FSMA Inspections & Recordkeeping: What Are The FDA's Required Documents?

By Sam Lewis, editor, Food Online

Be sure to watch the entire web chat or read part one and part two of this series

In this segment of Food Online’s and the Grocery Manufacturers Association’s (GMA) live web chat, Food For Thought: How To Always Be FSMA Inspection Ready, Elizabeth Fawell, food industry counsel at Hogan Lovells; and Samantha Cooper, senior manager of food safety and quality assurance at GMA discuss FSMA’s recordkeeping requirements regarding Preventive Controls, Allergen Controls, sanitation, as well as the Foreign Supplier Verification Program.

Sam: This question is going to put the sanitation of Preventive Control's records into perspective. What kind of records to you suspect the FDA will request for Sanitation Preventive Controls? Elizabeth, have you had any experiences with your site visits with this? If you could share any knowledge you have on that, we'd appreciate it.

Elizabeth: Sure! That's going to depend upon the nature of the program. In general, your sanitation controls will be those written controls and your procedures, as well as your records demonstrating that you performed the sanitation, and that those records were reviewed, as well as your corrective action procedure outlining the steps that you'll take if you find a deviation in your Sanitation Control Program. You may also have verification records consisting of environmental monitoring to help verify that your sanitation controls are effective. It's really going to depend upon your product, your process, your equipment, your facility, the nature of the hazard, and how your sanitation programs are working to control that hazard.

Samantha: I would add that we've all seen with these recent inspections that the FDA is taking a close look at allergen controls. This will be related to the sanitation controls put in place. Whenever we would teach the course, the curriculum, the PCQI through the FSPCA course, the sanitation control is a gray area. For a lot of folks, it's hard to break out of that, "I can view this in my prerequisite program, I shouldn't have to have a Preventive Control" mindset. To find out when you really need to elevate that sanitation program to perhaps Preventive Control, it's going to take time but also stem from your hazard analysis.

Sam: Obviously, sanitation is part of an environmental monitoring program (EMP). Could you offer us any details on what the FDA is looking for when they arrive at your facility and they want to take look at your EMP?

Samantha: I would have to have more clarification about this. I think we could have a week-long program on just environmental monitoring, but just to know that, at least in Preventive Control regulation, environmental monitoring is talked about as a verification of your sanitation program and is required if you have a ready-to-eat (RTE) product that is exposed to the environment prior to packaging. In that case, you would have to have an environmental monitoring program. However, we do see facilities that have an environmental monitoring program regardless if they had RTE product or not. Again, I would need more details to see what really needs clarification.

Sam: Great. Thanks, Samantha. I would feel terrible if I didn't follow back on the corporate question from earlier. This one just came in. Elizabeth, maybe you can address this one. "Would you recommend a corporate presence at the first Preventive Controls inspection due to the fact that many of the programs expected are corporate maintained? If you would recommend corporate presence being there, who would those people be?"

Elizabeth: That's just going to depend; that's a case-by-case decision that needs to be made based upon the strength of the food safety plan. When you talk about plant programs being managed at corporate, lots of times the ingredient hazard analysis and the supply chain program are managed at corporate, but many of the other programs are typically managed at a plant level. You'd need to think about what is it that that corporate versus the plant, the strength of the plant manager and the person that signed the food safety plan to be prepared to answer questions, the nature of the product, and what kinds of questions you think might arise from that.

I certainly know that companies have taken the decision to send corporate folks to a foreign inspection, particularly to help with explaining how the nature of global program relate to the FDA and U.S. requirements. Typically, within domestic inspections, and because they're unannounced, it's much more common for corporate to be on the phone and provide a supporting role via email, text, or phone call. I think it's important to recognize that the food safety plan needs to be signed by someone who has the ability to talk about it and defend the program. That person needs to be a PCQI. We should be thinking about what support you need to provide before that first inspection as well and then make the decision about whether there are still gaps that folks from corporate QA would be able to fill.

Sam: I'm going to switch gears on you a little bit. With FSMA being top of mind, everyone in the industry is going through some big changes and this question has to do with exactly that, it's dealing with change. It reads, "I already have records. Why do I need to switch to electronics? I don't have any sanitizing problems, why do I need to change my practices?"

