1. FSMA Implementation -- Foreign Supplier Verification Programs
National Confectioners Association
January 2016
Webinar #4
Robert Hahn
Olsson Frank Weeda Terman Matz PC

2. Disclaimer
These webinars are for informational purposes only and are not intended to provide legal advice

3. FSMA Final Rules CGMPs and Preventive Controls/Human Food
CGMPs and Preventive Controls/Animal Food
Foreign Supplier Verification Programs (FSVP)
Accreditation of Third-Party Certification Bodies
Produce Safety
Voluntary Qualified Importer Program (VQIP) – draft guidance document
FDA originally used the term “food security,” but that term is often used to mean food sufficiency.
Concerns about food defense received a big boost when, after September 11, we found evidence that terrorist groups were considering attacking the U.S. food supply.
Congress passed the Bioterrorism Act in 2002, which required food facilities to register with FDA. But, it did not require food companies to implement food defense measures.
FDA did issue a number of guidance resources that companies can use to protect themselves, including guidance documents with recommended food defense measures and training tools. FDA also conducted over 50 vulnerability assessments of food products and processes.

4. Additional Resources FDA plans to issue:
A draft guidance document on FSVP rule
Course materials on FSVP rule
FSMA Technical Assistance Network (TAN)

5. Foreign Supplier verification programs (FSVP)

6. FSVP Rule Basic requirement: Purpose:
Importers must develop, maintain, and follow a Foreign Supplier Verification Program
Purpose:
To ensure foreign supplier is complying with Preventive Controls or Produce Safety rule, if applicable, and is producing food that is not adulterated or misbranded (with regard to allergen labeling)

7. Definitions
“Importer” – The US owner or consignee of the article of food offered for import
“US owner or consignee” – The person in the US who, at time of entry, owns the food, has purchased the food, or has agreed in writing to purchase the food
If no US owner or consignee, the importer is the US agent or representative of the foreign owner or consignee, as confirmed in a signed statement of consent

8. Definitions
“Foreign supplier” – The establishment that manufactures/processes the food, raises the animal, or grows the food (without further manufacturing/processing of more than a de minimis nature)
“Food” – Food as defined in FD&C Act, except excludes pesticides
NB: Food contact substances included. So, an importer’s FSVP must address imports of food packaging.

9. Standard FSVP Requirements
Conduct a hazard analysis for imported food
Conduct an evaluation of the food and foreign supplier (and a reevaluation
Determine appropriate verification activities
Conduct verification activities and review and assess the results
Take appropriate corrective actions
Approve foreign suppliers and ensure that food is imported only from approved foreign suppliers (with limited exceptions)
Identify importer at time of entry
Keep required records

10. Hazard Analysis
Identify and evaluate known or reasonably foreseeable hazards for each type of food imported, to determine if any are hazards requiring a control
Based on experience, illness data, scientific reports, and other information
Hazard requiring a control is a hazard that a person knowledgeable about food safety would establish controls or measures to significantly minimize or prevent
A known or reasonably foreseeable hazard for which a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would establish one or more controls or measures to significantly minimize or prevent such hazard.

11. Hazard Analysis Hazard identification
Biological, chemical (including radiological), and physical hazards
Naturally occurring, unintentionally introduced, or intentionally introduced for economic gain (i.e., economically motivated adulteration)

12. Hazard Analysis Hazard Evaluation
Must consider probability and severity of hazard
Must consider environmental pathogens if a RTE food is exposed to the environment before packaging and packaged food does not receive a lethality treatment or include a control (e.g., formulation) that will control the pathogen

13. Hazard Analysis Hazard evaluation (cont’d) Must consider:
Product formulation;
Condition, function, and design of facility and equipment;
Raw materials and other ingredients;
Transportation practices;
Harvesting, raising, manufacturing, processing, and packing procedures;
Packaging and labeling activities;
Storage and distribution;
Intended or reasonably foreseeable use;
Sanitation, including employee hygiene; and
Any other relevant factors (e.g., weather that might affect levels of natural toxins)

