FDA’s Zero-Tolerance Standard for Pathogens

You are a processor exporting to the U.S. or planning to. If the Preventive Controls rule (PC rule) applies to you, then you need a compliant Food Safety Plan hashtag#fsp. And, If you’re a PCQI, you should be familiar with the 21 CFR §117.136 under the PC rule. The provision that allows a manufacturer to rely on a downstream customer to control an identified hazard, instead of implementing a preventive control at their own facility. So, does that mean you can legally ship a product with a known pathogen hazard… without controlling it? Be cautious with the interpretation. This is one of the provisions that might be misread/misinterpreted. The answer may be a “yes”, but only under tightly defined conditions. I underline “tightly defined”. Because this is true only under very specific, tightly controlled conditions. It’s a conditional regulatory pathway, built on documentation, disclosure, and accountability. When does downstream reliance apply? This is especially relevant in supply chain situations where a facility receives raw materials that may carry inherent hazards, but has no lethal step to eliminate them, e.g., raw cocoa, coffee beans, flour, grains.. In such cases, control is intentionally placed downstream, not ignored. All these conditions should me met: Does this relax zero tolerance policy for pathogens such as Salmonella? No. § 117.136 addresses a specific gap: your facility has no lethal step to eliminate hazards inherent in raw ingredients. It does not mean a facility can allow Salmonella to persist and expect the customer to clean it up. FDA expectations for Listeria monocytogenes and Salmonella do not disappear at handoff. And under the FD&C Act, food must not be adulterated, regardless of where in the chain control is applied. What this provision does NOT mean It is not a relaxation of pathogen standards.Zero-tolerance expectations for Salmonella and Listeria monocytogenes remain in full effect at every step in the chain. It is not a default option.This is a conditional, documented pathway; it applies only where your process genuinely cannot control the hazard. It is not an exemption from GMP or sanitation.You must still prevent contamination and ensure your process does not introduce or amplify hazards. It is not a transfer of legal accountability.Under the FD&C Act, food must not be adulterated; this applies regardless of where in the chain control is applied. Therefore, even when control is deferred, you must still: Control may be transferred under certain conditions, but your responsibility cannot be, and that does not mean the zero-tolerance policy is relaxed. If you have questions about what FDA registration means for your facility, which regulations apply to your operation, or how to design compliant food labels and build a compliant HACCP and Food Safety Plan for the US and EU market, DFK Safe Food Environment provides regulatory consulting, FSPCA training, and FSMA compliance support for domestic and international food businesses.

Which Facility Must Register With The FDA?

I often get questions on FDA registration from both startups and established companies. For example, Does our third-party warehouse need to register with FDA? If it holds food for US consumption, most likely, yes.First, what does the law state? FSMA requires that domestic and foreign facilities that manufacture, process, pack, or hold food for human or animal consumption in the U.S. must register with the FDA. So, a third-party warehouse used exclusively for storing your finished products is still a food holding facility. That brings it within FDA’s registration requirement, regardless of whether it handles products from one company or many. Almost all warehouses that handle food meet at least the “hold” threshold under FSMA, which means they are: 🔸Subject to FDA registration 🔸Expected to have applicable food safety controls in place This applies to domestic and foreign facilities alike. If the facility packs or holds food after the last foreign manufacturer or processor, the foreign packer or holder must also register. In multi-facility chains, more than one site may need registration. Exemptions apply to retail food establishments (restaurants/groceries) and farms holding their own produce are typically exempt. Pure carriers (trucks in transit) are generally not considered facilities, but the warehouses they transfer to are. ❗️NOTE: FDA registration is free See below details on which facility types must register, including scenarios involving multiple foreign facilities. If you have questions about what FDA registration means for your facility, which regulations apply to your operation, or how to design compliant food labels and build a compliant HACCP and Food Safety Plan for the US and EU market, DFK Safe Food Environment provides regulatory consulting, FSPCA training, and FSMA compliance support for domestic and international food businesses.
Tagged under: , , , ,

