FDA FSMA Final Rule – Mitigation Strategies to Protect Food Against Intentional Adulteration

The Food and Drug Administration (FDA) has published in the Federal Register a final rule on Mitigation Strategies to Protect Food Against Intentional Adulteration, 81 Fed. Reg. 34,165 (May 27, 2016), 21 C.F.R. Part 121 (Final Rule).  The proposed rule was issued on December 24, 2013. The revisions in the Final Rule are largely designed to provide either more information, where stakeholders requested it, or greater flexibility for food facilities in determining how they will assess their facilities, implement mitigation strategies, and ensure that the mitigation strategies are working as intended.

The Final Rule implements three key provisions of the Federal Food, Drug and Cosmetic Act (FD&C Act), as amended by the Food Safety Modernization Act (FSMA), that relate to the intentional adulteration of food. These include FD&C Act § 418 (addresses intentional adulteration in the context of facilities that manufacture, process, pack, or hold food), § 419 (addresses intentional adulteration in the context of fruits and vegetables that are raw agricultural commodities), and § 420 (addresses intentional adulteration in the context of high-risk foods).

Additional information about the Final Rule is provided on FDA’s FSMA Mitigation Strategies webpage.  The Mitigation Strategies webpage includes helpful explanatory diagrams that highlight the applicability and requirements of the Final Rule, a Fact Sheet, and Questions and Answers, among other resources.

EXECUTIVE SUMMARY

The purpose of the Final Rule is to protect food from intentional acts of adulteration where there is an intent to cause wide scale public health harm. This rule applies to both domestic and foreign facilities that are required to register under FD&C Act § 415.

The Final Rule requires various food defense measures that an owner, operator, or agent in charge of a facility is required to implement to protect against the intentional adulteration of food, including, specifically:

• A written food defense plan that includes a vulnerability assessment to identify significant vulnerabilities and actionable process steps, mitigation strategies, and procedures for food defense monitoring, corrective actions, and verification;
• Identify any significant vulnerabilities and actionable process steps by conducting a vulnerability assessment for each type of food manufactured, processed, packed, or held at the facility using appropriate methods to evaluate each point, step, or procedure in a food operation;
• Identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated. For each mitigation strategy implemented at each actionable process step, include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step;
• Establish and implement mitigation strategies management components, as appropriate to ensure the proper implementation of each such mitigation strategy, taking into account the nature of the mitigation strategy and its role in the facility’s food defense system;
• Establish and implement food defense monitoring procedures, for monitoring the mitigation strategies, as appropriate to the nature of the mitigation strategy and its role in the facility’s food defense system;
• Establish and implement food defense corrective action procedures that must be taken if mitigation strategies are not properly implemented, as appropriate to the nature of the actionable process step and the nature of the mitigation strategy;
• Establish and implement specified food defense verification activities, as appropriate to the nature of the mitigation strategy and its role in the facility’s food defense system;
• Conduct a reanalysis of the food defense plan;
• Ensure that all individuals who perform required food defense activities are qualified to perform their assigned duties; and
• Establish and maintain certain records, including the written food defense plan (vulnerability assessment, mitigation strategies and procedures for food defense monitoring, corrective actions, and verification) and documentation related to training of personnel. All records are subject to certain general recordkeeping and record retention requirements.

As specified in more detail below, there are several potentially applicable exemptions to the final rule.

The effective date is 60 days after the Final Rule was published; however, facilities generally have three (3) years and “small businesses” have four (4) years from the effective date to comply with the Final Rule (see definitions of such entities below).

FINAL RULE – DISCUSSION

I.          General Provisions (21 C.F.R. Part 121, Subpart A)

A)  Applicability and Exemptions – §§ 121.1; 121.5

The Final Rule applies to the owner, operator or agent in charge of a domestic or foreign food facility that manufactures/processes, packs, or holds food for consumption in the United States and is required to register with FDA as a food facility. The Final Rule is designed to primarily cover large companies whose products reach many people, exempting smaller companies. There are 3,400 covered firms that operate 9,800 food facilities.

