Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food

AGENCY:

Food and Drug Administration, HHS.

ACTION:

Final rule.

SUMMARY:

The Food and Drug Administration (FDA or we) is amending our regulation for Current Good Manufacturing Practice In Manufacturing, Packing, or Holding Human Food in two fundamental ways. First, we are modernizing the long-standing current good manufacturing practice requirements. Second, we are adding requirements for domestic and foreign facilities that are subject to our regulation for Registration of Food Facilities to establish and implement hazard analysis and risk-based preventive controls for human food. We also are revising certain definitions in our regulation for Registration of Food Facilities to clarify the scope of the exemption from registration requirements provided for “farms” and, in so doing, to clarify which domestic and foreign facilities are subject to the requirements for hazard analysis and risk-based preventive controls for human food. We are taking this action as part of our announced initiative to revisit the current good manufacturing practice requirements since they were last revised in 1986 and to implement new statutory provisions in the FDA Food Safety Modernization Act. The rule is intended to build a food safety system for the future that makes modern, science- and risk-based preventive controls the norm across all sectors of the food system.

DATES:

This rule is effective November 16, 2015, except for the amendment to part 110 in instruction 13, which is effective September 17, 2018 and paragraph (2) of the definition of “qualified auditor” in § 117.3, and §§ 117.5(k)(2), 117.8, 117.405(a)(2), 117.405(c), 117.410(d)(2)(ii), 117.430(d), 117.435(d), 117.475(c)(2) and 117.475(c)(13). FDA will publish a document in the Federal Register announcing the effective dates of paragraph (2) of the definition of “qualified auditor” in § 117.3, and §§ 117.5(k)(2), 117.8, 117.405(a)(2), 117.405(c), 117.410(d)(2)(ii), 117.430(d), 117.435(d), 117.475(c)(2), and 117.475(c)(13). See section LVI for the compliance dates.

FOR FURTHER INFORMATION CONTACT:

Jenny Scott, Center for Food Safety and Applied Nutrition (HFS-300), Food and Drug Administration, 5100 Paint Branch Pkwy., College Park, MD 20740, 240-402-2166.

SUPPLEMENTARY INFORMATION:

Table of Contents

Executive Summary

Purpose and Coverage of the Rule

Summary of the Major Provisions of the Rule

Costs and Benefits

I. Background

A. FDA Food Safety Modernization Act

B. Stages in the Rulemaking for the Human Preventive Controls Rule

C. Summary of the Major Provisions of Proposed Human Preventive Controls Rule

D. Draft Risk Assessment

E. Definition of “Retail Food Establishment”

F. Public Comments

II. Legal Authority

A. Changes to Current 21 CFR Part 1, Subparts H, I, and J

B. Changes to Current 21 CFR Part 110

C. Hazard Analysis and Risk-Based Preventive Controls

D. Comments on Legal Authority

III. General Comments on the Proposed Rule

IV. Comments on Proposed Revisions to the Definitions in the Section 415 Registration Regulations (21 CFR Part 1, Subpart H) and the Section 414 Recordkeeping Regulations (21 CFR Part 1, Subpart J)

A. Definitions That Impact a Determination of Whether an Establishment Is a “Farm”

B. Proposed Revisions to the Definition of Farm

C. Proposed New Definition of Harvesting

D. Proposed Revision to the Definition of Holding

E. Proposed Revision to the Definition of Manufacturing/Processing

F. Proposed New Definition of Mixed-Type Facility

G. Proposed Revision to the Definition of Packing

V. Comments on the Organizing Principles for How the Status of a Food as a Raw Agricultural Commodity or as a Processed Food Affects the Requirements Applicable to a Farm Under Sections 415 and 418 of the FD&C Act

VI. Rulemaking Required by Section 103(c) of FSMA: On-Farm Activities

A. Section 103(c)(1)(C) of FSMA

B. Comments on Qualitative Risk Assessment of On-Farm Activities Outside of the Farm Definition

C. Comments Regarding an Exemption for Small and Very Small Farm Mixed-Type Facilities Under Section 421 of the FD&C Act

VII. Comments on Proposed General Revisions to Current Part 110 (Final Part 117)

A. Title of Part 117

B. Proposed Revisions for Consistency of Terms

C. Proposed Additions Regarding Allergen Cross-Contact

D. Proposed Revisions for Consistency With the Definition of “Food”

E. Proposed Revisions To Address Guidance in Current Part 110

F. Proposed Editorial Changes

G. General Comments on Current Part 110 (Final Part 117)

VIII. Subpart A: Comments on Proposed § 117.1—Applicability and Status

A. Comments on Proposed § 117.1(a)—Applicability

B. Comments on Proposed § 117.1(b)—Prohibited Act

C. Comments on Proposed § 117.1(c)—Specific CGMP Requirements

IX. Subpart A: Comments on Proposed § 117.3—Definitions

A. Redesignation

B. Definitions in Current Part 110 That We Proposed To Delete

C. Definitions That We Proposed To Establish in Part 117

D. Comments Asking FDA To Establish Additional Definitions or Otherwise Clarify Terms Not Defined in the Rule

E. Additional Definitions To Clarify Terms Not Defined in the Proposed Rule

X. Subpart A: Comments on Qualifications of Individuals Who Manufacture, Process, Pack, or Hold Food

A. Applicability and Qualifications of All Individuals Engaged in Manufacturing, Processing, Packing, or Holding Food (Final § 117.4(a), (b), and (d))

B. Additional Requirements Applicable to Supervisory Personnel (Final § 117.4(c))

XI. Subpart A: Comments on Proposed § 117.5—Exemptions

A. General Comments on the Proposed Exemptions

B. Proposed § 117.5(a)—Exemption Applicable to a Qualified Facility

C. Proposed § 117.5(b) and (c)—Exemptions Applicable to Food Subject to HACCP Requirements for Fish and Fishery Products (21 CFR Part 123) or for Juice (21 CFR Part 120)

D. Proposed § 117.5(d)—Exemption Applicable to Food Subject to Part 113—Thermally Processed Low-Acid Foods Packaged In Hermetically Sealed Containers

E. Proposed § 117.5(e)—Exemption Applicable to a Facility That Manufactures, Processes, Packages, or Holds a Dietary Supplement

F. Proposed § 117.5(f)—Exemption Applicable to Activities Subject to Standards for Produce Safety in Section 419 of the FD&C Act

G. Proposed §§ 117.5(g) and (h)—Exemptions Applicable to On-Farm Low-Risk Activity/Food Combinations Conducted by a Small or Very Small Business

H. Proposed § 117.5(i)—Exemption Related to Alcoholic Beverages

I. Proposed § 117.5(j)—Exemption Applicable to Facilities Solely Engaged in Storage of Raw Agricultural Commodities Other Than Fruits and Vegetables Intended for Further Distribution or Processing

J. Proposed § 117.5(k)—Exemption Applicable to Farms, Fishing Vessels, Activities of “Farm Mixed-Type Facilities” Within the Definition of “Farm,” the Holding or Transportation of One or More Raw Agricultural Commodities, and Specified Activities Conducted on Specified Raw Agricultural Commodities

K. Comments Requesting Additional Exemptions

XII. Subpart A: Comments on Proposed § 117.7—Applicability of Part 117 to a Facility Solely Engaged in the Storage of Unexposed Packaged Food

XIII. Subpart B: Comments on Proposed § 117.10—Personnel

A. Management Responsibility for Requirements Applicable to Personnel

B. Proposed § 117.10(a)—Disease Control

C. Proposed § 117.10(b)—Cleanliness

XIV. Subpart B: Comments on Proposed § 117.20—Plant and Grounds

A. Proposed § 117.20(a)—Grounds

B. Proposed § 117.20(b)—Plant Construction and Design

XV. Subpart B: Comments on Proposed § 117.35—Sanitary Operations

A. Proposed § 117.35(a)—General Maintenance

B. Proposed § 117.35(b)—Substances Used in Cleaning and Sanitizing; Storage of Toxic Materials

C. Proposed § 117.35(c)—Pest Control

D. Proposed § 117.35(d)—Sanitation of Food-Contact Surfaces

E. Proposed § 117.35(d)(1)—Food-Contact Surfaces Used for Manufacturing/Processing or Holding

F. Proposed § 117.35(d)(2)—Wet Cleaning

G. Proposed § 117.35(d)(3)—Single-Service Articles

H. Proposed § 117.35(e)—Sanitation of Non-Food-Contact Surfaces

I. Proposed § 117.35(f)—Storage and Handling of Cleaned Portable Equipment and Utensils

XVI. Subpart B: Comments on Proposed § 117.37—Sanitary Facilities and Controls

A. Proposed § 117.37(a)—Water Supply

B. Proposed § 117.37(b)—Plumbing

C. Proposed § 117.37(c)—Sewage Disposal

D. Proposed § 117.37(d)—Toilet Facilities

E. Proposed § 117.37(e)—Hand-Washing Facilities

XVII. Subpart B: Comments on Proposed § 117.40—Equipment and Utensils

A. Proposed § 117.40(a)—Design, Construction, Use, Installation, and Maintenance of Equipment and Utensils

B. Proposed § 117.40(b)—Seams on Food-Contact Surfaces

C. Proposed § 117.40(c)—Construction of Equipment

D. Proposed § 117.40(d)—Holding, Conveying, and Manufacturing Systems

E. Proposed § 117.40(e)—Freezer and Cold Storage Compartments

F. Proposed § 117.40(f)—Accurate and Precise Instruments and Controls

G. Proposed § 117.40(g)—Compressed Air or Other Gases

XVIII. Subpart B: Comments on Proposed § 117.80(a)—General Processes and Controls

A. Proposed § 117.80(a)(1)—Adequate Sanitation Principles

B. Proposed § 117.80(a)(2)—Quality Control Operations

C. Proposed § 117.80(a)(3)—Supervision of Overall Sanitation

D. Proposed § 117.80(a)(4)—Production Procedures

E. Proposed § 117.80(a)(5)—Chemical, Microbial, or Extraneous-Material Testing Procedures

F. Proposed § 117.80(a)(6)—Contaminated Food

XIX. Subpart B: Comments on Proposed § 117.80(b)—Processes and Controls for Raw Materials and Other Ingredients

A. Proposed § 117.80(b)(1)—Inspection, Segregation and Handling of Raw Materials and Other Ingredients

B. Proposed § 117.80(b)(2)—Levels of Microorganisms in Raw Materials and Other Ingredients

C. Proposed § 117.80(b)(3)—Natural Toxins in Raw Materials and Other Ingredients

D. Proposed § 117.80(b)(4)—Pests, Undesirable Microorganisms and Extraneous Materials in Raw Materials and Other Ingredients