When Supplier Controls Matter More Than Your Own CCPs

A single ingredient , pre-cooked pasta, caused 7 deaths, 28 illnesses, 27 hospitalizations and brought 6+ brands into recall. This multistate Listeria monocytogenes outbreak was linked to prepared, ready-to-eat pasta meals. We are not here to speculate about failure or assign blame. But we should reflect. Irrespective of this specific case, where the exact root cause and system robustness are not fully clear, such incidents remind us of something critical: It is time for food safety to move beyond a purely HACCP-centered mindset. HACCP asks: That logic is vital, indispensable. But it is not sufficient. When conducting risk assessments and determining management strategies, food businesses must go beyond labeling controls as CCPs or PRPs. We need a broader, risk-based Food Safety Plan mindset. In cases like this, pre-cooked, hydrated components used in RTE foods inherently require elevated scrutiny not because something necessarily failed, but because the risk profile demands it. A broader system means: • Strong supply-chain preventive controls for high-risk ingredients.HACCP often treats supplier controls as PRPs. A Food Safety Plan treats high-risk incoming ingredients as Supply Chain Preventive Controls, applying CCP-equivalent rigor. • Sanitation Preventive Controls when the hazard is environmentalWhen environmental contamination is a reasonably foreseeable hazard, sanitation is no longer “just a PRP”, it becomes a managed preventive control. • Allergen Preventive Controls where cross-contact risk is significant.When severity is high, allergen management requires structured and robust preventive controls. • Verification beyond documentation.Does your supplier have validated preventive controls?Are you reviewing real performance data and environmental monitoring trends — not just Certificates of Analysis? • Environmental monitoring expectations at supplier level, where relevant. • Risk-based intensity of oversight proportional to severity. • and more…. Food Safety Plans change how we think. They shift us from diagram compliance to hazard-control strategy design. And that shift is not theoretical. It is necessary. If you manufacture or brand RTE foods, your strongest critical control may ALSO sit at your supplier’s site. I have prepared a very simplified illustration showing how HACCP and a Food Safety Plan approach may differ, both at the level of the pre-cooked pasta manufacturer and at the level of the brand owner using it in finished RTE products. Have a look at it here: If you have questions about what FDA registration means for your facility, which regulations apply to your operation, or how to design compliant food labels and build a compliant HACCP and Food Safety Plan for the US and EU market, DFK Safe Food Environment provides regulatory consulting, FSPCA training, and FSMA compliance support for domestic and international food businesses.
Tagged under: , , , , , ,
GRAS_or_Food_Additive

EU Compliance Is Not FDA Compliance: What Ingredient Status Means for US Market Access

If raw materials aren’t fully FDA-compliant but EU compliant, can we still sell the product in the US ? This question comes up often with complex formulations. From an FDA perspective, the logic is simple. Pointing to approval in other jurisdictions, relying on a long history of use elsewhere, or assuming that a low use level or a so-called “minor” ingredient will be overlooked is not a good argument or approach to access the US market. These factors may feel reassuring, but they do not establish legal status under FDA rules. What does work is a disciplined regulatory approach by mapping each ingredient and sub-ingredient to its US regulatory status, verifying that the intended use levels and conditions of use are covered, and reformulating where no valid approval or GRAS pathway exists. I have prepared this illustration that summarizes the decision logic used to determine a substance’s regulatory and legal status, and shows where compliance ultimately leads to the need for food additive authorization. If you find it useful and choose to share it, attribution would be appreciated. If you have questions, feel free to reach out anytime. We support food businesses with food labeling compliance, risk assessment and management, and food system compliance with the FDA. If you have questions about what FDA registration means for your facility, which regulations apply to your operation, or how to design compliant food labels and build a compliant HACCP and Food Safety Plan for the US and EU market, DFK Safe Food Environment provides regulatory consulting, FSPCA training, and FSMA compliance support for domestic and international food businesses.
Tagged under: , , ,
block-post

The decision of when and which validation study approach to adopt

The PCQI course participants often showed a particular interest in the topic of validation, when and how to validate, what is acceptable and what is not, with regards to compliance with the FDA requirements. The Preventive Controls for Human Food requirements stipulate in 21 CFR 117.160: (a) You must validate that the preventive controls identified and implemented in accordance with § 117.135 are adequate to control the hazard as appropriate to the nature of the preventive control and its role in the facility’s food safety system. (b) The validation of the preventive controls must be performed (or overseen) by a preventive controls qualified individual. According to § 117.3 Definitions, validation means obtaining and evaluating scientific and technical evidence that a control measure, combination of control measures, or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards. While the Preventive Controls for Human rule provided flexibility in justifying the reasons not to validate sanitation preventive controls, allergen preventive controls, and others – except in certain conditions (to be discussed in the next post), validation of process controls is a must-to-do. This decision tree , published by Ceylan et al. 2021 in Comprehensive Reviews in Food Science and Food Safety, is a practical and simple tool to use in supporting the decision of when and which validation study approach is most applicable. You find the decision tree in the link provided above to access the full article. If you find it useful, why not sharing it with you team members to enhance their knowledge on the importance of science-based approach in food safety. Got questions on your FSP and risk assessment, or on regulatory matters? I will be happy to hear from you.

