Fact Sheet on the FSMA Proposed Rule for Preventive Controls for Human Food: Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food

Updated January 14, 2013

Preventive Standards under the FSMA Main Page

View the Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food Proposed Rule.
Docket Number: FDA-2011-N-0920; comments due by May 16, 2013
 

See also:

• Preliminary Regulatory Impact Analysis
  NOTE: On January 4th, the Preventive Controls for Human Food proposed rule and its accompanying Preliminary Regulatory Impact Analysis (PRIA) statement were posted on this site. An incorrect version of the PRIA statement was posted. On January 16th, a corrected version of the PRIA statement was posted and is available in the docket folder, see FDA-2011-N-0920, as reference 194. 

• Draft Qualitative Risk Assessment of Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm (PDF: 660KB)

• External Peer Review of the FDA/CFSAN Draft Qualitative Risk Assessment: Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm (PDF: 585KB)   

Summary

FDA has released for public comment its proposed rule on preventive controls for human food that focuses on preventing problems that can cause foodborne illness. The proposed rule, which is required by the FDA Food Safety Modernization Act, would apply to many domestic and foreign firms that manufacture, process, pack or hold human food. These firms would be required to have written plans that identify hazards, specify the steps that will be put in place to minimize or prevent those hazards, identify monitoring procedures and record monitoring results and specify what actions will be taken to correct problems that arise. FDA would evaluate the plans and continue to inspect facilities to make sure the plans are being implemented properly. FDA will soon issue its proposed rule on importer foreign supplier verification; future proposed rules will address preventive controls for animal food, and accreditation of third-party auditors.

Under the proposed rule, the first compliance date would be one year after the final rule is published in the Federal Register. Recognizing that smaller businesses may need more time to comply with the requirements, FDA is proposing to allow two years for small businesses and three years for very small businesses to comply. The proposed rule will publish on January 16, 2013 and comments are due within 120 days of that date. FDA will hold public meetings to explain the proposal and provide additional opportunity for input. 

Background

High-profile outbreaks of foodborne illness over the last decade and data showing that such illnesses strike one in six Americans each year have caused a widespread recognition that we need a new, modern food safety system that prevents food safety problems in the first place--not a system that just reacts once they happen. The FDA Food Safety Modernization Act (FSMA) was signed into law on January 4, 2011, to better protect public health by helping to ensure the safety and security of the food supply. FSMA embraces preventing food safety problems as the foundation of a modern food safety system and recognizes the need for a global approach to food safety. Section 103 of FSMA, Hazard analysis and risk-based preventive controls, requires facilities to evaluate hazards, identify and implement preventive controls to address these hazards, verify that the preventive controls are adequate to control the hazards identified, take corrective action when needed, and maintain a written plan and documentation.  

Who is Covered?

The proposed rule on preventive controls for human food would apply to facilities that manufacture, process, pack or hold human food. In general, with some exceptions, the new preventive control provisions would apply to facilities that are required to register with FDA under FDA’s current food facility registration regulations. Facilities that are required to register include manufacturers, processors, warehouses, storage tanks and grain elevators. Exemptions and modified requirements in the proposed rule are listed at the end of this page. FDA may withdraw certain exemptions if it determines it is necessary to protect the public health and prevent or control a foodborne illness outbreak. Activities within the definition of "farm" would not be subject to the proposed rule, and the proposed rule would clarify those activities.

Highlights of the Proposed Rule

The rule has two major features. First, it contains new provisions requiring hazard analysis and risk-based preventive controls. Second, it would revise the existing Current Good Manufacturing Practice (CGMP) requirements found in 21 CFR part 110. The new preventive control requirements and the modified CGMPs would be placed in a new Part 117, “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food.” 

Hazard Analysis and Risk-Based Preventive Controls 

Under the proposal, each owner, operator or agent in charge of a facility (those required to register with FDA under Section 415 of the FD&C Act), with certain exceptions, would be required to comply with the hazard analysis and risk-based preventive controls. The preventive controls are science- and risk-based in that the rule would requirecontrols only where necessary to prevent hazards to public health and exempt certain facilities from requirements or modify requirements for certain low-risk activities. Second, they are flexible in that firmscould develop preventive controls that fit their products and operations, as long as they are adequate to significantly minimize or prevent all food safety hazards that are reasonably likely to occur. 

The proposed hazard analysis and risk-based preventive control requirements are similar to Hazard Analysis and Critical Control Points (HACCP) systems, which were pioneered by the food industry and are required by FDA for juice and seafood. Operators of a facility would be required to understand the hazards that are reasonably likely to occur in their operation and to put in place preventive controls to minimize or prevent the hazards. Although this proposed rule aligns well with HACCP, it differs in part in that preventive controls may be required at points other than at critical control points and critical limits would not be required for all preventive controls.

Each covered facility would be required to prepare and implement a written food safety plan, which would include the following:

