Achieving Success in the

New Era of Food Safety

Strategies for Navigating the
Food Safety Modernization Act
(FSMA)
 Contents
Strategies for Navigating the FSMA at a glance.

Introduction 1 GFSI Recognized Certification 7

to support FSMA Readiness
Elements of FSMA 2
Auditor Competency 9
Preventive Controls 3
Foreign Supplier Verification 10
Qualified Individuals 4
Why LRQA 13

PCQI Training 5

Management Systems Certification 6

& FSMA Connection

Lloyd’s Register LRQA © 2017

 Embracing a New Era in Food Safety
Signed in to law in 2011, the Food Safety Modernization Act (FSMA) requires the Food and Drug Administration
(FDA) to take a more proactive approach to securing the nation’s food supply. As opposed to responding to
contamination incidents, the American food industry must now focus on preventing them.

FSMA represents the biggest sweeping reform of food safety laws

in the U.S., impacting food companies around the world.

Both comprehensive and far-reaching, The Act is designed to carry influence beyond U.S.
borders and into the global food supply chain from farm to fork. The practical impact of the
new regulation for food industry practitioners has already begun to take shape. Large food
facilities must now comply with the Act’s Current Good Manufacturing Practice, Hazard
Analysis and Preventive Controls from September 2016.

In this eBook, you’ll gain insight into...

Vital details about FSMA topics most commonly addressed by food safety experts, including:
• Preventive Controls
• GFSI-recognized Third Party Certification
• Supplier Verification
• Auditor Competency

With additional insight into the many elements of FSMA, you can help your organization ensure readiness
and operate with greater efficiency.

1
Lloyd’s Register LRQA © 2017
 What is FSMA?
The key components of FSMA at a glance.
Prevention Imports
For the first time, FDA will have a legislative mandate to require comprehensive, science- The FSMA gives the FDA unprecedented authority to better ensure that imported products
based preventive controls across the food supply. This includes: meet U.S. standards and are safe for U.S. consumers. This includes:

• Mandatory preventive controls for food facilities • Importer accountability

• Mandatory produce safety standards • Third Party Certification
• Authority to prevent intentional contamination • Certification for high risk foods
• Voluntary qualified importer program
Inspection & Compliance • Authority to deny entry

The FSMA recognizes that preventive control standards improve food safety only to the Enhanced Partnerships
extent that producers and processors comply with them. Therefore, it will be necessary for
the FDA to provide oversight, ensure compliance with requirements and respond effectively FSMA builds a formal system of collaboration with other government agencies, both
when problems emerge. This includes: domestic and foreign. In doing so, the statute explicitly recognizes that all food safety
agencies need to work together in an integrated way to achieve public health goals.
• Mandated inspection frequency This includes:
• Records access: FDA will have access to records, including industry food safety plans
• Testing by accredited laboratories • State and local capacity building
• Foreign capacity building
Response • Reliance on inspections by other agencies

The FSMA recognizes that the FDA must have the tools to respond effectively when
problems emerge despite preventive controls. This includes:

• Mandatory recall
• Expanded administrative detention
• Suspension of registration
• Enhanced product tracing abilities
• Additional record keeping for high-risk foods
2
Lloyd’s Register LRQA © 2017
 Preventive Controls for Human & Animal Food
A Significant Departure from Past Food Safety Regimes…
FSMA’s Preventive Control Rules, which effectively act as the FDA’s new rules for food
safety management, set into law requirements for monitoring, verification, establishing
corrective actions and for record-taking for non-critical control points in the food
Before FSMA With FSMA
supply chain. Critical Control Points Preventive Controls