E. Proposed § 117.80(b)(5)—Holding Raw Materials, Other Ingredients, and Rework in Bulk

F. Proposed § 117.80(b)(7)—Liquid or Dry Raw Materials and Other Ingredients

G. Proposed § 117.80(b)(8)—Raw Materials and Other Ingredients That Are Food Allergens

XX. Subpart B: Comments on Proposed § 117.80(c)—Manufacturing Operations

A. Proposed § 117.80(c)(1)—Condition of Equipment, Utensils, and Finished Food Containers

B. Proposed § 117.80(c)(2)—Conditions and Controls for Food Manufacturing, Processing, Packing, and Holding

C. Proposed § 117.80(c)(3)—Food That Can Support the Rapid Growth of Undesirable Microorganisms

D. Proposed § 117.80(c)(4)—Measures To Destroy or Prevent the Growth of Undesirable Microorganisms

E. Proposed § 117.80(c)(5)—Work-in-Process and Rework

F. Proposed § 117.80(c)(6)—Finished Food

G. Proposed § 117.80(c)(7)—Equipment, Containers, and Utensils

H. Proposed § 117.80(c)(8)—Metal or Other Extraneous Material

I. Proposed § 117.80(c)(9)—Disposal of Adulterated Food, Raw Materials, and Other Ingredients

J. Proposed § 117.80(c)(10)—Performing Manufacturing Steps

K. Proposed § 117.80(c)(11)—Heat Blanching and Growth and Contamination by Thermophilic Microorganisms During Manufacturing Operations

L. Proposed § 117.80(c)(12)—Batters, Breading, Sauces, Gravies, Dressings, and Other Similar Preparations

M. Proposed § 117.80(c)(13)—Filling, Assembling, Packaging and Other Operations

N. Proposed § 117.80(c)(14)—Food That Relies on the Control of Water Activity for Preventing the Growth of Undesirable Microorganisms

O. Proposed § 117.80(c)(15)—Food That Relies on the Control of pH for Preventing the Growth of Undesirable Microorganisms

P. Proposed § 117.80(c)(16)—Requirements for Ice Used in Contact With Food

Q. Proposed Deletion of Current § 110.80(b)(17)—Food-Manufacturing Areas and Equipment

XXI. Subpart B: Comments on Proposed § 117.93—Warehousing and Distribution

XXII. Subpart B: Comments on Proposed § 117.110—Natural or Unavoidable Defects in Food for Human Use That Present No Health Hazard

XXIII. Subpart C: Comments on Overall Framework for Hazard Analysis and Risk-Based Preventive Controls

XXIV. Subpart C: Comments on Proposed § 117.126—Food Safety Plan

A. Proposed § 117.126(a)(1)—Requirement for a Food Safety Plan

B. Proposed § 117.126(a)(2)—Preparation of the Food Safety Plan by a Preventive Controls Qualified Individual

C. Proposed § 117.126(b)—Contents of a Food Safety Plan

D. Proposed § 117.126(c)—Records

E. Comments on Potential Requirements for Submission of a Facility Profile to FDA

XXV. Subpart C: Comments on Proposed § 117.130—Hazard Analysis

A. Proposed § 117.130(a)—Requirement for a Written Hazard Analysis

B. Proposed § 117.130(b)—Hazard Identification

C. Proposed § 117.130(c)—Evaluation of Whether a Hazard Requires a Preventive Control

XXVI. Subpart C: Comments on Proposed § 117.135—Preventive Controls

A. Proposed § 117.135(a)—Requirement To Identify and Implement Preventive Controls

B. Proposed § 117.135(b)—Requirement for Written Preventive Controls

C. Proposed § 117.135(c)(1)—Process Controls

D. Proposed § 117.135(c)(2)—Food Allergen Controls

E. Proposed § 117.135(c)(3)—Sanitation Controls

F. Proposed § 117.135(c)(4)—Supply-Chain Controls

G. Proposed § 117.135(c)(5)—Recall Plan

H. Proposed § 117.135(c)(6)—Other Controls

XXVII. Subpart C: Circumstances in Which the Owner, Operator, or Agent in Charge of a Manufacturing/Processing Facility Is Not Required To Implement a Preventive Control (Final §§ 117.136 and 117.137)

XXVIII. Subpart C: Comments on Proposed Requirements for a Recall Plan (Final § 117.139)

A. Proposed § 117.137(a)—Requirement for a Written Recall Plan (Final § 117.139(a))

B. Proposed § 117.137(b)—Procedures That Describe the Steps To Be Taken, and Assign Responsibility for Taking Those Steps (Final § 117.139(b))

XXIX. Comments on Proposed § 117.140—Preventive Control Management Components

A. Proposed § 117.140(a)—Flexible Requirements for Monitoring, Corrective Actions and Corrections, and Verification

B. Proposed § 117.140(b)—Applicability of Preventive Control Management Components to the Supply-Chain Program

C. Proposed § 117.140(c)—Recall Plan is Not Subject to Preventive Control Management Components

XXX. Subpart C: Comments on Proposed § 117.145—Monitoring

A. Our Tentative Conclusion To Require Monitoring of the Performance of Preventive Controls

B. Proposed § 117.145(a)—Flexibility in Requirements for Monitoring

C. Proposed § 117.145(b)—Records

XXXI. Subpart C: Comments on Proposed § 117.150—Corrective Actions and Corrections

A. Proposed § 117.150(a)(1)—Requirement To Establish and Implement Corrective Action Procedures

B. Proposed § 117.150(a)(2)—Content of Corrective Action Procedures

C. Proposed § 117.150(b)—Corrective Action in the Event of an Unanticipated Problem

D. Proposed § 117.150(c)—Corrections

E. Proposed § 117.150(d)—Records

XXXII. Subpart C: Comments on Proposed § 117.155—Verification

A. Flexibility in Requirements for Verification

B. Proposed § 117.155(a)—Verification Activities

C. Proposed § 117.155(b)—Documentation of Verification Activities

D. Comments on Potential Requirements Regarding Complaints

XXXIII. Subpart C: Comments on Proposed § 117.160—Validation

A. Flexibility in the Requirements To Validate Preventive Controls

B. Proposed § 117.160(b)(1)—When Validation Must Be Performed and Role of the Preventive Controls Qualified Individual in Validation

C. Proposed § 117.160(b)(2)—What Validation Must Include

D. Proposed § 117.160(b)(3)—Preventive Controls for Which Validation Is Not Required

XXXIV. Subpart C: Comments on Proposed § 117.165—Verification of Implementation and Effectiveness

A. Flexibility in the Requirements To Conduct Activities To Verify Implementation and Effectiveness

B. Proposed § 117.165(a)(1)—Calibration

C. Comments Directed to Proposed Requirements for Both Product Testing (Proposed § 117.165(a)(2) and (b)(2)) and Environmental Monitoring (Proposed § 117.165(a)(3) and (b)(3))

D. Proposed § 117.165(a)(2)—Product Testing

E. Proposed § 117.165(a)(3)—Environmental Monitoring

F. Proposed § 117.165(a)(4)—Review of Records

G. Proposed § 117.165(b)—Written Procedures

XXXV. Subpart C: Comments on Proposed § 117.170—Reanalysis

A. Proposed § 117.170(a)—Circumstances Requiring Reanalysis

B. Proposed § 117.170(b)—Timeframe To Complete Reanalysis

C. Proposed § 117.170(c)—Requirement To Revise the Written Food Safety Plan or Document Why Revisions Are Not Needed

D. Proposed § 117.170(d)—Requirement for Oversight of Reanalysis by a Preventive Controls Qualified Individual

E. Proposed § 117.170(e)—Reanalysis on the Initiative of FDA

XXXVI. Subpart C: Comments on Proposed § 117.180—Requirements Applicable to a Preventive Controls Qualified Individual and a Qualified Auditor

A. Proposed § 117.180(a) and (b)—What a Preventive Controls Qualified Individual or Qualified Auditor Must Do or Oversee

B. Proposed § 117.180(c)—Qualification Requirements

C. Proposed § 117.180(d)—Records

XXXVII. Subpart C: Comments on Proposed § 117.190—Implementation Records

A. Proposed § 117.190(a)—List of Required Records

B. Proposed § 117.190(b)—Applicability of Subpart F

XXXVIII. Subpart D: Comments on Proposed § 117.201—Modified Requirements That Apply to a Qualified Facility

A. Comments on Submission of a Certification Statement

B. General Comments on Modified Requirements That Apply to a Qualified Facility

C. Proposed § 117.201(a)—Documentation To Be Submitted

D. Proposed § 117.201(b)—Procedure for Submission

E. Proposed § 117.201(c)—Frequency of Determination and Submission

F. Proposed § 117.201(d)—Notification to Consumers (Final § 117.201(e))

G. Proposed § 117.201(e)—Records (Final § 117.201(f))

XXXIX. Subpart D: Comments on Proposed § 117.206—Modified Requirements That Apply to a Facility Solely Engaged in the Storage of Unexposed Packaged Food

