Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food
Below is a fact sheet provided by FDA.
- Federal Register Notice
- Docket Folder FDA-2011-N-0920
- Questions & Answers
- Clarification of Compliance Date for Certain Food Establishments
Public Meetings & Webinars
- Preventive Controls for Human and Animal Food Final Rules Public Meeting
- Webinar: Preventive Controls Hazard Analysis and Risk-Based Draft Guidance
- Webinar Series
- Guidance for Industry: What You Need to Know About the FDA Regulation: Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food; Small Entity Compliance Guide
- Draft Guidance for Industry: Describing a Hazard That Needs Control in Documents Accompanying the Food, as Required by Four Rules Implementing FSMA
- Draft Guidance for Industry: Hazard Analysis and Risk-Based Preventive Controls for Human Food
- Draft Guidance for Industry: Classification of Activities as Harvesting, Packing, Holding, or Manufacturing/Processing for Farms and Facilities
- Regulatory Impact Analysis
- Qualitative Risk Assessment:Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm (PDF: 651KB)
- Qualitative Risk Assessment: Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm: Response to Public Comments (PDF: 110KB)
- 5 Steps Toward Working with FDA on Human and Animal Food Guidance Documents
- Background on FSMA
- Case Study: Food Safety Guidelines for Cantaloupes
- Constituent Update: How to Work with FDA on Food Guidance Documents
- Consumer Update: 5 Ways New FDA Rules Will Make Your Foods Safer
- Food Safety Preventive Controls Alliance
- FSMA Training
- Qualified Facility Attestation
- Supplier Evaluation Resources
- Video: The Rulemaking Process: A Primer by FDA
- Video: FDA Food Safety Modernization Act, A Primer by FDA
- What to Expect Now that the First Big FSMA Compliance Dates Are Here
- How to Contact FDA about FSMA (Technical Assistance Network)
Translations of this Fact Sheet
This final rule is the product of an unprecedented level of outreach by the FDA to industry, consumer groups, the agency’s federal, state, local and tribal regulatory counterparts, academia and other stakeholders. This outreach began before the rule was proposed in January 2013.
In response to input received during the comment period and during hundreds of engagements that included public meetings, webinars, listening sessions, and visits to farms and food facilities across the country, the FDA issued a supplemental notice of proposed rulemaking in September 2014. The proposed revisions were designed to make the originally proposed rule more practical, flexible, and effective for industry, while still advancing the FDA’s food safety goals.
The final rule has elements of both the original and supplemental proposals, in addition to new requirements that are the outgrowth of public input received during the comment period for both proposals. For example, flexibility has been built into key requirements, including control of the supply chain, and the definition of farms— which are exempt from these regulations— has significantly changed to reflect modern farming practices.
1. Covered facilities must establish and implement a food safety system that includes an analysis of hazards and risk-based preventive controls. The rule sets requirements for a written food safety plan that includes:
- Hazard analysis: The first step is hazard identification, which must consider known or reasonably foreseeable biological, chemical, and physical hazards. These hazards could be present because they occur naturally, are unintentionally introduced, or are intentionally introduced for economic gain (if they affect the safety of the food).
- Preventive controls: These measures are required to ensure that hazards requiring a preventive control will be minimized or prevented. They include process, food allergen, and sanitation controls, as well as supply-chain controls and a recall plan.
- Oversight and management of preventive controls. The final rule provides flexibility in the steps needed to ensure that preventive controls are effective and to correct problems that may arise.
- Monitoring: These procedures are designed to provide assurance that preventive controls are consistently performed. Monitoring is conducted as appropriate to the preventive control. For example, monitoring of a heat process to kill pathogens would include actual temperature values and be more frequent than monitoring preventive maintenance activities used to minimize metal hazards, which could be a simple record of the date on which the activity took place.
- Corrective actions and corrections: Corrections are steps taken to timely identify and correct a minor, isolated problem that occurs during food production. Corrective actions include actions to identify a problem with preventive control implementation, to reduce the likelihood the problem will recur, evaluate affected food for safety, and prevent it from entering commerce. Corrective actions must be documented with records.
- Verification: These activities are required to ensure that preventive controls are consistently implemented and effective. They include validating with scientific evidence that a preventive control is capable of effectively controlling an identified hazard; calibration (or accuracy checks) of process monitoring and verification instruments such as thermometers, and reviewing records to verify that monitoring and corrective actions (if necessary) are being conducted.
Product testing and environmental monitoring are possible verification activities but are only required as appropriate to the food, facility, nature of the preventive control, and the role of that control in the facility’s food safety system. Environmental monitoring generally would be required if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control.
2. The definition of a ‘farm’ is clarified to cover two types of farm operations. Operations defined as farms are not subject to the preventive controls rule.
- Primary Production Farm: This is an operation under one management in one general, but not necessarily contiguous, location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities. This kind of farm can pack or hold raw agricultural commodities such as fresh produce and may conduct certain manufacturing/processing activities, such as dehydrating grapes to produce raisins and packaging and labeling raisins.