• A Hazard analysis that identifies and evaluates known or reasonably foreseeable hazards for each type of food manufactured, processed, packed or held at the facility.
• Preventive controls, which would be required to be identified and implemented to provide assurances that hazards that are reasonably likely to occur will be significantly minimized or prevented. Preventive controls would be required to include, as appropriate: (1) process controls, (2) food allergen controls, (3) sanitation controls, and (4) a recall plan.  However, the preventive controls required would depend on which, if any, hazards are reasonably likely to occur. It is unlikely that all possible prevention measures and verification procedures would be applied to all foods at all facilities. FDA believes a supplier approval and verification program is a risk-based and appropriate control to significantly minimize or prevent hazards from raw materials and ingredients that is consistent with current scientific understanding of food safety practices and is seeking comment on such a program. 
• Monitoring procedures to provide assurance that preventive controls are consistently performed and records to document the monitoring.
• Corrective actions that would be used if preventive controls are not properly implemented. Facilities would be required to correct problems and minimize the likelihood of reoccurrence, evaluate the food for safety and prevent affected food from entering commerce when necessary. If specific corrective action procedures were not identified for the problem, or if a preventive control were found to be ineffective, the facility would also be required to re-evaluate the food safety plan to determine if modifications are needed.
• Verification activities to ensure that preventive controls are consistently implemented and are effective. Verification activities might include validation that the preventive controls are adequate for their purpose and are effective in controlling the hazard, activities to verify that controls are operating as intended and review of monitoring records. In addition, the proposed rule would require reassessment of the food safety plan at least every three years and at other times as appropriate. FDA recognizes that product and environmental testing programs are science-based verification activities that are commonly accepted in many sectors of the food industry and is seeking comment on these programs. FDA also is asking for comments regarding review of customer and other complaints as part of verification. 
• Recordkeeping. Facilities would be required to keep a written food safety plan, including the hazard analysis. They also would be required to keep records of preventive controls, monitoring, corrective actions, and verification. 

A qualified individual would be required to prepare the food safety plan, develop the hazard analysis, validate the preventive controls, review records and conduct a reanalysis of the food safety plan (or oversee these activities). To be qualified, an individual would be required to successfully complete training in accordance with a standardized curriculum or be otherwise qualified through job experience to develop and apply a food safety system. 

Revisions to the Current Good Manufacturing Practices

The CGMP regulation would be modified to clarify that certain existing CGMP provisions requiring protection against contamination of food also require protection against cross-contact of food by allergens. Further, language in the regulation would be updated and certain provisions containing recommendations would be deleted. In addition, FDA is requesting comment on whether it should mandate training for employees and supervisors, including a requirement for records that document training, and whether it should require, rather than recommend, certain provisions, such as cleaning non-food-contact surfaces of equipment as frequently as necessary to protect against contamination of food and food-contact surfaces.

Generally, CGMP provisions would still apply to facilities that would be exempt from the hazard analysis and risk-based preventive control requirements or that would be subject to modified requirements. 

Draft Qualitative Risk Assessment of Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm

Along with the proposed rule, FDA is announcing the availability of, and requesting comment on, a draft qualitative risk assessment designed to provide a science-based risk analysis of those on-farm activity/food combinations that would be considered not reasonably likely to introduce hazards that are reasonably likely to cause serious adverse health consequences. Interested persons may submit written comments regarding the draft risk assessment. Public comments will be considered in preparing a final version of the risk assessment.

The draft risk assessment was submitted to a group of scientific experts external to FDA for peer review, and the draft was revised, as appropriate, considering the comments of those experts. 

Effective and Compliance Dates and Definitions for Small and Very Small Businesses

FDA is proposing the following effective and compliance dates for businesses subject to the proposed rule. Recognizing that small and very small businesses may need more time to comply with the requirements, the compliance dates are adjusted accordingly.

• Effective Date: 60 days after the final rule is published
• Compliance Dates:
  • Small Businesses—a business that employs fewer than 500 persons and that does not qualify for an exemption would have to comply two years after publication of the final rule.
  • Very Small Businesses—Three options are being proposed for the definition of a very small business:less than $250,000,  less than $500,000, and less than $1,000,000 in total annual sales of food, adjusted for inflation. Very small businesses, which would be considered “qualified facilities” and subject to modified requirements for preventive controls, would have to comply three years after publication of the final rule. 
  • Other Businesses—a business that is not small or very small and does not qualify for an exemption would have to comply one year after publication of the final rule.

Economic Impact of the Proposed Rule

The proposed rule is aimed at reducing the public health burden of foodborne illness. FDA estimates that close to 1,000,000 illnesses each year are attributable to food that would fall under the scope of this proposed rule. The economic cost of illnesses avoided is $2 billion a year. The proposed rule has a first-year cost to industry of $701 million and an annualized cost of $472 million using a 7 percent discount rate according to Office of Management and Budget guidelines.  The proposed rule would cover an estimated 97,600 domestic and 109,200 foreign facilities.

Rulemaking Process and How to Submit Comments

The proposed rule, “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food,” is published in the Federal Register so that the public can review it and submit comments. FDA considers comments received during the comment period on the proposed rule and then considers revising the rule, based on its review of the comments, before issuing a final rule. The proposed and final rules and supporting documents are filed in FDA’s official docket on http://www.regulations.gov and also can be accessed on the FSMA website.

FDA has conducted extensive outreach to industry, the consumer community, other government agencies and the international community to gain input and perspective on how best to implement this and other proposed rules required by FSMA. That input and perspective shaped the proposed rules in a way that will help to ensure they are practical, flexible and effective. FDA held a public meeting on preventive controls in April 2011, and will hold one or more public meetings during the comment period to explain the proposal and provide additional opportunity for input.

Assistance to Industry

FDA will publish within six months of publication of the final rule, a guidance document that provides the requirements in plain language to help businesses, particularly small businesses, comply with the hazard analysis and preventive controls requirements. In addition, FDA has helped to establish a Food Safety Preventive Controls Alliance to develop a core training curriculum and to disseminate information on hazards and controls to help industry, particularly small and mid-sized businesses, comply with the new requirements.

For Additional Information

• Video: The Rulemaking Process: A Primer by FDA
• Video: FDA Food Safety Modernization Act, A Primer by FDA
• Fact sheet: The Food Safety Law and the Rulemaking Process: Putting FSMA to Work

Exemptions and Modified Requirements for Preventive Controls for Human Food*