Avoid the mistake of assuming HACCP and GFSI compliance will meet the FSMA requirements

I have met recently with few representatives from the food industry and it appeared from our discussions that many were still unaware of the difference between the GFSI certification and FSMA compliance. For them, both equate, and the only steps required to export foods to the US market is to go through the registration process. There was some confusion about the mandatory requirement to develop and implement a Food Safety Plan (FSP) which was assumed to be the same as their existing HACCP plan, which is not the case. Certification to a GFSI-benchmarked scheme (BRC, SQF, FSSC22000, IFS, etc.) and having an HACCP plan do not make the food facility compliant with the FSMA Preventive Controls Rule, yet it does make it ready to reach compliance. While HACCP focuses on the determination of the Critical Control Points (CCPs) to prevent post-process contamination, under FSMA, the FSP goes far beyond the determination of the CCPs during processing to include risk-based preventive controls that are determined as critical elements in the sanitation and allergen control programs, and in the supplier chain program. The FSP must be created and overseen by a preventive controls-qualified individual (PCQI) and should be based on: 1- Hazard Analysis, identifying known or reasonably foreseeable biological, chemical, radiological and physical hazards 2- Documentation (written) of preventive controls including process controls, food allergen controls and sanitation controls, supply chain controls, and a recall plan 3- Documented implementation procedures which include monitoring the implementation of the preventive controls, corrective action, and verification procedures. To export foods to the US market, It is mandatory to develop the Food Safety Plan that is compliant with FSMA Preventive Rule, NOT with HACCP The difference between HACCP and GFSI compliance or to FSMA might not be practically easy to grasp without a PCQI training. Why it is important to train PCQIs? Under the FSMA rule, FDA is permitted to inspect domestic and foreign facilities (those based on non-US territories) at the times and in the manner permitted by the FD&C Act. As part of this, the FSP is inspected for its adequacy and any deficiencies or inadequacies identified means the PCQI (individual who developed the FSP) is not appropriately trained for the application of the risk-based preventive controls. The difference between HACCP / GFSI compliance and FSMA might not be practically easy to grasp without a PCQI training What may result out of this? In the event of having an inadequate food safety plan developed by unqualified staff, various scenarios are possible depending on the severity of the identified failure or if the food presents a threat of serious adverse health consequences or death to humans. Therefore, the FDA can take actions such as: suspension of the food facilities’ registration, product detention, issuing a warning letter and criminal charges and add to this the costly re-inspection visits. The cost for a foreign facility is $285 per hour. Ensuring the FSP is prepared and overseen by a trained PCQI is certainly an added value and crucial to avoid the above mistakes. To help the food industry complies with the requirements of the Preventive Controls rules, the Food Safety Preventive Controls Alliance (FSPCA) developed the FDA-approved standardized curriculum for training PCQIs.  As a PCQI Lead Instructor, I am offering public and in-house FSPCA certified PCQI training. For more information on locations and dates, please follow the link here and navigate the calendar. You are welcome to subscribe to the newsletter to keep you updated on the PCQI training that will be organized in Germany and selected countries in the MENA region for the year 2019.
Tagged under: , , ,

