getting from today’s haccp to - food-label-compliance.com...seven principles of haccp –...

Woodhouse Shanahan PA © 2015 Charles F. Woodhouse

Getting from Today’s HACCP to

FSMA Risk-Based Preventative

Controls (HARPC)

November 20, 2015


Charles F. Woodhouse, Esq.

• BA (Dartmouth), MBA (Wharton), JD (Rutgers), Graduate Certificate Food Law and MS Food Safety (Michigan State). Currently completing graduate program in Packaging (Materials Science) at MSU.

• Adjunct Professor of Law, Michigan State University College of Law

• Woodhouse Shanahan PA, Washington, DC, Cedar Key, FL, Haddonfield, NJ

• Of Counsel – Sandler, Travis & Rosenberg, PA

• Co-editor – Food, Cosmetics & Nutraceuticals, American Bar Association, Science & Technology Section.

• Recent Courses 2013/2014 - US Food Imports: Process, Regulation & Food Safety

• E-mail: [email protected]

• MSU Law Faculty Profile: http://www.law.msu.edu/faculty_staff/profile.php?prof=902

• Website: www.seafood-and-produce-law.com

• Blog: www.food-label-compliance.com

• E-mail: [email protected]

2

mailto:[email protected]





http://www.law.msu.edu/faculty_staff/profile.php?prof=902

http://www.seafood-and-produce-law.com/







http://www.food-label-compliance.com/






Background Reading

• 80 Federal Register 55908, September 17, 2015, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food.

• Woodhouse, Charles, ―Preparing for the Food Safety Modernization Act‖, SciTech Lawyer, (American Bar Association), Summer 2014.

• Woodhouse, C., Horn, G, Garg, S., Importer Food Safety Vulnerability Assessment, Association of Food Industries Annual Report, 2015.

• Codex Alimentarius Commission, General Principles of Food Hygiene, CAC-RPC-1-1969.

• The New Yorker, Profile of food safety lawyer Bill Marler, February 2, 2015.

• Marler, Bill, The End of My 20 Year Law Practice? Let’s Hope So!, Food, Cosmetics & Nutraceuticals, Winter 2014 (American Bar Association).

3


Background Reading (Continued)

• Yiannas, Frank, Food Safety Culture, Wiley Science.

• Fortin, Neal, US Food Regulation, Wiley Science.

• Swiss Reinsurance Studies – Cost of Food Recalls ($15.6 Billion in 2013) http://www.swissre.com/media/news_releases/nr_20150715_foodrecall.html

• Keane, V., Insurance Coverage & FSMA, Food, Cosmetics & Nutraceuticals, Winter 2014 (American Bar Association).

• Zweitering, Relevance of microbial finished product testing in food safety management, Food Control, vol. 60, 2016 (accepted for publication July 2015)

• Hamburg, Margaret A., Commissioner USFDA, Advancing Regulatory Science, SCIENCE, v. 331, p.987, 25 February 2011.

• 78 Federal Register 3646, January 16, 2013, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food.

• Woodhouse, Garg, Horn, Importer Responsibility for Compliance with FDA Food Contact Substances Regulation, Association of Food Industries Annual Report 2016 (article in press, accepted October 2015).

4


TAKE AWAY MESSAGES

1. Nothing New Under the Sun – History of HACCP

Codex Alimentarius, General Principles of Food Hygiene, CAC-RPC-1-1969

2. From HACCP to HARPC – Challenged to Think both Objectively and Subjectively

3. Risk-Based Preventative Controls represent a new way of thinking about Food Science, Risk Management, and Process Control.

4. This is “Science” not “Law” – get your Qualified Individal “on-board” and working NOW.

5. Compliance Reality (if you are Big-Food” or sell to “Big-Food”) is September 2016. (Insurance and “downstream” Indemnification)

HACCP Hazard Analysis and Critical Control Point

HARPC Hazard Analysis and Risk-Based Preventative Controls

FSMA Food Safety Modernization Act

Note: “CFR” references below are to sections in 80 FR 55908 (Final) and 78 FR 3646 (Proposed)

See last slide – CFW’s comment on Advance Texts of Final Rules released November 13.

