The Food Safety Modernization Act,
After One Year: Advancing and Building Food Safety Systems for the 21st Century

by Steve Armstrong

Most of the compliance dates have now arrived. Regulations have been written and published. Q&As have been issued. The first regulatory guidance documents have come out, with the promise of many, many more in the not-so-distant future. Yet with all of the activity surrounding the first compliance deadlines and the first year of enforcement of the Food Safety Modernization Act (FSMA), it’s fair to say that both the food industry and the Food and Drug Administration (FDA) are realizing that they have a lot to learn—from each other—about building open and collaborative food safety systems.

Both industry and FDA have acknowledged that FSMA represents a major change, but it is also becoming clear that the ongoing efforts at transparency and collaboration between industry and FDA will need to continue if FSMA’s promise of a truly preventive food safety network is to be realized. Food safety leaders in industry will need to get comfortable with sharing their assessments and records and explaining how they manage food safety across the enterprise. FDA investigators will need to get comfortable with taking a more holistic approach to food safety oversight and properly managing their new authority and access to processing records and written food safety programs.

Indeed, the activities of FDA and industry to date reflect a determination to effectuate positive change. As of this writing, FDA has taken several actions to cite facilities for violations of FSMA, but its emphasis has been on training and education. The agency has shared with industry that it is training its inspectors that they do not need to find a regulatory violation during every inspection.1 FDA appears willing to direct inspectors and facility managers toward a collaborative, “systems-oriented” food safety mindset and culture.

But food facility managers can expect that this approach will go only so far. Yes, FDA is being more open and cooperative.  But industry managers must remember that FDA food enforcement tools now have sharper teeth. When FDA uncovers problems, deficiencies, or gaps at a facility, and no immediate public health risks, the agency has shown, at least at this stage, that it can be patient, cooperative, and educational. When there is a known public health risk, however, FDA is pushing harder and faster for facilities to remove known and suspected lots of problematic products. What’s more, there appears to be consensus within the agency that suspending a facility’s registration and thereby shutting down its operations—a new enforcement tool available under FSMA2—is an effective means of protecting public health if a facility does not respond swiftly and effectively to a food safety concern that puts the public at risk.

Fundamental Shift

When addressing the FDLI enforcement conference in December, Scott McIntire, Director of the Division of Enforcement within FDA’s Office of Regulatory Affairs, observed that FSMA represented “a drastic change” not only for the food industry but for FDA as well.3 He wasn’t exaggerating. FSMA has, at long last, empowered FDA to shift its regulatory approach from reacting to food safety problems to preventing them. A bit of historical and legal background is helpful to understand the importance of this change.

For years, FDA protected public health from threats arising in the food supply by proving that a food was “adulterated.” Several definitions of that concept are set forth in the FDCA,4 but FDA frequently employed Section 402(a)(4), which provides that a food is adulterated if “it has been prepared, packed or held under insanitary conditions whereby it may have become contaminated with filth, or whereby it may have been rendered injurious to health.”5

The legislative history of the Act makes clear that this provision was designed to ensure reasonable standards of cleanliness in food handling. Back in the 1960s, FDA creatively applied this authority and issued current Good Manufacturing Practices (cGMPs) setting standards for guarding against insanitary conditions in food facilities.6 While FDA asserted that cGMPs were legally binding, in practice, enforcement took place when contamination actually occurred, or the potential was obvious. Inspectors used evidence of failure to adhere to cGMPs to establish that foods made under such conditions were “adulterated” because of the threat to public health.7

Such actions were based on FDA’s interpretation of Section 402(a)(4) as providing implied authority to prescribe conditions under which food must be manufactured.8 In each case, the agency built a substantive administrative record to back up its findings and demonstrate that the public was at risk unless food was made in the prescribed manner. Generally speaking, FDA’s efforts were reactive in nature. In situations of serious concern, the agency reinforced its efforts with appeals to the public to avoid a food and to industry to conduct voluntary recalls.

