FDA’s New Regulations for Food Processors: The Devil is in the Implementation

At long last, the Food and Drug Administration has promulgated two critical regulations implementing the Food Safety Modernization Act of 2011 (FSMA).  The regulations flesh out the statute’s requirements for facilities that process human food and animal feed.  Of the regulations that FDA has proposed in order to implement the FSMA, these are perhaps the least controversial.  Indeed, they have won praise from everyone from the Grocery Manufacturers Association to the food safety director of the Pew Charitable Trusts.  This blog post focuses exclusively on the regulations governing human food. 

The regulations require all processors of human food to prepare and maintain plans for ensuring that their products are not contaminated with pathogens.  A processing facility must conduct a hazard analysis and institute preventive controls to mitigate the hazards identified in the analysis.  The company must monitor those controls, conduct verification activities to ensure that the controls are effective, take appropriate corrective action when the controls fail to ensure against future failure, and maintain records documenting those activities. 

These requirements are consistent with, although not identical to, the hazard analysis at critical control points (HACCP) programs that were initially developed by the Pillsbury Corporation for ensuring the safety of the food that accompanied NASA astronauts into space and that FDA has required for seafood processors.  HACCP represents a scientific approach to food safety that has the potential to greatly reduce the incidence of food borne illness.  Some food safety experts refer to HACCP as the “gold standard” for ensuring food safety.

As with many regulations of this scale and importance, observers often caution that, “The devil is in the details.”  Yet while these regulations go into some detail with respect to the content and administration of the plans, the preamble boasts of the great “flexibility” that they provide to companies by allowing them to tailor the requirements to their individual circumstances.  In fact, the regulations provide so much flexibility through the use of softening phrases like “as appropriate” that the devil in these rules will be in their implementation by the companies that are subject to them.

The regulations require companies to “verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the hazards.”  To implement this requirement, the company must conduct various activities, “as appropriate to the facility,” including a “calibration of process monitoring instruments,” “product testing, for a pathogen . . . or other hazard,” “environmental monitoring, for an environmental pathogen or for an appropriate indicator organism, if contamination of a ready-to-eat-food with an environmental pathogen is a hazard requiring a preventive control,” and “review of . . . records within the specified time frames.” 

Such verification activities, especially product and environmental testing, are absolutely critical to the integrity of a HACCP-like program.  A plan may appear ideal in theory to food safety experts, but the rubber meets the road when the plan gets implemented in the real world.  Even the best-designed plans can fail when they encounter the messy reality of food processing operations.  That is why frequent testing of the environment in which the food is processed and of the product at the end of the line is so important.  When pathogens are found at the processing facility or in the products, the company must immediately take corrective action.

Still, the devil isn’t so much in the details as in the implementation. That’s because the companies not only devise their plans, but implement them on their own, without meaningful oversight from FDA.   The flexibility allowed by the phrase “as appropriate to the facility” lets the processor decide how the monitoring instruments should be calibrated, whether and how to test for pathogens in the product and processing environment, and how frequently to review its records.  The only check on this broad discretion is the opportunity that an overworked FDA inspector has to review the plan and object to one or more of its provisions.  And this will always occur after-the-fact, because the plans do not have to be approved by FDA before the processing facility may process food.  Depending on the resources available to FDA to enlarge its inspectorate, it could be years before an inspector reviews a company’s plan.  (It is noteworthy that the FDA funding bills before the Republican Congress would provide less than half of the $109.5 billion additional funding that the Obama Administration has requested for FDA for fiscal year 2016).

If processors write effective plans and vigorously implement them, the new regulations should reduce the number of disease outbreaks.  That will not eliminate outbreaks, because the regulations do not require safe food.  They just demand “appropriate” plans.  But good plans that are carefully followed should yield much safer food. 

If, however, companies use the flexibility afforded by the regulations to write sloppy plans or to shirk their responsibility to follow well-designed plans rigorously, consumers will have to endure more outbreaks and recalls.

Let’s hope all food processors voluntarily take these regulations seriously, because FDA is in no position to force them to do so.