Whether you have read about FSMA, HARPC, Preventive Controls or 21 CFR 117, you are reading about the same thing, and it is important to understand when, how and where you must keep all of the documents and records required by the FDA to meet this regulatory framework.
FSMA or the Food Safety and Modernization Act of 2010 was passed into law in January of 2011, and the new Good Manufacturing Practices, Hazard Analysis and Preventive Controls created by that law went into effect in September of 2016 for very large food manufacturers (>500 employees), and goes into effect in September of 2017 for mid-size and smaller food manufacturers (<500 employees).
Sometimes referred to as Hazard Analysis Risk-Based Preventive Control (HARPC), the new regulations are also referred to as just Preventive Controls (PCs). Regardless of what these rules are called, they are located in the Code of Federal Regulations, Title 21, Chapter 1, Subchapter B Part 117 (21 CFR 117).
Going forward, I’m going to refer to all of this as HARPC, and talk about preventive controls.
What has changed with the new HARPC rules?
One question that keeps coming up for our clients is if their HACCP plans can be used to meet the requirements in HARPC and FSMA. Unfortunately, that will not work in any situation where an FDA inspector or their representative requests the HARPC documents required in the 21 CFR 117.
- HACCP is an analysis program that focuses on monitoring specific critical points (mainly measurement-based critical points such as temperature, moisture percentage, pH, etc.) in the manufacture, processing or storage of foods as the mechanism to ensure that safe controls are in place to remove hazards. As HACCP has proven insufficient in many instances over the last four decades, a push was made to expand the monitoring process to include all of the steps that could allow hazards to be in food, rather than just a few steps in the process. The HARPC and FSMA rules changes the definition of those points to include all of the points of a manufacturing process that prevent hazards from occurring.
- As the HARPC definitions have changed and expanded the meaning of the control point, the rules also require programs that were mostly visually inspected. Companies that did not have an allergen recall were unlikely to ever have an FDA regulator assess their program, and in fact the FDA was not allowed to inspect paperwork on programs. While it is true that allergens have had to be listed on labels for over ten years, food manufactures have not been required to document a complex program for controlling allergens. With subpart C of the 21 CFR 117, that is now required, as are plans for recalls and sanitation. Previously, if your facility appeared clean upon inspection, and there was no evidence of cleanliness issues in finished goods, the FDA did what they felt was best. While your company’s sanitation program may be perfectly fine, and it may already meet the HARPC requirements, it must be fully documented, whereas before it was just known to the people who cleaned and sanitized.
- Recall planning was something that large companies regularly practiced, and that they required their suppliers to put into place, but it was not required by the law to have a full recall program. Now, everyone is held to the highest standards of recall preparedness, and must practice annually.
- Lastly, the managing of supply chain is the biggest change. How a company manages its supply chain is very complex, even for seemingly simple processes. Most mid-size businesses see hundreds of thousands or even millions of pounds of food move through their facility each year. Purchase orders, letters of guarantee, bills of lading and other basic documentation of commerce have normally been the foundation of supply chain management. Depending on the business, certificate of analysis testing documents also may or may not be required. The FDA has changed the rules to require companies to rethink and develop comprehensive strategies to prevent problems in the supply chain. While guidelines have been published, for companies bringing in large varieties of ingredients, or purchasing ingredients from oversees, the new requirements will not be met by antiquated or underdeveloped programs. Unless your business has already meeting strict third party audit requirements for years, your program should be re-evaluated and updated by ownership, and by food safety experts.
As with most major changes in rules and regulations, there is a large amount of confusion over them. For companies that have run sophisticated programs, adopting HARPC has not been a major challenge, as it has amounted to adding a few paragraphs to existing documents or rewording forms. For companies that have not previously needed to have complex programs, the new rules can be excruciatingly complex.
Companies that have been particularly hard hit by these rules are pet food manufacturers, non-farm raw ingredient suppliers, and small businesses without full time quality assurance and food safety employees. Attempting to sort out all of the new requirements and processes to ensure compliance can be overwhelming.
To learn more about HARPC and FSMA regulations, contact Kellerman Consulting.