Elizabeth: There's no requirement to switch to electronic records. The FDA waives compliance with part 11, the electronic records requirement within the final rule. Paper records are considered acceptable if they meet the underlying recordkeeping requirements that you'll find in the regulation.

With respect to not needing to sanitize, I think it's important to take a step back and think about why we have FSMA in the first place. FSMA is really about shifting the responsibility to food manufactures to prevent foodborne illness outbreaks. Thinking about if there aren't any problems, why is that the case? Is that based upon the nature of your process system, are you involved in a processing system producing a product where sanitation is of less importance? Or is there something that there is a food safety hazard that needs to be minimized or prevented? You really need to go back to your hazard analysis and look at that, and then think about whether or not you can defend your thinking and your reasoning to an FDA investigator.

You should also look at, if you need resources, the FDA guidance documents on the Preventive Controls rule. There's also an appendix to that guidance document that outlines potential food safety hazards in various commodities and products. That can be an important tool for you to help do a check on your own thinking about whether or not post-processing contamination might be an issue in your facility.

Samantha: To add onto what Elizabeth said, remember how in our introduction Elizabeth stated, "Remember: if it isn't documented, it didn't happen. If it is documented, it happened just that way." If you have that mindset that you don't need to sanitize just because you've never had a problem, how does that sound to an FDA investigator? Again, it's a different mindset. It's also going back to your hazard analysis and really making sure.

Maybe you've been producing something safely for the past 15 years. Now we have FSMA. FSMA is updating the food safety system. It is a new way of thinking, so it's important and a requirement to go back through that and to make sure that you are producing safe food and that you have preventive measures in place.

Sam: As you mentioned with records: f it's not documented, it didn't happen. That’s a great segue into this question. "We're in the process of reviewing the procedures on our records. What will the FDA be asking for? Will it be the food safety plan? Will it be traceability? The procedures we go through? Are there photographs that they want to see? Just for the general compliance and preparedness for an inspection, what should a food maker have at the ready?"

Samantha: This relates to part of what we said earlier; when the FDA arrives at your facility for an inspection, your entire food safety plan is open. Your food safety plan is all those documents that Elizabeth had mentioned earlier. It's your hazard analysis, it's your procedure of your programs, it's your determination of what you're Preventive Control is, which stems from your hazard analysis. If you call out as a Preventive Control, then you open up yourself to more responsibility and more recordkeeping.

Then you're going to have monitoring. You're going to have corrective actions. It indicates to your Preventive Control, you're going to have validation. Anything that even references it in your food safety plan, for instance, "I don't need a preventive control because of XYZ program." Well, now that program that you've referenced in your food safety program, the FDA could ask for that as well. The FDA, through FSMA, they have board record access. They will have access to a lot.

I'm kind of confused on photos that the FDA will request to see? I was thinking, there's an example where people sometimes take photos to put inside their sanitation procedures. Well, if you have a sanitation preventive control that has pictures in it, then yeah, the FDA is going to be able to see that.

Elizabeth: I think the most important thing to keep in mind is that the regulation is your best guide. It outlines the records that are required. You should be prepared to share those records with the FDA.

Sam: I agree wholeheartedly. If it's not proprietary to you, I think the FDA should be able to see that you're producing safe food and your plan to do so.

We're running out of time, so I'm going to ask one last question. I'm going to go back to FSVP. It reads, "Under the FSVP, what point of the supply chain does the importer control that hazard?"

Samantha: It's important to realize that FSVP and the obligations that comply to FSVP really fall onto the definition of the importer. Again, I think I mentioned earlier that this is a new rule and there could be a lot of confusion on FSVP. One of the biggest points is, well, "Am I the FSVP Importer?" This rule applies to you if you are the FSVP Importer, which you must be located in the U.S.

If you are the FSVP importer, I think the question asks, to what extend does the hazard need controls? Your obligation as the FSVP Importers is to assure that your foreign supplier is producing safe food. You, as FSVP Importer, unless you're also the receiving facility, you may not be actually controlling that hazard. You'd be "controlling that hazard" through your documented program to ensure that your foreign provider is producing safe food.