14. Hazard Analysis
Importer must do separate a hazard analysis for each food it imports from each foreign supplier
But, may do one hazard analysis for different foods of the same type from the same foreign supplier (e.g., different varieties of same fruit), provided all foods of that type have a similar hazard profile

15. Hazard Analysis
Importer not required to do evaluation or foreign supplier verification activities if there are no hazards requiring a control
FDA says that certain imported foods may have no hazard requiring a control, including salt, some food-grade chemicals, many types of candy (e.g., hard candy, fudge, maple candy, taffy, toffee), honey, molasses, sugar, syrup, and jams/jellies/preserves from acid fruits

16. Hazard Analysis
Importer not required to do evaluation or foreign supplier verification activities if:
Importer determines and documents that the type of food cannot be consumed without application of appropriate control (e.g., cocoa beans, coffee beans);
Importer controls the identified hazard; or
Importer relies on its customer or a subsequent entity in the US supply chain to control the identified hazard

17. Hazard Analysis
If importer relies on its customer or a subsequent entity to control hazard:
Importer must disclose that food is “not processed to control [identified hazard]”; and
Annually obtain from its customer a written assurance
Content of written assurance depends on who is controlling hazard

18. Evaluation of Food and Foreign Supplier Performance
Importer must evaluate the food and foreign supplier performance
This evaluation is the basis for:
Approving foreign suppliers; and
Determining appropriate foreign supplier verification activities

19. Evaluation of Food and Foreign Supplier Performance
Importer must consider the following factors:
The hazard analysis for the food (including the nature of the hazards requiring a control);
The entity controlling the identified hazards; and
The foreign supplier’s performance, including:
Its food safety processes and practices;
Applicable food safety regulations and its FDA compliance history (including any FDA Warning Letters and Import Alerts);
Its food safety history (e.g., results of testing, audit results, responsiveness in correcting problems); and
Other appropriate factors (e.g., storage and transportation practices)

20. Reevaluation
Importer must conduct a re-evaluation if it becomes of aware of new information about any of those factors, and at least every 3 years
If concerns about safety of imported food, importer must promptly determine whether it is appropriate to continue importing food from that foreign supplier and whether foreign supplier verification activities need to be changed

21. Approval of Foreign Suppliers
Importer must establish and follow written procedures to ensure food is imported only from approved foreign suppliers
May use unapproved foreign suppliers on a temporary basis when necessary, provided food is subjected to verification activities before it is imported

22. Foreign Supplier Verification Activities
Importer must establish and implement written procedures to ensure appropriate verification activities are conducted
Verification activities must provide assurance that the hazards requiring a control identified in the hazard analysis are significantly minimized or prevented
Verification activities are directed to the entity or entities that are controlling the hazards or verifying their control
Importer must promptly review and assess results of verification activities to determine if foreign supplier controlling identified hazards, and take appropriate corrective action if not.

23. Verification Activities
Importer must determine appropriate verification activities (and their frequency) based on the evaluation of the food and foreign supplier
Importer must establish and implement written procedures to ensure appropriate verification activities are conducted

24. Verification Activities
Appropriate verification activities include:
Onsite audits;
Sampling and testing of food;
Review of foreign supplier’s food safety records; and/or
Other appropriate verification activities
Verification activities must provide assurance that the hazards requiring a control identified in the hazard analysis are significantly minimized or prevented
Verification activities are directed to the entity or entities that are controlling the hazards or verifying their control

25. Verification Activities
If there is a reasonable probability the hazard in the imported food would cause serious adverse health consequences or death to humans or animals (SAHCODHA), annual onsite auditing is required…….
Unless importer determines (and documents) that other verification activities or less frequent audits are adequate to control the hazard