Indeed, during the first decade of this century, in response to a number of highly publicized outbreaks of food-borne illness, FDA refined its response technologies with epidemiological and DNA tools that could trace outbreaks of foodborne illnesses to specific foods.9 It was becoming increasingly clear that FDA was highly effective in responding to outbreaks but needed the regulatory tools necessary to help prevent them in the first place.10 Amid the publicity generated by repeated outbreaks of food-borne illness, Congress and FDA developed the reforms in the law that are now at the heart of FSMA and are designed “to offer a new public health paradigm–the shifting of the food safety focus from reaction to prevention.”11

Preventive Controls, Professional Judgments

When viewed against this backdrop of decades of FDA enforcement, the approach now imposed by FSMA is unprecedented. A broad-ranging obligation for protecting public health with a specific set of tools has now been placed squarely on the shoulders of processors, suppliers, distributors, and importers, i.e., everyone involved in manufacturing, holding, or transporting food. Their facilities must each adopt documented systems in which the organization and every responsible employee share in the task of ensuring safe food.

Specifically, FSMA requires that the owner of a food facility12 evaluate the significant hazards that could affect food and implement preventive controls to assure that the hazards are minimized or prevented. There must be a written analysis of hazards and a written food safety plan.13 FSMA also identifies the key elements of a food safety plan, including appropriate “preventive controls.”14 Meeting these requirements will “provide assurances that such food is not adulterated within the meaning of section 402[.]”15

So, does this mean that a food produced under a system that incorporates some preventive controls, but not others, is adulterated within the meaning of Section 402? Possibly, but not necessarily. While FSMA specifically imposes the obligation of establishing a food safety plan based on risk-based hazard analysis and preventive controls, the law, by its wording, leaves some room for the exercise of professional judgment in designing a system of controls.
FSMA defines preventive controls as “risk-based, reasonably appropriate procedures, practices and processes” which are “consistent with current scientific understanding of safe food manufacturing”16 and which a person “knowledgeable about the safe manufacturing, processing, packing or holding of food would employ to prevent or minimize the hazards identified in the hazard analysis.”17

In other words, once the food safety professional identifies where significant hazards arise within the enterprise, FSMA affords that professional some discretion in determining what controls are reasonable and how to deploy them. While FSMA identifies the types of controls that the professional would probably deem are necessary,18 the law itself stops short of mandating the use of specific preventive controls, practices, and processes. Instead, FSMA provides that a preventive controls program “may include” such controls as sanitation procedures, hygiene training, environmental monitoring, a food allergen program, a recall plan, a cGMP program, and supplier oversight activities.19

However, it would be unwise to put too much emphasis on “may include.” Requirements for complying with FSMA in connection cGMPs, hazard analysis, and preventive controls have now been incorporated into the new regulations set forth at 21 C.F.R., part 117. As a result, the necessary food safety programs and practices are now, for the most part, mandatory. A facility’s professional can exercise some discretion in deciding what controls need to be deployed and where—but not too much! A food safety manager may decide what is reasonable but should remain aware that FDA may have a more stringent opinion, as well as the fact that there is well-established scientific consensus around the preventive controls needed for certain high-risk foods.20 

At the same time, recognizing that the success of a food safety system depends on the use of sound professional judgment should, in many respects, widen the focus of FDA inspections. Investigators, as will be discussed below, are now being instructed to look at food safety programs as a whole, rather than focusing solely on deficiencies in any particular manufacturing practice.21 While inspections may become more intensive in the short term, food companies should begin to see that success in an inspection will depend, in part, on providing FDA investigators with the information necessary to help them understand the judgments that the professionals made in analyzing hazards and designing a system of controls.