On the flip side, you're the FSVP Importer, but also a receiving facility in the U.S. You could be controlling that hazard; maybe you're externally processing it. You could be controlling that hazard in your facility, which the control goes to the supply chain program. These rules do clip together and work with each other. FSVP is confusing, but really the hazard is going to be controlled by your supplier unless, of course, you're also the receiving facility, and you maybe apply a controlled path within your four walls of the U.S.

Sam: Great. Thank you, Samantha. Unfortunately, we have run out of time. If we didn't have a chance to answer your question, we'll certainly do our best to address it and follow-up content to the session.

If you'd like to view today's web chat again, or you have a colleague you'd like to share it with, it'll be made available soon on foodonline.com.

For more information on GMA, you can visit GMAonline.org. For more information for GMA on science and regulatory affairs, you can visit GMAonline.org/resources/science-and-regulatory-affairs/. GMA membership opportunities are available at GMAonline.org/membership, and don't forget to follow GMA on Twitter. Their handle is @grocerymakers.

Information on Hogan Lovells can be found at hoganlovells.com. The firm also has a blog covering the latest on food, law and policy. It can be found at HLfoodlaw.com. You can also follow the firm on Twitter using the handle @HoganLovells. You can also email Elizabeth directly, her email is elizabeth.fawell@hoganlovells.com.

Last but not least, be sure to visit foodonline.com and our food safety solutions center for additional content on food safety, FSMA, and FDA inspections.

With that, Elizabeth, do you have any closing thoughts on today's topic that you'd like to share with the audience?

Elizabeth: There have been some questions coming in about whether the food safety plan needs to be signed by a PCQI, and I may have confused folks. What I was trying to say was that the food safety plan is required to be prepared or overseen by a Preventive Control Qualified Individual. So it's important that you have somebody at your facility. That PCQI does not have to be necessarily an employee, you still need to have someone at your facility that's prepared to explain your food safety plan to the FDA. I think FDA's most likely going to look to the person who signed the plan, so if that's not the right person to explain the plan to FDA, they need to identify who is and who will help answer the agency's questions an defend the thinking in it and pull the right people into the conversation.

With respect to inspections overall, I think we've really emphasized that it's important to prepare, to make sure that your plan is well organized, that it meets FDA's requirements, that you have all the records that you need to have, that you're documenting what you said you would do. Prepare by doing some mock inspections. Think about who's going to be present, think about who's going to be on call to answer questions, what your company's policies are with respect to certain issues. Take corrective actions during the inspection and take detailed notes as well, so you know the conversations that took place, what you learned from the inspector, and what issues might need to be followed up on.

We didn't get to post-inspection, but be sure that you follow up, particularly if you have a 483 to respond in writing and develop documentation of your corrective actions, and to try to share your learning within your company if you've got multiple facilities as well.

Samantha: Similar to what Elizabeth just stated, I think we've said it numerous times over this past hour, be prepared, have your documents organized, and know where they are when the FDA asks for them. Treat inspections, as scary as they may seem, as learning opportunity. Remember that FSMA regulations are new, not just industry but they are new to the FDA. It will take some time before everything's running smoothly without a hitch. In the meantime, take advantage of this and learn. It's really important to utilize the resources that are already out there. There are three great courses that the FSPCA has that you could download online. Read the regulation itself and the preamble is a few hundred pages, but I'll tell you it's worth it.

Also, if you have a question that's regulatory in nature, use the FDA Technical Assistance Network (TAN). You can submit a question to the FDA about the regulation, about the interpretation, and ask them for their help. The FDA is using their frequently asked questions to help them assess where they need to make guidance. If there are a lot of questions about something in particular, maybe in months of years we'll see a guidance document come out. Then again, the guidance documents. There are draft guidance documents posted on the FDA website, go download and read them. There's also been some recent mock compliance guides that are on the website. Take advantage of the resources out there.

Sam: With that, our time together has come to an end. I'd like to thank our subject matter experts, Elizabeth and Samantha, for your willingness to educate the industry. Your time with us is greatly appreciated, so sincerely, thank you. And thank you, attendees, for taking the time to join us. We hope you enjoy the rest of your day.