Now that the first of the FSMA compliance dates have passed, let’s look back at the past year of training new PCQIs, their questions and concerns from classes as well as the perspective from our FDA friends (yes, really!) who attended our workshops. We have learned so much, it is hard to narrow it down to only five things—but if we look at the issues that arose, the following five proved to be recurring themes throughout 2016.
5. Don’t Scrap Your Current Plan
Many clients have approached us and said they were planning to throw their current food safety and/or HACCP plan in the trash and start from scratch. Please don’t do this! Companies that care about quality and food safety already have effective quality management systems in place. It would be a disservice to the company and the general public for all these time-tested plans to go straight into the bin. It is more realistic to take a look at the current system in light of the new regulation and ask yourself if there are any gaps that can be addressed. This brings us to the next point.
4. Education Is Key
A compliant system cannot be developed without an understanding of the requirements. Although FSMA is derived from the basic principles of HACCP, there are key differences, and not all of them in the direction of less regulation. It is important to understand not only the updated Good Manufacturing Practices and Preventive Controls for both Human and Animal food, but also the Foreign Supplier Verification Program, Sanitary Transportation and the Produce Rule (if they apply). Although the FDA-recognized curriculum for some of these companion regulations have not yet been released, some independent training providers are offering workshops to help fill the gap while the FDA and FSPCA are working on the official curriculum. (Comment on this article for more information via email).
3. “You Must Evaluate If You Need It” Is Not the Same as “You Don’t Need It”
Some training providers have told their attendees that they can scrap many of their current systems because FSMA is less stringent than GFSI-approved schemes. Your certification body for FSSC 22000, SQF or BRC does not care one whit how stringent FSMA is (as long as you are compliant with its requirements, as local regulatory compliance is a key factor in GFSI approval). FSMA will not change expectations related to the GFSI-approved food safety schemes. It is also misleading to think that because FSMA is flexible, FDA regulators will not have expectations of excellence when they arrive at food processing facilities. This law gives regulators the power to take legal actions to address many infractions they have seen over the years but have been powerless to stop; the flexibility may well be a double-edged sword in that regard. Ensure that all decisions are based on data and records exist to validate any claims.
The new requirements under Section 117 cGMPs of FSMA mandate that a “Qualified Individual” oversee the hazard analysis, preventive control process and Food Safety Plan. The expectation is that a plant operator designates qualified resources who are adequately represented during all food processing and handling at registered sites. In addition, the Qualified Individual stipulation requires that the organization provide resources to maintain the company’s GMP program and food safe processing, and to oversee key regulatory activities.
|Learn more about FSMA compliance at this year’s Food Safety Consortium in Schaumburg, IL | December 7-8, 2016|
Qualified or Competent Individual under FSMA Hazard Analysis and Risk-Based Preventive Controls
The organization must provide Qualified Individuals in all areas to ensure the food safety of product processing, production and distribution. The key roles under “Qualified Individual” are described under Subpart C Section 117.126. This statute requires that the food safety system and plan requirements must be overseen by Qualified Individuals. This includes development of a Food Safety Plan—prepared, or its preparation overseen, by one or more preventive controls Qualified Individuals. Additionally, the statute, as described in cGMPs, indicates that experience, education, certification and other qualifications are appropriate for companies to determine Qualified Individuals.
Other FSMA requirements under Section 117 include the following (as summarized and aligned for specific cases):
- 117.160(b) (1) Validate that preventive controls required under 117.135 are adequate to control hazards in the facility’s Food Safety System prior to development of the Food Safety Plan by Qualified Individual, or:
- 117.160 (b) (2) validation of preventive controls within 90 days or a reasonable timeframe after production of applicable food begins by Qualified Individual.
- 117.160 (c) food not applicable based on factors such as the nature of the hazard (including allergen, sanitation controls, recall plan, supply chain program or determined non-applicable hazards), as determined by Qualified Individual.
- 117.165 (a) (4) As appropriate to the facility and its role in the Food Safety System, review records that are effective and make decisions about corrective actions by a Qualified Individual.
- 117. 165 (a) (4) (i) Maintain records of monitoring and corrective actions within seven working days after the records are created by Qualified Individual.
