Article is available in full to IFST members and subscribers.

Register on the FST Journal website for free

Click the button to register to FST Journal online for free and gain access to the latest news


If you are an IFST member, please login through the Members Area of the IFST website. 













Meeting US food safety regulations

Andrew Collins of Campden BRI explains the implications of the US Food Safety Modernisation Act (FSMA) for businesses importing food into the US.

In the light of the UK’s decision to leave the EU and the current uncertainty as to the exact terms of our trading agreement, businesses will be looking for new markets; the US could be an important potential market.

In the US, the Food and Drug Administration’s (FDA) Reportable Food Registry records the notified food safety incidents. For the period September 2013/September 2014, outbreaks were reported involving Listeria monocytogenes (in 18.9% of all cases), Salmonella (24.9%) and undeclared allergens (47.3%). The incidents involving allergens increased from 43.6% in the previous year and if undeclared sulphites at 2.5% are included from 2013/2014, allergens were responsible for over 50% of reported incidents. Concerns over these figures in previous years and significant food safety outbreaks have led the US to develop a risk-based preventive approach to food safety management.

The Food Safety Modernisation Act 2011 (FSMA) is the US regulatory food safety requirement. The Act does not apply to all food businesses, only to those regulated by the FDA. The US Department of Agriculture (USDA) regulates cattle, sheep, goats, horses, mules, egg products, poultry, catfish and products containing >3% raw meat or >2% cooked meat.

FDA food safety rules

The FSMA does not include all the details of what businesses must do to comply with the law, so the FDA has written seven rules that provide a risk based framework for food safety from ‘farm to table’ (Table1). Companies that export to the US will need to comply with these rules.

The FSMA requires food businesses engaged in manufacturing, processing, packing or holding of food for consumption in the US to register with the FDA; this must be renewed every two years. The FDA’s enforcement powers have changed from a reactive approach to food safety to a proactive one. It now has the authority to suspend registration if it determines that there is a ‘reasonable probability’ of serious adverse health consequences or death to humans or animals (SAHCODHA). 

The Sanitary Transportation rule has the objective of ensuring that food is safe and maintained in a safe manner while it is being transported. The rule applies to foods that are going to enter the US food chain. It does not apply to food that is passing through the US on road or rail that is not going to enter the food chain.

The Mitigation Strategies to Protect Food Against Intentional Adulteration rule requires businesses to carry out a risk based vulnerability assessment to prevent the intentional adulteration of food from actions that may harm the public. The business would also need to demonstrate the measures taken to reduce or mitigate the likely occurrence of adulteration.

The Foreign Supplier Verification Programme (FSVP) rule is perhaps one of the biggest changes as it imposes an obligation upon the importer, broker or agent to ensure that each food that it imports, that will be consumed in the US, is safe and complies with the regulatory requirements. The rule requires the importer/ broker/ agent to evaluate its suppliers. This may involve an annual audit, particularly when there is a reasonable risk that a hazard will cause ‘serious adverse health consequences or death to humans or animals’ (a SAHCODHA hazard).  The importer is responsible for informing the FDA if there needs to be a recall from the market due to a food safety issue.

This article will focus on some of the requirements of the Preventive Controls for Human Food rule. The Code of Federal Regulations (CFR) Title 21 Part 117 ‘Current good manufacturing practice, hazard analysis, and risk-based preventive controls for human food’ defines what a food business has to do to comply with the FSMA regulations and requires the business to establish and implement a food safety system. There are some exemptions to this rule and these are laid down in CFR 21 117.5; more information can be found on the FDA website[1].

The Food Safety Preventive Controls Alliance (FSPCA) is a broad-based public private alliance of industry, academic and government stakeholders, which supports safe food production by developing training and outreach programmes to assist companies producing human and animal food in complying with the preventive controls regulations that are part of the Food Safety Modernization Act.

Table 1 FDA rules for food safety from ‘farm to table’

Food Safety Plan

The CFR 21 Part 117 requires a Food Safety Plan that includes a hazard analysis, written preventive controls, a recall plan, monitoring, corrective actions and written verification procedures. The Food Safety Plan is the primary document that the FDA will be assessing to ensure that the business is complying with the regulation.

The plan must be prepared by, or under the supervision of, a Preventive Control Qualified Individual (PCQI).

The PCQI is defined in CFR 21 Part 117 as ‘a qualified individual who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or is otherwise qualified through job experience to develop and apply a food safety system’. The training that is recognised by the FDA is the standardised course developed by the FSPCA[2]; on successful completion, the participant is given a PCQI number, which the FDA may ask to see.

The activities that the PCQI must undertake or oversee are defined in CFR 21 Part 117.180 and include the preparation of the Food Safety Plan, validation of the preventive controls, review of records and re-analysis of the Food Safety Plan. The PCQI may be held responsible for a food safety incident as they are seen as a qualified person.