            The Final Rule does not apply to the following:

• “Very small business,” e., a business (including any subsidiaries and affiliates) averaging less than $10,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee);
• Facilities that only hold food, except the holding of food in liquid storage tanks;
• Facilities that pack, re-pack, label, or re-label food where the container that directly contacts the food remains intact;
• Farms that are subject to Standards for Produce Safety (FD&C Act § 419);
• Alcoholic beverages at a facility that:
  • Is required to obtain a permit from, register with, or obtain approval of a notice or application from the Secretary of the Treasury as a condition of doing business in the United States, or is a foreign facility of a type that would require such a permit, registration, or approval if it were a domestic facility; and is required to register as a food facility under FD&C Act § 415 because it is engaged in manufacturing, processing, packing, or holding one or more alcoholic beverages; or
  • Is registered as a food facility under FD&C Act § 415 and (i) is in prepackaged form that prevents any direct human contact with such food; and (ii) constitutes not more than 5 percent of the overall sales of the facility.
• Facilities that manufacture, process, pack, or hold food for animals;
• On-farm manufacturing, processing, packing, or holding of eggs and game meats by a small or very small business, if such activities are the only activities conducted by the business.

B)  Definitions – § 121.3

“Actionable process step” – a point, step, or procedure in a food process where a significant vulnerability exists and at which mitigation strategies can be applied and are essential to significantly minimize or prevent the significant vulnerability.

“Adequate” – that which is needed to accomplish the intended purpose in keeping with good public health practices.

“Affiliate” – any facility that controls, is controlled by, or is under common control with another facility.

“Calendar day” – every day as shown on the calendar.

“Contaminant” – any biological, chemical, physical, or radiological agent that may be added to food to intentionally cause illness, injury, or death.

“Facility” – a domestic facility or a foreign facility that is required to register under FD&C Act § 415.

“Farm” – a facility in one general physical location devoted to the growing and harvesting of crops, the raising of animals (including seafood), or both. Washing, trimming of outer leaves, and cooling produce are considered part of harvesting. The term “farm” includes:

1. Facilities that pack or hold food, provided that all food used in such activities is grown, raised, or consumed on that farm or another farm under the same ownership; and
2. Facilities that manufacture/process food, provided that all food used in such activities is consumed on that farm or another farm under the same ownership.

“Food” – (1) articles used for food or drink for man or other animals, (2) chewing gum, and (3) articles used for components of any such article.

“Food defense” – the effort to protect food from intentional acts of adulteration where there is an intent to cause wide scale public health harm.

“Food defense monitoring” – to conduct a planned sequence of observations or measurements to assess whether mitigation strategies are operating as intended.

“Food defense verification” – the application of methods, procedures, and other evaluations, in addition to food defense monitoring, to determine whether a mitigation strategy or combination of mitigation strategies is or has been operating as intended according to the food defense plan.

“Full-time equivalent employee” – represents the number of employees of a business entity for the purpose of determining whether the business qualifies as a small business. The number of full-time equivalent employees is determined by dividing the total number of hours of salary or wages paid directly to employees of the business entity and of all of its affiliates and subsidiaries by the number of hours of work in 1 year, 2,080 hours (i.e., 40 hours × 52 weeks). If the result is not a whole number, round down to the next lowest whole number.

“Holding” – storage of food and also includes activities performed incidental to storage of food (e.g., activities performed for the safe or effective storage of that food, such as fumigating food during storage, and drying/dehydrating raw agricultural commodities when the drying/dehydrating does not create a distinct commodity (such as drying/dehydrating hay or alfalfa)). Holding also includes activities performed as a practical necessity for the distribution of that food (such as blending of the same raw agricultural commodity and breaking down pallets), but does not include activities that transform a raw agricultural commodity into a processed food as defined in section 201(gg) of the FD&C Act. Holding facilities could include warehouses, cold storage facilities, storage silos, grain elevators, and liquid storage tanks.

“Manufacturing/processing” – making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food, including food crops or ingredients. Examples of manufacturing/processing activities include: Baking, boiling, bottling, canning, cooking, cooling, cutting, distilling, drying/dehydrating raw agricultural commodities to create a distinct commodity (such as drying/dehydrating grapes to produce raisins), evaporating, eviscerating, extracting juice, formulating, freezing, grinding, homogenizing, irradiating, labeling, milling, mixing, packaging (including modified atmosphere packaging), pasteurizing, peeling, rendering, treating to manipulate ripening, trimming, washing, or waxing. For farms and farm mixed-type facilities, manufacturing/processing does not include activities that are part of harvesting, packing, or holding.

