The first FSMA implementation deadline — general compliance with the Preventive Controls Rules — hit last September. This September, small companies will need to comply with these rules, followed next year by very small companies. Over the next five years, we’ll see a similar pattern for the remaining rules: Produce Safety, the Foreign Supplier Verification Program, Third-Party Accreditation and Certification, Sanitary Transportation, and Intentional Adulteration.

While there is a perception that, especially for big companies, implementing FSMA is mainly a matter of “dotting your i’s and crossing your t’s,” for most companies that isn’t the case. Even companies that have solid food safety plans and processes in place are still finding complying with the Preventive Controls Rule a challenge.

To learn more about where companies are and where they need to go, we spoke with Dr. Scott Brooks, a food safety, quality, and regulatory expert and owner of River Run Consulting.

Brooks has a long history of expertise in this area. Before starting his consulting business, he held leadership roles in food safety, quality, and regulatory affairs at Kraft, PepsiCo, and Yum! Brands. Prior to that, he was a public health officer in the armed forces. He also has a master’s degree in food microbiology and a doctor of veterinary medicine degree focusing on farm-to-table food safety. Today, Brooks’s consulting business works with clients on both the consumer packaged goods side and the food service side of the industry.

Brooks served as one of our PROCESS EXPO Experts in Residence last semester, where he outlined a four-part plan to help companies achieve food safety by design:

In this article, we look at where companies stand right now with FSMA compliance, and what they need to do going forward.

Where companies are now: Still working to understand the requirements

One of the biggest hurdles to FSMA implementation is simply understanding what needs to be done.

Brooks believes that the FDA has “somewhat downplayed the challenge” that FSMA poses for large companies.

But, he says, that’s “flat wrong.” A lot of things need to be done, and they require a lot of resources. This includes hiring the right people and putting new systems and processes in place.

It also includes extensive documentation. For companies that already have their process controls well documented, the shift to FSMA is certainly easier. But it’s a far cry from finished. The Preventive Controls for Human Food Rule comes with stricter requirements for documentation and recordkeeping than the industry is accustomed to. And as the FDA issues guidance for the other rules, we’re likely to see requirements for documentation that extend far beyond the bounds of the food safety plan.  

The trick for now is that the FDA hasn’t issued all of its guidance yet, so companies are “left in a little bit of a lurch.”

Brooks notes: “A lot goes into setting up these systems. If you set them up one way and the FDA says it isn’t adequate, it’s a huge change. Especially for companies with 40, 50, 60 facilities across the United States, it can cause stress on your system. For consistency and execution, you need a simple message that you can put out there and your facilities can execute. It’s best to think about it just once. Companies will react appropriately, but it will be quite stressful. And that’s where a lot of companies are right now.”

For small and medium-sized companies, like many ingredients suppliers, the concerns are similar. But, for the most part, they’re starting from a different place. The compliance deadline for small businesses isn’t until this September, and, according to Brooks, many haven’t yet thought about their documentation and food safety plans. “Some don’t realize what they’ve got coming,” he says. “They may think they’re ready, but they haven’t gone through everything.”

A special challenge smaller companies face is that they don’t have the same internal resources as their larger counterparts. “They may have just one or two people responsible for food safety and quality. And they’re busy dealing with the day-to-day operations to make sure food is produced safely. It takes additional time and resources to deal with the new regulatory requirements.”

What companies need to do to be ready for the FDA

Brooks has many ideas for what companies large and small can do to make sure they’re ready when FDA auditors appear at their doorstep. What they all boil down to is this: Do something, and do it now.

This approach is especially applicable to small companies. With the compliance deadline eight months away, Brooks says, “many companies don’t have the sense of urgency they probably should have. If your implementation deadline is September 19, you need to be working toward it now. You can’t wait until September 1 to start thinking about these things.”

In terms of how long it will take, that depends on the process. For a simple process making a simple product, like salt, Brooks estimates a few to six months, depending on the effort.

On the other hand, if you have a complex operation that uses a lot of process controls, cooking, acidified foods, and so on, you’ll need to do a lot of validation work, “and that takes time.” If you haven’t validated your processes to deliver a microbial kill step or to manage and audit your suppliers, you need to get going. In addition, companies involved in co-manufacturing or private label manufacturing tend to have more complex processes.

