Navigating FSMA Documentation

Seven rules have been issued under the Food Safety Modernization Act (FSMA), and the compliance dates for the Preventive Controls for Human Food guideline has passed. FSMA requires that a written record be kept of the entire Hazard Analysis and Risk-based Preventive Controls (HARPC) plan. These records must be maintained for no less than two years, and evaluated whenever there is a significant change at the facility that might increase a known hazard or introduce a new one, or every three years if no significant changes occur.

Most companies have identified what needs to be done in order to comply, but for many the challenge of documenting those efforts remains. Typically there is no consistent format or approach for records maintenance, and too often key information on the same topic or issue is different at different locations. Information should be easily accessible and usable across the organization to identify trends and to remind to follow up on corrective actions and/or audits.

Three key points are the focus for FSMA documentation: the supplier, the facility, and the shipper.

Know Who You’re Buying From

For most food manufacturers, in-depth knowledge of suppliers is crucial to ensure the quality of the product; now it is also a critical step of your HARPC plan. You must document not only the hazard your supplier is responsible for controlling, but also the action they have taken to prevent or control that issue. For example, an ice cream company would want to ensure that the peanut butter entering their facility is not contaminated with salmonella. Working with certified suppliers would provide assurance that the ingredients meet quality and safety standards. Certificates of analysis from the supplier offer one form of documentation that the product is within limits; in-house testing prior to use would verify those findings. Annual audits would also be necessary to evaluate the supplier’s effectiveness in controlling the hazard.

“Trust, but verify” is the mantra for this stage of documentation. A thorough, written program that details your verification process is necessary to meet FSMA requirements. There is still time to ensure compliance; the supplier verification requirements take effect in March 2017. A fully integrated Enterprise Resource Planning (ERP) system would track supplier audits and link the documentation to supplier records. Proactive controls within an alert management system would prevent ingredients from advancing to the manufacturing floor until acceptable test results had been received. When you are fully aware of your suppliers and their capabilities, you can better execute when there is a quality or safety issue.

Know Yourself

Many businesses already have preventive controls programs in place; however, the challenge now becomes validating and documenting those processes and procedures. Some businesses may have been following Hazard Analysis and Critical Control Points (HACCP) guidelines, but may not have adequate documentation to prove it. Companies with GFSI certifications tend to have more complete documentation, but the format can vary from sophisticated technology to manual logs. Continuing with our example of the ice cream company, sanitation records would be necessary to prove the processing environment would not allow listeria to contaminate the finished product. Listeria is found in soil and water, and can be introduced into a manufacturing facility a number of ways. Floor drains are common sites of contamination as they can be neglected by cleaning staff. Once introduced into a cold environment, it can be difficult to contain, partly because the bacteria grows well at refrigerator temperatures, as low as 40°F. A thorough cleaning and sanitation program is required to keep listeria out of the processing environment. Tests should be run on the finished product to ensure there has been no microbial contamination. A shipping hold would prevent the product from being distributed prior to receipt of clean test results. Shipping documentation must be maintained that would reflect such a hold.

“If it’s not documented, it didn’t happen” is the call to action at this phase. A written analysis of both the identifications of the hazards and the controls to prevent or minimize the issue is required. Verification steps must also be designed and implemented to ensure the HARPC plans are operating correctly. A manufacturing execution system (MES) can record quality assurance tests, as well as cleaning and maintenance protocols, while the alert management system can warn when control checks have not occurred or when conditions are out of tolerance so that immediate action can be taken. A detailed record of the full scope of the plan, including the process, the proof, and the problem, must be kept.

Know Who You’re Shipping With

The third area of documentation is for shipment of the finished product. The Sanitary Transportation of Human and Animal Food rule requires that entities engaged in the shipping of food and food ingredients ensure that contamination and adulteration are avoided en route. In order to ensure the quality of the product, the ice cream company in our example would want to verify that temperatures are maintained throughout shipment. In addition, a properly maintained transport is necessary to prevent cross-contamination.

“Ignorance is not bliss” resonates for this point. Many food manufacturers already follow most of the requirements of the Sanitary Transportation rule; the focus going forward will be on documentation, training, and validation systems. As with supplier verification, it is your responsibility to document that you provided the shipper with detailed specifications for transport, such as temperature and cross-contamination controls. All written procedures, agreements, and training programs must be maintained for a year after use. While the compliance date for this rule is April 2017, these preventive controls should be put in place as soon as possible.

Conclusion

FSMA states that documentation must be accurate, detailed, and legible; it must be created at the same time as the activity being recorded, and it must be provided within 24 hours of the request for review. An integrated ERP system serving as a single source of truth for the company satisfies all of these provisions, gathering documentation from an MES and an alert management solution. A robust ERP will give a food manufacturer visibility and management of materials, quality, scheduling, and inventory management in order to track specific orders. At each step in the process, if a food safety risk is uncovered, immediate action must be taken to recall the affected product. The traceability feature of ERP allows the company to track a single ingredient or lot of finished product back to the supplier, through the inbound carrier, and forward to the outbound carrier and ultimately the distributor.

The FDA has stated their philosophy is to “educate before and while they regulate.” In keeping with this mindset, expect continuous improvement as these regulations continue to evolve. Implementing FSMA documentation provides an opportunity to encourage greater collaboration, instill a broader business perspective, and build stronger relationships that improve productivity and ensure food safety.