They also set separate requirements for distinct classes of foods such as ‘ready to eat’
and make mandatory in each company’s hazard analysis the inclusion of an environmental
monitoring program.
This is a significant departure from the past food safety regimes. Most previous guidelines
or standards favoured measures known as critical control points, which were largely process
controls that closely monitored activities such as cooking, drying and pasteurization. The
controls were validated and then periodically verified.
FSMA recognizes that some hazards need to be controlled differently because they relate to
the work environment. Many of these controls pertain to the factory environment and seek
to prevent threats such as cross contamination, the entry of allergens and other sanitation-
related issues. There are now requirements for very specific documentation in these areas,
including monitoring activities, verification and validation.
The primary concern was the validation and Now with FSMA, specific documentation
periodical verification of raw materials, products requirements for:
and processes associated with: • Critical control points
• Cooking • Corrective actions
• Drying • Record-taking for non-critical control points
• Pasteurization • Unique requirements for distinct food classes,
such as ‘ready to eat’
• Mandatory environmental supervision
• Recall action plans, including an active
product-tracing system to support recalls

Any organization must also be able to demonstrate that they are prepared to recall any
potentially unsafe product, which means having in place a recall plan, a definition of
responsibilities for this, as well as an active product-tracing system to support recalls.

3
Lloyd’s Register LRQA © 2017
 PC Qualified Individuals for Before FSMA With FSMA
Organizationally decided Preventive Controls Qualified Individuals
Human & Animal Food qualifications
Previously, each organization in the Now with FSMA, it is the first time the requirements for
Embracing ‘Human Competency Assurance’ US food supply chain decided the
qualifications necessary to perform
being ‘qualified’ have been standardized, requiring PCQIs
that can demonstrate understanding of:
a role in food safety, with some • Preventive controls, food safety plans & resources
In a general sense, FSMA requires major companies in the U.S. food supply chain to requirements for food safety required to prepare them
ensure its ability to react to incidents, as well as to demonstrate the competence of practices, record keeping, etc, • Process & sanitation preventive controls
its employees, particularly those who design and implement food safety management but no verification for training. • Verification & validation procedures
systems.
• Hazard analysis & ability to determine what requires
preventive controls
This ‘human competency assurance’ has been given structure and formalized by FDA’s • Good Manufacturing Practices & prerequisite programs
Preventive Controls Qualified Individual (PCQI) initiative. Commercial food safety plans • Chemical, physical & economically motivated food
must now show any company to have competent people to design, build and maintain those safety hazards
systems; those people must know how to identify the hazards related to their products and • The preliminary steps for developing a food safety plan
process environments, in addition to knowing which combination of control measures are • Regulation overview: CGMP
appropriate to address the potential hazards faced by their company. (Current Good Manufacturing
Practices), hazard analysis &
They also need to be able to show that they can build a system that would demonstrate that
risk-based controls for human food
those hazards are properly controlled on the floor. That competence must be held not only
• Recall plans
by those who are in charge of conducting the hazard analysis, but also by those in charge of
monitoring the control activities and measures. • Supply chain & food allergen
preventive controls
But as a risk-based safety regime, compliance requires more than checking all the boxes on • Biological food safety hazards
a list. It is about encouraging a cultural as well as systemic change within the industry, as • Record-keeping procedures
highlighted by the two-tiered approach to achieving individual ‘qualification’.

The first level requires the person of interest to demonstrate previous qualifications,
experience and education, knowledge of the regulation itself and applicable food standards.
The second requires the individual to have received the standardized curriculum training,
known as Food Safety Preventive Controls for Human Foods and/or Animal Foods.