A. Proposed § 117.206(a)—Modified Requirements for Unexposed Refrigerated Packaged Food That Requires Time/Temperature Controls

B. Proposed § 117.206(b)—Records

XL. Subpart E: Comments on Proposed New Provisions for Withdrawal of a Qualified Facility Exemption

A. Proposed § 117.251—Circumstances That May Lead FDA To Withdraw a Qualified Facility Exemption

B. Proposed § 117.254—Issuance of an Order To Withdraw a Qualified Facility Exemption

C. Proposed § 117.257—Contents of an Order To Withdraw a Qualified Facility Exemption

D. Proposed § 117.260—Compliance With, or Appeal of, an Order To Withdraw a Qualified Facility Exemption

E. Proposed § 117.264—Procedure for Submitting an Appeal

F. Proposed § 117.267—Procedure for Requesting an Informal Hearing

G. Proposed § 117.270—Requirements Applicable to an Informal Hearing

H. Proposed § 117.287—Reinstatement of a Qualified Facility Exemption That Was Withdrawn

I. Conforming Amendment to 21 CFR part 16

J. Other Comments on the Withdrawal Provisions

XLI. Subpart F: Comments on Proposed New Recordkeeping Requirements

A. Proposed § 117.301—Records Subject to the Requirements of Subpart F

B. Proposed § 117.305—General Requirements Applying to Records

C. Proposed § 117.310—Additional Requirements Applying to the Food Safety Plan

D. Proposed § 117.315—Requirements for Record Retention

E. Proposed § 117.320—Requirements for Official Review

F. Proposed § 117.325—Public Disclosure

G. Proposed § 117.330—Use of Existing Records

H. Final § 117.335—Special Requirements Applicable to a Written Assurance

I. Other Comments on the Recordkeeping Requirements of Subpart F

XLII. Subpart G: General Comments on Proposed Requirements for a Supply-Chain Program

XLIII. Subpart G: Comments on Requirement To Establish and Implement a Supply-Chain Program

A. Requirement for a Written Supply-Chain Program (Final § 117.405(a)(1) and (b))

B. Circumstances That Do Not Require a Written Supply-Chain Program (Final § 117.405(a)(2))

C. Exemption for Food Supplied for Research or Evaluation (Final § 117.405(a)(3))

D. Additional Requirements for Non-Suppliers (Final § 117.405(c))

E. Proposed General Requirements for the Supply-Chain Program That We Are Not Including in the Final Rule (Proposed § 117.136(a)(4) and (5))

XLIV. Subpart G: Comments on General Requirements Applicable to a Supply-Chain Program

A. Description of What the Supply-Chain Program Must Include (Final § 117.410(a))

B. Appropriate Supplier Verification Activities ((Final § 117.410(b))

C. Purpose of Supplier Verification Activities for Raw Materials and Other Ingredients (Final § 117.410(c))

D. Factors That Must Be Considered When Approving Suppliers and Determining Appropriate Supplier Verification Activities for Raw Materials and Other Ingredients (Final § 117.410(d))

E. Supplier Non-Conformance (Final § 117.410(e))

XLV. Subpart G: New Requirement Specifying Responsibilities of the Receiving Facility (Final § 117.415)

XLVI. Subpart G: Comments on Using Approved Suppliers and Determining Appropriate Supplier Verification Activities

A. Using Approved Suppliers (Final § 117.420)

B. Determining Appropriate Verification Activities (Final § 117.425)

XLVII. Subpart G: Comments on Conducting Supplier Verification Activities for Raw Materials and Other Ingredients

A. Requirement to Conduct One or More Supplier Verification Activities (Final § 117.430(a))

B. Requirement for an Onsite Audit as a Verification Activity When a Hazard Has a Reasonable Probability of Resulting in Serious Adverse Health Consequences or Death to Humans (Final § 117.430(b))

C. Alternative Verification Activity When the Supplier Is a Qualified Facility (Final § 117.430(c))

D. Alternative Verification Activity When the Supplier Is a Produce Farm That Is Not a “Covered Farm” for the Purposes of the Future Produce Safety Rule (Final § 117.430(d))

E. Alternative Verification Activity When the Supplier Is a Shell Egg Producer That Has Less Than 3,000 Laying Hens (Final § 117.430(e))

F. Independence of Persons Who Conduct Supplier Verification Activities (Final § 117.430(f))

XLVIII. Subpart G: Comments on Onsite Audit

A. Requirements Applicable to an Onsite Audit (Final § 117.435(a) and (b))

B. Substitution of Inspection by FDA or an Officially Recognized or Equivalent Food Safety Authority

C. Onsite Audit by a Third-Party Auditor Accredited for the Purposes of Section 808 of the FD&C Act

XLIX. Subpart G: Comments on Records Documenting the Supply-Chain Program

A. Applicability of the Recordkeeping Requirements of Subpart F (Final § 117.475(a))

B. Requirement To Review Records of the Supply-Chain Program (Final § 117.475(b))

C. Documentation Demonstrating Use of the Written Procedures for Receiving Raw Materials and Other Ingredients (Final § 117.475(c)(5))

D. Documentation of the Conduct of an Onsite Audit (Final § 117.475(c)(7))

E. Documentation of Sampling and Testing (Final § 117.475(c)(8))

F. Documentation of Other Appropriate Supplier Verification Activity (Final § 117.475(c)(10))

G. Documentation of an Alternative Verification Activity for a Supplier That Is a Farm That Is Not a “Covered Farm” for the Purposes of the Future Produce Safety Rule (Final § 117.475(c)(13))

L. Holding Human Food By-Products Intended for Use in Animal Food

LI. Comments by Foreign Governments and Foreign Businesses

LII. Editorial and Conforming Changes

LIII. Comments on FSMA's Rulemaking Provisions

A. Comments on Requirements in Section 418(n)(3) of the FD&C Act Regarding Content

B. Comments on Requirements in Section 418(n)(5) of the FD&C Act Regarding Review of Hazard Analysis and Preventive Controls Programs in Existence on the Date of Enactment of FSMA

LIV. Comments on Proposed Removal of 21 CFR part 110—Current Good Manufacturing Practice in Manufacturing, Packing, or Holding Human Food

LV. Comments on Proposed Conforming Amendments

LVI. Effective and Compliance Dates

A. Effective and Compliance Dates for Part 117

B. Effective and Compliance Dates for Revisions to Part 1

C. Effective Dates for Conforming Amendments

D. Delayed Effective Dates for Provisions That Refer to the Forthcoming Rules for Produce Safety and Third-Party Certification

LVII. Compliance and Enforcement

LVIII. Executive Order 13175

LIX. Economic Analysis of Impacts

LX. Analysis of Environmental Impact

LXI. Paperwork Reduction Act of 1995

LXII. Federalism

LXIII. References

Executive Summary

Purpose and Coverage of the Rule

This rule is part of FDA's implementation of the FDA Food Safety Modernization Act (FSMA), which intends to better protect public health by, among other things, adopting a modern, preventive, and risk-based approach to food safety regulation. This rule creates certain new requirements for the production of human food by registered food facilities, and revises previous requirements, in three key ways.

First, this rule creates new requirements for certain domestic and foreign facilities to establish and implement hazard analysis and risk-based preventive controls for human food. In general, these requirements apply to establishments that are required to register with FDA as a food “facility.” This portion of the rule requires registered food facilities to maintain a food safety plan, perform a hazard analysis, and institute preventive controls for the mitigation of those hazards, unless an exemption applies. Facilities must also monitor their controls, conduct verification activities to ensure the controls are effective, take appropriate corrective actions, and maintain records documenting these actions.

Second, this rule modernizes FDA's long-standing current good manufacturing practice (CGMP) regulations regarding the manufacturing, processing, packing, or holding of human food. We have updated, revised, and otherwise clarified certain requirements within the CGMP regulations, which were last updated in 1986.

Third, this rule clarifies the scope of the exemption for “farms” in FDA's current food facility registration regulations and makes corresponding revisions to FDA's current regulations for the establishment, maintenance, and availability of records. These revisions affect who is subject to the existing regulations for registration and recordkeeping, as well as the new requirements for hazard analysis and risk-based preventive controls requirements established here.

This final rule is the result of significant stakeholder engagement, beginning before the proposed rule. In response to extensive stakeholder input on the proposed rule, we revised key provisions in a supplemental notice of proposed rulemaking. After the supplemental notice of proposed rulemaking, we conducted even more outreach to the stakeholder community to ensure that the risk-based, preventive requirements in this final rule are practical and protective of public health.

Summary of the Major Provisions of the Rule

The final rule implements the requirements of FSMA for covered facilities to establish and implement a food safety system that includes a hazard analysis and risk-based preventive controls. Specifically, the rule establishes requirements for:

• A written food safety plan;
• Hazard analysis;
• Preventive controls;
• Monitoring;
• Corrective actions and corrections;
• Verification;
• Supply-chain program;
• Recall plan; and
• Associated records.

We have added flexibility and clarity to these provisions in response to comments. Although there are similarities between these requirements of FSMA and the requirements of food safety systems known as Hazard Analysis and Critical Control Point (HACCP) systems, not every provision in FSMA is identical to the provisions of HACCP systems, and we have revised much of our terminology to distinguish FSMA's requirements for hazard analysis and risk-based preventive controls from HACCP requirements. A facility subject to the rule must conduct a hazard analysis to identify and evaluate known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at the facility to determine whether there are any hazards requiring preventive controls. The first step of a hazard analysis is hazard identification, which must consider known or reasonably foreseeable hazards, including biological, chemical, and physical hazards. The hazard analysis must consider hazards that may be present in the food because they occur naturally, are unintentionally introduced, or are intentionally introduced for purposes of economic gain. We continue to believe that hazards that may be intentionally introduced for economic gain will need preventive controls in rare circumstances, usually in cases where there has been a pattern of economically motivated adulteration in the past. Economically motivated adulteration that affects product integrity or quality, for example, but not food safety, is out of the scope of this rule.