5


Codex Alimentarius – 1969

Seven Principles of HACCP

1. Conduct Hazard Analysis

2. Determine Critical Control Points (CCPs)

3. Establish Critical Limits

4. Establish System to monitor control of CCPs

5. Establish Corrective Action for each CCP if outside Control Limits

6


Seven Principles of HACCP – Continued

6. Establish procedures for Verification of each CCP’s effectiveness

7. Documentation and Record-Keeping

Take-Away: After 45-years, HACCP now is firmly established in the “food-safety-culture” of two-generations of the graduates of Food Science and Food Engineering programs of dozens of research universities worldwide. It is also firmly ―internalized‖ in the thinking of Government Regulators (worldwide) and in the Risk-Management Protocols of the Insurance Industry.

Your “Qualified Individual” will be “programmed’ by her or his graduate education in “HACCP Thinking” about Process Management.

7


Today’s Topic

80 Federal Register 55908, September 17, 2015, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food.

1. This Final Rule is 261 pages in the Federal Register (9/17/2015).

2. It must be read in coordination with the Proposed Rule (78 FR 3646).

3. We will cover only 12-points ―Getting from HACCP to HARPC‖.

4. Reality – Consider that you will need to be in compliance by September 2016. (―Small Business‖ Suppliers to ―Big-Food‖ will be pressured through insurance and downstream indemnification to meet this date.)

5. This is ―Science‖ not ―Law‖ – your Qualified Individual must have documented educational credentials in Food Science and experience in food plant management.

8


Today’s Topic (Continued)

6. Primary Task – your HARPC Plan covering your role in the Supply-Chain.

7. Considerations for Importers (Importer of Record) – HARPC Plan on file for each product you import.

Language, cultural differences, and technical capabilities of your suppliers will make this a complex and challenging task. Further discussion beyond scope of this presentation.

8. CFW wrote an MS Thesis on ―HACCP to HARPC‖ (Michigan State Mather Food Safety Award and Lecture 2011) – this brief summary cannot be considered as definitive – it is only a very limited overview.

9. In July 2014 the American Bar Association (SciTech Lawyer) published CFW’s article cited above – warning to American food businesses that they need to start the RBPC (HARPC) preparation process immediately. That was 16 months ago!

Purpose of this presentation - Setting Compliance Priorities.

9


21 CFR 117.130 Hazard Analysis

The “Heart” of your RBPC Plan

Identify and Evaluate “Reasonably Foreseeable” Hazards

Biological (pathogens, parasites, toxins, allergens), Chemical (natural and anthropogenic poisons), Physical hazards (glass, metal, plastic fragments). Gross Contaminants and Filth: Insects or body-parts thereof, rodent hairs and excretia, etc.

Special Attention – RTE Foods (Ready to Eat – no intervening kill-step)

Includes Raw Materials, Ingredients, Additives, Food Contact Substances.

Mitigation by measures taken by upstream suppliers and downstream customers, or consumers.

10


21 CFR 117.135 Preventative Controls

More subjective than traditional HACCP

This is where your “Qualified Individual” earns her paycheck. Blending Food Science and Food Engineering in order to categorize what is “Reasonably Foreseeable” and how to prevent it.

Understanding of Upstream Supplier processing and Downstream Customer processing – “Written Assurances” – Audit Verification.

Examples - the interplay between aw and pH may render certain controls irrelevant – a downstream Customer or Consumer Kill-Step may be adequate.

HACCP is “checkers” – this is “Chess”

11


21 CFR 117.139 Recall Plan

Insurance Industry is out in front of FDA on Recall Plans. (C&R Coverage and Third-party Indemnification – See Swiss Reinsurance studies cited.)

C&R (Contamination & Recall) Carriers want to see the written Recall Plan.

Keep your team as small as possible – compartmentalize information.

Traceability is the “Key” – Limiting Recalls – Mock Traceability Testing

Preservation of Privilege – you need careful and thoughtful counsel here from attorneys who understand Food Safety Litigation Risk and the science behind it.

Reportable Food Registry Responsibilities of Managers.

Recalls, Market Withdrawals, Stock Recoveries – Science and data based arguments to limit scope of Recall.

Documented Upstream Supplier agreement with your Recall Plan.

12


21 CFR 117.140 Preventative Controls Management

The plant “Macro-System”: Raw materials receiving; Transportation sanitation and security; Ingredient and Packaging receiving and storage; Processing water; Refrigeration systems; Employee hygiene and health; Tools and utensils; Sanitation protocols; special RTE considerations; low-acid and acidified foods considerations; Microbiology and Toxicology protocols; Insect, Rodent , and Avian Control Measures - the list must include all “foreseeable risks”.