26. Verification Activities
Onsite Audits
Must be conducted by a qualified auditor
Not required to be done by an accredited third-party certification body (CB)
Even if done by third-party CB, audit not subject to Third-Party Certification Body rule (e.g., submission of audit report to FDA)
If food is subject to FDA food safety regulations, audit must consider those regulations and review foreign supplier’s food safety plan and its implementation
If audit conducted solely to comply with FSVP rule, even if done by an accredited TPCB, the audit is not subject to the Third-Party Certification Body rule (e.g., the requirement to submit regulatory audit report to FDA)

27. Verification Activities
Onsite Audits (cont’d)
GFSI and other audit schemes
FDA implies these schemes will need to be updated to be consistent with FDA food safety requirements
“Until such time, if an importer choses to use a GFSI, GAP, or other similar audit, the importer might need to supplement that audit to meet the requirements of [the FSVP rule] or otherwise determine that the audit meets the requirements of [the FSVP rule].” 80 Fed. Reg. at

28. Verification Activities
Onsite Audits (cont’d)
In lieu of an onsite audit, the importer may rely on a food safety inspection by:
FDA;
Other federal, state, local, tribal, or territorial agency; or
The food safety authority of a country whose food safety system FDA has officially recognized as comparable or equivalent to the US system
Provided the inspection is done within 1 year of the date an onsite audit would have been required

29. Verification Activities
Importer must promptly review and assess results of verification activities to determine whether the hazards in food from that foreign supplier are being adequately controlled

30. Corrective Action
If importer determines foreign supplier is not following procedures that provide same level of protection as FDA requirements, it must take appropriate corrective actions
If importer learns of problem by means other than verification activities or re-evaluation of food and foreign supplier, importer must investigate and determine whether FSVP needs to be modified.

31. Identification of Importer
Importer must ensure that, for each line entry, the following information is provided to Customs:
Importer’s name;
Importer’s address; and
A unique facility identifier acceptable to FDA
FDA will issue a guidance document on acceptable identifiers, which will include the DUNS number
Importer should provide DUNS number for the facility at which it keeps its FSVP records

32. Identification of Importer
FDA will use this importer information to:
Create a list of all FSVP importers to be posted on FDA’s website, as required by FD&C Act § 805(g)
Identify and locate importers for inspection
Prevent “port shopping”

33. Recordkeeping and FDA Access
Extensive required records
Must be made available to FDA upon request during inspection and must be submitted to FDA electronically (or other prompt means) upon written request
Records not required to be in English, but importer must provide English translation within a reasonable time upon request

34. Training
Must use a qualified individual to develop FSVP and perform all required FSVP tasks
QI must have education, training, or experience (or combination thereof) necessary to perform the activity
QI must be able to read and understand the language of any records reviewed in performing a required task

35. Training
Must use a qualified auditor to conduct onsite audits of foreign supplier
QA is a QI who has technical expertise to perform audit function obtained through education, training, or experience (or combination thereof)
But, must have at least some actual audit experience
May be a government employee or audit agent of an accredited third-party certification body

36. Reliance on Other Entities
May rely on another entity for certain tasks:
Hazard analysis
Evaluation of food and foreign supplier (not foreign supplier)
Verification activities (not foreign supplier, except for sampling/testing of food)
Importer must review and assess documentation, and document its review and assessment (including documenting that the task was done by a qualified individual)
Only the importer may approve foreign suppliers

37. Exemptions Food imported for research or evaluation
Food imported for transshipment
Food imported for processing and future export
US food returned without further manufacturing/processing
Meat, poultry, and egg products subject to USDA jurisdiction

38. Exemptions
If importer is also a “receiving facility” under Preventive Controls rule and is in compliance with supply-chain program requirements, it is deemed to be in compliance with FSVP rule
Importer still subject to requirement to identify FSVP importer at time of entry

39. Not Exempt
Imports where importer and foreign supplier are part of same corporate family
But, may take this into account in evaluating food and foreign supplier performance and in determining appropriate foreign supplier verification activities

