At CIFT, we understand the challenges faced by food processors in Ohio when it comes to complying with the Food Safety Modernization Act (FSMA) Preventive Controls for Human Food rule. It has been nearly 8 years since the rule was finalized, and organizations of all sizes have been required to be in full compliance. Some organizations have received their first audit from the FDA, and we have received valuable feedback from many of our clients regarding the findings they encountered during the audit.
To help our partners in Ohio and beyond, we have compiled three areas we think are critical to focus on before your audit.
- Inadequate or missing hazards not identified in the hazard analysis.
The FDA has provided industry guidance documents to assist with compliance, including Appendix 1: Potential Hazards for Foods and Processes, which helps in identifying potential hazards of concern. During the audit, inspectors refer to this document to review an organization’s hazard analysis. If all hazards are not identified in the analysis based on the raw materials and/or the process, the FDA will issue a finding.
For example, failing to identify cross-contamination from environmental pathogens when a product is open and exposed to the environment after the process control or kill step, or neglecting to identify natural toxins in raw materials known to pose such a risk. Even organizations that are GFSI compliant have received findings in this area, particularly in the raw material hazard analysis, due to not identifying all hazards listed in the appendix or providing justification for their exclusion.
- Inadequate or missing written preventive control procedures.
If you have identified hazards that require preventive controls, it is crucial to have documented procedures that cover monitoring, corrective action, and verification components for each preventive control. This is particularly relevant for supply chain preventive controls. If you identify a hazard that you cannot control and rely on your supplier, you need to have procedures in place to approve your suppliers and ensure you receive the necessary documentation from them, such as audits and Certificates of Analysis. Failure to have these written procedures can result in findings during an audit.
- Inadequate or missing documentation for the monitoring of preventive controls.
As mentioned earlier, monitoring records are required when a preventive control is needed to control a hazard. These records should be completed at the frequency specified in the preventive control program. For instance, if your allergen preventive control program states that you will clean between unique allergens, you must maintain records of the cleaning activities. Any stated activities must be documented as verification that the cleaning was conducted and effective.
If your organization has not yet undergone a full preventive controls audit from the FDA we highly encourage you to review your food safety plan. Ensure that all hazards have been properly identified and that your written preventive control programs include adequate monitoring, corrective action, and verification procedures. It is also beneficial to conduct an internal audit or have an organization conduct an audit on your behalf to ensure that your written programs align with the practices implemented within your facility. Often, organizations are doing the right things but lack the necessary written procedures and monitoring documentation to substantiate their efforts.
In the realm of food safety, it is crucial to remember that if it’s not documented, it didn’t happen.