A facility subject to the rule must identify and implement preventive controls to provide assurances that any hazards requiring a preventive control will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated. The rule establishes preventive control management components (monitoring, corrective actions and corrections, and verification) as appropriate to ensure the effectiveness of the preventive controls. One way we have clarified the risk-based flexibility of these requirements is by clearly stating in the final rule that a facility must take into account the nature of the preventive control and the facility's food safety system when considering which activities are appropriate for that facility.

We have also added flexibility and made risk-based modifications for specific preventive control management components. For example, the final rule allows flexibility for the specific records required to document monitoring of refrigeration controls during storage of a food that requires time/temperature control for safety. These records can be either affirmative records demonstrating temperature is controlled or “exception records” demonstrating loss of temperature control. As another example, the rule includes tailored, less burdensome requirements for corrections. A correction is defined in this rule as an action to identify and correct a problem that occurred during the production of food, without other actions associated with a corrective action procedure (such as actions to reduce the likelihood that the problem will recur, evaluate all affected food for safety, and prevent affected food from entering commerce). The final rule clarifies that corrections must be taken in a timely manner and must be recorded when appropriate, but they do not, for example, need to be included in a written plan or accompanied by a reanalysis of the written food safety plan.

As a third example, the final rule provides flexibility for which verification activities must occur. In general, a facility is required to conduct verification activities, as appropriate to the nature of the preventive control and its role in the facility's food safety system, including validation, verification of monitoring, verification of corrective actions, verification of implementation and effectiveness, and reanalysis. Validation is not required for all controls. For example, the rule specifies that validation is not required for certain types of preventive controls (i.e., food allergen controls, sanitation controls, supply-chain controls, and the recall plan) and provides flexibility for the facility to not validate other preventive controls with a written justification based on factors such as the nature of the hazard, and the nature of the preventive control and its role in the facility's food safety system. Product testing and environmental monitoring are listed as possible verification activities, but, like other preventive control management components in general, they are only required as appropriate to the food, facility, the nature of the preventive control, and the preventive control's role in the facility's food safety system. In many cases, neither product testing nor environmental monitoring will be appropriate. For example, there would be little or no benefit to product testing or environmental monitoring in facilities that pack or hold produce raw agricultural commodities that are rarely consumed raw, such as potatoes.

A facility must reanalyze the food safety plan as a whole at least once every three years. The final rule provides the flexibility for a facility to only reanalyze the applicable portion of the food safety plan under certain other circumstances, such as when a facility becomes aware of new information about potential hazards associated with a food.

The final rule also adds flexibility to the preventive controls requirements and recognizes the reality of modern distribution chains by not requiring a manufacturing/processing facility to implement a preventive control in certain circumstances when the hazard requiring a preventive control will be controlled by another entity in the distribution chain. For example, if a facility's customer (or another entity in the distribution chain) will control the hazard, then that facility can rely on its customer to provide written assurance that the identified hazard will be controlled by an entity in the distribution chain, with flexibility for how the customer provides that written assurance depending on whether the customer, or an entity subsequent to the customer, will control the hazard. We have identified four specific circumstances in which a manufacturing/processing facility can rely on another entity in the distribution chain to control a hazard, with practical solutions explained further in section XXVII. We also have provided flexibility for a facility to establish, document, and implement an alternative system that ensures adequate control, at a later distribution step, of the hazards in the food product distributed by a manufacturing/processing facility such that the facility would not need to implement a preventive control.

We revised the proposed provisions for a supplier program to add flexibility, recognizing that the receiving facility and the supplier may be separated by several entities in a supply chain. We are allowing entities such as distributors, brokers, and aggregators to determine, conduct, and document appropriate supplier verification activities as a service to the receiving facility, provided that the receiving facility reviews and assesses applicable documentation provided by the other entity and documents that review and assessment. However, because the approval of suppliers is ultimately the responsibility of the receiving facility, the rule specifies that only a receiving facility can approve suppliers. To improve clarity and readability we redesignated the proposed provisions into eight distinct sections of regulatory text in a newly established subpart G (Supply-Chain Program).

Each facility subject to the rule must have a recall plan for a food with a hazard requiring a preventive control.

Many activities required by the final rule must be conducted (or overseen) by a preventive controls qualified individual, a new term we are coining here. A preventive controls qualified individual is a qualified individual who has successfully completed certain training in the development and application of risk-based preventive controls or is otherwise qualified through job experience to develop and apply a food safety system.

The rule establishes several exemptions (including modified requirements in some cases) from the requirements for hazard analysis and risk-based preventive controls. All of these exemptions are expressly authorized by FSMA. A facility that manufactures, processes, packs, or holds food and that is required to register with FDA would be required to comply with the requirements for hazard analysis and risk-based preventive controls unless it is covered by an exemption, as shown in the following table.

The rule includes procedures for withdrawing a qualified facility exemption, in the event of an active investigation of a foodborne illness outbreak that is directly linked to the facility, or if FDA determines that it is necessary to protect the public health and prevent or mitigate a foodborne illness outbreak based on relevant conditions or conduct associated with the qualified facility. The final rule provides procedures for a facility to appeal an order to withdraw a qualified facility exemption, for a facility to request an informal hearing, for the conduct of an informal hearing, for an appeal, for revoking an order to withdraw a qualified facility exemption, and for reinstating an exemption that was withdrawn.

The rule finalizes recordkeeping provisions associated with the new provisions for hazard analysis and risk-based preventive controls. These records allow facilities to show, and FDA to determine, compliance with the new requirements. To meet these requirements, a facility may use existing records as appropriate.

In addition to finalizing new requirements for hazard analysis and risk-based preventive controls as required by FSMA, the rule does two more key things. First, it modernizes the existing CGMPs. Second, it revises the “farm” definition.

The rule makes several revisions to the CGMPs to update and clarify them. For example, the final CGMPs do not include nonbinding provisions, because it is no longer FDA's practice to include guidance in the regulatory text. The rule finalizes some of the previously nonbinding provisions in the CGMPs as binding requirements, including a requirement for education and training, but deletes other nonbinding provisions. We have revised some key terms for consistency and clarity. And we have clarified FDA's long-standing position that the CGMPs address allergen cross-contact by making that explicit in the regulatory text. Finally, the rule revises a long-standing exemption from the CGMP requirements regarding specific activities conducted on raw agricultural commodities to reflect the contemporary regulatory framework associated with the “farm” definition. In addition, elsewhere in this issue of the Federal Register, in a final rule that establishes requirements for hazard analysis and risk-based preventive controls for food for animals, FDA is establishing an additional revision to the human food CGMPs to address comments about the practice of human food manufacturers sending by-products to local farmers or animal food manufacturers for use as animal food. Because we proposed these requirements as part of the rulemaking for the animal preventive controls rule, we are finalizing these provisions in the final animal preventive controls rule rather than in this rule.

Finally, the rule clarifies the “farm” definition that is central to the determination of whether certain entities must register as a food facility and, thus, become subject to the new requirements for hazard analysis and risk-based preventive controls. The final “farm” definition reflects current farming practices, differentiates between two types of farm operations (i.e., a “primary production farm” and a “secondary activities farm”), and allows for a consistent—although not identical—regulatory approach across similar operations, to the extent possible. In general, a “primary production farm” is an operation under one management in one general (but not necessarily contiguous) physical location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities. A farm packs and holds raw agricultural commodities and may conduct certain manufacturing/processing activities (i.e., drying/dehydrating raw agricultural commodities to create a distinct commodity (such as drying/dehydrating grapes to produce raisins), treatment to manipulate the ripening of raw agricultural commodities (such as by treating produce with ethylene gas), and packaging and labeling). The term farm also now includes a “secondary activities farm,” which is an operation, not located on a primary production farm, devoted to the key farming operations of harvesting, packing, and/or holding of raw agricultural commodities, provided that the primary production farm(s) that grow, harvest, and/or raise the majority of the raw agricultural commodities harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm. A secondary activities farm may also conduct those additional activities allowed on a primary production farm.

Costs and Benefits

This final regulation requires domestic and foreign facilities to adopt a food safety plan, perform a hazard analysis, and to institute preventive controls for the mitigation of those hazards. It also includes requirements for facilities to institute risk-based environmental monitoring, product testing, and a supply-chain program as appropriate to the food, the facility, and the nature of the preventive controls, as well as a requirement to institute controls to help prevent hazards associated with economically motivated adulteration. The total annualized domestic costs are estimated to be approximately $381 million per year, estimated with a 3 percent discount rate, and $382 million per year, estimated at 7 percent when discounted over 10 years. We estimate that processed foods covered by this rulemaking are responsible for approximately 903,000 foodborne illnesses each year, at a total cost to the American public of approximately $2.2 billion. Our break-even analysis shows that for the rule to be cost effective, it would have to prevent $382 million worth of foodborne illness; approximately 17 percent of the total annual illnesses, or approximately 157,000 illnesses when using a discount rate of 7 percent. For the rule to be cost effective using a discount rate of 3 percent, it would have to prevent $381 million worth of foodborne illness (about 17 percent or 156,000 illnesses).

I. Background

A. FDA Food Safety Modernization Act

The FDA Food Safety Modernization Act (FSMA) (Pub. L. 111-353), signed into law by President Obama on January 4, 2011, is intended to allow FDA to better protect public health by helping to ensure the safety and security of the food supply. FSMA enables us to focus more on preventing food safety problems rather than relying primarily on reacting to problems after they occur. The law also provides new enforcement authorities to help achieve higher rates of compliance with risk-based, prevention-oriented safety standards and to better respond to and contain problems when they do occur. In addition, the law contains important new tools to better ensure the safety of imported foods and encourages partnerships with State, local, tribal, and territorial authorities. A top priority for FDA are those FSMA-required regulations that provide the framework for industry's implementation of preventive controls and enhance our ability to oversee their implementation for both domestic and imported food. To that end, we proposed the seven foundational rules listed in table 1 and requested comments on all aspects of these proposed rules.