- 117.170 (c) (2) (ii) Reanalysis by the Qualified Individual every three years for the written justification of the Food Safety Plan exceeding 90 days after production of applicable food.
- 117.170 (c) (2) (e) Preventive controls Qualified Individual must perform (or oversee) the reanalysis.
- 117.180 Requirements applicable to a preventive controls Qualified Individual and Qualified Auditor are described in this section with the introduction of the Qualified Auditor-level resource.
- 117.180 (a) One or more preventive controls Qualified Individuals must do or oversee:
- Preparation of the Food Safety Plan
- Validation of preventive controls
- Written justification for validation that exceeds the first 90 days of production.
- 117.180 (a) General processes and controls.
- Overall sanitation of the plant must be under the supervision of one or more Competent Individuals assigned responsibility for this function.
- 117.190 Implementation records required for this subpart.
- Records that document applicable training for preventive controls Qualified Individual and Auditor.
These requirements under FSMA list the necessity of multiple Qualified Individuals, Qualified Auditors, and Competent Individuals for sanitation. Accordingly, all management and personnel must know, understand and be trained for the food safety aspects of their jobs.
Self-Diagnostic Assessment Tool
The following self-diagnostic assessment tool can help organizations better determine their current state of planning when it comes to determining and deploying the various Qualified Individuals in meeting FSMA. To complete your own planning assessment, review your progress compared to the questions below.
Companies must have the appropriate resources to comply with FSMA or face possible violations, fines and penalties under FDA enforcement. The questions in Table I will help companies identify the areas in which they need to focus attention. Kestrel can also help answer questions, provide input on solutions, discuss how to better manage GFSI certification—and change “No” responses into “Yes” responses that promote best practices for FSMA compliance.
Get the checklist to assess your company’s readiness level. It’s a crucial part of the compliance process.
Training plays a crucial role in the FSMA Preventive Controls rule. As online learning becomes a more integral part of employee learning, companies may want to reexamine the methods they use to boost more effective outcomes. And for companies that currently use face-to-face training, investing in a virtual approach could encourage a more proactive employee learning experience.
“Under the [Preventive Controls for] Human Food rule we have legal roles that didn’t exist before—we must create smarter career pathways for these new positions and responsibilities, such as the Qualified Individual under the PCQI, the Preventive Controls Qualified Individual, and the auditor,” says Kathryn Birmingham, vice president, research and development at ImEpik. “The compliance required for these new positions is a great opportunity to use innovative and scalable training models. This becomes even more important for ROI (return on investment) in training, when turnover is likely or when companies want to attract new talent into the food safety industry.”
In a Q&A with Food Safety Tech, Birmingham explains how companies can navigate some of the additional training requirements under FSMA and how interactive online learning may offer both employees and companies more successful results.
Food Safety Tech: What employee training challenges do today’s food companies face?
Kathryn Birmingham: As an educator, business owner and researcher who has designed certification and degree programs for workforce training in several industries, I see [that] the food manufacturing industry must move from lifetime experience training to training standards. For the first time, the evidence of QI training and PCQI credential are owned by the person as they move from company to company.
Food companies need a cost-effective training system that can assess knowledge, skills and competency standards. Industry research tells us that company leaders want training that is relevant, in which employees can apply skills right away. They want to be able to test the knowledge of persons in these new roles who are accountable for regulatory compliance. Thus they expect valid assessments in their certification training.
The demand is for smarter pathways to reach these new legal roles in the legislation for the QI and PCQI. Assisting in this area, we need to remember that food manufacturing companies view their number one job as making food, not completing paperwork or digital documentation, so when it comes to FSMA we have to come up with relevant training that can be applied right away.
FST: In what areas do you think companies are unprepared for FSMA implementation and compliance?
Birmingham: Companies seem to be least confident in terms of training in a few areas: For the legal role of the PCQI, they seem to be least confident about the record keeping requirements and foreign supplier verification areas.
For the role of the QI, standardized training doesn’t exist, but we know from the PCQI training that if the QI is required to implement the food safety plan under the PCQI, then QIs must understand components of the food safety plan and the hazard analysis. So it follows that the QI must also understand some scientific and regulatory factors related to the preventive controls along with the new language that must be used in the food safety plan and documentation.