How Does HARPC system differ from HACCP

“What is the difference between the Hazard Analysis and Critical Control Points (HACCP) and the Hazards Analysis and Risk-Based Preventive Controls (HARPC)?” is a question we often hear from professionals working in the food industry and expected to be raised more often having been involved in managing the food safety systems based on the HACCP concept which is universally accepted by government agencies, trade associations and the food industry around the world ( NACMCF, 1997). HACCP is based on the analysis and control of biological, chemical, and physical hazards from raw material production, procurement and handling, to manufacturing, distribution and consumption of the finished product in order to reduce the risks of safety hazards in food. It is based on 7 principles: Principle 1: Conduct a hazard analysis.Principle 2: Determine the critical control points (CCPs).Principle 3: Establish critical limits.Principle 4: Establish monitoring procedures.Principle 5: Establish corrective actions.Principle 6: Establish verification procedures.Principle 7: Establish record-keeping and documentation procedures The HARPC is based on these same basic food safety principles; more specifically, it recognizes the importance of hazards analysis and setting critical limits to monitor the control points; it emphasizes the corrections/corrective actions, verification activities and the recall plan. The preventive approach is not recent, it dates back to the 60’s when the HACCP was pioneered by the Pillsbury corporation to ensure food safety for the first manned National Aeronautics and Space Administration space missions. NASA’s main concerns were to ensure safe food for astronauts. The WHO Europe recommended the system in 1983 and the Codex released the first HACCP Guidelines which was revised in 2001 and adopted by the FAO/WHO Codex Alimentarius Commission. The U.S.National Advisory Committee on Microbiological Criteria for Foods (Committee) reconvened a Hazard Analysis and Critical Control Point (HACCP) Working Group in 1995. The primary goal was to review the Committee’s November 1992 HACCP document, comparing it to current HACCP guidance prepared by the Codex Committee on Food Hygiene. The Committee again endorses HACCP as an effective and rational means of assuring food safety from harvest to consumption. NACMCF issues the third revision document in 1997. Basically, the HACCP was integrated into the official regulations in the European Union and the United States. For instance, the U.S. Food and Drug Administration adopted HACCP in low acid canned foods, then the FDA mandated HACCP for seafood products and in 2001 for juice processors. The Council Directive no. 91/493/EEC places the responsibility of product safety on the industry as it introduced the concept of ‘own checks’ and Critical Control Points during processing and the Commission Decision 94/356/EEC details the rules for the application of the HACCP system. The term HARPC goes back to 2011, when the Food Safety Modernization Act (FSMA) was signed into law by President Barack Obama. FSMA directs FDA to establish standards for adoption of modern food safety prevention practices by those who grow, process, transport, and store food. In 2015, FDA has finalized seven major rules to implement FSMA; the Hazards Analysis Risk-Based Preventive Controls for Human food is one of those 7 rules which is also referred to as The Preventive Controls for Human Food (PCHF). The Hazards Analysis Risk-Based Preventive Controls for Human food (HARPC) requirements specify that a facility must prepare, or have prepared, and implement a written food safety plan (FSP) (21 CFR 117.126). The elements of the FSP are (21 CFR 117.126(b)): Hazard analysis Preventive controls (see 21 CFR 117.135), as appropriate to the facility and the food, to ensure safe food is produced, Procedures for monitoring the implementation of the preventive controls, as appropriate to the nature of the preventive control and its role in the facility’s food safety system Corrective action procedures, as appropriate to the nature of the hazard and the nature of the preventive control Verification procedures, as appropriate to the nature of the preventive control The preventive controls approach to controlling hazards used in an FSP is developed based on the risk-based HACCP principles as described by the National Advisory Committee on Microbiological Criteria for Foods It is important to note that the preventive controls approach to controlling hazards used in an FSP is developed based on the risk-based HACCP principles as described by the National Advisory Committee on Microbiological Criteria for Foods. Therefore, there are similarities between the FSP and a HACCP plan and the similarities are in the essence of both systems; both adopt the preventive approach , yet there are few differences. Table 1 shows the different elements required in each of the plan and how they differ: In HARPC, A “hazard” is any biological, chemical (including radiological), or physical agent that has the potential to cause illness or injury. These include hazards that occur naturally, that are unintentionally added or that may be intentionally added to a food for purposes of economic gain (i.e., economic adulteration). Contaminants that have no direct impact on the safety of the products are considered “undesirable defects” and do not require a preventive control, hence they should not be included in the FSP. Once the hazards requiring preventive controls are identified in the Hazard analysis, the FSP should include documentation of the preventive controls that were determined as appropriate to controlling the hazards. The preventive controls include: Process controls Food allergen controls Sanitation controls Supply-chain controls Recall plan Other controls The CCP is a point, step or procedure at which controls can be applied and a food safety hazard can be prevented, eliminated or reduced to acceptable (critical) levels. In a HACCP plan, the CCPs are steps in the process that are always monitored, whereas in the FSP, not all preventive controls are CCPs (Process controls), hence the preventive controls are only monitored as appropriate to the nature of the preventive control and its role in the facility’s food safety system. That means some preventive controls that are not necessary applied at CCPs may not be monitored such as the supply chain preventive control and recall plan. The FSP incorporated the element “corrections” in addition to