We also issued a supplemental notice of proposed rulemaking for the rules listed in table 2 and requested comments on specific issues identified in each supplemental notice of proposed rulemaking.

As FDA finalizes these seven foundational rulemakings, we are putting in place a framework for food safety that is modern and brings to bear the most recent science on provisions to enhance food safety, that is risk-based and focuses effort where the hazards are reasonably likely to occur, and that is flexible and practical given our current knowledge of food safety practices. To achieve this, FDA has engaged in a great deal of outreach to the stakeholder community to find the right balance in these regulations of flexibility and accountability.

Since FSMA was enacted in 2011, we have been involved in approximately 600 engagements on FSMA and the proposed rules, including public meetings, webinars, listening sessions, farm tours, and extensive presentations and meetings with various stakeholder groups (Ref. 1) (Ref. 2). As a result of this stakeholder dialogue, FDA decided to issue the four supplemental notices of proposed rulemaking to share our current thinking on key issues and get additional stakeholder input on those issues. As we move forward into the next phase of FSMA implementation, we intend to continue this dialogue and collaboration with our stakeholders, through guidance, education, training, and assistance, to ensure that everyone understands and engages in their role in food safety. FDA believes these seven foundational final rules, when implemented, will fulfill the paradigm shift toward prevention that was envisioned in FSMA and be a major step forward for food safety that will protect consumers into the future.

B. Stages in the Rulemaking for the Human Preventive Controls Rule

With regard to this rulemaking, we published proposed provisions in the 2013 proposed human preventive controls rule and we published new and re-proposed provisions in the 2014 supplemental human preventive controls notice. In the 2014 supplemental human preventive controls notice, we reopened the comment period only with respect to specific proposed provisions. In addition, we emphasized that the re-proposed provisions we included in the regulatory text were based on a preliminary review of the comments.

In this document, we use the broad term “proposed human preventive controls rule” to refer to the complete proposed regulatory text, including both the proposed provisions we published in the 2013 proposed human preventive controls rule and the new and re-proposed provisions we published in the 2014 supplemental human preventive controls notice. We use the narrow terms “2013 proposed human preventive controls rule” and “2014 supplemental human preventive controls notice” to refer to specific text published in the Federal Register of January 16, 2013 (78 FR 3646) and September 29, 2014 (79 FR 58524), respectively. We use the terms “final human preventive controls rule” and “this rule” to refer to the regulations we are establishing as a result of this rulemaking.

We issued a notice correcting several typographical and stylistic errors in the 2013 proposed human preventive controls rule and a mistake in the date of a reference (78 FR 17142, March 20, 2013). In that correction notice, we republished the Appendix in its entirety (78 FR 17142 at 17143 through 17155; the corrected Appendix) because all the references to the Appendix as published in the 2013 proposed human preventive controls rule (78 FR 3646 at 3812 through 3824) had been numbered incorrectly. We also extended the comment periods for the 2013 proposed human preventive controls rule, its information collection provisions, and a related risk assessment (see section I.D) in response to several requests that we do so.

C. Summary of the Major Provisions of Proposed Human Preventive Controls Rule

As part of our announced initiative (Ref. 3) to revisit the CGMP requirements since they were last revised in 1986, we proposed to amend our regulation for Current Good Manufacturing Practice In Manufacturing, Packing, or Holding Human Food (currently established in part 110 (21 CFR part 110)) to: (1) Modernize it; (2) adjust and clarify what activities fall within the long-standing exemption from the CGMP requirements for establishments engaged solely in the harvesting, storage, or distribution of one or more raw agricultural commodities (RACs) based on experience and changes in related areas of the law since issuance of the CGMP regulation; (3) delete some non-binding provisions of current part 110; and (4) re-establish the provisions of current part 110 in new part 117 (21 CFR part 117). We also requested comment on: (1) Additional proposed revisions or clarifications to our CGMP regulations, including whether to further implement opportunities for CGMP modernization, such as on how best to revise the current provisions for training; and (2) whether to revise some non-binding provisions to establish new requirements in proposed part 117, or to simply retain them as useful provisions of a comprehensive CGMP.

As part of our implementation of new statutory provisions in FSMA, we also proposed to add, in newly established part 117, requirements for certain domestic and foreign facilities to establish and implement hazard analysis and risk-based preventive controls for human food. As directed by FSMA (see section 418 of the Federal Food, Drug, and Cosmetic Act (FD&C Act)), these new provisions would apply to domestic and foreign facilities that are required to register under section 415 of the FD&C Act and our regulation for Registration of Food Facilities (21 CFR part 1, subpart H; the section 415 registration regulations). As directed by FSMA (see sections 418(l) and (m) of the FD&C Act), we proposed to establish modified requirements for certain facilities. We requested comment on all aspects of the proposed requirements, including an opportunity for public comment on potential requirements for product testing, environmental monitoring, a supply-chain program, and hazards that may be intentionally introduced for purposes of economic gain.

As directed by section 103 of FSMA, we proposed to clarify the scope of the exemption from the section 415 registration regulations for “farms” by revising the “farm” definition and by adding or modifying the definitions for certain activities (i.e., for “harvesting,” “holding,” “manufacturing/processing,” and “packing” activities) that govern, in part, whether a business that is devoted to the growing of crops, the raising of animals, or both is within the “farm” definition. We also proposed to add or revise these definitions in our current regulation (implementing section 414 of the FD&C Act) for Establishment and Maintenance of Records for Foods (21 CFR part 1, subpart J; the section 414 recordkeeping regulations), which also have an exemption for “farms.”

We proposed to establish the requirements for CGMPs, for hazard analysis and risk-based preventive controls, and related requirements in new part 117 as shown in table 3:

D. Draft Risk Assessment

We issued for public comment a “Draft Qualitative Risk Assessment: Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm” (the section 103(c)(1)(C) draft RA) (78 FR 3824, January 16, 2013). The purpose of the section 103(c)(1)(C) draft RA was to provide a science-based risk analysis of those activity/food combinations that would be considered low risk when conducted in a facility co-located on a farm. We used the tentative conclusions of the section 103(c)(1)(C) draft RA to propose to exempt food facilities that are small or very small businesses that are engaged only in specific types of on-farm manufacturing, processing, packing, or holding activities from the requirements for hazard analysis and risk-based preventive controls. We are including the final risk assessment (the section 103(c)(1)(C) RA) in the docket established for this document (Ref. 4).

E. Definition of “Retail Food Establishment”

An establishment that meets the definition of “retail food establishment” is exempt from the requirements of the section 415 registration regulations and, thus, from FSMA's requirements for hazard analysis and risk-based preventive controls. Section 102(c) of FSMA requires that we revise the definition of “retail food establishment” in § 1.227 to clarify its intent. We are addressing the requirements of section 102(c) of FSMA in a separate rulemaking and issued a separate proposed rule to amend the definition of “retail food establishment” in the section 415 registration regulations and the section 414 recordkeeping regulations (80 FR 19160, April 9, 2015). We intend to issue a final rule to amend the definition of “retail food establishment” in the section 415 registration regulations in the near future.

F. Public Comments

We received more than 8,000 public submissions on the 2013 proposed human preventive controls rule, and more than 1,300 public submissions on the 2014 preventive controls supplemental notice, each containing one or more comments. We received submissions from diverse members of the public, including food facilities (including facilities co-located on a farm); farms; cooperatives; coalitions; trade organizations; consulting firms; law firms; academia; public health organizations; public advocacy groups; consumers; consumer groups; Congress; Federal, State, local, and tribal Government Agencies; and other organizations. Some submissions included signatures and statements from multiple individuals. Comments address virtually every provision of the proposed human preventive controls rule. In the remainder of this document, we describe these comments, respond to them, and explain any revisions we made to the proposed human preventive controls rule.

Some comments address issues that are outside the scope of this rule. For example, some comments express concern over pesticides being used on local crops being harmful to the honeybee population. Other comments address the requirements of the proposed produce safety rule, such as standards for water quality. Other comments express concern about the use of bioengineered food ingredients, and ask that foods containing such ingredients be labeled so that consumers can identify such foods and choose whether to consume them. Other comments assert that the rules should address social issues. We do not discuss such comments in this document.

II. Legal Authority

The proposed rule contained an explanation of its legal basis under authorities in the FDA Food Safety Modernization Act, the FD&C Act, and the Public Health Service Act. After considering comments received in response to the 2013 proposed human preventive controls rule and 2014 supplemental human preventive controls notice, FDA made changes in the final rule. The legal authorities relied on for the final rule are the same as in the proposed rule unless otherwise described in the sections that follow.

A. Changes to Current 21 CFR Part 1, Subparts H, I, and J

Sections 103(c)(2)(A) and (B) of FSMA require that the Secretary adopt final rules for purposes of section 415 of the FD&C Act (Registration of Food Facilities) with respect to “activities that constitute on-farm packing or holding of food that is not grown, raised, or consumed on such farm or another farm under the same ownership” and “activities that constitute on-farm manufacturing or processing of food that is not consumed on that farm or on another farm under common ownership.” In section IV, we discuss our revision of the section 415 registration regulations (21 CFR part 1, subpart H) to clarify the types of activities that are included as part of the definition of the term “facility” under section 415 of the FD&C Act and the scope of the exemption for “farms” provided by section 415 of the FD&C Act. The final rule also makes corresponding changes in part 1, subpart I (Prior Notice of Imported Food) and in part 1, subpart J (Establishment, Maintenance, and Availability of Records). FDA's legal authority to modify these regulations is derived from section 103(c) of FSMA and sections 414, 415, 381(m) and 371(a) of the FD&C Act (21 U.S.C. 350c, 350d, 801(m), and 701(a)).