“Mitigation strategies” – those risk-based, reasonably appropriate measures that a person knowledgeable about food defense would employ to significantly minimize or prevent significant vulnerabilities identified at actionable process steps, and that are consistent with the current scientific understanding of food defense at the time of the analysis.

“Mixed-type facility” – an establishment that engages in both activities that are exempt from registration under FD&C Act § 415 and activities that require the establishment to be registered. An example of such a facility is a “farm mixed-type facility,” which is an establishment that is a farm, but also conducts activities outside the farm definition that require the establishment to be registered.

“Packing” – placing food into a container other than packaging the food and also includes re-packing and activities performed incidental to packing or re-packing a food (e.g., activities performed for the safe or effective packing or re-packing of that food (such as sorting, culling, grading, and weighing or conveying incidental to packing or re-packing)), but does not include activities that transform a raw agricultural commodity into a processed food as defined in FD&C Act § 201(gg).

“Qualified individual” – a person who has the education, training, or experience (or a combination thereof) necessary to perform food defense measures activities (as required under the Final Rule), as appropriate to the individual’s assigned duties. A qualified individual may be, but is not required to be, an employee of the establishment.

“Significant vulnerability” – a vulnerability that, if exploited, could reasonably be expected to cause wide scale public health harm. A significant vulnerability is identified by a vulnerability assessment conducted by a qualified individual, that includes consideration of the following: (1) Potential public health impact (e.g., severity and scale) if a contaminant were added, (2) degree of physical access to the product, and (3) ability of an attacker to successfully contaminate the product. The assessment must consider the possibility of an inside attacker.

“Significantly minimize” – to reduce to an acceptable level, including to eliminate.

“Small business” – a business (including any subsidiaries and affiliates) employing fewer than 500 full-time equivalent employees.

“Subsidiary” – any company which is owned or controlled directly or indirectly by another company.

“Very small business” – a business (including any subsidiaries and affiliates) averaging less than $10,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee).

“Vulnerability” – the susceptibility of a point, step, or procedure in a facility’s food process to intentional adulteration.

II.          Food Defense Measures – 21 C.F.R. Part 121, Subpart C

While this is the first time that companies are required to create a food defense plan, the FDA has taken an approach under the Final Rule similar to a Hazard Analysis Critical Control Point (HACCP) system, an approach adopted by industry for the identification, evaluation and control of food safety hazards. The Final Rule aims to advance and strengthen those safeguards.

A.  Food Defense Plan – § 121.126

An owner, operator or agent of a food facility must prepare and implement a written food defense plan.  As set forth in more detail below, a food defense plan must include the following in writing: the vulnerability assessment and explanation, the mitigation strategies and explanation, the procedures for the food defense monitoring of the implementation of mitigation strategies, the procedures for food defense corrective action, and the procedures for food defense verification.

B.  Written Vulnerability Assessment – § 121.130

A vulnerability assessment is required for each type of food manufactured, processed, packed, or held at a facility using appropriate methods to evaluate each point, step, or procedure in food operations to identify significant vulnerabilities and actionable process steps. Appropriate methods must include, at a minimum, an evaluation of:

1. The severity and scale of the potential impact on public health. This would include such considerations as the volume of product, the number of servings, the number of exposures, how fast the food moves through the distribution system, potential agents of concern and the infectious/lethal dose of each; and the possible number of illnesses and deaths;
2. The degree of physical access to the product. Things to be considered would include the presence of such physical barriers as gates, railings, doors, lids, seals and shields; and
3. The ability to successfully contaminate the product.

The assessment must consider the possibility of an inside attacker.  The vulnerability assessment must be in writing and must include an explanation as to why each point, step, or procedure either was or was not identified as an actionable process step.

C.  Written Mitigation Strategies – § 121.135

Facilities must identify and implement mitigation strategies at each actionable process step to provide assurances that the significant vulnerability at each step will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated.  The mitigation strategy must be in writing, and at each actionable process step, the facility must include a written explanation of how the mitigation strategy sufficiently minimizes or prevents the significant vulnerability associated with the actionable process step. 

The Final Rule removes the distinction between “broad” and “focused” mitigation strategies. The proposed rule only required “focused” mitigation strategies because “broad” mitigation strategies, such as a fence around the entire facility, did not protect specific points from being attacked by an insider.  The Final Rule recognizes that a mitigation strategy, applied in a directed and appropriate way to protect the actionable process step from an insider attack, would sufficiently minimize the risk of intentional adulteration.

