The Mitigation Strategies to Prevent Intentional Adulteration of Foods (21 CFR 121), one of the supporting regulations to the Food Safety Modernization Act (FSMA), was released as a draft in December 2013 and as a final rule on May 27, 2016. The regulation is designed to prevent the deliberate adulteration (adulteration) of food, including acts of terrorism, which can have widespread adverse public health consequences. According to the regulations, all food production companies selling in the United States must complete compliance by July 26, 2021 at the latest.
General Provisions
(1) Effective date
Effective Date: July 26, 2016.
Considering that some companies need more buffer time for transition, the regulation effective time is adjusted to:
Very small enterprises: can be implemented within 5 years after the regulations are issued, that is, before July 26, 2021;
Small businesses: can be implemented within 4 years after the regulation is issued, that is, before July 26, 2020;
General enterprises: must be implemented within 3 years after the regulations are issued, that is, before July 26, 2019.
As of now, all food manufacturers (except exempt) are required to establish and operate a food defense plan.
(2) Scope of application
Applicable to domestic and foreign food production, processing, packaging, and storage companies that require registration under Section 415 of the Federal Food, Drug, and Cosmetic Act (FD&C Act) for products sold and used in the United States, except for exemptions.
The following situations are exempt:
1. Very small businesses;
2. Enterprises that store food, except for liquid storage tank enterprises;
3. Packaging, repackaging, labeling, or relabeling, etc., that do not cause any changes in containers that come into direct contact with food;
4. Farms subject to the provisions of Section 419 of the FD&C (Product Safety Standards Regulations);
5. Alcoholic beverage enterprises that meet certain conditions;
6. Enterprises that produce, process, pack or store animal food;
7. An on-farm hybrid business is an on-farm production, processing, packaging, or storage of the following foods that complies with the low-risk activity requirements of FD&C Section 418 and is operated by small and very small businesses :
(1) Eggs (in the shell, except for unprocessed agricultural products such as pasteurized);
(2) Game (whole or cut, not ground or shredded, without auxiliary ingredients).
food defense measures
The regulations stipulate that food defense measures must include the following eight aspects:
►►►
(1) Food Defense Plan
Regulatory requirements require business owners, operators, and agents to implement a written food defense plan.
A written food defense plan must include:
(1) A written vulnerability assessment conducted to identify significant vulnerabilities and actionable process segments (APS), including necessary descriptions, subject to the requirements of § 121.130(c);
(2) A written mitigation strategy, including the necessary instructions, must comply with the requirements of §121.135(b);
(3) Written monitoring procedures for implementing mitigation strategies, subject to the requirements of §121.140(a);
(4) Written food defense correction procedures, subject to the requirements of § 121.145(a)(1);
(5) Written food defense verification procedures, subject to the requirements of §121.150(b).
Records: Food Defense Program records shall meet the requirements of Part D of this regulation.
►►►
(2) Identification of significant weaknesses and vulnerability assessment of APS
Establishments are required to conduct vulnerability assessments using appropriate methods for each point, step and procedure in the processing, handling, packaging or storage of each type of food produced in the facility to identify vulnerabilities and APS. The evaluation process requires an assessment of a minimum of the following factors:
(1) The degree of potential harm to public health after product contamination (e.g. severity and scale of impact);
(2) The degree of accessibility to the product;
(3) The ability of the attacker to successfully contaminate the product.
The assessment must also take into account the possibility of insider attacks.
Regardless of the outcome of the assessment, a written vulnerability assessment report is ultimately required and must include reasons for confirming that each point, step or procedure is an APS.
►►►
(3) Actionable mitigation strategies
Enterprises develop and implement mitigation strategies for each vulnerable link to minimize or eliminate risks in significant vulnerabilities and ensure that the food the enterprise produces, processes or stores is not adulterated (see Federal Food, Drug and Cosmetic Act). ” Section 402). Each mitigation strategy for APS needs to describe how it effectively reduces or prevents the risk of significant vulnerabilities. Mitigation strategies and corresponding explanations must be in writing.
►►►
(IV) Mitigation strategy management elements
Considering the nature of each mitigation strategy and its role in the facility's food defense plan, the mitigation strategies required by §121.135 include the following management elements to ensure that appropriate mitigation strategies can be effectively implemented.
(1) Monitoring of food defense, consistent with the requirements of § 121.140;
(2) The correction of food protection is consistent with the requirements of § 121.145;
(3) Verification of food defense, consistent with the requirements of § 121.150.
►►►
(5) Food protection monitoring
Depending on the nature of the mitigation strategy and its role in the food defense system, the requirements are as follows:
(1) Written procedures. Require establishments to develop and implement written procedures, including the frequency of monitoring the implementation of food defense mitigation strategies;
(2) Monitoring of food protection. Enterprises will be required to implement sufficient frequency monitoring to ensure that mitigation strategies can continue to be implemented;
(3) Records. Food Defense Requirements for Monitoring documents. All monitoring activities for targeted actions must be documented, verified as required by §121.150(a)(1), and reviewed as required by §121.150(a)(3)(i). Normal records indicate that the mitigation strategy was implemented effectively, and abnormal records indicate that in some cases the mitigation strategy was not implemented as effectively and sufficiently as expected.
►►►
(6) Corrective measures for food protection
1. Corrective action procedures for food defense.
According to the nature and characteristics of the process links and mitigation strategies that can be taken:
(1) Written corrective actions for food defense shall be established and implemented.
(2) Corrective action procedures for food defense shall describe steps to be implemented to ensure:
(i) Take appropriate action to identify and correct problems that arise during the implementation of the mitigation strategy.
(ii) Take appropriate measures as necessary to reduce the likelihood of the problem recurring.
2. Record. All food defense corrective actions implemented pursuant to this section shall be documented and verified pursuant to § 121.150(a)(2) and audited pursuant to 121.150(a)(3)(i).
►►►
(7) Food Protection Verification
1. Food defense verification activities.
Food defense verification activities need to be consistent with the characteristics of the mitigation strategy and its role in the facility's food defense system, and must include the following:
(1) Whether food defense monitoring activities are conducted in accordance with the requirements of §121.138. (must also comply with §121.140);
(2) Are appropriate food defense corrective actions established in accordance with the requirements of §121.138. (must also comply with §121.145);
(3) Verify that mitigation strategies are effectively implemented and significantly reduce or prevent significant vulnerabilities. To this end, the following activities need to be carried out according to the company's actual situation, food characteristics, mitigation strategies and their role in the company's food defense system:
(i) Review food defense monitoring and corrective records for an appropriate period of time to ensure that records are complete, that the activities reflected in the records are consistent with the Food Defense plan, that mitigation strategies were properly implemented, and that appropriate food defense corrective actions were taken;
(ii) other verification activities to verify the effectiveness of mitigation strategies;
(4) Validation of reanalysis performed in accordance with §121.157.
2. Written procedure.
A written verification procedure, including the frequency of verification, must be established and implemented in accordance with §121.150(a)(3)(ii).
3. Record keeping.
All verification activities conducted in accordance with this section must be documented.
►►►
(8) Reanalysis
1. Re-analyze the entire Food Defense Program at least every 3 years;
2. The entire Food Defense Plan, or an applicable portion of the Food Defense Plan, must be reanalyzed when:
(1) once there is a significant change in the activities carried out by the factory, there may be new weak links or there is a risk of a significant increase in the previously identified weak links;
(2) As soon as new information becomes known about potential vulnerabilities related to food production or facilities;
(3) once one or more mitigation strategies are identified, or the food defense plan is not properly implemented;
(4) once FDA requests a reanalysis to address new vulnerabilities, known threats to the food supply chain, and new scientific insights including biological, chemical, radiological, or other terrorism risk assessment reports by the Department of Homeland Security .
3. A reanalysis and mitigation strategies for significant weaknesses must be performed in accordance with (a) and (b) of this section if:
(1) before the change in corporate activities (including mitigation strategies) becomes effective;
(2) within 90 days after production if necessary;
(3) within a reasonable time period. For the first production, if the reanalysis is carried out after 90 days after production, a reasonable written explanation shall be provided.
4. If significant changes in factory activities have created new potential weak link risks, or the risks of previously identified weak links have significantly increased, the written food defense plan needs to be revised. If it is concluded that no revision is required, the relevant basis should be recorded.
Records that must be established and maintained
►►►
(1) General requirements
Records must:
(1) Preservation as original records, true copies (such as photocopies, pictures, scans, microfilms, microfilms, or other accurate reproductions of original records) or electronic records;
(2) contains actual values and observations obtained during food defense monitoring;
(3) Accurate, indelible and legible;
(4) Created concurrently with the execution of the recorded activity;
(5) provide a historical record of the work performed in as much detail as possible;
(6) Including:
① Information sufficient to identify the facility (for example: the name of the facility and, if necessary, the location of the facility);
② Record the date and time of the activity (if applicable);
③ The signature or initials of the person performing the activity;
④ Wher appropriate, the identification and batch number of the product (if any).
(7) Records created or maintained as required by Regulation 121 are exempt from the provisions of the Code of Federal Regulations, Electronic Records (21 CFR 11), even if they meet the definition of electronic records in §11.3(b)(6). However, if a record meets the requirements of Regulation 121 and also meets other applicable legal or regulatory requirements, it shall still comply with the provisions of Regulation 21 CFR 11.
►►►
(ii) Additional Requirements Applicable to Food Defense Programs
A food defense record should be issued, signed and dated by the owner, operator or representative of the business when:
(1) Before the first implementation;
(2) After modification
►►►
(3) Record Retention Requirements
1. Enterprises must keep all relevant records in the factory for at least two years. If an enterprise needs 3 years of records to prove that its scale is a small enterprise, it must keep the relevant records in the factory for a long time to prove its scale.
2. The expired enterprise food defense plan must be kept for at least 2 years.
3. In addition to the food defense plan, records stored outside the factory area can also be used as records management objects if they can be provided on-site within 24 hours during official inspections. The food defense plan must be kept at the facility. Electronic records that can be provided on-site should also be the object of record management.
4. If the factory facility is closed for a long time and the food defense plan is transferred to other places outside the factory, the enterprise must bring the food defense plan back to the factory within 24 hours when it is officially requested.
Compliance
(1) Owners, operators, or agents of food production, processing, packaging, and storage businesses whose products are sold in the U.S. market shall comply with Part 418 of the Federal Food, Drug, and Cosmetic Act or Parts C and D of this regulation , otherwise, would violate Section 301(uu) of the Federal Food, Drug, and Cosmetic Act.
(2) Failure to comply with Part 420 of the Federal Food, Drug, and Cosmetic Act or Parts C and D of this regulation will violate the provisions of Section 301(ww) of the Federal Food, Drug, and Cosmetic Act.
Source: 12360 Customs Hotline