B. Changes to Current 21 CFR Part 110

The changes to the current CGMP regulation finalized in this document clarify the existing requirements of the regulation and update existing requirements to reflect changes in the food industry and in scientific understanding of food safety since issuance of the current regulation. FDA's legal authority to require Current Good Manufacturing Practices derives from sections 402(a)(3), (a)(4) and 701(a) of the FD&C Act (21 U.S.C. 342(a)(3), 342(a)(4), and 371(a)). Section 402(a)(3) of the FD&C Act provides that a food is adulterated if it consists in whole or in part of any filthy, putrid, or decomposed substance, or if it is otherwise unfit for food. Section 402(a)(4) of the FD&C Act provides that a food is adulterated if it has been prepared, packed, or held under insanitary conditions whereby it may have become contaminated with filth, or whereby it may have been rendered injurious to health. Under section 701(a) of the FD&C Act, FDA is authorized to issue regulations for the efficient enforcement of the FD&C Act. The revisions we are making to the current CGMP regulation are necessary to prevent food from containing filthy, putrid, or decomposed substances, being otherwise unfit for food, or being prepared, packed, or held under insanitary conditions whereby it may have become contaminated with filth, or whereby it may have been rendered injurious to health.

In addition to the FD&C Act, FDA's legal authority for the changes to current CGMP requirements derives from the PHS Act to the extent such measures are related to communicable disease. Authority under the PHS Act is derived from the provisions of sections 311, 361, and 368 (42 U.S.C. 243, 264, and 271) that relate to communicable disease. The PHS Act authorizes the Secretary to make and enforce such regulations as “are necessary to prevent the introduction, transmission, or spread of communicable diseases from foreign countries into the States * * * or from one State * * * into any other State” (section 361(a) of the PHS Act). (See sec. 1, Reorg. Plan No. 3 of 1966 at 42 U.S.C. 202 for transfer of authority from the Surgeon General to the Secretary.) The revisions we are making to the current CGMP regulation are necessary to prevent the spread of communicable disease.

C. Hazard Analysis and Risk-Based Preventive Controls

Section 103 of FSMA, Hazard Analysis and Risk-Based Preventive Controls, amends the FD&C Act to create a new section 418, which mandates rulemaking. Section 418(n)(1)(A) of the FD&C Act requires that the Secretary issue regulations “to establish science-based minimum standards for conducting a hazard analysis, documenting hazards, implementing preventive controls, and documenting the implementation of the preventive controls. . . .” Section 418(n)(1)(B) of the FD&C Act requires that the regulations define the terms “small business” and “very small business,” taking into consideration the study of the food processing sector required by section 418(l)(5) of the FD&C Act. Further, section 103(e) of FSMA creates a new section 301(uu) in the FD&C Act (21 U.S.C. 331(uu)) to prohibit “[t]he operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is not in compliance with section 418 [of the FD&C Act].”

In addition to rulemaking requirements, section 418 contains requirements applicable to the owner, operator, or agent in charge of a facility required to register under section 415. Section 418(a) is a general provision that requires the owner, operator, or agent in charge of a facility to evaluate the hazards that could affect food manufactured, processed, packed, or held by the facility, identify and implement preventive controls, monitor the performance of those controls, and maintain records of the monitoring. Section 418(a) specifies that the purpose of the preventive controls is to “prevent the occurrence of such hazards and provide assurances that such food is not adulterated under section 402 [of the FD&C Act] or misbranded under section 403(w) [of the FD&C Act]. . . .” In addition to the general requirements in section 418(a) of the FD&C Act, sections 418(b)-(i) contain more specific requirements applicable to facilities. These include hazard analysis (section 418(b)), preventive controls (section 418(c)), monitoring (section 418(d)), corrective actions (section 418(e)), verification (section 418(f)), recordkeeping (section 418(g)), a written plan and documentation (section 418(h)), and reanalysis of hazards (section 418(i)).

Section 103(c)(2)(C) of FSMA requires that the Secretary adopt a final rule with respect to the requirements under sections 418 and 421 of the FD&C Act from which the Secretary may issue exemptions or modifications of the requirements for certain types of facilities. Sections 418(j)-(m) of the FD&C Act and sections 103(c)(1)(D) and (g) of FSMA provide authority for certain exemptions and modifications to the requirements of section 418 of the FD&C Act. These include provisions related to seafood and juice HACCP, and low-acid canned food (section 418(j)); activities of facilities subject to section 419 of the FD&C Act (Standards for Produce Safety) (section 418(k)); qualified facilities (section 418(l)); facilities that are solely engaged in the production of food for animals other than man, the storage of raw agricultural commodities (other than fruits and vegetables) intended for further distribution or processing, or the storage of packaged foods that are not exposed to the environment (section 418(m)); facilities engaged only in certain low-risk on-farm activities on certain foods conducted by small or very small businesses (section 103(c)(1)(D) of FSMA), and dietary supplements (section 103(g) of FSMA). In sections XI, XII, XXXVIII, and XXXIX, we discuss provisions that implement these exemptions and modified requirements.

In the 2014 supplemental human preventive controls notice, we included potential requirements for a supplier program, environmental monitoring, and product testing. We are including provisions for such activities in the final rule. Section 418(o)(3) of the FD&C Act provides supplier verification activities and an environmental monitoring program as examples of preventive controls. Section 418(f)(4) of the FD&C Act provides for the use of environmental and product testing programs as part of required verification that the preventive controls are effectively and significantly minimizing or preventing the occurrence of identified hazards.

In certain circumstances, the final rule does not require a manufacturing/processing facility to implement a preventive control for a hazard requiring a preventive control. Instead, the facility is permitted to rely on a subsequent entity in the distribution chain to significantly minimize or prevent the hazard. In such a circumstance, a facility must disclose in documents accompanying the food, that the food is “not processed to control [identified hazard].” This requirement is supported by sections 418 and 701(a) of the FD&C Act (21 U.S.C. 350g and 371(a)). The requirement that facilities apply preventive controls to significantly minimize or prevent hazards is fundamental to the public health benefits of the rule. To accommodate the realities of modern food production, the rule allows a facility to rely on a subsequent entity in the distribution chain rather than requiring that facility to apply the control. A food may pass through multiple entities in the distribution chain before it reaches consumers. Further, ordinarily it is not apparent from visual examination of the food whether a hazard requiring a preventive control has been addressed. Consequently, without labeling, a facility might not know that a facility upstream in the supply chain has not applied a preventive control and is relying on a downstream entity to do so. Therefore, the agency concludes that information that food has not been processed to control an identified hazard is necessary for a facility to fulfil its obligation under section 418 when a facility is relying on a subsequent entity to control the hazard. The agency also concludes that such labeling is necessary for the efficient enforcement of the Act because the labelling is critical for FDA to hold facilities responsible for their obligations under this regulatory scheme. Further, when the hazard can cause a communicable disease, FDA concludes that the requirement is necessary to prevent the spread of communicable disease from one state into another state and relies on sections 311, 361, and 368 of the PHS Act.

FDA concludes that the provisions in subpart C and related requirements in subparts A, D, F, and G should be applicable to activities that are intrastate in character. Facilities are required to register under section 415 of the FD&C Act regardless of whether the food from the facility enters interstate commerce (§ 1.225(b)). The plain language of section 418 of the FD&C Act applies to facilities that are required to register under section 415 (section 418(o)(2) of the FD&C Act) and does not exclude a facility from the requirements because food from such a facility is not in interstate commerce. Further, the prohibited act provision associated with section 418 (section 301(uu) of the FD&C Act) does not require interstate commerce for a violation.

FDA also is issuing the provisions in subpart C and related requirements in Subparts A, D, F, and G, under sections 402(a)(3), 402(a)(4), 403(w), and 701(a) of the FD&C Act to the extent such requirements are necessary to prevent food from being held under insanitary conditions whereby it may become contaminated with filth or rendered injurious to health, or being unfit for food; and to the extent necessary to prevent food from being misbranded under section 403(w). FDA also is finalizing those provisions under sections 311, 361, and 368 of the PHS Act relating to communicable disease to the extent those provisions are necessary to prevent the interstate spread of communicable disease.

D. Comments on Legal Authority

(Comment 1) One comment asserts that FDA does not have authority to regulate intrastate commercial activities. Another comment asserts that FDA does not have authority to regulate farms that are selling wholly intrastate.

(Response 1) With regard to farms, this rule does not apply. With respect to farms that engage in activities outside the farm definition (i.e., farm mixed-type facilities), this rule applies to the non-farm portion of the operation.

FDA disagrees with the comments regarding application of this rule to activities that are intrastate in character. Facilities are required to register under section 415 of the FD&C Act regardless of whether the food from the facility enters interstate commerce (§ 1.225(b)). The plain language of section 418 of the FD&C Act applies to facilities that are required to register under section 415 (section 418(o)(2) of the FD&C Act) and does not exclude a facility because food from such a facility is not in interstate commerce. Section 301(uu) of the FD&C Act (21 U.S.C. 331(uu)) provides that “the operation of a facility that manufactures, processes, packs, or holds food for sale in the United States if the owner, operator, or agent in charge of such facility is not in compliance with section 418” is a prohibited act. Notably, other subsections in section 301 of the FD&C Act, and section 304 of the FD&C Act (21 U.S.C. 334) demonstrate that Congress has included a specific interstate commerce nexus in the provisions of the FD&C Act when that is its intent. Accordingly, it is reasonable to interpret sections 418 and 301(uu) of the FD&C Act as not limiting the application of the rule only to those facilities with a direct connection to interstate commerce.

