We hope you’re enjoying our new monthly feature on the Food Safety Modernization Act! We’re back to provide another round of answers to those burning FSMA questions that we know are keeping you up at night. This month, we address the written assurance and written disclosure requirements under the Preventive Controls rule, when supplier verification is needed, and how a farm should respond if the Food and Drug Administration shows up to conduct a facility inspection.
Please keep your questions coming! You can send them to Tim Birmingham at tbirmingham@almondboard.com with the subject line “FSMA Files.”
Question: When does 21 C.F.R. §§ 117.136 in the Preventive Controls rule, which requires facilities to provide so-called “written disclosures” to and obtain “written assurances” from their customers, apply?
Straight Talk: Typically, this provision will apply to handlers that are “facilities” and that do not pasteurize or otherwise treat the almonds they handle at their own facility, but rather send the almonds to a custom processor or a DV user for treatment. This is because you only need to comply with 21 C.F.R. §§ 117.136 if (1) you are a registered food facility and you engage in activities that require you to have a food safety plan for the foods you produce; and (2) rather than control a food safety hazard at your facility, you rely on your customer downstream to control the hazard.
Explanation: The Preventive Controls rule only applies to registered food facilities that engage in certain activities. If you are a registered food facility and one of the exemptions from the rule does not apply, then you must identify potential food safety hazards that may occur with your product, and then put controls in place to prevent or mitigate the most serious hazards. The rule provides that when a manufacturer identifies a hazard requiring a preventive control, but it does not control the hazard and instead relies on an entity in its distribution chain to address the hazard, it must:
- Provide documentation to its direct customer that the food is “not processed to control [identified hazard]” (a “written disclosure”); and
- Annually obtain a written assurance from its customer that the customer is manufacturing, processing or preparing the food in accordance with the applicable food safety requirements, or will only sell the food to someone who agrees to do so.
Keep in mind, however, that FDA has delayed the deadline for compliance with the “written assurance” component for two years, while it works to figure out ways to make the regulation more practical to implement. Therefore, facilities do not need to take steps to comply with the written assurance requirement at this time. (But the written disclosure requirement remains in effect).
Alternatively, the regulation also provides that no written assurance or written disclosure is required in situations in which a hazard is controlled downstream if “you have established, documented and implemented a system that ensures control, at a subsequent distribution step, of the hazards in the food you distribute, and you document the implementation of that system.” With the mandatory program for reduction of Salmonella bacteria on almonds, sufficient controls and systems may already be in place, which would enable handlers to avoid additional written assurance requirements for microbiological pathogens. FDA has not yet issued guidance on the types of situations to which this provision applies or what such a system would look like. Almond Board of California (ABC) will be offering more guidance on this in the coming months.
Finally, it’s important to recognize that there are a number of open questions about when and how the written disclosure and written assurance requirements apply. ABC has been engaged with FDA to adapt these requirements in a way that makes sense for the almond industry, and takes into account the mandatory pasteurization component of the marketing order.
Question: Under what circumstances do I need to comply with Subpart G in the Preventive Controls rule and have a supplier verification program?
Straight Talk: You need to have a supplier verification program when you are engaged in manufacturing or processing activities and you are relying on a supplier to control hazards in the materials you receive. For example, if you are making seasoned almonds and you receive pasteurized almonds and treated seasonings at your facility, you need to conduct supplier verification on your suppliers for those materials.
Explanation: Subpart G – Supply-Chain Program in the Preventive Controls rule only applies to registered facilities that are engaged in manufacturing/processing activities that are covered by the rule. So your first step is to determine whether you are a “facility.” (If you are a “farm mixed-type facility,” you also need to determine whether the exemptions from the Preventive Controls rule for low-risk activities conducted on-farm apply to you. For example, if you are a farm mixed-type facility, meet the definition of a small business, and the only manufacturing/processing activity you conduct is making almond butter, then you are exempt from Preventive Controls, including Subpart G.)
If you are a facility engaged in manufacturing/processing that is covered by the Preventive Controls rule, then your next step is to determine whether you rely on any of your suppliers to control food safety hazards in the ingredients, foods and materials you receive. For example, if you receive treated spices, or cheese powder to make seasoned almonds, then you likely rely on your suppliers to control food safety hazards in those foods. Likewise, if you rely upon a custom processor to pasteurize the almonds you receive, then you rely on the custom processor to control hazards in the almonds. In these circumstances, you will need to develop and implement a supply chain program to verify that your suppliers are in fact controlling the hazards in these foods.
Question: What should a farm (including huller/shellers and brownskin almond handlers considered a primary or secondary farm) do if FDA shows up to perform a facility inspection?
Straight Talk: If FDA seeks to perform a facility inspection on your farm, you should politely inform the inspector that you are a farm, rather than a facility, as those terms are now defined in FDA’s regulations. If you previously were registered with FDA but have recently canceled your registration, you should explain this, and also be prepared to tell the inspector why you canceled your registration.
Explanation: FDA modified the “farm” and “facility” definitions as part of the FSMA rulemakings, so some operations that previously were part of FDA’s database and are on the list of operations to inspect as facilities now qualify as farms. (Conversely, be aware that some operations that previously were considered as farms may now be considered facilities.) If you have concluded that your operation is a farm, you should ensure that your operation is no longer registered with FDA through its online registration system.
If FDA representatives arrive to inspect your operation, first ask them the purpose of their inspection. If FDA is inspecting for compliance with either of the regulations that apply to registered facilities (i.e., Good Manufacturing Practices and Preventive Controls), you can politely explain that your operation is a farm, rather than a facility, so it should not be inspected for compliance with those rules. Also, consider keeping a brief document explaining your farm’s reasoning for why you fall under the farm, rather than the facility, definition. You could use this as talking points with FDA if the need arises and it always is good to memorize your thinking.
Bear in mind that after your Produce Safety rule compliance date (which could be as soon as January 26, 2018, for a large business), FDA may be making a visit to perform an inspection of your compliance with that rule.
This column was prepared by Elizabeth Fawell and Maile Hermida, who are lawyers with Hogan Lovells US LLP in Washington, D.C. The FSMA Files column is provided for informational purposes only and does not constitute legal advice.
