President Obama signed the Food Safety Modernization Act (FSMA) into law on Jan. 4, 2011. The FSMA imposes several extensive new records requirements on food manufacturers and the effective date for some of the more significant new requirements (July 4, 2012) is approaching. The FSMA also gave the FDA additional work and responsibilities, but not additional resources. Based on public statements made by FDA officials, some people believe the FDA will not enforce the new requirements until a reasonable time after it has promulgated implementing regulations (a task on which it is currently behind). Nonetheless, non-exempt companies that manufacture, process, pack, or hold food should familiarize themselves with the new requirements and begin preparations to comply if they have not already done so.

One of the new sets of records requirements relates to hazard analysis and risk-based preventive controls (HARBPC) under Section 103 of the FSMA (21 U.S.C. Section 418). This section requires a food facility to "evaluate the hazards that could affect food manufactured, processed, packed, or held" by the facility, to "identify and implement preventive controls to significantly minimize or prevent the occurrence of such hazards," to "monitor the performance of those controls," and to "maintain records of this monitoring as a matter of routine practice." Section 103 expressly requires the facility to prepare a written plan analyzing the potential hazards and identifying the preventive controls adopted to address them. It also requires the facility to re-analyze potential hazards whenever there is a significant change in operations or every three years at a minimum. Finally, Section 103 requires the facility to maintain records of at least the following: (1) monitoring of the preventive controls implemented; (2) instances of non-conformance material to food safety; (3) testing and other appropriate means of verification; (4) instances when corrective actions were implemented; and, (5) the efficacy of preventive controls and corrective actions. The facility must retain the records for at least two years.

Importantly, Section 103 states that the facility must make all such records available to the FDA upon oral or written request. This is expected to add record audits to inspections of food facilities, which to date have been primarily observation-based. Indeed, the record audits may come to pre-dominate food facility inspections. 

Another important source of new record requirements is Section 301 of the FSMA (21 U.S.C. Section 805), titled "Foreign Supplier Verification Program." Section 301 requires each importer of food into the US to "perform risk-based foreign supplier verification activities for the purpose of verifying that the food imported" complies with US law. Section 301 requires the FDA to issue guidance and promulgate regulations that require an importer's verification program to "provide the same level of public health protection as those required" under Section 103 (discussed above) and another section of the FSMA. It also identifies potential verification activities that can be required, including (1) monitoring records for shipments, (2) lot-by-lot certification of compliance, (3) annual on-site inspections, (4) checking the foreign supplier's HARBPC plan, and (5) periodically testing and sampling shipments. Again, the FSMA requires that importers maintain records of their verification program, retain them for at least two years, and make them available to FDA upon request.

The FSMA required the FDA to issue the guidance and regulations regarding foreign supplier verification within one year. This is one of the FSMA deadlines that FDA has missed, creating some uncertainty as to when it will begin to enforce the requirements. In this instance, however, the statutory requirements do not take effect until Jan. 4, 2013.

Section 204 of the FSMA requires the FDA, in conjunction with the Department of Agriculture and certain State agencies, to establish pilot projects "to effectively and rapidly track and trace food that is in the United States or offered for import into the United States." In this connection, "to rapidly and effectively identify recipients of a food to prevent or mitigate a foodborne illness outbreak," Section 204 requires FDA within two years to "publish a notice of proposed rulemaking to establish recordkeeping requirements" for facilities that "manufacture, process, pack, or hold" foods designated by FDA as "high-risk foods." In another missed deadline, the FDA was to have designated the high-risk foods last January. In this case, the FDA can require the records to be retained for up to (rather than at least) two years.

As the dates for implementation of these new recordkeeping requirements approach, to the extent necessary covered food facilities should plan to conduct and document the necessary analyses, create the required plans, and implement the systems necessary to create, retain, store and retrieve the relevant records. During an FDA inspection, food facilities will want to demonstrate that their records are complete, organized, and readily accessible because, in the FDA's view, if there is no written record of an analysis, action, decision, plan, test or other required activity, then it did not happen. Further, covered facilities will want to train the relevant employees to ensure that the relevant records are created and retained with due emphasis on the importance of regulatory compliance and the potential penalties for non-compliance.