When the Food Safety Modernization Act (FSMA) was signed into law in 2011 by President Obama, it changed how companies and suppliers handle food safety. The act shifted the regulations from responding to contamination to preventing contamination. It’s considered the most extensive U.S. food safety reform since 1938. While the FSMA became law in 2011, the roll-out is in stages for various regulations within the act.
While the regulations are text heavy and comprehensive, the act basically asks two questions:
- What are the risks in your supply chain?
- Who is controlling them?
In the last five to 10 years, recalls have increased, and it’s a supply chain problem, said David Acheson, president and CEO of the Acheson Group, a consulting company that helps food companies with regulatory risks. The increased risks are from supply chain and testing technology getting more complex, as has labeling requirements for food allergens. A tainted ingredient could be shipped out to dozens of manufacturers who must each issue a Class I consumer recall, unless they can document that they killed the bacteria by cooking it. If the products are only in their warehouses, they may be able to withdraw the products and no one will know about it except for the Food and Drug Administration (FDA).
“When you look that scenario, which happens constantly, it’s a recognition that many of today’s recalls are triggered by the supply chain,” said Acheson.
Why FSMA matters to supply chain
The Peanut Corporation of America (PCA) recall around 2008-2009, had a significant impact on the FSMA’s creation. At that time, thousands of PCA manufacturing customers recalled peanut products due to Salmonella contamination.
Acheson has a long history in food regulation, including a stint at the FDA as an associate commissioner for foods, and as chief medical officer at the USDA Food Safety and Inspection Service. “The question came up from a regulatory perspective, how much due diligence did the manufacturers using PCA products do?” He said that when the FDA investigated, they weren’t happy with the manufacturer inspections or the PCA. According to reports, PCA knowingly sent out contaminated products. After the recalls, PCA went out of business. Those at the FDA thought, “can we protect public health and make this a regulatory requirement? That’s why, in my opinion, it was put in a statute,” said Acheson.
[FSMA is] a recognition that many of today’s recalls are triggered by the supply chain.
David Acheson
President and CEO, Acheson Group
Three FSMA rules touch on the supply chain: the foreign supplier verification program (FSVP) and two preventive control rules. One preventive control rule is for manufacturing, processing, packing and holding of foods/products for humans, and the other does the same for animal foods/products. The FSVP focuses on imported food that is not manufactured, processed, packed or held here. It requires importers to assess that food risk and do a hazard analysis to determine who controls that risk before the foods are allowed into the U.S. Acheson breaks down the requirements this way:
- Hazard analysis: Analyze the supply chain of ingredients to see what are public health risks and need to be controlled.
- Determine who will control the risk: There can be different risks and different responsibilities for who controls the risk for the same product, as shown in the example.
- Verify the risk is being controlled: If controlled elsewhere, the company needs to get written verification.
Downstream manufacturers should only use approved suppliers, where the manufacturer has done its own assessments, so they’re managing their own risk.
FSMA Compliance Dates, by proposed rule and business size
| General | Small Business | Very Small Business* | |
|---|---|---|---|
| Preventive Controls: Human Food | 8-30-16 | 8-30-17 | 8-30-18 |
| Preventive Controls: Animal Feed | 8-30-16 | 8-30-17 | 8-30-18 |
| Produce Safety | 12-31-17 | 12-31-18 | 12-31-19 |
| Foreign Supplier Verification Program | 4-31-17 | 4-31-17 | 4-31-17 |
| Third Party Accreditation and Certification | Pending | Pending | Pending |
| Sanitary Transportation | 3-31-17 | 3-31-18 | 3-31-17 |
| Food Defense | 7-31-17 | 7-31-18 | 7-31-19 |
*For further qualifying information, visit this page.
SOURCE: The Association of Food, Beverage and Consumer Product Companies
How to develop FSMA best practices
Aside from regulations, “what really matters is your brand,” Acheson said, and regulatory compliance is already part of daily life for food brands. Consumer-facing brands can’t shift the blame to suppliers and expect consumers to follow suit. When brands issue a recall, they must put out a press release. Even if they say that the supplier was at fault, “what consumers will remember is that major Brand X is doing a recall,” he said.