The supplemental rule proposed, and the final rule includes, a change to expand the definition of “farm” to include packing or holding raw agricultural commodities (such as fresh produce) that are grown on a farm under a different ownership. The final rule also includes within the “farm” definition companies that solely harvest crops from farms.
- Secondary Activities Farm: This is an operation not located on the Primary Production Farm that is devoted to harvesting, packing and/or holding raw agricultural commodities. It must be majority owned by the Primary Production Farm that supplies the majority of the raw agricultural commodities harvested, packed, or held by the Secondary Activities Farm.
This definition for a Secondary Activities Farm was provided, in part, so that farmers involved in certain formerly off-farm packing now fit under the definition of “farm,” as the packing is still part of the farming operation. In addition to off-farm produce packing operations, another example of a Secondary Activities Farm could be an operation in which nuts are hulled and dehydrated by an operation not located at the orchard before going to a processing plant. If the farmer that owns the orchards and supplies the majority of the nuts is a majority owner of the hulling/dehydrating facility, that operation is a Secondary Activities Farm.
- Primary Production and Secondary Activities Farms conducting activities on produce covered by the Produce Safety Rule will be required to comply with that rule.
3. Supply-chain program is more flexible, with separate compliance dates established.
- The rule mandates that a manufacturing/processing facility have a risk-based supply chain program for those raw material and other ingredients for which it has identified a hazard requiring a supply-chain applied control. Manufacturing/processing facilities that control a hazard using preventive controls, or who follow requirements applicable when relying on a customer to controls hazards, do not need to have a supply-chain program for that hazard.
- Covered food facilities are responsible for ensuring that these foods are received only from approved suppliers, or on a temporary basis from unapproved suppliers whose materials are subject to verification activities before being accepted for use. (Approved suppliers are those approved by the facility after a consideration of factors that include a hazard analysis of the food, the entity that will be controlling that hazard, and supplier performance.)
- A facility will not be required to implement a preventive control when an identified hazard will be controlled by a subsequent entity such as a customer or other processor. The facility will have to disclose that the food is “not processed to control (identified hazard)” and obtain written assurance from its customer regarding certain actions the customer agrees to take.
- Another entity in the supply chain, such as a broker or distributor, can conduct supplier verification activities, but the receiving facility must review and assess that entity’s documentation of the verification of control of the hazard.
- Separate compliance dates have been established for the supply-chain program provisions so that a food facility will not be required to comply with the supply-chain program provisions before its supplier is required to comply with the preventive controls for human food rule or the produce safety rule.
4. Current Good Manufacturing Practices (CGMPs) are updated and clarified.
- The final rule does not include nonbinding provisions, which are more appropriate for guidance.
- Some of the previously nonbinding provisions, such as education and training, are now binding.
- Management is required to ensure that all employees who manufacture, process, pack or hold food are qualified to perform their assigned duties.
- Such employees must have the necessary combination of education, training, and/or experience necessary to manufacture, process, pack, or hold clean and safe food. Individuals must receive training in the principles of food hygiene and food safety, including the importance of employee health and hygiene.
- Note that there are similar requirements related to preventive controls.
- The FDA’s longstanding position that CGMPs address allergen cross-contact is now explicit in the regulatory text.
Compliance dates for businesses are staggered over several years after publication of the final rule.
- Very small businesses (averaging less than $1 million per year (adjusted for inflation) in both annual sales of human food plus the market value of human food manufactured, processed, packed, or held without sale): Three years, except for records to support its status as a very small business (January 1, 2016).
- Businesses subject to the Pasteurized Milk Ordinance (compliance dates extended to allow time for changes to the PMO safety standards that incorporate the requirements of this preventive controls rule): Three years
- Small businesses (a business with fewer than 500 full-time equivalent employees): Two years
- All other businesses: One year
- Receiving facility is a small business and its supplier will not be subject to the human preventive controls rule or the produce safety rule: Two years
- Receiving facility is a small business and its supplier will be subject to the human preventive controls rule or the produce safety rule: Two years or six months after the supplier is required to comply with the applicable rule, whichever is later
- Receiving facility is not a small or very small business and its supplier will not be subject to the human preventive controls rule or the produce safety rule: 18 months
- Receiving facility is not a small or very small business and its supplier will be subject to the human preventive controls rule or the produce safety rule: Six months after the supplier is required to comply with the applicable rule
For more information see, Compliance Date Extensions and Clarifications for FSMA Final Rules.
Assistance to Industry
The FDA is developing several guidance documents on subjects that include:
- Hazard analysis and preventive controls,
- Environmental monitoring,
- Food allergen controls,
- Validation of process controls,
- A Small Entity Compliance Guide that explains the actions a small or very small business must take to comply with the rule.
- Establishing a Food Safety Technical Assistance Network within the agency to provide a central source of information to support industry understanding and implementation of FSMA.
- Collaborating with the Food Safety Preventive Controls Alliance to establish training and technical assistance programs.
- Partnering with the National Institute of Food and Agriculture in the U.S. Department of Agriculture to administer a grant program to provide technical assistance to small and mid-size farms and small food processors.