17 June 2016
New Rule Will Require Food Facilities to Prevent Intentional Adulteration
The Food and Drug Administration has finalised a new food safety rule that will require food businesses in the United States and abroad to take steps to prevent intentional adulteration of the food supply. This rule, which incorporates several major revisions from the FDA’s proposal to provide for greater flexibility and clarity, marks the last of the seven major rules implementing the core of the Food Safety Modernization Act to be completed. The rule was initially proposed in December 2013 and took into consideration more than 200 comments submitted by the food industry, government regulatory partners, consumer advocates and other interested parties.
For the first time, domestic and foreign food facilities that manufacture, process, pack or hold food and are required to register as food facilities (with some exceptions) will be required to prepare and implement a written food defence plan that assesses significant vulnerabilities to deliberate contamination where the intent is to cause wide-scale harm to public health. These facilities will also have to identify and implement strategies to minimise or prevent these vulnerabilities and establish and implement food defence monitoring procedures, corrective actions and verification activities.
The required food defence plan must include (i) a written vulnerability assessment, including required explanations, to identify significant vulnerabilities and actionable process steps; (ii) written mitigation strategies, including required explanations; (iii) written procedures for the food defence monitoring of the implementation of the mitigation strategies; (iv) written procedures for food defence corrective actions; and (v) written procedures for food defence verification.
Covered food facilities must either conduct or have conducted a vulnerability assessment for each type of food manufactured, processed, packed or held at the facility using appropriate methods to evaluate each point, step or procedure in the food operation to identify significant vulnerabilities and actionable process steps. Appropriate methods must include, at a minimum, an evaluation of (i) the potential public health impact (e.g., severity and scale) if a contaminant were added; (ii) the degree of physical access to the product; and (iii) the ability of an attacker (including an inside attacker) to successfully contaminate the product. Regardless of the outcome, the vulnerability assessment must be written and must include an explanation as to why each point, step or procedure was or was not identified as an actionable process step.
Covered food facilities must also identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimised or prevented and the food manufactured, processed, packed or held by the facility will not be adulterated under section 402 of the Federal Food, Drug, and Cosmetic Act. For each mitigation strategy implemented at each actionable process step, the facility must include a written explanation of how the mitigation strategy sufficiently minimises or prevents the significant vulnerability associated with the actionable process step.
In addition, covered food facilities must establish and implement written procedures, including the frequency with which they are to be performed, for food defence monitoring of the mitigation strategies. The facility must monitor its mitigation strategies with adequate frequency to provide assurances that they are consistently performed as well as document the monitoring of mitigation strategies in records that are subject to verification. Records may be affirmative records demonstrating the mitigation strategy is functioning as intended, although exception records demonstrating the mitigation strategy is not functioning as intended may be adequate in some circumstances.
As appropriate to the nature of the actionable process step and the mitigation strategy, the facility must establish and implement written food defence corrective action procedures that must be taken if mitigation strategies are not properly implemented. These procedures must describe the steps to be taken to ensure that (i) appropriate action is taken to identify and correct a problem that has occurred with implementation of a mitigation strategy and (ii) appropriate action is taken, when necessary, to reduce the likelihood that the problem will recur.
Food defence verification activities must include the following, as appropriate to the nature of the mitigation strategy and its role in the facility’s food defence system: (i) verification that food defence monitoring is being conducted as required; (ii) verification that appropriate decisions about food defence corrective actions are being made as required; (iii) verification that mitigation strategies are properly implemented and are significantly minimising or preventing the significant vulnerabilities (such as a review of the food defence monitoring and food defence corrective actions records within appropriate timeframes to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defence plan, the mitigation strategies are properly implemented and appropriate decisions were made about food defence corrective actions, as well as other activities appropriate for verification of proper implementation of mitigation strategies); and (iv) verification of reanalysis.
Records must be kept as original records, true copies (such as photocopies, pictures, scanned copies, microfilm, microfiche or other accurate reproductions of the original records) or electronic records. They must (i) contain the actual values and observations obtained during food defence monitoring; (ii) be accurate, indelible and legible; (iii) be created concurrently with performance of the activity documented; (iv) be as detailed as necessary to provide history of work performed; and (v) include information adequate to identify the facility (e.g., the name and when necessary the location of the facility), the date and when appropriate the time of the activity documented, the signature or initials of the person performing the activity and, where appropriate, the identity of the product and the lot code, if any.
This rule is effective as of 26 July but compliance will not be required until 26 July 2019 for facilities other than small businesses and 26 July 2020 for small businesses. The FDA notes that it is committed to working with both industry and state, local and tribal partners to ensure effective implementation of this new rule, including by providing industry with valuable tools (such as guidance documents, training courses and a technical assistance centre) aimed at facilitating compliance.