D.  Mitigation Strategies Management Components – §121.138

Steps must be taken to ensure the proper implementation of each mitigation strategy (as identified under §121.135).  In each of these areas of food defense, the facilities are given flexibility to establish mitigation strategy management components most appropriate to their operation and products:

• Monitoring (§121.140): establishing and implementing procedures, including the frequency with which they are to be performed, for monitoring the mitigation strategies.
• Corrective actions (§121.145): the response if mitigation strategies are not properly implemented.
• Verification (§121.150): verification activities would ensure that monitoring is being conducted and appropriate decisions about corrective actions are being made.

       a.  Food Defense Monitoring – § 121.140

Facilities are required to establish and implement written procedures, including the frequency with which they are to be performed, for food defense monitoring of the mitigation strategies.  Facilities mustl monitor the mitigation strategies with adequate frequency to provide assurances that they are consistently performed. 

The monitoring of mitigation strategies must be documented and in accordance with verification and records review requirements (see § 121.150).  Records may be affirmative records demonstrating the mitigation strategy is functioning as intended. Exception records demonstrating the mitigation strategy is not functioning as intended may be adequate in some circumstances.

      b.  Food Defense Corrective Actions – § 121.145

Food defense corrective action must be taken if mitigation strategies are not properly implemented.  Food defense corrective action procedures are to be established as appropriate to the nature of the actionable process step and the nature of the mitigation strategy and must describe the steps to be taken to ensure that:

1. Appropriate action is taken to identify and correct a problem that has occurred with implementation of a mitigation strategy; and
2. Appropriate action is taken, when necessary, to reduce the likelihood that the problem will recur.

Facilities are required to establish and implement written food defense corrective actions procedures.  All such corrective action taken must be documented in records that are subject to food defense verification and records review requirements (see § 121.150).

      c.  Food Defense Verification – § 121.150

Food defense verification activities must include, as appropriate to the nature of the mitigation strategy and its role in the facility’s food defense system:

1. Verification that food defense monitoring is conducted in accordance with §121.140 and as required by § 121.138;
2. Verification that appropriate decisions about food defense corrective actions are made in accordance with §121.145 and as required by § 121.138.
3. Verification that mitigation strategies are properly implemented and are significantly minimizing or preventing the significant vulnerabilities. Such verification activities, as appropriate to the facility, the food, and the nature of the mitigation strategy and its role in the facility’s food defense system, include:
   1. Review of the food defense monitoring and food defense corrective actions records within appropriate timeframes to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food defense plan, the mitigation strategies are properly implemented, and appropriate decisions were made about food defense corrective actions; and
   2. Other activities appropriate for verification of proper implementation of mitigation strategies;

Facilities are required to establish and implement food defense verification procedures, including the frequency for which they are to be performed and all such verification activities must be documented in records.

E.  Reanalysis – § 121.175

Facilities must conduct a reanalysis of the food defense plan as a whole at least once every three years.  In addition, a reanalysis is required in whole, or part, when:

1. There is a significant change made in the activities conducted at a facility that creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability;
2. A facility becomes aware of new information about potential vulnerabilities associated with the food, operation, or facility;
3. A facility finds that a mitigation strategy, a combination of mitigation strategies, or the food defense plan as a whole is not properly implemented; and
4. FDA requires reanalysis to respond to new vulnerabilities, credible threats to the food supply, and developments in scientific understanding including, as appropriate, results from the Department of Homeland Security biological, chemical, radiological, or other terrorism risk assessment.

Facilities must complete reanalysis (and implement any necessary additional mitigation strategies):

1. Before any change in activities (including any change in mitigation strategy) at the facility is operative;
2. When necessary within 90-calendar days after production; and
3. Within a reasonable timeframe, providing a written justification is prepared for a timeframe that exceeds 90 days after production of the applicable food first begins.

Facilities must revise the written food defense plan if a significant change in the activities conducted at the facility creates a reasonable potential for a new vulnerability or a significant increase in a previously identified vulnerability or document the basis for the conclusion that no revisions are needed.

F.  Qualifications and Training – §121.4

All individuals that perform required food defense measures activities must be a “qualified individual” (as defined in § 121.3, i.e., have the education, training, or experience necessary to perform food defense measures activities as appropriate to the individuals assigned duties).   Such individuals may be, but are not required to be, employees of the facility.