New Challenges, a New Chapter

FDA realized soon after the passage of FSMA that implementing the requirements of the new law and assuring compliance would require extensive outreach to manufacturers, distributors, and importers, with an emphasis on education, especially for the small and medium-sized companies that are becoming an increasingly important part of the emerging the food economy. FDA leaders saw early on that achieving these objectives would require a collaborative rather than an adversarial approach, as FDA Deputy Commissioner Mike Taylor told FDLI in April 2015:

Food safety success requires a comprehensive systems approach that considers all possible pathways for contamination and in which everyone in the system understands their role and does their part. [FDA] will have our greatest positive impact on food safety by thinking about our role in a more expansive way. We are the federal regulator, of course, but we are also an educator, a collaborator and even a partner with those who share the food safety goals now embodied in FSMA.22

By this time, of course, FDA was already hard at work updating its cGMP regulations, and five months later, in September 2015, the new rules were issued, with a one-year compliance deadline.23 As that deadline arrived, a senior FDA official, Joann Givens of FDA’s Office of Regulatory Affairs, reiterated the FDA’s intention to collaborate with industry in assuring compliance:

We know that this is new territory for food companies; it’s new territory for us too… As we enter this new chapter, the FDA’s primary focus will continue to be on education, training and technical assistance to help companies comply with the new requirements. We intend to continue this dialogue and collaboration with regulated industry to ensure that everyone understands and engages in their respective roles in food safety.24

FDA also recognized that the need for education was especially important with importers, who faced new and wholly unfamiliar obligations in connection with the Foreign Supplier Verification Program. FDA policy advisor Sharon Mayl provided the following update on the FDA website:
We have done a lot of outreach already to help importers understand the regulations and what they have to do. However, we understand that this is new to a lot of importers, so our approach will be to educate while we regulate to create a culture of compliance… Good communication is key. 25

This past December, Scott McIntire of FDA’s Division of Enforcement told FDLI that the agency’s priorities would be to provide prevention-oriented compliance standards in guidance documents and develop tools and resources for outreach and education. In August 2016, just a month before the cGMP compliance deadline, FDA took an important step by issuing a five-chapter, 185-page draft guidance document with five appendices.26 This was the first installment of a comprehensive guidance document that will ultimately run to fourteen chapters and cover all of the critical elements of a hazard analysis and preventive controls program. In August 2017, the sixth chapter and the sixth appendix were released in draft form, with comment accepted by FDA until February 27, 2018.

A critically important first step toward creating a collaborative education and training program came much earlier, within a year after FSMA was enacted, literally while the ink was still drying on the bill as signed into law.

FDA-Industry Alliance

In 2011, the Food Safety and Preventive Controls Alliance (FSCPA) was created under a grant from FDA to the Illinois Institute of Technology’s Institute of Food Safety and Health. FSPCA was established as a broad-based alliance of FDA officials and representatives of industry, academia, and state regulatory agencies. FSPCA’s agenda is far-reaching, but the primary objective is to develop a standardized, FDA-recognized education and training course, including distance-learning modules, to teach food industry and regulatory professionals how to implement FSMA.

The regulations that took effect in September 2016 require, under subpart “C,” that a program of preventive controls be managed by a Preventive Controls Qualified Individual (PCQI). That person’s responsibilities shall include (1) preparation of the written food safety plan, (2) validation of preventive controls, (3) records review, and (4) periodic reanalysis of the plan.27 Indeed, the primary focus of FSCPA has been to develop cost-effective training and education programs following a consistent, science-based curriculum recognized by FDA as qualifying food safety and quality managers to serve as PCQIs.

Shortly after the formation of the FSPCA, working groups composed of food safety and quality executives from such companies as Nestle, PepsiCo, Heinz, Cargill, and Chobani began developing the PCQI curriculum. By November 2015,—10 months in advance of the first deadline for compliance with the PCHF regulation issued pursuant to FSMA—the Alliance had issued its first standardized, FDA-recognized training curriculum.28 A further update was released in February 2016. The Preventive Controls training curriculum has now been used to educate FDA headquarters and field investigators, state food safety regulators, food companies, universities, and consulting firms across the country and internationally.

