FSMA Compliance Requirements

We know it can be difficult keeping all of the rules and regulations straight, especially when it comes to sanitation in food processing plants. We at Meritech specialize in sanitation and hygiene in the food industry, so we continually strive to be a resource and partner for all of these types of questions. Below are the four key requirements of the FDA Food Safety Modernization Act (FSMA) Preventive Controls for Human Food.

Key FSMA Compliance Requirements

  1. Covered facilities must establish and implement a food safety system that includes an analysis of hazards and risk-based preventive controls. The rule sets requirements for a written food safety plan that includes:
  • Hazard analysis: The first step is hazard identification, which must consider known or reasonably foreseeable biological, chemical, and physical hazards. These hazards could be present because they occur naturally, are unintentionally introduced, or are intentionally introduced for economic gain (if they affect the safety of the food).
  • Preventive controls: These measures are required to ensure that hazards requiring a preventive control will be minimized or prevented. They include process, food allergen, and sanitation controls, as well as supply-chain controls and a recall plan.
  • Oversight and management of preventive controls. The final rule provides flexibility in the steps needed to ensure that preventive controls are effective and to correct problems that may arise.
    • Monitoring: These procedures are designed to provide assurance that preventive controls are consistently performed. Monitoring is conducted as appropriate to the preventive control. For example, monitoring of a heat process to kill pathogens would include actual temperature values and be more frequent than monitoring preventive maintenance activities used to minimize metal hazards, which could be a simple record of the date on which the activity took place.
    • Corrective actions and corrections: Corrections are steps taken to timely identify and correct a minor, isolated problem that occurs during food production. Corrective actions include actions to identify a problem with preventive control implementation, to reduce the likelihood the problem will recur, evaluate affected food for safety, and prevent it from entering commerce. Corrective actions must be documented with records.
    • Verification: These activities are required to ensure that preventive controls are consistently implemented and effective. They include validating with scientific evidence that a preventive control is capable of effectively controlling an identified hazard; calibration (or accuracy checks) of process monitoring and verification instruments such as thermometers, and reviewing records to verify that monitoring and corrective actions (if necessary) are being conducted. 

      Product testing and environmental monitoring are possible verification activities but are only required as appropriate to the food, facility, nature of the preventive control, and the role of that control in the facility’s food safety system. Environmental monitoring generally would be required if contamination of a ready-to-eat food with an environmental pathogen is a hazard requiring a preventive control.
  1. The definition of a ‘farm’ is clarified to cover two types of farm operations. Operations defined as farms are not subject to the preventive controls rule.
  • Primary Production Farm: This is an operation under one management in one general, but not necessarily contiguous, location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities. This kind of farm can pack or hold raw agricultural commodities such as fresh produce and may conduct certain manufacturing/processing activities, such as dehydrating grapes to produce raisins and packaging and labeling raisins.

    The supplemental rule proposed, and the final rule includes, a change to expand the definition of “farm” to include packing or holding raw agricultural commodities (such as fresh produce) that are grown on a farm under a different ownership. The final rule also includes within the “farm” definition companies that solely harvest crops from farms.
  • Secondary Activities Farm: This is an operation not located on the Primary Production Farm that is devoted to harvesting, packing and/or holding raw agricultural commodities. It must be majority owned by the Primary Production Farm that supplies the majority of the raw agricultural commodities harvested, packed, or held by the Secondary Activities Farm.

    This definition for a Secondary Activities Farm was provided, in part, so that farmers involved in certain formerly off-farm packing now fit under the definition of “farm,” as the packing is still part of the farming operation. In addition to off-farm produce packing operations, another example of a Secondary Activities Farm could be an operation in which nuts are hulled and dehydrated by an operation not located at the orchard before going to a processing plant. If the farmer that owns the orchards and supplies the majority of the nuts is a majority owner of the hulling/dehydrating facility, that operation is a Secondary Activities Farm.
  • Primary Production and Secondary Activities Farms conducting activities on produce covered by the Produce Safety Rule will be required to comply with that rule.
  1. Supply-chain program is more flexible, with separate compliance dates established.
  • The rule mandates that a manufacturing/processing facility have a risk-based supply chain program for those raw material and other ingredients for which it has identified a hazard requiring a supply-chain applied control. Manufacturing/processing facilities that control a hazard using preventive controls, or who follow requirements applicable when relying on a customer to controls hazards, do not need to have a supply-chain program for that hazard.
  • Covered food facilities are responsible for ensuring that these foods are received only from approved suppliers, or on a temporary basis from unapproved suppliers whose materials are subject to verification activities before being accepted for use. (Approved suppliers are those approved by the facility after a consideration of factors that include a hazard analysis of the food, the entity that will be controlling that hazard, and supplier performance.)
  • A facility will not be required to implement a preventive control when an identified hazard will be controlled by a subsequent entity such as a customer or other processor. The facility will have to disclose that the food is “not processed to control (identified hazard)” and obtain written assurance from its customer regarding certain actions the customer agrees to take.
  • Another entity in the supply chain, such as a broker or distributor, can conduct supplier verification activities, but the receiving facility must review and assess that entity’s documentation of the verification of control of the hazard.
  • Separate compliance dates have been established for the supply-chain program provisions so that a food facility will not be required to comply with the supply-chain program provisions before its supplier is required to comply with the preventive controls for human food rule or the produce safety rule.
  1. Current Good Manufacturing Practices (cGMPs) are updated and clarified.
  • The final rule does not include nonbinding provisions, which are more appropriate for guidance.
  • Some of the previously nonbinding provisions, such as education and training, are now binding.
    • Management is required to ensure that all employees who manufacture, process, pack or hold food are qualified to perform their assigned duties.
    • Such employees must have the necessary combination of education, training, and/or experience necessary to manufacture, process, pack, or hold clean and safe food. Individuals must receive training in the principles of food hygiene and food safety, including the importance of employee health and hygiene.
    • Note that there are similar requirements related to preventive controls.
  • The FDA’s longstanding position that cGMPs address allergen cross-contact is now explicit in the regulatory text.


There’s a lot to understand, but don’t stress about it. Our products are NSF, CE, and CSA certified and accepted by the FDA and USDA so we’re very familiar with the industry’s rules and regulations. When considering food industry hygiene  best practices, or anything to do with infection control --look to Meritech to help meet and exceed requirements and third party audits. 

Contact our infection control experts now!



Topics:Hand Hygiene Resources