40. Modified Requirements
Food imported by a very small importer
<$1 million in average annual sales of human food plus market value of human food manufactured, processed, packed, or held without sale

41. Modified Requirements
Very small importer must:
Annually document eligibility
Obtain written assurance (before importing food and every 2 years thereafter) from foreign supplier that producing food with same level of public health protection as FD&C Act and that food is not adulterated or misbranded with regard to allergen labeling
Not required: hazard analysis, evaluation of food and foreign supplier performance, foreign supplier verification activities

42. Modified Requirements
Food imported from the following small foreign suppliers:
Qualified facility as defined in Preventive Controls rule (includes a very small business, i.e., a business with <$1 million in average annual sales of human food);
Farm that grows produce and that is not a covered farm under the Produce Safety rule (e.g., <$25,000 in average annual sales) or that has a qualified exemption; or
Shell egg producer with < 3,000 laying hens

43. Modified Requirements
Importer must:
Annually document eligibility of foreign supplier
Obtain written assurance (before importing food and every 2 years thereafter) from foreign supplier – content of written assurance depends on type of small foreign supplier
Not required: hazard analysis, foreign supplier verification activities

44. Modified Requirements
Certain food imported from a foreign supplier in a country whose food safety system FDA has officially recognized as comparable or equivalent
Systems recognition agreement
Applies only to food that will not be processed further (e.g., finished packaged food, RACs that will not be commercially processed)

45. Modified Requirements
Importer must document (before importing food and annually thereafter) that:
Foreign supplier is under oversight of comparable or equivalent food safety system;
Food is within scope of official recognition or equivalence determination; and
Supplier is in good compliance standing with the foreign food safety authority
Not required: hazard analysis, evaluation of food and foreign supplier performance, foreign supplier verification activities

46. Compliance Dates Importers must comply by the latest of the following:
May 27, 2017 (18 months after final rule);
If foreign supplier is subject to Preventive Controls or Produce Safety, 6 months after foreign supplier is required to comply with the relevant rule; or
If importer is also a “receiving facility,” the date the importer is required to comply with the supply-chain program provisions of the Preventive Controls rule

47. Accreditation of third-party certification bodies

48. Accreditation Program
FDA will recognize accreditation bodies
Accreditation bodies (ABs) will accredit third-party certification bodies
Accredited third-party certification bodies (CBs) will audit foreign eligible entities and issue food and facility certifications

49. When Certification Required
Two situations:
FDA requires certification as an additional condition of admission under FD&C Act 801(q)
To be eligible to participate in VQIP, importer must have a current facility certification for each foreign supplier of food it intends to import under VQIP
Foreign suppliers and importers may also use accredited CBs to conduct audits under FSVP rule, but not required to

50. Audits
When performing audits under this program, an accredited CB must:
Perform facility audits unannounced (during a 30-day window)
Audit for compliance with FDA regulatory requirements, not GFSI or other benchmarked schemes
Notify FDA immediately if discover a condition that could cause or contribute to a serious risk to public health
Prepare audit report within 45 days after the audit

51. Regulatory Audits
Must be sufficiently rigorous to ensure entity likely to remain in compliance for at least 12 months after the audit
Audit report must be submitted to FDA electronically, regardless of whether a certification is issued
A certification may be issued only after a regulatory audit

52. Consultative Audits A food safety audit of an eligible entity:
To determine compliance with FDA requirements and industry standards and practices;
For internal purposes only; and
Conducted in preparation for a regulatory audit
Audit report must be maintained in records, not sent to FDA. FDA may access only under FD&C Act section 414 (based on reasonable belief food is adulterated and poses a risk of SAHCODHA).