“Big companies have been working on this for a year and a half or more,” Brooks says. “And they’re still getting everything together. You can probably get things in place in six to nine months to check most of the boxes, but if you really want to be on top of it, you should be thinking a year or more.”

Here are the strategies Brooks recommends.

Act on the best information available

We mentioned earlier that the FDA hasn’t yet issued all of its guidance. But, Brooks says, that shouldn’t stop companies from taking action now. “The rules are out. You can read the rules. Just be aware that you may have to adjust your interpretation when the guidance comes out.”

For example, Brooks notes that there’s a gray area around how to manage relationships with co-packers. He recommends that companies “give their best effort now, work with their suppliers to take action, and be ready to adapt later.”

Get involved with industry organizations or hire outside expertise

Industry organizations can help companies solve the puzzle of what actions to take. Brooks notes that the Grocery Manufacturers Association has been doing a lot to help its members work through the “question mark issues” by pressing the FDA for guidance and sharing with the FDA areas where the industry is struggling.

For smaller companies that aren’t members of the GMA, Brooks advises bringing in outside expertise “to understand some of the complexity that’s coming.”

Ensure someone at your facility is PCQI trained and establish a food safety plan

Every company should have somebody who has been through Preventive Controls Qualified Individual (PCQI) training. That person is qualified to establish the food safety plan.

Brooks says: “The plan may not be perfect, but don’t sit back and wait. Get that plan in place. When the FDA comes in, you’ll be in better shape than if you had nothing. It may not protect you from getting a 483, but it will give you a baseline to work from and make improvements. If they come in and you have nothing in place, you’ll be behind the power curve.”

Develop an environmental monitoring program

A key element of a food safety plan is an appropriate environmental monitoring program based on the facility hazard analysis. This is particularly important for RTE food processors.

The FDA has announced their intention to perform more inspections this year. Specifically, they’ll be conducting what Brooks calls a “swab-a-thon,” in which they’ll pick hundreds of facilities and swab objects in the environment looking for Salmonella and Listeria. Brooks predicts this will lead to even more recalls than we saw in 2016 (which, by the way, included one of the biggest recalls in U.S. history — the CRF recall of frozen vegetables following an outbreak of Listeria).

Brooks notes that the stakes for environmental monitoring are higher now because the FDA isn’t just swabbing for bacteria, but also sequencing their genomes. Whole genome sequencing (WGS) is how the agency discovered that the Listeria in the Blue Bell ice cream recall of 2015 was the cause of illnesses going back to 2010.

By putting an appropriate environmental monitoring system in place now, Brooks says, “you’ll have opportunities for improvement rather than being hit for complete violations of the statute.”

Rethink your sanitation practices

Finally, Brooks encourages companies to reevaluate how they execute their sanitation in terms of infrastructure sanitation and cleanliness, equipment sanitation and cleanliness, and preventive maintenance of equipment.

He points to Joe Stout’s recent Food Safety Magazine article about hygienic design. There is currently a big push in the industry toward this practice, which is an excellent step toward food safety. However, a lot of the facilities and equipment in use today were built decades ago, before we knew as much about hygienic design. And replacing those facilities and equipment is a huge capital investment that could take years.

But, Stout writes, “It is not acceptable to wait a generation for change.” Effective sanitation procedures and controls are things processors can focus on and improve right now.

Looking into the FSMA future

So far, this article has focused on the Preventive Controls Rules, to which big companies are already beholden and small companies will be soon.

But, that’s just two of seven rules (Preventive Controls for Human Food and Preventive Controls for Animal Food). What about the rest of them?

Brooks says that implementation of all of the rules will be complex. However, the one he feels will pose the biggest challenge is the Intentional Adulteration Rule.

While compliance for this rule is still a few years down the road, Brooks says it’s different because it involves operations, physical security, and other aspects of a production environment that don’t fall under the traditional food safety umbrella. This rule is “outside the norm for the kinds of things food safety and quality people deal with daily, and they’ll need to engage people (like security personnel) who haven’t had it on their radar before.”

The FDA hasn’t yet issued guidance for this rule. But, because of the complexity, companies would still do well to start thinking about it now.

For more about implementing FSMA, check out our recent blog series: