Supplier Approval Challenges Under FSMA

The Food Safety Modernization Act (FSMA) is posing many challenges for food manufacturers and those who supply ingredients to them.

As a food safety and regulatory consultant, I work with diverse clients who face many different challenges with Food Safety Modernization Act (FSMA) implementation. The ones that are the hardest to address fall into the intersection between company policy and regulatory requirements. Supply-chain approval is a major challenge for many larger corporate clients, as well as smaller clients who must remain flexible to maintain profitability. The requirements of the Foreign Supplier Verification Programs, or FSVPs, will soon add another layer as some compliance dates start as soon as May 30, 2017. The largest corporations have the earliest compliance dates, and although these organizations may have deep pockets they also have many facilities - which can present a major implementation challenge.

Implementation Issues

The first inkling of implementation issues came with the supply-chain requirements of 21 CFR 117 Subpart G. Consider the case of a large corporate entity which uses co-manufacturers to produce a branded product. These co-manufacturers package the product, but use a proprietary pre-mixed ingredient (provided by the corporate entity) to deliver the color and flavor to these products to maintain brand quality and consistency throughout the world. The color and flavor packages are dispensed at a pre-determined dosage, but the co-manufacturers are not privy to the corporate recipe by design. Some of these pre-mixed color and flavor packages contain restricted ingredients, such as Red No. 40 or Yellow No. 5. Because the co-manufacturers do not know what is in the packaged pre-mix, the FDA is concerned they may inadvertently deliver a harmful dosage of these regulated ingredients. This is considered a potential chemical hazard.

Arguments about whether this is a legitimately significant risk are moot as the FDA has already communicated their intent to regulate on this issue under FSMA. Extrapolating this issue to the larger community of branded corporate manufacturers that use co-packers or co-manufacturers, one begins to see the possibilities for regulatory issues to arise in many different industries. Under FSMA, the primary responsibility for records retention lies at the facility level. Records are considered to be stored on-site when they are accessible within 24 hours, so corporate storage may be fine in certain cases, but communication must be adequate to ensure the co-manufacturer will not be caught in a compromising position if this challenge is brought to their attention at 4:30 PM on a Friday (Pacific time).

Daunting Distributor Documentation

The next challenge predicted to affect companies large and small is presented by distributors such as Sysco. Under the law, distributors are merely brokers and not manufacturers. As such, documentation provided by the distributor is not acceptable unless it was generated by the original manufacturer and can be reviewed by the receiving facility. In a large Sysco warehouse, there can be over a million individual SKUs. Keeping documentation on every one of those products is a daunting proposition.

The other side to the broker/distributor coin is maintaining profitability. Maybe it is not an issue for a company like Sysco, but some smaller brokers do not want to identify their suppliers because their customers may choose to cut them out and go directly to the source. This is especially true in cases of expensive commodities like grapefruit cold pressed oil intended for use in flavors. A broker can make multiple dollars per kilo on a commodity like grapefruit oil, and if he is selling entire containers of oil the money is not insignificant. If the final customer is buying quantities close to those sold by the original supplier, the broker is in a difficult position. He cannot create the food safety paperwork himself as he is not the manufacturer, but if he gives away the paperwork of his supplier he may eliminate his own revenue stream, which is never a good idea. What is a scrupulous broker or distributor to do?

Foreign Supplier Verification Programs

A final challenge presents itself in the form of the Foreign Supplier Verification Programs, or FSVP. This has not yet received much press because the Preventive Controls regulations have been at the forefront of media coverage, but the FSVP will create a lot of work for regulators and industry alike. In a nutshell, the company that declares itself the FSVP Importer (on the Customs import paperwork) must maintain records to demonstrate the food was manufactured under food safety requirements and conditions equivalent to (or better than) those in the United States. This can be demonstrated by an on-site audit performed by a qualified auditor whose report is provided to the US company and reviewed by a qualified individual. For those counting along at home, that is three separate quality functions (performance of the audit, sending the paperwork from the foreign supplier to the US company buying the product, review of the documents at the customer site), each of which entails a salary that must be figured into the cost of the commodity being sold.

Another major challenge of the FSVP is that the FSVP Importer is not necessarily the same as the Customs Importer of Record (IOR). The IOR is typically the customs broker, or whomever is filling out the paperwork – if they are taking care of the shipment from a legal perspective they are doing all that’s required. The biggest requirement is filling out all the documentation correctly, with all the right codes, i’s dotted and t’s crossed. The FSVP Importer is arguably a more complex requirement, with documents that must be kept as records and maintained on file for a long time. The FDA will be making a database of all the companies that are declared as FSVP Importers on Customs import documents and sending electronic document requests to ensure they are completing their legal requirements.

The customs personnel must ensure they are educated on the implications of being the FSVP Importer. If they just put their own name in the box (well, their own Dun and Bradstreet number, which is what’s being used as importer ID for the time being) then they can expect a request from the FDA, asking for lots of food safety related paperwork and evidence of the paperwork’s review by a qualified individual either employed at or contracted by their company. If they take a short cut and put the customer’s DUNS number in the box without communicating to the customer that they need to take care of the FSVP requirements, they will have a very unhappy customer when the FDA sends the customer the electronic records request. Unhappy customers are usually not repeat customers, and repeat customers are the backbone of any successful business.

Spreading the FSVP Word

The challenge of effective communication is present in every industry in one form or another. How will the word be spread to the Customs brokers and foreign suppliers who need to be compliant with FSVP? Their customers should tell them, as it’s impossible for the FDA to reach out to the more than 180,000 registered facilities and tell each of them exactly what they need to do.

The beauty of capitalism is that each business develops into its own specific niche, filling a need of its own customers and customizing business practices based on locale, supply and demand. It would be impossible to write a regulation that addressed every possible permutation of business, not only within the 50 United States but also throughout the world beyond. Just as with the advent of GFSI-approved food safety schemes, compliance with the FSVP will be driven largely by customer demand in the short term. Long term compliance activities will depend largely on enforcement actions pursued by the FDA.

Some small companies create their own niche by aggregating product from many smaller producers, creating larger lots and then presenting these for sale on the open market. If these companies want to sell their products in the United States, they will need to require a lot of records from each of these smaller producers, many of whom may not have the resources or the desire to comply with the FSVP. What will this mean for their business models? It’s important to remember that certain small or very small companies are exempt from some requirements of FSMA, or have later compliance dates. Refer to the chart below (populated with information provided by the FDA) to determine if you fall into an excepted category based on revenue or other factors.

All these supply chain requirements probably seem onerous and intimidating, especially to companies who have not traditionally dealt with maintaining FDA regulatory compliance. There are many individual consulting firms who can assist with preparation of written supplier approval programs, evaluation of supplier documentation and even performing on-site audits of foreign suppliers; however, the importance of ensuring the chosen consultant is qualified to be doing the work cannot be overstated. Anyone can hang out a shingle and call themselves an expert – ask for recommendations, examples of previous clients or other evidence to prove to yourself that the consultant can provide the required services.

Although the requirements of the FSVP are new, the process of FDA compliance is not. Many companies have been compliant with strict regulations for many years. It may be beneficial to bring some of this experience in-house, such as Juice or Seafood HACCP experts who have internalized the latest laws. Don’t hesitate to reach out for help – the time to phone a friend is long before the FDA is standing at the door.