FST: What tools or technologies should companies leverage?
Birmingham: Research and successful practice in workforce training tells us a few things. In order to speed learning and verify the trainee’s learning, knowledge and competencies, we recommend instructional methods that are immediately relevant, engaging and motivating. Effective training for food safety regulatory compliance helps the learner with stronger critical thinking for decision-making and encourages the learner to apply the skills right away. Modular instruction allows time for practice and reflection while increasing the odds of retention of the material. Relevant work simulations can teach technical and scientific knowledge as well as communication skills.
We recommend online training that demonstrates proficiency and mastery rather than passive learning. The learner must engage and practice what they’re learning, show an understanding, practice critical thinking, and pass valid assessment exercises.
FST: Do you think a lot of passive learning is happening in the food industry?
Birmingham: [Birmingham cites a food safety online training survey conducted by ImEpik earlier this year; see Table I.] Survey responses from a sample of 140 companies are telling us that they’re not satisfied with lack of engagement in training offerings. Those overseeing training would like to see more valid assessments. In terms of passive learning, they don’t want to click through voice-over narration for training or have face-to-face training that is lecture style without a lot of engagement. They want to understand the learning outcomes and what they should be getting out of the curriculum as they move through the training.
|Preference for Specific Online Learning Attributes|
|I Dislike It||I Can Tolerate||I Expect It||I Like It|
|Research-based Instructional Methodologies||—||—||79%|
|Certificate of Completion||—||—||65%|
|Table I. Results from ImEpik survey about food safety online training. While animation and learning analytics are not as expected in online learning, these attributes are an important part of simulating the work experience in order to apply new knowledge, test specific content areas for clarity and assist the learner in remediation as needed. Data courtesy of ImEpik.|
In the 2015 survey, 73% said they expect interactive activity in training while 91% expect valid assessment. People are looking for feedback as they progress through training. In the end they want to have the ability to prove what they know and can do.
With the emphasis now on FSMA, for companies to develop their entire food safety team, we need to rethink training and remember that it is possible to look at other industries and see what they’ve done with these career pathways for new roles that have been legislated. We can compare online training that is accessible anywhere and agile enough to train for new concepts quickly. Science and GMPs change. This is where a tool like online learning—not only full-course certification courses but also micro-learning modules—can really help the industry. And in the long run, it could be a better return on investment than face-to-face and long-term experiential learning.
Confusion reigns in many organizations and especially with our food safety and quality professionals, as we debate and attempt to decide how best to address the requirements of FSMA. With the first compliance date of September 2016 drawing near, companies are feeling increased pressure to take action. As many are already accredited to a GFSI-approved food safety scheme such as SQF Level 3, BRC, Primas, IFS or FSSC 22000, often the question is, how does my current system fit into FSMA, and where do I need to make changes? The undercurrent to this question is the implication that changing the system to fit FSMA will cause it to no longer be tailored for the desired GFSI food safety scheme, and that a change could cause issues with those audits (which are crucial for purchasing, marketing and sales).
The Food Safety Consortium will discuss critical industry issues, including FSMA compliance. The event takes place in Schaumburg, IL | December 5–9, 2016 | LEARN MOREAs with so many of our industry challenges, there is no easy and prescriptive answer to these questions. Each organization has to make the decision for their own system based on their individual hazard analysis, risk tolerance and resources. Some over-arching themes begin to emerge, which may be analyzed to assist the decision makers in the creation of a road map to FSMA compliance.
During our FSMA Preventive Control Qualified Individual (PCQI) training courses we are repeatedly asked, “What qualifies as a preventive control? Are our critical control points (CCPs) automatically a preventive control? How about our operational prerequisite programs (OPRPs)—are these PCs also?” While there is no easy answer (yes or no), there are some important things to keep in mind that can help in the decision.
The official answer is that a preventive control should be any point in the process where, with a loss of control, it is reasonably foreseeable that a significant food safety hazard either will occur or has an increased likelihood of occurrence. Remember this is intended to be a single point in the process, not the entire process. For example, the sanitation program may be managed as a prerequisite program; however, there may be a point in the process that requires special sanitation attention and without it, there is a reasonably foreseeable likelihood of a hazard.
