Overview
The Food Safety Modernization Act (FSMA) is a federal law that was passed in 2011. It requires companies that make, process, pack, or store human food and are registered with the FDA to follow new food safety rules called the Preventive Controls for Human Food (PCHF) rule, which can be found in 21 CFR Part 117. This rule is now final, and some businesses had to start following these requirements as early as September 2016.
The Pennsylvania Department of Agriculture (PDA) has adopted these new federal regulations and will enforce them. All businesses registered with the PDA must comply with the relevant parts of the PCHF rule, even if they are not registered with the FDA, unless they are specifically exempt. During inspections of food facilities, the PDA will check that the required food safety plans are in place and being followed correctly.
The PCHF rule requires eligible food establishments to follow updated good manufacturing practices (Modernized GMPs) and to create and implement a complete food safety plan.
PCHF Food Safety Plan Requirements:
Firms subject to PCHF must set up a food safety system. It must include a hazard analysis and risk-based preventive controls. This food safety system includes a written food safety plan that covers:
What are the known or reasonably foreseeable biological, chemical, and physical hazards that occur naturally, are unintentionally introduced, or are intentionally introduced, that could affect the safety of the food.
Preventive controls are required measures. They must minimize or prevent the identified hazards, including:
- Process controls: procedures, practices, and processes to control parameters during operations. Examples of process controls are cooking and refrigeration, and product formulation.
- Food allergen controls: procedures to prevent allergen cross-contact and ensure correct labeling of all food allergens.
- Sanitation controls: procedures, practices, and processes to make sure the facility is maintained in a sanitary manner to control hazards such as environmental pathogens. Environmental monitoring is required if contamination of a ready-to-eat food with an environmental pathogen such as Listeria monocytogenes is a hazard requiring a preventive control.
- Supplier-chain controls: a risk-based approach to ensure suppliers are not providing food establishments with raw materials or ingredients that pose a significant risk to the final product made by the firm.
- Other appropriate controls: preventive control procedures that are not process, food allergen, or sanitation controls, but are necessary to ensure that a hazard requiring a preventive control will be significantly minimized or prevented.
Monitoring: These procedures ensure preventive controls are consistently applied. Monitoring depends on the control in place. For instance, checking a heat process to eliminate pathogens involves recording temperatures. Also, all monitoring must be documented.
Corrections: These are timely steps to find and fix a minor, isolated problem in food production.
Corrective Actions: These include actions to identify and correct a problem implementing a preventive control, reduce the likelihood the problem will recur, evaluate affected food for safety, and prevent that food from entering commerce if you cannot ensure that the affected food is not adulterated. Corrective actions must be documented with records.
- Verification: These activities ensure preventive controls work and reduce hazards. For example, scientists validate controls to see if they effectively manage hazards. They also check instruments, like thermometers, for accuracy. Additionally, they review records to confirm monitoring and necessary corrections. Importantly, all verification activities must be documented.
Product testing and environmental monitoring can verify food safety. These are needed based on the food, facility, preventive control, and its role in safety. Environmental monitoring is vital if there's a risk of ready-to-eat food being contaminated with pathogens.
Keep records of compliance with the food safety plan. This includes monitoring, corrective actions, and verification activities. Make these records available to regulatory authorities, such as PDA and FDA.
If the hazard analysis identifies a hazard that requires a preventive control, you must have a written recall plan that includes the procedures that describe the steps to perform the recall and at minimum assigns responsibility for:
- Notifying the direct consignees of the food being recalled, including how to return or dispose of the affected food;
- Notifiying the public about hazards in the food;
- Conducting effectiveness checks; and
- Appropriately disposing of the recalled product.
Exemptions
There are some businesses that are exempt from PCHF food safety plan requirements. They include:
Food establishments covered by separate regulations including juice, seafood, dietary supplements, alcoholic beverages, or Low-acid canned foods (for C. botulinum control only as regulated by Part 113).
Grain elevators and warehouses that only store agricultural commodities (except fruits and vegetables) for further processing.
Establishments, such as warehouses, that only store packaged foods that are not exposed to the environment and for which refrigeration is not required for safety (Dry Warehouses).
Establishments that are Small or Very Small On-Farm businesses that conduct certain low-risk manufacturing and processing, packing, or holding activities (e.g., making jams/jellies, honey, maple syrup, candy, soft drinks, etc.); see more information in 117.5(g)(3) and 117.5(h)(3).
Note:
The new requirements don't cover a Farm, unless it is a mixed-type facility. That is, it is a Farm, but also does some activities outside the farm definition. Those activities require it to be registered under section 415 of the Federal FD&C Act.