The Heart of the Matter

The FSPCA training program for PCQIs is comprehensive. It follows a three-day curriculum with a 500-page participant manual covering sixteen chapters that outline the steps necessary to developing an FSMA-compliant food safety plan.

The course explains at the very outset that risk-based preventive controls should focus on the hazards and issues that are of higher risk and matter most for food safety. Such controls must be preventive, not reactive, and should be designed to work in conjunction with other food safety practices and procedures, such as cGMP programs and systems incorporating Hazard Analysis and Critical Control Points (HACCP).

Importantly, these training materials provide a broad-based approach, establishing the science behind the identification of food safety hazards and providing practical examples and templates for use by the industry in building FSMA-compliant food safety programs. The key to understanding what FSMA requires is to remember that its mandates focus not just on a single process or program, but on a facility’s entire food safety system.29

“Systems Thinking”

In considering how to implement FSMA, FDA realized that it would not only have to reach out to the food industry, it would also have to reach out and re-educate its own investigators. Toward this end, FDA leveraged its work with FSPCA and appears to have begun re-orienting the perspectives and practices of its investigators. Indeed, in training its investigators, FDA is beginning to emphasize that they look not just at how a facility’s programs and practices match up with individual cGMPs but evaluate food programs and processes as connected and fully integrated parts of a holistic food safety system.30 This important new perspective emphasizes the importance of a “systems thinking” mindset.

This move toward “systems thinking” is evident in the instructional materials that FDA is using to train investigators to assess importers’ Foreign Supplier Verification Programs (FSVP). Clearly, FSVP compliance will be an early priority. During the last year, FDA issued 109 citations to firms for not having FSVPs, and 37 citations for programs that were deficient in some respect, e.g., absence of a written hazard analysis, inadequate documentation, and lack of verification procedures.31

A 16-page instructional memo dated August 31, 2017, addressed to FDA’s Import Division from the Office of Compliance of the Center for Food Safety and Applied Nutrition, makes clear that FSVP inspectors are still in the “educate while we regulate” phase of FSMA implementation.32 Inspectors will provide importers with copies of the final FSVP rule, and an agency summary of key requirements.33 Importantly, a prerequisite for an investigator to conduct an FSVP inspection will be to complete the FSPCA preventive controls and FSVP training courses and become an FDA-recognized PCQI.

In addition, the investigator must complete a “Regulators Course,”34 which stresses that successful food safety programs should be open, interactive, collaborative, and grounded in trust and accountability. The course introduces the investigator to the “Habits of a Systems Thinking Mindset” and provides pointers for how to become a “systems thinker”:

  • Looking at the Big Picture: Step back and examine the dynamics of a system and the interrelationship of its parts. Systems thinkers balance their perspective between seeing the forest and the details of any particular tree.
  • Recognizing Interdependence: Uncover connections among parts of a food safety system and ask how they all work together.
  • Making Corrections: New information must be assessed and linked to what has already been learned or observed. Does the new data change the assessment of the facility’s programs?
  • Questioning Assumptions: Be aware of how past experiences can influence current thinking and form filters, biases, and mental models. An effective Systems Thinker is aware of the effect of personal assumptions and expectations.
  • Assessing from Many Perspectives: Work collaboratively and be open to seeing a situation from differing perspectives, and thereby increasing understanding.
  • Seeing Issues Fully: Be patient and resist the urge to come to a quick conclusion. Take time to deepen your understanding of the structure and operation of the food safety system before making any judgments.35

The course concludes by observing that the proper application of “soft skills” is to build rapport, develop working relationships, diffuse difficult situations, and get critical information. Such skills are “important to your success as an investigator” and “can make all the difference” in protecting public health.36

Conclusion

If these training materials are any indication, FDA is encouraging its investigators to take a new, holistic approach to evaluating food safety systems under FSMA. For this approach to be successful, both industry and FDA will need to make a continuing commitment to transparency and accountability. The process will take time. Industry will no doubt feel uneasy presenting FDA with detailed processing and testing records, since they have not had to share a great deal in the past. FDA investigators will no doubt feel uneasy accepting information at face value, as they are trained to verify everything.