Thinking about the concept, a logical conclusion is that a loss of control leads to a significant food safety hazard or, at the very least, increases the likelihood of said hazard. It follows that a loss of control would beget the need for a withdrawal if the product had already left the organization’s control. Therefore, one should only designate a point as a preventive control if the implications of conducting a recall in the event of failure have been analyzed as part of the risk assessment. The organization must be fully prepared to conduct such a recall in the event of failure.
The FSMA Preventive Control regulation (§21CFR117.135 – Preventive Controls) requires a recall program only if there is a preventive control identified in the process. Of course, any food processing organization would be remiss if they did not have an effective recall program defined and tested by regular mock recalls. Waiting for a true recall is no time to find out that your program has issues. Even without a preventive control, what happens if a supplier contacts the processor with an issue that requires a recall?
Through the evolution of compliant and mature food safety management systems, it is common for an organization to initially identify multiple CCPs and then, through data collection and process improvements, slowly reduce the CCPs to control points managed through OPRPs or PRPs over time. So, should an OPRP (Operational Prerequisite Program – ISO 22000:2005 Section 7.5) also be designated preventive control? This is perhaps one of the grayest of gray areas in this arena. A deviation in a preventive control, if the product has left the organization’s control, requires a recall. A recall for a deviation in an OPRP is not absolute, and it is actually handled by the food safety team and management on a case-by-case basis, depending on the risk. In addition, although identified when possible, a critical limit is not required for an OPRP (ISO 22000:2015 Section 7.5). Parameters are required for a preventive control.
There really isn’t one answer that fits every situation, but it is important to remember that the requirements for FSMA Preventive Controls regulation (§21CFR117.135) are designed for those operations that in the past have not had the opportunity to define, implement and maintain a food safety program—one that includes a hazard analysis based on HACCP guidelines (Codex Alimentarius Commission [Annex to CAC/RCP 1-1969, Rev. 3 (2003)]) and/or a GFSI-approved food safety scheme. Personally, we feel that if an organization has evaluated their process in compliance with a GFSI-approved food safety scheme, then any reasonably foreseeable hazards have been identified and addressed through a control point such as a CCP, OPRP or PRP. However, that said, upwards of 90% of recalls are linked to either ineffective or nonexistent PRPs such as allergen mislabeling, which accounted for 53% of all recalls last year. Thus, it is imperative that we evaluate all aspects of our processes with the same scrutiny that we do our microbial pathogen and metal control programs, which are common CCPs in today’s world of food safety.
Risks must be evaluated through an effective risk assessment based on science and facts. We start almost all of our workshops with the great American Society for Quality (ASQ) video: Cost of Poor Quality. This highlights the lack of an effective risk assessment performed on January 28, 1986, related to the launch of the Challenger. Unfortunately, emphasis was not on the fact that the engineers presented about the lack of cold temperature stability of critical O-rings, but rather on the fact that the launch had already been postponed for two days, and there was intense media and political hype surrounding the event. An effective risk assessment must be based on facts and objectivity, not on our feelings about what we want or need the decision to be.
FSMA PCQI training stresses the use of reliable and credible resources such as academia, trade organizations and process authorities. The internet itself can also be a valuable resource. Jon Porter stated in 2004, “HACCP, as we know it, would not exist without the internet.” (If Jon could only see us now.) However, again, we must be sure we are choosing credible information from the internet. We all know that we can usually find any answer we desire on the internet, but is it credible and accurate?
Competent industry sector-experienced consultants may also be good options if the organization ensures their credibility. Sometimes, a set of independent eyes can be just what the doctor ordered. Even in cases where the organization has a fully qualified team that is perfectly capable of managing the food safety program on their own, the right external resource (i.e., consultant) may provide an additional, independent viewpoint to your process. A friendly debate with an external resource can oftentimes open a whole new vista of previously unconsidered possibilities for the team.