Acheson encourages food companies to just think about the FSMA as more than just food safety regulations. Think about the brand impact. Companies must take food safety seriously if they want to protect their brands.
To develop a robust program, Acheson advises his clients to look at the inherent risks of all ingredients. Leafy greens carry more risk than cans of beans, for example. Then look at the supplier’s behavior. “You can have someone sending you fresh lettuce with state-of-the-art good agricultural practices, where they control the water supply and animal encroachment area, and have great equipment. And then down the street, there’s a farmer whose fields have manure everywhere and there’s no toilets around (for workers). It’s the same product, but supplier behaviors are dramatically different,” he said.
“When you’re a manufacturer, it doesn’t matter how many suppliers you have, five or five thousand. Within that supply chain, some of those ingredients are going to be more risky than others,” he said. The way to manage this from an industry perspective is to look at the risks in your supply chain and ask tough questions: which suppliers do I need to pay attention to?
Consider these:
- What you’re doing with the product. Cooking it minimizes the risk.
- Determine if there’s a major recall potential
- Consider if the ingredient constitutes only a trace amount of one product or if it’s in every product on the shelf.
- Determine an approach partly based on the resources needed to manage the risk, as well as the potential for recall
- Recognize that resources are finite; the approach isn’t one-size-fits-all
Finally, don’t just rely on a certificate of analysis coming from the supplier. That’s better than having nothing, but they can generate a false sense of security, said Acheson. If that ingredient is used in every one of your products, it may be a low general risk, but if that ingredient is a problem, you’ll have to recall everything on the shelf with your name on it. “It’s massive,” Acheson said.
How the FSMA is affecting companies
Like every regulation, said Acheson, some companies say they’ve been following rules like this already, and for others, it’s stretching them to the limit. “There’s a big variation in how food companies are reacting.”
Many companies already have robust supply chain programs in place. “We have heard that they feel prepared for implementation,” said Jason Strachman-Miller, spokesman for the FDA. He expects that these larger companies already have food safety programs in place, and their programs probably only need tweaking. Others, particularly smaller companies, are working with their suppliers to ensure they’re in compliance with applicable requirements or will be by the necessary time. The FDA is working with Food Safety Preventive Controls to come up with a program that companies can follow if needed.
The regulation provoking the most anxiety is when the manufacturer must rely on the customer to control the risk. In that scenario, the rule says that when you’re shipping an ingredient to someone else (like pepper), and that risk isn’t controlled by anyone else, the customer must send the supplier a letter of assurance confirming they’re controlling that risk. “That has proven to be a nightmare,” Acheson said. Customers and food companies aren’t willing to write that letter. As a result, the FDA is delaying enforcement until 2019. “That tells me is they recognize it’s a mess. The rule as written isn’t realistic,” Acheson said. He anticipates that the FDA will later change the rule.
We have heard that [companies] feel prepared for implementation.
Jason Strachman-Miller
Spokesman, Food and Drug Administration
It’s not just companies adjusting to new rules – the FDA is as well. “A preventive controls inspection is quite different from a sanitation inspection, so industry and our investigators both need to understand the new approach. Industry and inspectors need training, and inspectors are being asked to use critical thinking to assess whether a facility is controlling hazards,” said Strachman-Miller.
FSMA regulations don’t have to be expensive to implement. Analysis varies by ingredient volume, and whether you have 10 suppliers or 5,000. “The process I’ve outlined is not going to cost you millions of dollars. It’s an intellectual exercise,” Acheson said. The challenge is making sure you have someone qualified to do it. It’s not cost-prohibitive, “especially when in context – you have to do it for regulation and compliance, but it’s more about brand protection. In today’s environment, you need to invest in this,” he said. The chances of getting caught up in a supplier issue are greater than ever. Why?
There are more problems found today by the FDA and members of the food industry, he said. If a manufacturer or supplier finds something that could cause a Class I recall, like an allergen or Salmonella, there’s a legal and regulatory requirement to tell the FDA. In addition, the technology to detect problems has gotten better, making the likelihood of discovery higher than it used to be.