53. Certifications Have a maximum term of 12 months
FDA may refuse to accept certification if agency determines it is not valid or reliable

54. FDA Notification Requirement
CB must notify FDA immediately if discovers a condition that could cause or contribute to a serious risk to public health
Requirement applies to both regulatory and consultative audits
But, because consultative audits must be unannounced and must be done in anticipation of a regulatory audit, an audit that does not meet this definition is not a “consultative audit” and is not subject to notification requirement

55. Effective Date Effective date is January 26, 2016
However, program will not launch until the final user fee rule takes effect
At that time, accreditation bodies may apply for FDA recognition
Third-party certification bodies may seek accreditation after one or more FDA-recognized accreditation bodies begin accepting applications

56. Voluntary Qualified Importer Program (VQIP)

57. VQIP VQIP draft guidance document (June 2015)
Explains how VQIP will work and how importers can qualify
A voluntary program

58. Definitions
“Importer” – The person who causes the food to be imported into the customs territory of the US
Can be importer of record, owner, manufacturer, etc.
“Foreign supplier” – Same definition as in FSVP rule
“Food” – Food as defined in FD&C Act, except excludes pesticides and food contact substances

59. Eligibility Criteria At least 3 year history of importing food
Current facility certification for each foreign supplier whose food importing under VQIP (by an accredited third-party certification body)
Annual non-refundable fee paid by Oct. 1
FDA estimates the annual fee will be $16,400
No food imported by the importer is the subject of an Import Alert or Class I recall

60. Eligibility Criteria (cont’d)
Importer and “non-applicant entities” may not be the subject of any ongoing FDA administrative or judicial action (e.g., Import Alert, injunction, debarment, suspension of registration) or have a history of significant non-compliances (e.g., Class I recall, OAI inspection with no corrective action).
Non-applicant entities – foreign supplier, FSVP or HACCP importer (if different than VQIP importer), customs broker

61. Eligibility Criteria (cont’d)
Importer may not be the subject of any CBP penalties, forfeitures, or sanctions related to safety or security of FDA-regulated products during preceding 3 years
FSVP or HACCP importer must be in compliance with importer requirements under those regulations
Importer must use paperless filers/brokers that have received a passing rating during their last FDA Filer Evaluation

62. Eligibility Criteria (cont’d)
Importer must have a Quality Assurance Program (QAP), including:
A corporate policy statement on food safety and security throughout supply chain;
Training/experience requirements for employees;
Food safety policies and procedures (including procedures for reporting to FDA foreign supplier non-compliance that poses a risk to public health);
Food defense policies and procedures;
QAP implementation procedures; and
Recordkeeping procedures and required records

63. Annual Application Process
Importer submits Notice of Intent between Jan. 1 and May 31
Importer submits application, copy of QAP, and labels of each food to be imported under VQIP to FDA
FDA will review application and usually inspect the importer
Importer must pay annual fee by Oct. 1
Importer must promptly amend application if removes a food, removes/replaces a foreign supplier, removes/adds a food label, updates QAP, removes/replaces a FSVP or HACCP importer, removes/adds a filer/broker, etc.
Importer identifies food as VQIP food at entry

64. Benefits of Participation
PREDICT screening system will recognize VQIP foods and immediately release, unless need to examine or sample for public health reasons
FDA will not examine or sample except “for cause,” surveillance assignment, or VQIP audit
If examine or sample shipment, FDA will do so at destination or other location chosen by importer
Any lab tests will be expedited “to extent possible”
If re-export necessary, FDA will work with CBP to export food from port preferred by importer
Also:
FDA Help Desk to answer questions.
FDA will post list of VQIP importers on its website, but free to opt out.

65. Concerns Costs may outweigh benefits GMA comments requested:
GMA estimates annual cost of participation at least $85,000 (annual fee plus cost of regulatory audits for 20 foreign suppliers)
GMA comments requested:
FDA issue May Proceed or notice of examination/sampling at least 5 days before shipment arrives in US
FDA should allow VQIP importer to choose lab
FDA should decrease frequency of inspections of foreign suppliers

66. THANK YOU Bob Hahn rhahn@ofwlaw.com