Choosing the “right” set of Preventative Controls and Managing their implementation will require your “Qualified Individual” to use all the skills that she or he has attained through university education and career experience.

13


21 CFR 117.145 Monitoring

Monitoring needs flexibility to adjust to the nature of the Preventative Control and its place in system design.

Affirmative Records of parameter monitoring or Exception Records of deviation.

Traditional HACCP and the “Unusual Events” Log-Book – an insight into management’s ability to recognize errors, analyze them and take corrective action to prevent them from happening again.

Comment – when I do a site-visit, one of the first documents I ask for is the “Exception Record (Unusual Event) Log Book” – the absence of such a Log speaks volumes about management of the facility. The first spaces I inspect are the Employee bathrooms and Changing Area. The first person I interview is the Plant Sanitarian.

14


21 CFR 117.150 Corrective Action

Subjective: depends upon the nature of the Hazard, the specific Preventative Control, and the extent of the Deviation of the Control Parameter.

Some Preventative Controls may not have specified Corrective Actions. These must be specifically delineated at “disposal events”. Example: RAC (Raw Agricultural Commodity) with MRL (Maximum Residual Level) of a biocide above EPA limit. “None-Detected” if no EPA MRL or FIFRA §18 Variance.

Other circumstances may not require Corrective Action since two or more Preventative Controls may have complimentary interactions. Example: aw and pH in low-acid foods.

15


21 CFR 117.155 Verification

Semantics – Verification? Validation? – 117.155 & 117.160

Here is where the Proposed Rule helps - 78 FR 3646, January 16, 2013, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food.

“Verification that monitoring is being conducted, verification that appropriate decisions about corrective actions are being made, verification of implementation and effectiveness, and reanalysis.” (80 FR 56051)

“Verification Activities” – take into account the nature of the preventative control and its role in the facility’s food safety system.

16


21 CFR 117.160 Validation

More Semantics – Verification? Validation? – 117.155 & 117.160

Validation is the development of data based upon sound food science principles applying, microbiology, toxicology, and food engineering standards to the production process in order to demonstrate that the preventative controls and corrective actions in place are appropriate to ensure that your part of production, storage, and distribution supply-chain does not permit adulteration or contamination of the food product.

You cannot “outsource” this responsibility:

“We have no plans to endorse certification under GFSI (or any other standard setting organization) as satisfying the requirements for validation.” FDA on Third-Party Audits: 80 FR 56054 (9/17/2015)

GFSI Global Food Safety Initiative (Benchmarking and Private Standards)

17


21 CFR 117.165 Verification of Implementation and Effectiveness

FDA seems to make essentially the same points repetitively in 155, 160, and 165 - Suggestion – go back to 78 FR 3752-3761 which covers these three sections entirely in the Proposed 117.150 (2013).

This highlights the key working method for constructing your RBPC Plan. You will have the 179 pages of 78 FR 3646 in one notebook and the 261 pages of 80 FR 55908 (2015) in another – and you will be constantly moving back and forth between the documents which must be read together.

80 FR 55908 covers two-years of Comments (and FDA’s reaction thereto) on 78 FR 3646. Your Qualified Individual will need a strong Food Science background and significant “hands-on” plant management experience to do this work properly.

18


21 CFR 117.170 Reanalysis

Five circumstances requiring Reanalysis by Qualified Individual **:

1. At least once every 3 years.

2. Whenever a change in procedure at the facility creates a new Hazard or a significant increase in an existing hazard.

3. New information about potential hazards.

4. After any unanticipated food safety problem.

5. When management becomes aware that a preventive control is ineffective.

** Each Facility will have an ongoing multi-year relationship with its named Qualified Individual

19


21 CFR 117.180 Qualified Individuals

1. The availability of Qualified Individuals is limited despite efforts of the major research universities to ramp-up graduate programs. Michigan State, with America’s largest Graduate Food Science and Food Safety programs, produces fewer than 200 graduates per year.

2. (80 FR 56071) FDA Statement - “We disagree that the requirements applicable to the preventative controls qualified individual should be designed to match any current limitations in the number of individuals who have the knowledge and skill to prepare (or oversee the preparation of) a food safety plan. We expect that market forces will act to increase the number of preventative controls qualified individuals to match the demand generated by this rule.”