4
Lloyd’s Register LRQA © 2017
 FSMA PCQI Training Options
Ensure you Choose a Trusted Training Provider.
PCQI Training for Human Food Key Course Topics Include:
• Introduction to Preventive Controls and Food Safety Plans
This in person or live online course was developed by the Food Safety Preventive Controls Alliance • Good Manufacturing Practices and Pre-requisite programs
(FSPCA) and is recognized by the US FDA as containing the standardized curriculum for meeting • Biological Food Safety Hazards
the FSMA PCQI Human Food Rule Training requirements. • Chemical, Physical and Economically Motivated Food Safety Hazards
• Preliminary Steps in Developing a Food Safety Plan
You need this course if: • Resources for Preparing Food Safety Plans
• You are working towards meeting the requirements of the FSMA preventive controls qualified individual training • Hazard Analysis and Preventive Controls Determination
• You need a better understanding of the requirements of the Good Manufacturing Practice, Hazard • Process Preventive Controls
Analysis, and Risk-based Preventive Controls for Human Food regulation (referred to as the Preventive • Food Allergen Preventive Controls
Controls for Human Food regulation) • Sanitation Preventive Controls
• You want to attend an FDA-recognized FSPCA FSMA PCQI training course • Supply chain Preventive Controls
• You need an FDA-recognized FSPCA preventive controls qualified individual training course certificate • Verification and Validation Procedures
• You’re looking for options to attend either a Live Online or In-Person training course • Record-keeping Procedures
• Recall Plan
• Regulation Overview – cGMP, Hazard Analysis, and Risk-Based Preventive
• Controls for Human Food

Transitioning from HACCP to FSMA HARPC Food Safety Modernization Act Overview

This e-learning course is ideal for anyone who needs a high-level overview (30-60
minutes) of how to integrate FSMA HARPC into an existing HACCP system.
Key Course Topics Include:
• How to recognize key elements to consider when expanding HACCP to include HAPRC
• How the foundational elements of an existing food safety system can be integrated to
include FSMA HARPC
• Recognizing the key expectations of HAPRC verification and validation, including
terminology, application and examples, do’s and don’ts
Lloyd’s Register LRQA © 2017
This in person or live online course is ideal for anyone who needs a high-level fully
customizable overview (1-3 hours) of FSMA and the potential implications for your
organization, whether you are based in the USA or are an importer – helping you to
understand what you need to do to ensure compliance with FSMA requirements.
Key Course Topics Include:
• Which organizations are required to comply with FSMA and which are not
• The fundamental differences between HACCP and HARPC
• The possible actions necessary to align FSMA requirements with an FSSC 22000 based
management system
 The Management System Certification and FSMA Connectionx
Why do FSMA Guidelines Recommend Independent Third Party Certification?
Effectively, all of the elements required by the FSMA’s Preventive Controls Rules are achievable by taking a
management systems approach to food safety.
Once a management system is in place, using an
A company may have all the technical requirements in place – the good manufacturing process and pre-requisite program independent assurance provider, such as LRQA, is the best
rules, etc. – but if the management systems aren’t effective, the technical elements will not be put into action. For FSMA, way to assure its effectiveness and:
the Preventive Controls are what makes it work; if you want those to be effective, you have to ground the program in a
management system – based on FSSC 22000 and ISO 22000, for example. Embedded with the cycle of plan-do-check- • Discover and correct weaknesses
act, a management system will enable you to: • Refine and improve key food safety metrics
• Update your documentation • Identify threats more quickly
• Verify and improve your system • Builds transparency across all food safety processes
• Respond to incidents • Reduce the potential for public health & lasting reputational
• Ensure continuous improvement issues such as food fraud
• Monitor the key processes and activities • Add an extra level of credibility
• Demonstrate your company to be making safe products • Receive unbiased technical assessments

The farm-to-fork demands of FSMA require a deeply

The value of independent third party certification experienced global auditor pool with the breadth of management
systems knowledge that can not only verify compliance but help
FSMA’s guidelines recommend using an experienced independent third party to certify compliance. Independent audits to benchmark your company’s efforts against best practice.
add an additional level of credibility and, with the personal stakes now higher for the U.S. food industry’s most senior
executives, they offer sobering technical assessments that are unencumbered by a company’s commercial environment
and pressures.

Whatever system is put in place to reach your food safety goals, it has to be dynamic and it has to endure. Independent
third party assurance from the right company can verify not just whether the system you chose has been implemented as
designed, but whether it is adequately protecting and monitoring your food supply chain and driving improvement.

