Food safety - FDA issues final implementing rule

The 7th and final Food Safety Modernization Act (FSMA) implementing rule is finally here and most companies will have three years to comply. On May 26, 2016, the FDA finalized the Mitigation Strategies to Protect Food Against Intentional Adulteration rule. The effective date of the rule is May 27, 2016, the date of the rule’s publication in the Federal Register. The rule implements the “food defense” provisions of the FSMA and aims to protect the public health from intentional adulteration acts, such as acts of terrorism targeting the food supply.

The proposed rule was issued in December 2013 and the final rule primarily provides more information to stakeholders and greater flexibility for facilities in how they can mitigate these risks. The rule does not focus on specific foods or hazards but instead the rule mandates risk-reducing strategies for processes in certain food facilities.

The rule applies to domestic and foreign companies that are required to register with the FDA as food facilities under the Food, Drug, and Cosmetic Act (FDCA). Primarily, the rule is targeted at large companies whose products reach many people, while smaller companies may be exempt. Also, the rule does not cover farms. The FDA estimated that there are 3,400 covered firms under the rule that operate 9,800 food facilities.

The FDA is providing a longer timeline than expected for facilities to comply with the final rule. Very small businesses will have to comply with modified requirements within five years after the publication of the final rule. Small businesses[ will have to comply four years after the publication of the final rule. Finally, all other businesses will have to comply three years after the publication of the final rule. Facilities should begin to determine if they are exempt from the rule’s requirements or have to meet modified requirements. While the deadlines are a few years away, affected facilities should begin efforts now to ensure that all of the rule’s requirements are met by the compliance start date.

Exemptions from the final rule include

• A very small business. These businesses would still be required to provide to FDA, upon request, documentation to demonstrate that the business is very small.
• The holding of food, except the holding of food in liquid storage tanks.
• Activities that fall within the definition of “farm”.
• On-farm manufacturing, processing, packing, or holding by a small or very small business of certain foods identified as having low-risk production practices. The exemption applies if such activities are the only activities conducted by the business subject to the rule. These foods include certain types of eggs, and certain types of game meats.
• Manufacturing, processing, packing, or holding of food for animals.
• The packing, re-packing, labeling, or re-labeling of food where the container that directly contacts the food remains intact.
• Alcoholic beverages under certain conditions.

Key provisions of the final rule include

• Covered facilities must prepare and implement a food defense plan. The written plan must identify vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions and verification. A re-analysis of the plan is required every three years or when certain criteria are met, such as improperly implemented mitigation strategies.
• A vulnerability assessment must be conducted and this includes the identification of vulnerabilities and actionable process steps for each type of food manufactured, processed, packed or held at the food facility.
• For each point or procedure in the facility’s process, the vulnerability assessment must evaluate the severity and scale of the potential impact on public health, the degree of physical access to the product, and the ability to successfully contaminate the product.
• Mitigation strategies should also be identified and implemented at each process step to ensure that risks are minimized. The final rule clarified that a mitigation strategy applied in a direct and appropriate way to protect an actionable process step from an insider attack would sufficiently minimize the risk of intentional adulteration.
• Facilities must require that personnel in certain vulnerable areas receive appropriate training.
• Facilities must maintain records for food defense monitoring, corrective actions, and verification activities.
• Facilities must ensure the proper implementation of each mitigation strategy and the final rule gives facilities flexibility to establish these actions in the way most appropriate to their operation and product.
• Facilities must establish and implement procedures for monitoring the mitigation strategies.
• Facilities need to have corrective actions in place if mitigation strategies are not properly implemented.
• Covered entities must have verification activities to ensure that monitoring is being conducted and appropriate corrective action decisions are being made.

Due to the novelty of the rule, the FDA is providing education and outreach tools to affected food facilities. The FDA established an Intentional Adulteration Subcommittee with the Food Safety Preventive Controls Alliance to develop food defense training resources for industry and regulators alike. Additionally, the FDA intends to publish guidance documents to provide information about the final rule requirements, such as conducting a vulnerability assessment, identifying and implementing mitigation strategies, and writing procedures for food defense monitoring, corrective actions, and verification. The Mitigation Strategies Database is also available for covered facilities and provides a searchable list of mitigation strategies that can be used during different times in a food operation to mitigate intentional adulteration risks. Lastly, the FDA FSMA Food Safety Technical Assistance Network is a central source of information to help the industry understand and implement FSMA.