3. (80 FR 56070) – Qualified Individual - “…this individual may be, but is not required to be an employee of the facility”, “…review of testing records (e.g., records of product testing or environmental testing) must be conducted or overseen by a preventative controls qualified individual.”, “…the rule also does not require that the preventative controls qualified individual be onsite during operating hours.”

20


21 CFR 117.190 Implementation Records

Once again best guidance is at 78 FR 3808 – Required records:

1. ** RBPC Food Safety Plan: Written plan including hazard analysis, preventative controls, monitoring procedures, corrective action, verification, and Recall Plan;

2. Records of monitoring of preventative controls;

3. Records documenting corrective actions;

4. Records documenting Verification including: ** Validation; Monitoring; Corrective Actions; Calibration process monitoring and verification of instruments;

5. ** Records Review: Implementation, effectiveness, and corrective actions;

6. ** Reanalysis;

7. Records documenting training ** of Qualified Individual.

** Required that Qualified Individual perform, oversee, or review these functions. (80 FR 56070 and 56072)

21


Comments on Compliance Challenge

Final Rule – September 2015

80 Federal Register 55908, September 17, 2015, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food. (261 pages in FR)

Proposed Rule - 2013

78 Federal Register 3646, January 16, 2013, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food. (179 pages in FR)

A substantial challenge for your Qualified Individual – choose this person with great care.

22


Concluding Comments

―You are only as strong as your weakest link. And if food safety is a chain, not a confederacy of monoliths, then weak links will stand out as the liabilities they are. A misstep by a single supplier can affect a brand’s market cap significantly. And that single supplier is one recall away from bankruptcy. So for any reputable food supplier, manufacturer or distributor, data-driven insights — as deep and detailed as possible — are actually prudent business insurance.‖

Khalil Divan, PhD of Fisher Scientific writing in Food Safety News (11/9/2015)

********

Swiss Reinsurance Studies – Cost of Food Recalls ($15.6 Billion in 2013) Food Safety in a Globalized World (2015)

Food Safety: International Regulatory Dynamics and the Impact of Insurance (2015)

Available at: http://www.swissre.com/media/news_releases/nr_20150715_foodrecall.html

23


Important Final Point

What is a “Third-Party” Audit? First-Party, Second-Party, Third-Party Audits and ―Inspections‖?

Clarifying our terms:

• First-Party ―Self Audits‖

• Second-Party – downstream buyer audits of suppliers

• Third-Party – outside firm focuses on verification of adherence to ―standard‖ - usually a ―proprietary‖ standard.

Example: British Retail Consortium ―BRC‖

• Inspections – governmental entities – Federal, State, Local levels

24


Audits and Testing

Audit – snapshot in time of ―Process‖

Never enough to ensure Food Safety (Powell)

• Testing – spot-checking of ―Product‖

Spot-checking is NOT statistically valid sampling (Gombas)

“People think testing means something. When I say it doesn’t, they smile, nod, and keep testing”. (Gombas, NY Times, 4/5/15)

Auditing and Testing alone provide a ―false sense of security‖ (Gombas, NY Times).

Management Systems: Risk-Based Preventative Controls and company-wide Food Safety Culture are the key to minimization of risk of a major Food Safety Incident.

25


Third-Party Audits - Perspective

Doug Powell, Barfblog April 10, 2015 “Supporters argue third-party audits are a way to ensure food safety in an era of dwindling economic resources. Critics contend that while external audits and inspections can be a valuable tool to help ensure safe food, such activities represent only a snapshot in time”.

Powell, Erdozan, et al., Audits and Inspections are never enough: A critique to enhance food safety, Food Control, v. 30, pp. 686-691, 2013.

************************************************************************

FDA on Third-Party Audits: 80 FR 56054 (9/17/2015)

“We have no plans to endorse certification under GFSI (or any other standard setting organization) as satisfying the requirements for validation.”

Note: Data developed in the course of third-party certification may be used as evidence of the appropriateness of Control Measures for an identified Hazard.

26


Background Reading on Audits and Testing

• New York Times, Food safety product testing, April 5, 2015. See comments of Dave Gombas, PhD, Chief Scientist, United Fresh Produce Association.

• Lytton, T., McAllister, L., Oversight in Food Safety Auditing: Addressing Auditor Conflict of Interest, Wisconsin Law Review, v. 289, 2014.

• Keane, V., Insurance Coverage & FSMA, Food, Cosmetics & Nutraceuticals, Winter 2014 (American Bar Association).