(See Definition in 21 CFR 117.3)
Firms subject to the modified requirements
(Subpart D)
1. Very Small businesses as defined in 21 CFR 117.3
2. Qualified facilities as defined in 21 CFR 117.3 to which both of the following apply:
- In the three years before this calendar year, the average annual value of food sold directly to qualified end-users must surpass that sold to other buyers. This food was made, processed, packed, or stored at the facility.
- The average annual value of all food sold, adjusted for inflation, was under $500,000 in the 3 years before the applicable calendar year.
(See modified requirements that apply to qualified facilities in §117.201)
Resources
- Assistance for Industry
- Training Opportunities
- Key Facts about the Preventive Controls
- 21 CFR Part 117 – GMPs & PC Regulation
- PCHF Draft Guidance for Industry
- Frequently Asked Questions on FSMA (Q&A)
- FDA Small Entity Compliance Guide
- Potential Hazards for Food & Processes
- More Guidance and Supporting Material
Qualified facilities must submit the following attestations to FDA
An attestation that the facility is a qualified facility as defined in § 117.3; AND
A statement that you have identified hazards in the food being produced. You are implementing preventive controls to address the hazards. You are monitoring these controls to ensure they are effective.
An attestation that the facility complies with PDA Food Safety Law. Use licenses, inspection reports, or other evidence of oversight.
A qualified facility must notify the FDA within two years of updating its registration. If it doesn't, it may then need to follow Hazard Analysis and Preventive Controls requirements.
Attestations can be submitted to FDA either electronically here or by mail using FDA Form 3942a. Click here for more information.
Facilities storing refrigerated packaged foods require temperature control to prevent pathogens. These firms must: (See complete requirements in §117.206)
- Establish and implement temperature controls adequate to significantly minimize or prevent pathogen growth, and toxin formation,
- Monitor the temperature controls at adequate frequency,
- Take appropriate corrective actions when there is loss of temperature control,
- Verify temperature controls,
- Establish and maintain records.
NOTE:
Warehouse and distribution establishments engaged in the storage of any exposed food products and/or engaged in any processing/ manufacturing activities or “value added services” (e.g. blast freezing, roasting, tempering, labeling, repacking), may be subject to the PC rule requirements where they need to conduct a hazard analysis and may need to implement preventive controls.
Updated Good Manufacturing Practices (modernized GMPs)
The PCHF Rule also updates the current Good Manufacturing Practice requirements. All food establishments (regardless of exemption status) are subject to modernized GMP regulations.
The new updates include:
Training:
Management must ensure all food-handling employees are qualified. They need training in food hygiene and safety. This includes understanding the importance of health and hygiene. Training should be relevant to the food, facility, and their duties. Records of this training must be kept.
Allergen cross-contact:
Allergen cross-contact is now explicit in the regulatory text. You are required to employ practices and procedures to control allergen cross-contact.
Human food by-products used for animal foods:
The updated CGMPs cover holding and distributing human food by-products for animal food.
Guidance for Industry - Human Food By-Products for Use as Animal Food
How does the Preventive Controls Plan compared to a HACCP plan?
The general concepts are very similar.
However,"preventive controls plans" also cover monitoring, records, and corrective actions for items that are generally pre-requisite programs in HACCP plans. These include food allergen controls, sanitation controls, and a recall plan.
The table below compares the requirements for both plans.
Element | HACCP Plan | PC Rule Food Safety Plan |
Hazard Analysis | Biological, chemical, physical hazards | Biological, Physical & Chemical. Chemical hazards include radiological hazards. Also, consideration of economically motivated adulteration (21 CFR 117.130(b)(1)(ii)) |
Preventive Controls | CCPs for processes | Process CCPs + controls at other points that are not CCPs (21 CFR 117.135(a)(2)) |
Parameters and values | Critical limits at CCPs | Parameters and minimum/maximum values (equivalent to critical limits for process controls) (21 CFR 117.135(c)(1)) |
Monitoring | Required for CCPs | Required as appropriate for preventive controls (21 CFR 117.145) |
Corrective actions and Corrections | Corrective actions | Corrective actions or corrections as appropriate (21 CFR 117.150(a)) |
Verification (including validation) | For process controls | Verification as appropriate for all preventive controls; validation for process controls; supplier verification required when supplier controls a hazard (21 CFR 117.155, 117.160) |
Records | For process controls | As appropriate for all preventive controls (21 CFR 117.190) |
Recall plan | Not required in the plan | Required when a hazard requiring a preventive control is identified (21 CFR 117.139) |
Contact us
Bureau of Food Safety
(717) 787-4315
Suzanne Pyle
Program Specialist
(223) 666-2568
supyle@pa.gov