As part of the Plan, there may be some preparatory information included, such as the Food Safety Team, product description, intended use and consumers of the food. It may also include a process flow diagram, with a process narrative that describes in detail what happens at each process step. It is difficult to see how the Food Safety Plan could be prepared without this information.

A written hazard analysis is required and this would include biological, physical and chemical hazards, but may also include radiological hazards if appropriate and also economically motivated hazards.

The hazards that need to be considered are those ‘known and reasonably foreseeable’. The team would need to determine if the hazard requires a preventive control.

This would typically be determined as an outcome of a severity x likelihood/probability calculation, but the regulation does not require the business to have documented risk metrics for risk evaluation. It would be necessary to justify the team’s decision. The likelihood/probability factor should be based on the absence of control to clearly identify significance.

Figure 1 Food Safety Plan

Preventative controls

Preventive controls are defined in CFR 21 Part 117 as ‘those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis.’

They are explained in CFR 21 Part 117.135 and they may include process preventive controls, food allergen preventive controls, sanitation preventive controls and supply chain preventive controls; they need to be effective at controlling the hazard. Other preventive controls may be identified at this point.

The PCQI may be held  responsible for a food  safety incident as they are  seen as a qualified person'

Recall plan

A recall plan must be included in the Food Safety Plan. This has been a requirement in the EU under Regulation (EC) 178/2002. The regulatory guidance EC Commission Notice 2016C 278/01 has this requirement as part of a company’s preparedness, which would be managed as a prerequisite programme. In the US recalls are categorised as Level 1, where adulterated products are likely to cause serious adverse health consequences or death, Level 2 where products may cause injury but the probability of serious illness or death is remote or unlikely, or Level 3, which would involve products that are not likely to cause injury or illness.

Process preventive controls

The process preventive controls are typically critical control points (CCPs). A CCP is defined in CFR 21 Part 117.3 as ‘a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.’ The procedures could also be viewed as Operational Prerequisites (OPRPs). The use of the term ‘preventive controls’ removes any uncertainty about whether a hazard is managed by a CCP or an OPRP.

Food allergen preventive controls

The food allergen preventive controls require actions that prevent cross contact as well as label review, which should ensure that the label has the correct information and that it is applied to the right product.

Sanitation preventive controls

Sanitation preventive controls are required to prevent contamination of the product from the environment, people and equipment. 

Supply chain preventive control

The supply chain preventive controls requirements are defined in CFR 21 Part 117 Sub part G; this section covers the need for effective approved supplier programmes. This may not be a preventive control for all food businesses; it will depend on who makes the product safe. If it is not a preventive control, management will be through the current good manufacturing practices (cGMPs).

The food business will need to determine parameters for all preventive controls; those for the process preventive controls could be critical limits.  

The preventive controls will need to be monitored and monitoring results will need to be documented. There is also a requirement for corrective action procedures. The terms ‘corrections’ and ‘corrective actions’ are used in the rule; correction is applied when there is no impact on the product safety.

This is not the same as the definitions used in the ISO 22000 standard. In ISO 22000 corrections are activities that deal with the product and regain control of the process and corrective actions are activities that prevent the issue from happening again or reduce its likely occurrence.

The Food Safety Plan will need to be verified; verification is defined in CFR 21 Part 117.3 as ‘the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure or combination of control measures is or has been operating as intended and to establish the validity of the food safety plan.’ This definition may cause confusion as it includes validation as part of verification. This is not the approach that Codex Alimentarius has taken in its Guidelines for the Validation of Food Safety Control Measures (CAC/GL69/2008).

In this document, Codex defines verification as ‘the application of methods, procedures, tests and other evaluations, additional to monitoring, to determine whether a control measure is or has been operating as intended.


More guidance is required and is expected in certain areas. For example, although the PCQI does not need to successfully complete a recognised course, there is no clear guidance as to how qualification through job experience can be achieved.

As it is early days regarding the inspections by the regulatory official, we can expect more feedback on compliance requirements.

It is understood that a number of gap analyses have been performed, comparing GFSI (Global Food Safety Initiative) benchmarked standards with the requirements of FSMA.

The BRC (British Retail Consortium) offers an FSMA bolt on module, which specifically covers the additional requirements. Interest in the requirements of FSMA is growing in the UK and Europe as a whole.

Andrew Collins, Food Safety Management Specialist, Campden BRI, Station Road,

Chipping Campden, Gloucestershire, GL55 6LD, UK.



Campden BRI offers the FSPCA Standardised Curriculum PCQI course and will be organising an FSMA update seminar on 25th October 2017. Further information is available on the Campden BRI website or by emailing the author.







View the latest digital issue of FS&T or browse the archive


Click here

Become a member of the Institute of Food Science and Technology