Not all independent third party assessments are created equal, just as compliance with FSMA is not the end of the road for
companies with best-in-class food safety goals.

6
Lloyd’s Register LRQA © 2017
 GFSI Recognized Certification to support FSMA Readiness
Important Standards to Consider
Whether your organization is already certified to a GFSI-recognized standard, such as FSSC 22000
v4.1 or BRC Food 7, or is looking to become certified, it is important to understand which standards
offer certification to support FSMA Readiness.

FSSC 22000 v4.1

Developed by the Foundation for Food Safety Certification, FSSC 22000 represents a comprehensive
approach to food safety risk management throughout the food supply chain. An independent evaluation of
the FSSC 22000 found that it “often exceeds FDA requirements.” In addition, the December 2016 release of
FSSC 22000 v4 were intended to help further ensure the standard aligns and exceeds FSMA requirements.

How does FSSC 22000 v4.1 certification address food fraud prevention?
Recent changes in FSSC 22000 now include Food Fraud Prevention, and companies must include controls
to mitigate food fraud.

The measures include: Identification of Vulnerability Develop and Prioritization

• Vulnerability assessment: FSSC 22000 certified organizations must document a procedure and Vulnerabilities Assessment of Measures

a written assessment on vulnerability.

• Preventive measures: Based on the result of the vulnerability assessment, FSSC 22000 certified
organizations must put in place preventive measures to mitigate adulteration.
• Review: The food fraud procedure and assessment must be updated and reviewed once a year
or when changes occur.
Food Fraud
Prevention
FSSC 22000 v4.1 also addresses unannounced audits, the introduction of critical nonconformities, computer
aided audit techniques, standardized audit reports and auditor rotation. FSSC 22000 has also extended its
scope beyond food manufacturing, food packaging, animal feed and food manufacturing, and farming to
include Transportation and Storage, Food Service/Catering and Retail/Wholesale Industries.
Preventive
Review Testing Communication
Measures

Audits

7
Lloyd’s Register LRQA © 2017
 GFSI Recognized Certification to support FSMA Readiness
Important Standards to Consider, continued…
BRC Food 7 + FSMA Voluntary Module
The BRC Global Standard for Food Safety – first published in 1998 and now in its 7th issue. The BRC Food
7 is recognized by the Global Food Safety Initiative (GFSI). In addition to HACCP, the BRC Global Standard
for Food Safety 7 focuses on:
• Management commitment
• Quality management systems
• Auditing good manufacturing processes
• Auditing areas that often have the highest rate of product recalls and withdrawals
• Developing systems to reduce exposure to food fraud
• Ensuring consistency of audit processes
• Promoting greater resilience, transparency and traceability in the supply chain

To support alignment with the US Food Safety Modernization Act (FSMA), the standard has introduced the
BRC FSMA Voluntary Module, which can be added to a BRC Global Standard for Food Safety audit.
The module brides the gap in requirements between FSMA and the BRC Standard.

8
Lloyd’s Register LRQA © 2017
 Auditor Competency
The importance of auditor competency to support FSMA
There’s a level of confidence and credibility that comes with using independent,
accredited certification bodies, particularly with stakeholders such as regulators. To gain
accreditation, certification bodies must follow the rules and processes that govern auditor
qualifications. Accreditation is a very rigorous process. LRQA’s assessors undergo
assessor training in addition to any education in chemistry or biology, etc. They also need
to be qualified in the specific food sector they are auditing.