Food safety managers will need to ensure that FDA understands and has access to information about programs across their businesses, irrespective of whether the information resides at the facility, headquarters, or a supplier’s location. FDA investigators will need to feel that they are getting all that they need, and have visibility to where and how food safety programs are managed. Investigators will need to accept that food safety work proceeds across a diversity of locations, i.e., that process controls, allergen procedures, and environmental monitoring may be carried on at the facility itself, while supplier management, technical support, and standard-setting are conducted from a central office or other location, such as a research and development center. An importer will need to explain where food safety and verification activities occur throughout its supply chain, at foreign facilities, distribution centers, and domestic offices.

If these avenues of communication open up, and if all of these changes in behavior and perspectives begin to gel, then the experience of an inspection applying the core mandates of FSMA should be quite different from what food facilities have experienced in the past. Industry groups can play a critical role in collecting information about first-hand experiences with FSMA inspections and sharing those experiences with FDA so as to help make inspections more open and collaborative.37 In any event, both industry and the agency appear to recognize that they are in the early stages of ensuring that FSMA fulfills its potential. If both sides are open, trusting, and transparent, then FSMA could truly usher in an era of collaboration and commitment to protecting public health from threats emerging in the food supply.

The author gratefully acknowledges Charles M. Breen, a retired FDA District Director and an independent advisor for EAS Consulting Group, for his contributions in the preparation of this article.