In addition to being a “qualified individual,” each individual assigned to an actionable process step (including temporary and seasonal personnel) or in the supervision thereof must receive training in food defense awareness.

One or more qualified individuals must oversee the preparation of the food defense plan, conduct a vulnerability assessment, identify/explain the mitigation strategies, and any reanalysis of such activities.

Individuals that perform or oversee the preparation of the food defense plan, conduct a vulnerability assessment, identify/explain the mitigation strategies, and any reanalysis of such activities, must be “qualified individuals” and have successfully completed training for the specific function at least equivalent to that received under a standardized curriculum recognized as adequate by FDA, or be otherwise qualified through job experience to conduct the activities.

Responsibility for ensuring compliance by individuals with the requirements of the Final Rule must be clearly assigned to supervisory personnel that have a combination of education, training, and experience necessary to supervise the food defense measures requirements.

Training, as required above, must be documented in records, and must include the date of training, the type of training, and the persons trained.

III.          Recordkeeping Requirements – 21 C.F.R. Part 121, Subpart D

A.  In General – § 121.305

All records that are required to be maintained under the Final Rule, as stated above, must:

• Be kept as original records, true copies (i.e. photocopy), or electronic records;
• Contain the actual values and observations obtained during food defense monitoring;
• Be accurate, indelible, and legible;
• Be created concurrently with performance of the activity documented;
• Be as detailed as necessary to provide a history of work performed; and
• Include:
  1. Information adequate to identify the facility;
  2. Dates and times, where appropriate;
  3. The signature or initials of the person performing the activity; and

The identity of the product and the lot code, if any.

Electronic records maintained pursuant to the Final Rule are exempt from the FDA’s electronic records requirements (21 C.F.R. Part 11). Records that satisfy the requirements of the Final Rule, but that also are required under other applicable statutory provisions or regulations, remain subject to FDA’s electronic records requirements.

B.  Additional Requirements Applying to the Food Defense Plan – § 121.310

The owner, operator, or agent in charge of the facility must sign and date the food defense plan upon initial completion, and upon any modification.

C.  Retention, Official Review, Public Disclosure, and Existing Records – §§ 121.315, 121.320, 121.325, 121.330

All records required by the Final Rule must be retained at the facility for at least 2 years after the date they were prepared.  The food defense plan must be retained for at least 2 years after its use is discontinued.

Except for the food defense plan, offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of request for official review. The food defense plan must remain onsite. Electronic records are considered to be onsite if they are accessible from an onsite location.  If the facility is closed for a prolonged period, the food defense plan may be transferred to some other reasonably accessible location, but must be returned to the facility within 24 hours for official review upon request.

A “very small business” must keep records at the facility to support its status as exempt during the 3-year period preceding the applicable calendar year as long as necessary to support the exempt status during the applicable calendar year.

All records required by the Final Rule must be made promptly available to any duly authorized representative of the Secretary of Health and Human Services for official review and copying upon oral or written request.  Records required by the Final Rule will be protected from public disclosure to the extent allowable under FDA’s Public Information Regulations (21 C.F.R. Part 20).

Existing records (e.g., records that are kept to comply with other federal, State, or local regulations, or for any other reason) do not need to be duplicated if they contain all of the required information and satisfy the requirements of the Final Rule.  Existing records may be supplemented, as necessary, to include all of the required information.

The information required by the Final Rule does not need to be kept in one set of records. If existing records contain some of the required information, any new information required by the Final Rule may be kept either separately or combined with the existing records.

IV.          Compliance and Compliance Dates – 21 C.F.R. Part 121, Subpart E

Failure to comply with FD&C Act § 418, §420, or subparts C or D of the Final Rule are “prohibited acts” under FD&C Act § 301(uu).

In general, facilities must comply with the Final Rule three (3) years after the date of publication, i.e., May 28, 2019; however “small businesses” have four (4) years from date of publication, i.e., May 28, 2020, to comply.  Although “very small businesses” are exempt from the Final Rule, such entities have five (5) years to comply with §121.5(a), which requires documentation to show that a facility meets the “very small business” exemption.

*                                  *                                  *                                  *

We hope you find this summary is useful.  If you have any questions or desire additional information, please do not hesitate to contact us.