• Powell, Erdozan, et al., Audits and Inspections are never enough: A critique to enhance food safety, Food Control, v. 30, pp. 686-691, 2013.

• Zweitering, Relevance of microbial finished product testing in food safety management, Food Control, vol. 60, 2016 (accepted for publication July 2015)

27


How to Take-Control of Compliance Tasks by September 2016

Assemble your RBPC Team – you have a year to produce a RBPC for each product you manufacture or sell.

Assemble your Recall Team – keep the team “small” and remember “privilege”.

Qualified Individual(s) – choose with care and verify credentials – don’t let a tort lawyer “shred” your Qualified Individual in the first 10 minutes of a deposition. Your Qualified Individual will be named in discoverable documents. She or he will be deposed by the plaintiff’s attorneys.

Legal Team – experience in food production management and graduate training in science. (Numerous research universities have LLM Food Law or MS Food Science / Regulatory Science programs)

Audit your Suppliers (upstream) and carefully review Indemnification Terms of your “downstream” Customers.

Recalls always expose you to Indemnification and often involve Tort Liability.

Serious Food Safety Incidents will always be followed by civil tort actions and can involve Criminal Liability for Managers (in extreme circumstances – PCA, Jensen Farms, DeCoster).

28


TAKE-AWAYS

True Food Safety is only achieved by:

1. Company-wide Food Safety Culture (Yiannas)

2. Risk-Based Preventative Controls carefully designed by qualified Food Scientists and implemented with expert Food Engineering.

3. Statistically Significant Sampling – This is Statistically Significant Sampling during the Production Process - not ―Finished-Product Testing‖.

4. A Company Culture of Analysis and Education: Learning from incidents in which operating parameters move outside CCPs.

29


The Current Litigation Environment

Through the CDC’s PulseNet and Whole Genome Testing, the etiology of foodborne illness is quickly established. See introduction to Woodhouse article in SciTech Lawyer.

If a serious food safety incident occurs, Bill Marler, Fred Pritzker, and other plaintiffs’ lawyers will find you. See Marler New Yorker profile and Marler in Food Cosmetics & Nutraceuticals.

The Indemnification Terms that you signed to get your Vendor Number from top food retailers and food service operators will transfer risk to you. See Woodhouse, Horn, Garg in AFI Annual Report and Keane in Food Cosmetics & Nutraceuticals. (also Cross in next issue FCN)

Your only protection is a robust company-wide Food Safety Culture and a Qualified Individual with the stature to protect you in litigation.

30


Follow-up Ideas

• Read ―Preparing for the Food Safety Modernization Act‖, Woodhouse, SciTech Lawyer, Summer 2014.

• Read ―Importer Food Safety Vulnerability Review‖ in the AFI Annual Report

• Buy (Amazon Kindle) ―Food Safety Culture‖ (Frank Yiannas)

• Make sure you have on-board a ―Qualified Individual‖ - Verify credentials: education, publications. There are many poorly-qualified people fraudulently ―selling‖ their ―expert services‖. Most important verify claims of university training in Food Science before you engage a ―Qualified Individual‖.

• Hint: Look for an individual who has been elected as a Professional Member of the Institute of Food Technologists after receiving a university degree in Food Science or a related scientific field.

• Consider the value of ―Attorney-Client Privilege‖ in your ―Qualified Individual‖ selection.

For copies of any of the articles cited (copyright restrictions permitting), please send me an e-mail

[email protected]

31







Advance Texts of Final Rules Released November 13

• November 13, 2015 - FDA has posted Advance Texts of three more FSMA Final Rules: (1) Third-Party Certification; (2) the Foreign Supplier Verification Program; and (3) the Produce Final Rule.

• Please see texts posted below. But please, before starting any serious analysis, wait for the three Final Rules to appear in the Federal Register on November 27 since all citations must be to the final texts.

• Also - please note that, as is the case with the Proposed Rule and Final Rule on Risk-Based Preventative Controls, you cannot read the Final Rules without constant reference back to the Proposed Rules.

• Also the advance texts are respectively: 801 pages for Produce; 504 pages for FSVP; and 356 pages for Third-Party Certification. So think twice before reading these 1,661 pages instead of being patient and waiting for the final text on November 27.

• This post appears on CFW’s Blog www.food-label-compliance.com

32






getting from today’s haccp to - food-label-compliance.com...seven principles of haccp –...

Documents