FSMA Preventive Controls Final Rule Enforcement

Believe it or not, it’s been 10 years since President Obama signed the Food Safety Modernization Act (FSMA) into law. In the years that followed, FDA worked tirelessly to draft enabling regulations to help facilitate the congressional goals of making the U.S. food supply safer. One of the new FSMA rules developed by FDA was the Final Rule for Preventive Controls for Human Food.

The final rule, which went into effect in 2016 and required compliance from all covered facilities in 2018, called for nearly all FDA-regulated facilities to develop a written food safety plan designed to ensure that the risks associated with the production of certain food products were identified and addressed. The rule required food companies to conduct a hazard analysis designed to identify those hazards that were reasonably likely to occur in the food at issue, to identify effective controls to eliminate or reduce any such hazards, and to effectively implement those controls to accomplish the stated goals (see 21 C.F.R. § 117.16). The rule also required companies to develop written monitoring procedures, verification procedures, and corrective action procedures (in the event of a deviation or failure), as well as a written supply chain program and written recall plan.

In addition to requiring companies to develop written food safety plans, FSMA also established a mandated inspection frequency that is based on overall risk for food facilities and the specific products they manufacture (FSMA, 124 Stat. 3885, Sec. 201). Pursuant to the mandated inspection frequency, FDA is now required to inspect domestic food facilities at least every five years for non-high-risk facilities and at least every three years for high-risk facilities. With that said, in many cases, processors will find that the inspections are actually more frequent than the mandated minimums.

Initially, from an enforcement standpoint, FDA stated that the agency’s primary focus would be on education and technical assistance. More recently, however, now that the final rule has been in place for almost five years, the agency has stated it will begin taking a more aggressive enforcement approach, focusing less on education and more on compliance and enforcement.

In October 2020, FDA issued guidance that provides direction to FDA inspectors who are conducting assessments under the Final Rule (See Compliance Program Guidance (CPG) Manual 7303.040. FDA confirmed that high-risk facilities will be prioritized for inspections, and inspectors are directed to select the highest-risk food or process within the facility for review during the inspection to target FDA resources on the most significant risks present. The CPG directs inspectors to use FDA Form 483 as the primary, though not exclusive, method of agency follow-up for critical and major preventive controls violations that are identified. The goal of FDA’s Form 483’s inspection and enforcement methodology as identified in the CPG is “to obtain high rates of industry compliance,” while, at the same time, encouraging voluntary corrective actions.

When a facility violates FDA regulations, FDA considers those violations to be very serious and, if they not corrected immediately by the facility under scrutiny, FDA can and will issue warning letters to the offending company. An FDA warning letter is the mechanism the agency uses to threaten the removal of a food company’s registration (in essence, threatening to shut the company down) for uncorrected food safety violations that the agency deems to be very serious. While the issuance of an FDA Form 483 to a company is not widely publicized by the agency, FDA warning letters get much more attention and are, thus, more “public.” Therefore, warning letters should be avoided at all costs.

We examine three recent warning letters identifying instances where FDA has found violations of the Preventive Controls Final Rule.