The Food Safety Modernization Act (FSMA) requires the Food and Drug Administration (FDA) to develop regulations for “Hazard Analysis and Risk-based Preventive Controls” (HARPC) requirements at food facilities. These requirements include a hazard analysis and the implementation and monitoring of preventive controls to ensure that hazards are addressed. These HARPC requirements must be written and documented in a food safety plan at a facility. The HARPC requirements make up the bulk of the new requirements that facilities must comply with in the Preventive Controls Rule. The HARPC requirements are based on and are similar to a “HACCP” – Hazard Analysis and Critical Control Points – approach, but there are differences.
To figure out whether you operate a facility that must comply with HARPC requirements and develop and implement a food safety plan, visit NSAC’s “Do I Operate a Farm or a Facility?” issue page. Facilities, including facilities on farm, must register as facilities with FDA, and are subject to the Preventive Controls Rule. Some facilities may be eligible for modified requirements to the HARPC requirements described below, and on-farm processors may be exempt from the HARPC requirements under certain circumstances.
The proposed HARPC requirements require the owner, operator, or agent in charge of a facility to prepare and implement a written food safety plan. The food safety plan must include:
A “qualified individual” – someone who has successfully completed relevant training recognized by FDA or has enough job experience to develop and apply a food safety system – must prepare or oversee the preparation of the food safety plan. For big companies, these will be in-house employees, but for most small businesses, including farms, this will likely require paying a consultant or attending a training course.
The food safety plan must include a written hazard analysis that identifies and evaluates known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at the facility. The hazard identification must consider biological, chemical, physical, and radiological hazards that may occur naturally or be unintentionally introduced. The hazard evaluation must determine whether hazards are reasonably likely to occur.
The food safety plan must include written preventive controls to ensure that identified hazards will be significantly minimized or prevented, and that food produced at the facility will not be adulterated or misbranded. Preventive controls must include, as appropriate, process controls, food allergen controls, sanitation controls, and other controls. Preventive controls are subject to monitoring, corrective action, and verification requirements (see below).
The food safety plan must include written procedures for monitoring the preventive controls, including the frequency of monitoring procedures. Monitoring must occur often enough to ensure that preventive controls are consistently performed. All monitoring must be documented (see “Proposed Recordkeeping Requirements” below).
FDA has newly proposed that the food safety plan include a written supplier program that establishes and maintains a risk-based approach to verifying suppliers providing receiving facilities with raw materials or ingredients that pose a significant risk, and the risk is controlled by the supplier, not the receiving facility. The program must be written and include verification activities, as appropriate to the hazard, and documentation of these activities, to ensure raw materials and ingredients are received only from suppliers approved for control of the hazard(s) in that raw material or ingredient. In some instances, an onsite audit may be required, in which case the facility must also maintain documentation of the audit. Learn more about this new requirement on our Supplier Verification Program page.
The food safety plan must include written corrective action procedures that must be taken if preventive controls are not properly implemented. The procedures must ensure that action is taken to identify and correct the problem with implementation of a preventive control, that all affected food is evaluated for food safety, and that all affected food does not enter commerce if the food may be adulterated or misbranded. In addition, if the problem was unanticipated, then the food safety plan must be revaluated. All corrective actions taken must be documented (see “Proposed Recordkeeping Requirements” below).
The food safety plan must include written verification procedures to validate the preventive controls and verify that they are being consistently implemented and are effectively minimizing or preventing hazards. The validation of preventive controls must be done by a qualified individual before the food safety plan is implemented, whenever there is a need to reanalyze the food safety plan, and must include collecting and evaluating scientific and technical information. Monitoring must be verified, as must decisions about corrective actions. The owner, operator, or agent of a facility must conduct a reanalysis of the food safety plan at least once every three years, or under specific circumstances. All verification activities must be documented (see “Proposed Recordkeeping Requirements” below).
The food safety plan must include a written recall plan for food with a hazard that is reasonably likely to occur. The recall plan must describe steps to notify the direct recipients of the food about the recall and the public about any hazard, verify that the recall is carried out, and appropriately dispose of the recalled food.
The owner, operator, or agent of the facility must establish and maintain the following records:
The records must be kept as original records, contain values and observations from monitoring, be accurate and legible, be created concurrently with the activity documented, and provide details on the history of work performed. They must include the name and location of the facility, the date and time the activity was documents, the signature or initials of the person doing the activity, and when appropriate, the identity of the product and the production code.
All records must be kept at the facility for at least two years after they were prepared. Records that document the adequacy of equipment or processes used must be kept for at least two years after their use is discontinued. Except for the food safety plan, records can be stored offsite after six months if they can be retrieved in 24 hours. The food safety plan must remain at the facility.
This information may be shared if credited to NSAC and accompanied by a link to this page.