public through Freedom of Information Act requests. When drafting the various policies that compose a company's Food Safety Plan, it is imperative that, to the extent possible, proprietary processes and formulations are not codified in the policies or plans. It is also important to clearly designate all proprietary documents as such.

There are limited exceptions exempting FDA-regulated facilities from the requirements of Section 103. When the FSMA was considered, substantial debate concerning its effect on small companies occurred. Many advocating on behalf of small farms and producers targeting local and regional markets argued that the more onerous provisions of Section 103 were not only unnecessary but would also put them at a substantial economic disadvantage. These lobbying efforts proved effective, since the FSMA exempts certain facilities from compliance, referred to as "qualified facilities." A "qualified facility" for purposes of this exemption is one that sells less than $500,000 in food annually and, within a three-year period, sells the bulk of its product directly to consumers or restaurants or retail food establishments located in the same state or within 275 miles of the qualified facility. Also exempt from Section 103 requirements are seafood, juice and low-acid canned food facilities already subject to HACCP programs and those facilities subject to the requirements for produce safety.

The new requirements imposed by Section 103 are substantial and require careful, advance planning. Having helped companies develop these plans and having defended them in court, McGuireWoods LLP's food and beverage industry team stands ready to assist.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.