Managing Your Supply Chain Through FSMA Compliance
Jennifer Kinion
At every level of the supply chain, food and beverage companies face increasing complexity which is why many process manufacturers are relying on software to help with supplier management compliance. While the key drivers for this added complexity vary, many companies share a demand for innovation, including new flavors, new products, and exciting ingredients. There are also new threats to food, including the appearance of new microbes and instances of bacteria such as E. coli emerging in previously unsuspected products and ingredients. These complexities are in part what led the FDA to recognize the supply chain as a major risk, and the Food Safety Modernization Act (FSMA) was developed as a result.
Because the FDA recognized that supply chain control is critical in terms of managing food safety risks, it developed two rules address this key area, outlined below. Discover whether your FSMA compliance approaches are up-to-date with a quick review of the two key rules:
Preventive Controls Rule (Human and Animal Food)
Food and beverage manufacturers subject to the Preventive Controls Rule must assess supply chain risks and then verify that the risks are being controlled. If it is determined that the supplier is responsible for controlling the risk, the purchasing company must be able to verify that the supplier is doing so effectively.
Foreign Supplier Verification Program (FSVP)
FSMA’s FSVP is very similar to the Preventive Controls Rule, with the exception of the fact that it shifts the burden of ensuring safe food to importers. It is therefore the FDA’s expectation that importers will have assessed risks in the supply chain and subsequently verify that risks are being controlled.
While these rules are conceptually fairly simple, many companies still face confusion around their implementation. For instance, a common question is as follows: If a manufacturer that would ordinarily fall subject to the Preventive Controls Rule also imports food, does it need to take a separate approach to comply with both rules? The answer is no – it can cover all supply chain risk control as part of the Preventive Control Rule requirements.
The FSMA Compliance Approach to Supply Chain Control
The regulatory approach to managing supply chain risks is the same for both the Preventive Controls Rule and FSVP. It comprises the following key steps:
Perform a Hazard Analysis
Look at hazards presented by the materials your company sources in all three areas: ingredients, products, and packaging.Evaluate the Risks
Identify the types of risks posed, including whether they are microbiological, chemical, or physical. The next step is to identify who is responsible for controlling the risk. This could be the supplier, your company, or your customer. If your customer is responsible for controlling the risk, FSMA requires a letter of assurance from the customer stating this.Supplier Verification
If it has been determined that the supplier is controlling the risk, you will need to verify that the vendor is indeed doing so effectively.Use of Approved Suppliers
The FDA may request to see your list of approved suppliers as well as the means by which you select and approve suppliers.Corrective Actions
Any time a supplier fails, make sure the corrective actions are carried out appropriately and are thoroughly documented.Build a Program and Keep Records
Detailed recordkeeping is a common theme across many aspects of FSMA, so confirm that records are updated regularly and are well organized.
A Basic Approach to the Preventive Controls Rule
A practical implementation of a FSMA approach to the Preventive Controls Rule is as follows:
Create a List
Compile a list of all ingredients you are using, as well as products and primary packaging.Perform a Hazard Analysis
Determine if any risks are Class 1 level. Retain this information for your records, as it may be requested by the FDA.Determine who will control the risks you have identified.
Will it be your company? If so, you must build controls into your food safety plan. If the supplier is controlling the risk, you must have measures in place to verify that they are doing so.
Supplier Verification
The approach to supplier verification is very similar to that of the Preventive Controls Rule. You can start by compiling a list of all suppliers, including locations if there are multiple manufacturing sites for one supplier. For all Class 1 risks being controlled by the supplier, you will need an onsite audit. If you are sourcing from multiple sites, you will need an audit for each. Many companies rely on third-party audits to satisfy this requirement; however, it is essential to make sure that you have proper documentation in place should you choose to go this route. Because Global Food Safety Institute (GFSI) standards are well-aligned with FSMA, GFSI certification appears to satisfy FDA requirements. If you are unable to perform an onsite audit for Class 1 risks, you will need to document the reason why and control the risk through another means, such as a testing program.
For other risks, you can use alternate control methods, such as a COA or review of suppliers’ food supply plans. Be mindful of how you use COAs, however. While they are common across the industry, it is important to understand exactly what each COA means. If an ingredient poses a high risk, make sure the COA is strong and reliable. For instance, is the testing method an approved one? Does it test adequate amounts of the product? Is the lab that is being used an accredited one? While you do not have to look at COAs quite this closely for every ingredient, be sure to do so for those you deem most important.
To review, here is a brief recap of the information outlined above:
Maintain a list of approved suppliers
Take appropriate corrective actions
Keep full records
If your company falls under the Preventive Controls Rule or FSVP and follows these tactics, your facilities will likely be well prepared for an FDA inspection.