The FSMA Preventive Controls regulation (§21CFR117.135) states that “each organization is required to have a PCQI that has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to develop and apply a food safety system”. What qualifies an individual to be qualified through job experience is not specifically defined but is judged by the effectiveness of their food safety program. However, if FDA visits the facility and asks for the PCQI and no one has taken an FDA-recognized course—but there is someone that the organization has identified as qualified—this has the potential to start the visit off with a negative focus. We urge each organization to send two food safety associates to an FDA-recognized FSMA PCQI training course regardless of their background (this provides a back-up person in case the primary representative is ill, traveling for business or pleasure, wins the lottery, or otherwise leaves the company, etc.). This provides a strong foundation for the future, as ownership of the system is always crucial to not just surviving an inspection, but excelling—and as food safety professionals that is an idea we can all support.
You will hear some new abbreviations being tossed around in questions by executives in food manufacturing and processing these days. “Do I need a PCQI? Who is my PCQI? What is a PCQI?”
Strangely, many of these executives do need a PCQI, and they need one very soon. A PCQI is the “Preventive Controls Qualified Individual” needed to oversee implementation of the HARPC rule under FSMA. Last September FDA published the final rule “Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.” Unless a food manufacturer is specifically exempt, the date for compliance with implementation of the rule’s preventive controls portion is September 19, 2016. A facility’s PCQI is responsible for overseeing the implementation process. For companies that have yet to prepare for compliance, the good news is that several organizations, such as the Food Safety Preventive Controls Alliance, offer training to meet the requirement for having a PCQI.
For large companies (those with more than 500 employees), time is of the essence to meet the September 19 compliance date; for companies with less than 500 full-time-equivalent employees, you have more time to prepare, with September 18, 2017 being the compliance date.
Whether your due date is this year or 2017, your food safety plan is the primary document that guides your preventive controls food safety system. It must be developed using a systematic and risk-based approach that uses scientific principles to identify the hazards that require preventive controls to prevent foodborne illness or injury. It is most effectively prepared not only by a single PCQI but also a cross-functional food safety team that includes individuals with executive support and leadership. In addition to including the hazard analysis in which you must analyze for hazards requiring a preventive control for your product(s), your food safety plan must have preventive controls for your process and for food allergens, sanitation, supply chain and any other appropriate areas where you identified that preventive controls were needed.
Further, your food safety plan must include a recall plan, procedures for monitoring, corrective action and verification when a hazard requiring a preventive control is identified, along with science-based validation for process preventive controls. Of course, Good Manufacturing Practices (GMPs) and other prerequisite programs must be in place to provide a solid foundation for your food safety plan. And there’s more news: FSMA includes significant changes in the GMPs. For example, all formerly non-binding provisions are now binding, including education and training. One of the new GMP requirements is cleaning of non-food contact surfaces “as frequently as necessary” to protect against allergen cross-contact and contamination of food contact surfaces and food packaging.
Back to the possibility that you may qualify for a specific exemption, if you heard that processors subject to the low-acid and acidified canned foods regulation are not subject to the preventive controls rule, the exemption is only for hazards that are microbiological. For physical and chemical hazards, including allergens, a hazard analysis must be conducted to determine whether hazards are an issue and whether preventive controls are needed. This analysis must be documented, even if you determine that no preventive controls are needed. And if preventive controls are needed, they must be developed and documented with verification and possibly validation as previously described. Of course the new GMPs also apply to low-acid and acidified canned food manufacturers.
If you heard that warehouses are in the clear due to a specific exemption, there is more to the story. Only facilities such as warehouses that store strictly unexposed packaged materials for which refrigeration is not required are exempt from preventive controls. Facilities that store raw agricultural commodities that are fruits and vegetables are not exempt from hazardous analysis and risk-based preventive controls. All of these facilities, and even those subject to seafood and juice HACCP and not required to do preventive controls, are not exempt from updated GMP requirements.
Take the obvious first or next step for your organization’s compliance with FSMA: Ensure you have a PCQI and start working on your hazard analysis and food safety plan now.
FSMA introduced two different types of identified individuals, the Preventive Controls Qualified Individual and the Qualified Individual. Specific training requirements are associated with each. Dr. Hilary Thesmar, VP FMI Food Safety Programs reviews the difference in responsibility and required training for each role for your checklist. Watch the webisode