FSMA’s first anniversary arrived January 4 this year, and while FDA staffers have made progress in laying the implementation foundation and tightened controls over imported foods and raw materials, requirements for food and beverage manufacturers are hazy at best. Proposed rules for “preventive controls”—FDA speak for a hazard analysis, critical control points (HACCP) plan—likely won’t be unveiled until February or March, and experts predict tighter plant security requirements won’t be known until 2013. In the meantime, production executives and food safety specialists are reviewing their existing HACCP programs and probing for gaps that might surface when FDA auditors begin conducting their own inspections.

Though 2010 was a year of Congressional inaction, FSMA won the approval of both houses of Congress because it had the support of major food companies and lobbying organizations such as the U.S. Chamber of Commerce and the Grocery Manufacturers Association—though produce organizations lined up in opposition. The disastrous 2009 salmonella outbreak tied to peanut butter and peanut paste manufactured by Peanut Corporation of America (PCA) exposed the interdependency of companies up and down the supply chain and galvanized support for stricter food safety protocols. The industry was at the table with legislators and consumer groups that helped craft the new law, which for the first time gives FDA the authority to impound products suspected of being adulterated or misbranded and replaced the system of voluntary recalls.

It also expands the agency’s authority to demand facility records relating to safety and requires all registered production facilities to be reinspected every three to five years, depending on their level of risk. Traceability and facility registration requirements addressed in the Bioterrorism Act of 2002 remain intact, though the consequences of failure to comply are more severe. As a result, there has been a surge in plant registrations since FSMA’s passage (see related story below).

Only meat, poultry, juice, seafood and low-acid retorted foods have been mandated to have a HACCP plan, though surveys by Food Engineering and others consistently indicate at least 85 percent of US plants have HACCP, supported by the good manufacturing practices and prerequisite programs for sanitation and personal hygiene already required under 21 CFR Part 110. But under FSMA, companies will have to demonstrate HACCP is a living program, not a dusty manual on a shelf, public health experts say, with ongoing validation of effectiveness and proof of corrective actions when problems occur. “It’s going to be HACCP-plus,” predicts David Acheson, a managing director with the consultancy Leavitt Partners and former associate commissioner of foods at FDA. His FDA successor, Michael Taylor, is spearheading the rulemaking effort for FSMA.

Collaboration characterized FSMA in the early going, though “maybe when the rules are written, the boxing gloves will come off,” adds Acheson. “I hope not,” but FSMA implementation will move the industry into unchartered waters.

Filling the gaps

While they await explicit rules for FSMA implementation, many companies are taking a proactive approach, reassessing their HACCP plans. In contrast, nearly a decade after HACCP for seafood became mandatory in the mid-1990s, only 86 percent of processors have a written plan. 

A final rule on preventive controls is not due until July, and a grace period will follow, with small and mid-sized food companies being phased into the compliance program in 2013 and beyond. Leading organizations spent 2011 reviewing their food safety systems and conducting gap analyses to determine where improvements were needed. As vice president-quality and food safety for Pittsburgh-based H.J. Heinz Co., Kurt Deibel oversaw a HACCP review for every product on every line in the company’s production network, validating the plans’ robustness and validating critical elements of the safety programs for allergens and pathogen defense, with particular emphasis on sanitation practices. Additionally, a global network of subject matter experts was created to conduct in-house audits of Heinz’s 87 facilities around the world.

Validation requires documentation, and Heinz is improving its electronic records by installing SAP at its 25 North American manufacturing sites, a change “that’s going to improve our traceability” and eliminate the inherent inconsistencies of multiple ERP systems, Deibel says. But upgrading the global supply chain will be the greatest challenge: The company sources 3,000 different ingredients, and validating the processes of the vendors that supply them “is where the big impact will be,” he points out. Deibel hopes FDA will provide guidance in this area in the coming months. (He will provide an update on FSMA at Food Engineering’s Food Automation & Manufacturing Conference in Fort Myers, FL, April 22-25.)

Documentation review also is a focus at Snyder’s-Lance Inc., the Charlotte, NC snack food maker with a dozen North American manufacturing sites. For example, in-house training long has been part of the food safety continuous improvement effort, but now workers must sign and date a document for each training session they attend, “ensuring the document is perfectly aligned with what happened,” according to Greg Flickinger, director of manufacturing.

In theory, documentation should be done electronically. In practice, FDA only enforces the electronic signature requirements of 21 CFR Part 11 with drug companies. But ERP systems are starting to accommodate the shift from paper to electronic records. In recent months, Plex Systems Inc. added “true electronic signature” to its ERP program, according to Tom Nessen, senior solution engineer in Plex’s Atlanta office. He cites the example of Cuisine Solutions, a DC-area processor that integrates every worker’s “skill matrix” in the plant floor operating system. If a worker is not up to date on all training requirements, including food safety, “that employee is not allowed to record production,” says Nessen. “It’s a hard stop."