FDA is mindful that its interpretation of FSMA and the FD&C Act should not cast doubt on their constitutionality. (See Solid Waste Agency of Northern Cook County v. U.S., 531 U.S. 159 (2001)). FDA has considered the relevant provisions of FSMA and the FD&C Act, FDA's responsibilities in implementing those laws, and the law interpreting the commerce clause of the Constitution (Article I, section 8). Congress' power to legislate under the commerce clause is very broad. However, such power is not without limits, see United States v. Lopez, 514 U.S. 549, 567 (1995); U.S. v. Morrison, 529 U.S. 598, 618 (2000), and these limits have been construed in light of relevant and enduring precedents. In particular, in Lopez, supra, the Supreme Court acknowledged the continuing vitality of Wickard v. Filburn, 317 U.S. 111 (1942), noting that “although Filburn's own contribution to the demand for wheat may have been trivial by itself, that was not `enough to remove him from the scope of Federal regulation where, as here, his contribution, taken together with that of many others similarly situated, is far from trivial.' ” (514 U.S. at 556.) See also Gonzales v. Raich, 545 U.S. 1, 17-25 (2005). This principle applies to the application of sections 418 and 301(uu) of the FD&C Act, as added by section 104 of FSMA. Accordingly, given the collective impact on commerce of facilities that manufacture, process, pack, or hold food that is sold in intrastate commerce, FDA concludes that such facilities should be subject to the rule. FDA notes that to the extent these facilities are very small, they are subject to modified requirements under § 117.201. This outcome regarding intrastate commerce is consistent with section 709 of the FD&C Act (21 U.S.C. 379a), which states that in any action to enforce the act's requirements respecting foods, drugs, devices, and cosmetics, any necessary connection with interstate commerce is presumed. Likewise, this outcome is consistent with FSMA's risk-based, preventive approach to food safety because the risk presented by unsafe food can be significant, whether or not the food moves from one state to another.

III. General Comments on the Proposed Rule

(Comment 2) Several comments ask us to develop guidance to accompany the rule, particularly with respect to the new requirements for hazard analysis and risk-based preventive controls. For example, comments ask us to provide guidance on topics such as hazard analysis, environmental monitoring, and validation. Some of these comments ask that drafts of the guidance first be made available for public comment.

Other comments emphasize the importance of education and outreach and ask us to provide support for ongoing education and outreach, including an active role in providing needed instructional examples and lessons learned from current investigations and foodborne outbreaks. Some comments ask us to convene a scientific workgroup that includes experts in food and laboratory science, public health, proficiency testing, quality control, and other areas on at least an annual basis to assess what pathogens should be addressed in a food safety plan.

Some comments ask that funding and information on funding for training be provided. Other comments assert that we must make available adequate resources to support outreach and technical assistance delivered by State regulatory agencies, as well as Cooperative Extension programs and non-governmental organizations that work directly with farmers and facilities.

(Response 2) We are developing several guidance documents, including general guidance on hazard analysis and preventive controls, as well as guidance on specific aspects such as environmental monitoring and food allergen control (Ref. 5). We also intend to develop guidance specific to a variety of food types based in part on technical information we obtained through a grant for this purpose, as well as on other topics, such as validation. We will develop and issue this guidance in accordance with our good guidance practices regulation, which establishes criteria for when we issue a guidance document as an initial draft, invite public comment, and prepare a final version of the guidance document that incorporates suggested changes, when appropriate (§ 10.115(g)) (21 CFR 10.115(g)). The public may submit comments on any guidance document at any time (§ 10.115(g)(5)).

We agree with comments that stress the importance of education and outreach. A central element of our strategy to gain industry compliance is to help make available to facilities subject to this rule the education and technical assistance they need to understand and implement the requirements (Ref. 6). Within the Agency we are establishing a Food Safety Technical Assistance Network and seeking funding to increase FDA staffing to provide a central source of information to support industry understanding and implementation of FSMA standards (Ref. 6). This will allow us to respond in a timely and consistent way to industry questions on preventive controls technical and compliance issues (Ref. 6).

We also are working in collaboration with the Food Safety Preventive Controls Alliance (FSPCA) to develop training materials and establish training and technical assistance programs (Ref. 5) and (Ref. 7). The Alliance includes members from FDA, State food protection agencies, the food industry, and academia. It is funded by a grant to the Illinois Institute of Technology's Institute for Food Safety and Health, a nationally-recognized leader in food safety. In addition to developing a standardized preventive controls training curriculum, the FSPCA is developing selected sections of model food safety plans for several food types that will provide needed instructional examples. Although we have provided funding to the FSPCA to develop a standardized preventive controls training curriculum, we are unable to fund training for individual groups who might need particular training materials.

We also are partnering with the National Institute of Food and Agriculture (NIFA) of the U.S. Department of Agriculture (USDA) to administer the FSMA-mandated National Food Safety Training, Education, Extension, Outreach, and Technical Assistance Program, a grant program to provide technical assistance for FSMA compliance to owners and operators of small and medium-size farms and small food processors (Ref. 8). Such efforts will help ensure widespread voluntary compliance by encouraging greater understanding and adoption of established food safety standards, guidance, and protocols.

At this time, we intend to rely on scientific publications and epidemiological findings to assess the potential that new pathogens, or more virulent pathogenic strains, have emerged, and do not intend to convene annual workgroups to assess that data and information.

(Comment 3) Several comments ask us to classify specific on-farm activities as harvesting, packing, holding, or manufacturing/processing so that an operation that conducts these activities on a farm can determine whether conducting that specific activity is within, or outside, the “farm” definition. These comments emphasize that a farm operation needs to know when a specific activity that it conducts would be outside the “farm” definition for the purposes of the requirements to register as a food facility and, thus, require that the farm operation both register as a food facility and comply with the new requirements for hazard analysis and risk-based preventive controls. Some of these comments focus on activities that we have previously classified in more than one way (e.g., “washing,” which we have previously classified as both “harvesting” and “manufacturing/processing,” depending on when the activity occurs) (See table 1 in the Appendix to the 2014 supplemental human preventive controls rule, 79 FR 58524 at 58571-58572.) Other comments ask us to periodically review our lists of harvesting, packing, holding, and manufacturing/processing activities to ensure that they reflect current practices. Some comments ask us to make a table of activities prominently available on our Internet site for easy access whenever the public seeks out information regarding the forthcoming produce safety rule and the human preventive controls rule.

(Response 3) We have added several examples of “harvesting,” “packing,” “holding,” and “manufacturing/processing” to the regulatory text (see §§ 1.227, 1.328, and 117.3 and Response 27, Response 28, Response 29, Response 31, Response 37, Response 38 and Response 39). However, it is not practical to include every possible activity conducted by farm operations in the regulatory text. Attempting to include a more extensive set of examples in the regulatory text has the potential to signal—incorrectly—that any activity not specified in the regulatory text cannot be considered to be within the definition of that activity. In addition, we have not previously discussed our approach to classifying some of the activities mentioned in the comments, and we believe that we should provide an opportunity for public comment on a more extensive list of activities classified as “harvesting,” packing,” “holding,” or “manufacturing/processing.”

To address these comments, in the near future we intend to issue a draft guidance with our current thinking on the classification of activities as “harvesting,” packing,” “holding,” or “manufacturing/processing.” In accordance with our regulation on good guidance practices (§ 10.115(g)(1)), we will review any comments received and prepare the final version of the guidance document that incorporates suggested changes, when appropriate; publish a notice in the Federal Register announcing that the guidance document is available; and post the guidance document on the Internet and make it available in hard copy. Under our good guidance practices regulation (§ 10.115(g) and (h)), the public can comment on any guidance document at any time, and we will revise guidance documents in response to public comments when appropriate.

In addition, our previously issued “Guidance for Industry: Questions and Answers Regarding Food Facility Registration” (Ref. 9) is in its sixth edition, and we intend to update it in the near future to reflect the changes to the definitions of “farm,” “harvesting,” packing,” “holding,” and “manufacturing/processing” that we are establishing in this rulemaking.

(Comment 4) Some comments ask us to prepare a table or flow chart of activities that make an operation a farm, a retail food establishment, or a facility because food businesses will need to be able to easily determine their regulatory classification to comply with the applicable regulations. Other comments ask us to amend the definition of “manufacturing/processing” to ensure that community supported agriculture (CSA) programs will not become subject to the requirements for hazard analysis and risk-based preventive controls. Other comments ask us to clarify how the revised definitions we are establishing in the section 415 registration regulations will affect entities classified as research and development entities, pilot plants, test kitchens, shared use storage facilities, co-packers, sales offices, corporate offices, private residences, and registered foreign facilities that only send samples to the United States. Some comments ask us to clarify how the revised definitions we are establishing in the section 415 registration regulations will affect a determination of whether an entity or program (such as a farmers' market, roadside stand, CSA program, commissary kitchen, community and incubator kitchens) is a retail food establishment that is not required to register as a food facility in the human preventive controls rule rather than through a separate rulemaking. One comment notes that its farm has a store and a café that use products from the farm, and it is not clear if the store and café will be under regulations while nearby restaurants and grocery stores are not. Some comments ask us to define farmers' markets, CSA programs, roadside stands, and other direct-to-consumer programs as retail food establishments not subject to registration as part of the human preventive controls rulemaking rather than through a separate rulemaking.