Identifying Additional Necessary Attributes

Auditing is a systematic, independent and documented process for obtaining audit

evidence and evaluating it objectively to determine the extent to which audit criteria
are fulfilled. Audits are done for several reasons, including: (1) determining conformity,
(2) determining effectiveness and (3) identifying improvement opportunities. The
Plan, Do, Check, Act (PDCA) commonly known as the process-based audit, is a
more comprehensive way of assessing effectiveness and identifying improvement
opportunities. Since an auditor may need to deviate from a set audit plan, it is important
for him or her to have the necessary audit skills, including:

Building Rapport – Being cognizant that the audit process is entwined with human
psychology

Questioning Techniques – Effectively use three fundamental question types: open-

ended, close-ended and clarifying

Evidence Search – Mastering the interview process, as well as time management,

sampling, observation, evaluation of evidence, note-taking and probing

9
Lloyd’s Register LRQA © 2017
 Foreign Supplier Verification
Elevating supplier standards worldwide.
The FSMA’s impact on importers
The Act also ensures that importers only import foods from suppliers who are compliant
with the FDA’s Preventive Controls. The new legislation has not only raised the bar
throughout the U.S. food supply chain, it has raised food safety practices around the
world, and everyone will benefit—especially the consumer.

Foreign Supplier Verification

Another foundation of the Preventive Controls is the Foreign Supplier Verification

Program. It requires importers to verify that their suppliers meet the same U.S. food
safety standards as they do. FSMA greatly improves external communication practices
among participating companies and regulators globally, building a formal system of
collaboration between government agencies, domestic and foreign. Importers are
responsible for actions that include:

• Determining known or reasonable foreseeable hazards with each food

• Evaluating the risk posed by food and the foreign supplier’s performance
• Approve suppliers and determine appropriate supplier verification activities
• Conducting supplier verification activities
• Conducting corrective actions
• Establishing and following written procedures to ensure food is imported only from
approved foreign suppliers
• Developing, maintaining and following a FSVP for each food brought into the U.S. and
for its foreign supplier
• Evaluating risks posed by imported food and supplier performance at least every 3
years, or when new hazard’s and performance issues come to light

10
Lloyd’s Register LRQA © 2017
 Foreign Supplier Verification
FSVP Q&A
Q. What are considered ‘hazards’ in the FSVP?
A. Under FSVP, importers are required to identify and evaluate the known or
reasonable for seeable hazards for each type of food it imports to determine the
hazards requiring control. As important element of FSVP gives the importer the ability
to rely on another entity to conduct the hazard analysis as long as the importer reviews
and assesses the relevant documentation.
HAZARDS INCLUDE:
• Biological harzards, such as parasites and disease-causing bacteria
• Chemical hazards, such as radiological, pesticide and drug residues, natural toxins,
food decomposition, unapproved food or color additives, food allergens, etc
• Physical hazards, such as glass, etc.
• Naturally occurring, unintentionally or intentionally introduced for purposes of
economic gain
HAZARD ANALYSIS must:
• Assess probability of occurrence in the absence of controls and the severity of
illness or injury that could occur
• Consider factors such as formulation of food; condition, function and design of
establishment or typical entry of food; raw materials and ingredients; transportation
practices; harvesting, raising, manufacturing, processing and packing procedures;
packaging and labeling; storage and distribution; intended or foreseeable use;
sanitation, including employee hygiene, etc
• Evaluate food risks and supplier performance
Lloyd’s Register LRQA © 2017
Q. What do importers need to be familiar with in the FSVP?
A. In general, understanding and gaining compliance with the FSVP’s requirements will be
a complex process. For importers, the first basic steps are:
1) Pinpointing exactly where their ingredients are coming from
2) Documenting the full verification process and maintain records
3) Performing risk assessments for the materials that they are importing
Q. Who is responsible for implementing the FSVP?
A. This function is carried out by “qualified individuals” who have relevant food experience,
hazard assessment experience and education. Individuals can be from the importer’s
organization or from an independent contractor. They are responsible for administering a
Hazard Identification (HAZID) study as well as evaluating any risks posed by the specific
food and the performance of the foreign supplier, including:
• Hazard analysis for the food
• The company that will be applying the hazard controls
• The supplier’s food safety practices and procedures
• U.S. food safety regulations
• The supplier’s food safety related performance history
• Annual onsite audits of the supplier’s facility
• Food sampling and testing
• A review of the supplier’s relevant food safety records
11
 Foreign Supplier Verification
4 Steps to Developing a Supplier Verification Program
To ensure your organization not only complies, but thrives, under the FSMA regulations, you need a partner
with the experience, resources and deep knowledge to move forward with confidence. LRQA is that partner.
We’ll help you set up a Supplier Verification Program in 4 proven steps:

