Preventive Controls Documentation

In previous blog posts, we've looked at the new ways food facilities must identify and evaluate food safety hazards, as well as the types of controls they need to put in place. In this one, we'll examine another large piece of the FSMA pie: documentation.

FSMA changes the requirements for mandatory recordkeeping and documentation of food safety information.

If you're looking for a shortcut rule, here it is: Document everything and keep your records.

Let's look at the new requirements in a little more detail.

What documentation is required?

Under the previous system, documentation focused on traceability through the supply chain. In the new one, the documentation requirements go far beyond that to include the food safety plan and its entire implementation and remediation process.

Here's an overview of the required documentation:

  • Hazard analysis
  • Preventive controls for each identified hazard
  • Verification of preventive controls to ensure they are effectively controlling the hazards
  • Monitoring procedures to ensure preventive controls are consistently performed
  • Corrective action procedures for each hazard, as well as records of all instances requiring corrective action
  • Supplier approval and verification program
  • Recall plan
  • All test results
  • All audit results
  • Training records for the Preventive Controls Qualified Individual

How long do you need to keep this documentation?

Your food safety plan must be readily accessible at all times. For records related to food hazards and process control systems, keep them for at least two years.

What will the FDA do with this documentation?

FDA inspectors can request your food safety plan and records at any time. These records reviews are anticipated to play a large part in FDA inspections because they will give inspectors insights into what happens in the plant on a daily basis.

Importantly, if there is no documented control for a particular hazard, the FDA will assume there is no control in place. Since the FDA also has increased powers of enforcement, this isn't a risk you'll want to take.

These recordkeeping and documentation requirements are steeper than they've been in the past. As a general rule of thumb, if you're going to err, err on the side of too much documentation as opposed to too little.

Just keep repeating the mantra: Docs or it didn't happen!