HACCP gap analysis was a 2011 priority at Lance’s, and like his counterparts at Heinz, Flickinger expects incoming raw materials to be the area of greatest concern under FSMA. But both organizations approach food safety as a continuous improvement challenge, and managers believe the shift toward prevention of chemical, biological and radiological contamination already has occurred and should help most manufacturers avoid the cost of reinspection by FDA, which will bill plants that fail their initial inspection at a rate of $224 per hour, or $325 if foreign travel is required.

FSMA complements the standards programs under the Global Food Safety Initiative (GFSI), Flickinger suggests, and that customer-driven industry effort helps align plant safety programs with the goals of FSMA. Lance’s production facilities were certified under the GFSI-sanctioned SQF program, most at the highest level, and the Snyder’s plants acquired in 2010 are being brought up to that standard. At Heinz, FSSC 22000 certification under GFSI was chosen. Like Heinz’s internal continuous improvement audits, FSSC 22000 is ISO based, Deibel explains. He expects all 22 US plants to be FSSC 22000 certified by mid-year. “The hope in the industry is that FDA adopts an inspection program similar to the GFSI standards,” Deibel adds, and that more consistent expectations will reduce the total number of inspections. Heinz facilities undergo as many as 17 customer audits a year, he notes.

GFSI audits are a good starting point, but Acheson believes FDA plant inspections will be more rigorous. “I don’t think those go far enough,” he says. “If you’ve gone through one of the higher level GFSI programs, you’re in a better position, but you probably are not where you need to be to meet FDA standards.” Once preventive controls guidelines are known, Acheson believes standards such as BRC, SQF and FSSC 22000 will be raised accordingly.

Rationalizing record-keeping

Recognizing the many differences between food companies in terms of product complexity and throughput, FDA never has enforced electronic records requirements for food manufacturers, even when the Bioterrorism Act of 2002 mandated traceability for raw materials and finished goods. “If you can get away with written logs, why buy software?” Acheson asks rhetorically. “If you can get away with Excel, why buy something more sophisticated?” But the direction of food safety requirements is toward more specificity, and the one up, one down traceability that currently exists is destined to give way to much more detailed records throughout the supply chain. “You need a management strategy to do that, and you may need an information system to help you,” he advises.

Business efficiency still is the driver for ERP implementation, with FSMA compliance “a nice side benefit,” Plex’s Nessen observes, but that will change as food companies gain a better understanding of FSMA’s requirements. “FSMA may be the tipping point that forces companies to switch from Access databases and Excel spreadsheets to integrated systems like ERP,” he says. Records will have to be populated with supplier data, as well as process data, and that is beyond the capabilities of homegrown systems, says Nessen.

Plex’s roots are in the automotive industry, and Nessen maintains NASA borrowed from automotive’s failure mode effects analysis when devising the first HACCP program in the 1960s. “Failure mode effects analysis is a lot more rigorous in quantifying risk” than HACCP, he contends, and FSMA may drive some organizations to add a similar risk management element to their safety programs.

Besides collecting more details, FSMA obliges manufacturers to maintain those records for at least two years, according to Tom Chestnut, vice president-supply chain, food safety and quality at NSF International Inc., Ann Arbor, MI. Those records are an integral part of documenting that the company has a functioning safety management system that extends to raw material sourcing, he says.

FSMA’s greatest significance may be its impact on safety standards worldwide, not just in the United States, says Chestnut. “People look to the US for food safety, and if FDA can raise the bar, there’s probably a good chance that the higher standards will become the new baseline globally,” he says. Raising the bar will be a slow process, however, and will require much greater capacity to inspect plants and upgrade the supply chain than currently exists. As one of the leading audit firms performing compliance reviews of the GFSI-standards, NSF has scrambled to recruit and train qualified auditors. Perhaps one in 10 US plants have undergone GFSI inspections, Chestnut estimates. To audit the remaining 150,000 facilities will take many more boots on the ground, and FDA faces an even more daunting infrastructure-building challenge.

In the absence of explicit guidelines, FSMA was a backburner issue in 2011 for many food companies. That soon will change. “We’ve got a tsunami building for the early part of 2012,” says Acheson, with FDA officials intent on having regulations in place before 2013, in case an anti-regulation administration occupies the White House after the next presidential election. Before that happens, food companies may rue their early support of FSMA, but at least the present uncertainty will be replaced by known expectations for food safety systems. 

For more information:

Tom Chestnut, NSF International Inc., 734-769-8010

David Acheson, Leavitt Partners, 801-910-5795

Tom Nessen, Plex Systems Inc., 770-401-9239, tnessen@plex.com