STEP 1:
STEP 3:
ESTABLISH & PRIORITIZE OBJECTIVES
ASSESSMENT & TRAINING
AND EVALUATE SUPPLY CHAIN RISKS

First, LRQA will work with you to evaluate your assurance needs, expectations and LRQA can brief and train all relevant parties in your organization, and our assessors and
requirements. Then, we’ll help you establish objectives and priorities. client management teams, to deliver Supplier Verification services that are fully aligned
with your business objectives.

STEP 2: STEP 4:
APPROACH & CRITERIA REPORTING & ACTION

We’ll identify a suitable approach for the assessment, criteria, methodology and reporting. Based on KPIs agreed upon during the development phase, our assessor and client
If you don’t have compliance criteria in place, LRQA can shape your requirements, develop management team will help you identify strengths and weaknesses, risks and opportunities
your own company-specific standard and benchmark it to international standards. for improvement, enabling you to take action where it matters most.

12
Lloyd’s Register LRQA © 2017
 Why LRQA
Partner with LRQA - the strategic choice for your FSMA Readiness.
Your business has a unique set of requirements. Our FSMA services create a customized Leave your food safety requirements to us
plan of action to meeting your requirements—and exceeding your expectations.
Leave your food safety requirements to us Your organization isn’t in the business of
A completely tailored approach conducting assessments. We are. LRQA has been delivering trusted, unbiased and
independent assessments worldwide for more than 30 years. Work with highly skilled food
Ask yourself the following questions: safety management system assessors trained to expertly manage your internal or supplier
• Are you confident in your processes, your suppliers and your business performance? auditing program.
• Are you sure your operations and suppliers are FSMA compliant?
• Are your suppliers’ capable of controlling identified hazards?
• Are you aware of your risks and how to control them?

Through our FSMA services, our assessments are individually designed to give you
assurance across the all of these critical areas.

Impartiality when you need it most

With LRQA, you have a trusted brand and the assurance of objective, high-quality
insight and intelligence together with a clear picture of compliance levels throughout
your organization and supply chain. Our worldwide reputation for rigorous
assessment and value-added insight makes us a natural partner for companies
seeking continual improvement and a competitive advantage.

Mitigation of your global food safety and supply chain risks

LRQA has assessment teams deployed globally through one of the world’s most
comprehensive assessment resource networks. We have the FSMA expertise
and local resources available to cover the assessment of all aspects of your business
risks and requirements worldwide.

13
Lloyd’s Register LRQA © 2017
 Learn more or get started today at:
www.lrqausa.com/FSMA

Lloyd’s Register Quality Assurance, Inc.

1330 Enclave Parkway, Suite 200 Houston, TX 77077 USA

Business Advisors: +1 866-971-LRQA (5772)

LRQA Training: +1 888-877-8001
info-usa@lrqa.com
sales-usa@lrqa.com

Lloyd’s Register and variants of it are trading names of Lloyd’s Register Group Limited, its
subsidiaries and affiliates. Lloyd’s Register Quality Assurance, Inc. is a Delaware USA corporation.
Care is taken to ensure that all information provided is accurate and up to date.
However, Lloyd’s Register accepts no responsibility for inaccuracies in, or changes to, information.
Copyright © Lloyd’s Register Quality Assurance, Inc. 2017. A member of the Lloyd’s Register group.

Lloyd’s Register LRQA © 2017