  1. An official of FDA’s Office of Regulatory Affairs informed members of the Grocery Manufacturers Association (GMA) during a fall meeting that FDA investigators are being trained that they do not have to find a Section 483 infraction during every inspection, and that this was a shift away from current practice. During 2018, the agency is planning 400 domestic inspections and 100 foreign inspections.
  2. Federal Food, Drug, and Cosmetic Act (FDCA), § 415(b)(1); 21 U.S.C. § 350d(b)(1).
  3. Scott J. MacIntire, Director, Division of Enforcement, FDA Office of Regulatory Affairs, “FSMA Enforcement: The First Year,” presentation to FDLI Enforcement and Litigation Conference, Washington, D.C., December 6, 2017.
  4. FDCA Section 402; 21 U.S.C. § 342.
  5. FDCA Section 402(a)(4); 21 U.S.C. § 342(a)(4) (emphasis added).
  6. Frederick H. Degnan, from the introductory chapter to Food Safety Modernization Act: A Comprehensive, Practical Guide to the Landmark Legislation, James William Woodlee, ed., Food and Drug Law Institute, Washington, D.C., 2012, at pp. 3-5 (“Introduction: The Federal Food, Drug, and Cosmetic Act, the regulatory authority that the Food and Drug Administration has relied upon to help ensure the safety of food, reflects the diversity and complexity of the food supply”).
  7. Id., at p. 11.
  8. Working with industry, the agency succeeded in prescribing specific controls in certain categories of foods, e.g., canned or acidified foods or seafood, occurring all too often as a result of actual contamination, outbreaks, illness, or even deaths. Id., at pp. 8-9, 12-15.
  9. Id., at p. 16.
  10. Id.
  11. Michael T. Roberts, Food Law in the United States, Cambridge Univ. Press, New York, N.Y., 2016, at p. 83.
  12. FSMA defines “facility” as a domestic or foreign facility that is required to register with the FDA under the Bioterrorism Act of 2002. FDCA § 418(o)(2), 21 U.S.C. § 350g(o)(2); registration is required of “any facility engaged in manufacturing, processing, packing, or holding food for consumption in the United States.” FDCA § 415(a), 21 U.S.C. § 350d(a).
  13. FDCA §§ 418(b)(3), 418(h); 21 U.S.C §§ 350g(b)(3), 350g(h).
  14. FDCA § 418(a), 21 U.S.C. § 350g(a) (emphasis added); appropriate allergen warnings are also mandatory, and failure to provide such warnings can render a food misbranded. FDCA §§ 418(b)(3), 418(h); 21 U.S.C §§ 350g(b)(3), 350g(h).
  15. Mandatory elements of a food safety plan include corrective action procedures, monitoring to assure that the controls are effective, verification and recordkeeping, and periodic reanalysis of the system, in particular when any significant change occurs in activities at the facility or in its supply chain. See FDCA §§ 418(b)-(i), 21 U.S.C. §§ 350g(b)-(i).
  16. Id.
  17. FDCA § 418(o)(3), 21 U.S.C. § 350g(o)(3) (emphasis added).
  18. FDCA § 418(o)(3); 21 U.S.C. § 350g(o)(3); note that the analysis and control of microbiological hazards in seafood, juice or canning operations are exempt from FSMA, since predecessor regulations cover these matters in some detail. FDCA § 418(j); 21 U.S.C. §350d(j).
  19. FDCA § 418(o)(3)(A)-(G); 21 U.S.C. § 350g(o)(3)(A)-(G).
  20. For example, control of moisture applies to some foods and not others. For those where it is applicable, moisture control measures might as well be a mandatory.
  21. Significantly, the definition of “preventive controls” in Section 418 of the Act, cGMPs are identified as just one of seven categories of controls that can provide assurances against adulteration. FDCA § 418(o)(3)(F); 21 U.S.C. § 350d(o)(3)(F).
  22. Remarks of Michael R. Taylor, FDA Deputy Commissioner, when giving the Harvey Wiley Lecture during the Food and Drug Law Institute Annual Conference, April 20, 2015.
  23. 80 Fed. Reg. 55908 (September 17, 2015).
  24. “What to Expect Now That the First Big FSMA Compliance Dates Are Here,” Q&A with Joann Givens. Co-Chairman, FSMA FDA Operations Team Steering Committee, FDA Office of Regulatory Affairs, 9/19/2016, https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm521171.htm
  25. “FSVP: What Do Importers Need to Know?” Conversation and Q&A with FDA Senior Policy Advisor Sharon Mayl, https://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm560689.htm
  26. The draft of Hazard Analysis and Risk-Based Preventive Controls: A Guide for Industry was published in August 2016 and is available at www.fda.gov; the final rule establishing FSMA-compliant current Good Manufacturing Practices, part 117 of the Code of Federal Regulations, was published almost one year earlier. 80 Fed. Reg. 55908 (September 17, 2015).
  27. 21 C.F.R., part 117, subpart C.
  28. Food Safety Preventive Controls Alliance, Preventive Controls for Human Food: Participant Manual, First Edition – 2016 (Version 1.2, February 2016). FSCPA has also issued a curriculum for FSVP managers, FSPCA Foreign Supplier Verification Programs, First Edition (Version 1.0, January 2017).
  29. FSCPA Preventive Controls Manual., at p. 1-4 to 1-6.
  30. Toward this end, FDA investigators are being trained to inform food facilities of the specific type of inspection being conducted, e.g., preventive controls, cGMPs, intentional adulteration, FSVP, consumer complaint, etc. It is no longer enough to say that FDA has come for a “routine inspection.”
  31. Scott J. MacIntire, Supra note 1. Presentation to FDLI, “FSVP Citations FY 2017.”
  32. Memorandum, “FY 17 Foreign Supplier Verification Programs inspections,” August 31, 2017, at p. 8. (Obtained pursuant to the Freedom of Information Act).
  33. Id.
  34. Id., at p. 5; the course is identified as “IM220 Foreign Suppliers Verification Program Regulators Course” (hereafter, the “Regulators Course”).
  35. Regulators Course at p. 18.
  36. FSVP Course, at p. 19.
  37. A working group within GMA is collecting information from members about their experiences with FSMA with an eye toward spotting trends in FDA inspectional observations and enforcement. The group is planning meetings with FDA early in 2018 to share these experiences.