(Response 4) Section 102(c) of FSMA requires that we revise the definition of “retail food establishment” in § 1.227 to clarify that, in determining the primary function of an establishment or a retail food establishment under the section 415 registration regulations, the sale of food products directly to consumers by such establishments includes the sale of such food products or food directly to consumers by such establishment at a roadside stand or farmers' market where such stand or market is located other than where the food was manufactured or processed; the sale and distribution of such food through a CSA program; and the sale and distribution of such food at any other such direct sales platform as determined by the Secretary of HHS. As discussed in section I.E, we have begun the process of amending the definition of “retail food establishment” in a separate rulemaking conducted under section 102(c) of FSMA, and are continuing that separate rulemaking by issuing a separate final rule. We intend to issue a final rule to amend the definition of “retail food establishment” in the section 415 registration regulations in the near future. We also intend to update our previously issued “Guidance for Industry: Questions and Answers Regarding Food Facility Registration” (Ref. 9) to reflect any changes to a determination of whether an entity is a retail food establishment as a result of that rulemaking. In the meantime, commenters may find our existing guidance helpful in addressing their questions.

(Comment 5) Some comments ask us to explain how we will enforce the rule, particularly with respect to coordination with State and local authorities and with other Federal agencies. For example, some comments ask whether FDA or the States will pay for inspections, whereas other comments ask us to coordinate inspection of imports with USDA's Food Safety and Inspection Service (FSIS) or ask us to combine our inspections with those of USDA where possible (such as when USDA conducts inspections for adherence to organic standards). Some comments express concern about the time gap between the effective date of this rule and the time it will take to incorporate applicable provisions into State law.

(Response 5) We are working through the Partnership for Food Protection (PFP) (a group of dedicated professionals from Federal, State, local, tribal, and territorial governments with roles in protecting the food supply and public health) to develop and implement a national Integrated Food Safety System consistent with FSMA's emphasis on establishing partnerships for achieving compliance (see section 209(b) of FSMA). For an example of our current thinking on establishing partnerships for achieving compliance, see the “best practices” document made available by PFP (Ref. 10). This “best practices” document provides information to FDA field and State programs on a variety of issues, including how to coordinate compliance activities. Our document entitled “Operational Strategy for Implementing FSMA” also recognizes the importance of developing operational partnerships with States and other government counterparts to optimize the effectiveness, efficiency, and consistency of FSMA implementation domestically (Ref. 11).

We are implementing a new inspection paradigm focused on whether firms are implementing systems that effectively prevent food contamination, requiring fundamentally different approaches to food safety inspection and compliance (Ref. 12). This new paradigm involves a major reorientation and retraining, for which we are seeking funding, of more than 2,000 FDA inspectors, compliance officers, and other staff involved in food safety activities, as well as thousands of State, local, and tribal inspectors (Ref. 12).

(Comment 6) Some comments ask us to specify that the human preventive controls rule does not apply to activities subject to the animal preventive controls rule.

(Response 6) The human preventive controls rule does not apply to activities subject to the animal preventive controls rule. The title of the rule (i.e., Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food) narrows its applicability to human food. Moreover, regulations directed to food for animals are established in subchapter E of 21 CFR (i.e., Animal Drugs, Feeds, And Related Products, parts 500-599), whereas regulations directed to human food are established in subchapter B of 21 CFR (i.e., Food For Human Consumption, parts 100-199).

(Comment 7) Some comments ask us to look to existing industry information technology solutions where possible to lower the burden on industry for implementation. These comments also ask us to adopt a centralized information technology solution with robust functionality to facilitate tracking stakeholders' compliance with the rule.

(Response 7) The rule allows for use of any available information technology (e.g., in the creation and retention of records) that will allow industry to comply with the rule, and we encourage the use of information technology to streamline compliance. The long-standing CGMP requirements allow for the use of automated systems (see § 117.40(d)). We are developing new electronic systems to track compliance. However, our internal procedures for tracking compliance are outside the scope of this rule.

(Comment 8) Some comments ask us to re-evaluate the proposed human preventive controls rule, compare it with existing programs, and identify a mechanism for integrating compliance verification with existing industry and governmental programs. These comments note that many handlers/processors use and understand voluntary food safety management systems such as HACCP and HACCP-based certification programs (e.g., certification to Global Food Safety Initiative (GFSI) benchmark schemes) and ask us why we proposed to create a separate inspection framework for FSMA, without integrating that inspection framework with existing programs.

(Response 8) We decline this request. As previously discussed, we are establishing this rule as required by section 103 of FSMA (78 FR 3646 at 3657-3659 and 3668-3669). However, where compliance with this rule mirrors compliance with existing regulatory requirements, there is no need to duplicate existing records, which may be supplemented as necessary to include all of the required information. (See also Response 5 regarding implementation of a national Integrated Food Safety System.)

(Comment 9) Some comments ask us to make the various rules we are establishing to implement FSMA consistent with each other.

(Response 9) We have aligned the provisions of the various rules to the extent practicable. For example, we use the same definitions of “farm” and the same terms used in the definition of “farm” (i.e., harvesting, packing, holding, and manufacturing/processing) in this rule, the animal preventive controls rule, and the proposed produce safety rule. However, the statutory direction is not the same for all the rules, and this difference in statutory direction does lead to some differences between the rules. For example, section 418(l) of the FD&C Act (which relates to this rule) provides for modified requirements for facilities that are very small businesses in addition to facilities that satisfy criteria for sales to qualified end-users, but section 419(f) of the FD&C Act (which relates to the proposed produce safety rule) only provides for modified requirements for direct farm marketing.

Likewise, we have worked to align the provisions of this rule with the provisions of the FSVP rule. Again, however, there are statutory differences that lead to some differences between the rules. For example, section 805 of the FD&C Act (21 U.S.C. 348a) applies to an importer whereas section 418 of the FD&C Act applies to a facility that is required to register under section 415 of the FD&C Act.

(Comment 10) Some comments ask us to clarify how the requirements for hazard analysis and risk-based preventive controls will apply to an establishment that supplies raw materials and other ingredients to a registered facility.

(Response 10) The requirements for hazard analysis and risk-based preventive controls apply to facilities that are required to register under section 415 of the FD&C Act. If an establishment that supplies raw materials and other ingredients to a registered facility is itself a facility that is required to register under section 415 of the FD&C Act, that establishment is subject to the requirements for hazard analysis and risk-based preventive controls. If that establishment is not itself a facility that is required to register under section 415 of the FD&C Act, that establishment is not subject to the requirements for hazard analysis and risk-based preventive controls. However, such facilities may be subject to verification activities of manufacturers/processors that are required to verify controls implemented by their suppliers.

(Comment 11) Some comments express concern about the potential for unfair enforcement of the rule relating to business size. Some comments assert that we should strictly enforce the rule for big industry, but be lenient towards small farms.

(Response 11) We intend to enforce the rule in a fair and reasonable manner. We note that farms are not covered by this rule, and the rule contains special provisions applicable to a farm mixed-type facility that is a small or very small business. Specifically, a small or very small business that is a farm mixed-type facility is exempt from the requirements for hazard analysis and risk-based preventive controls if the only activities that it conducts are the low-risk activity/food combinations listed in § 117.5(g) and (h). A very small business that is a farm mixed-type facility, but does not satisfy the criteria for the exemptions for only conducting low-risk activity/food combinations, is eligible for modified requirements as a qualified facility, and we will enforce the modified requirements, rather than the full requirements for hazard analysis and risk-based preventive controls, for such very small businesses.

(Comment 12) Some comments express concern that we will enforce the rule more strictly for domestic facilities than for foreign facilities—e.g., because we lack the funds and manpower to enforce the rule for foreign facilities. Other comments assert that it is unprecedented for importing countries to regulate the production processes in exporting countries and that no scientific evidence supports such regulation. These comments express concern that this regulatory requirement will greatly increase trading costs and might constitute a barrier to trade for exporting countries.

(Response 12) We intend to enforce this rule in a consistent manner to ensure that imported and domestically produced foods are in full compliance with the requirements of this rule. We note that the forthcoming FSVP rule will require importers to help ensure that food imported into the United States is produced in compliance with processes and procedures, including reasonably appropriate risk-based preventive controls, that provide the same level of public health protection as those required under this rule. The implementation of these supplier verification programs by U.S. importers will thus provide assurances that imported food is in compliance with this regulation.

We disagree that we are seeking to “regulate the production processes in exporting countries” inappropriately. This rule provides for a flexible set of principles and a framework for hazard analysis and risk-based preventive controls to be applied to a given production process in order to ensure the production of safe food destined for the United States. Mandating that a finished food is manufactured under general methods applicable to all foods (e.g., good manufacturing practices) is a widely accepted regulatory practice and fundamentally different than mandating that food be produced in a certain way. We note that many countries have adopted food safety regulations that mandate certain principles and conditions be applied to food manufacturing. These include mandatory HACCP programs for seafood and other foods. For example, in a guidance document on food safety import requirements, the European Commission stated: “The EU rules on food hygiene confirm that all food businesses in third countries after primary production must put in place, implement and maintain a procedure based on the HACCP principles.” The mandate that preventive controls be applied to control hazards in the production of foods in this rule is similar to the European Union (EU) rules. Because the requirements being implemented by FDA under this regulation are flexible and not prescriptive, we do not agree that this regulation will significantly increase costs or impede trade.

We also disagree that there is no scientific evidence supporting this rule. In the 2013 proposed preventive controls rule, we provided an extensive background discussing the scientific evidence and international food safety standards upon which this rule is based (78 FR 3646 at 3659 through 3667, January 16, 2013). That discussion reviews a number of well documented food safety risks and how they can be controlled by modern food safety systems including the Codex HACCP principles contained in the HACCP Annex of the Codex General Principles of Food Hygiene (78 FR 3646 at 3667, January 16, 2013). In that discussion we stated: “The proposed rule would require that a food safety system similar to HACCP be implemented in food facilities and would harmonize our requirements with the recommendations and requirements of internationally recognized food safety experts/authorities, such as experts/authorities in [Codex Alimentarius], [Food Safety Authority Australia New Zealand], [Canadian Food Inspection Agency], and the European Union.” (78 FR 3646 at 3663, January 16, 2013) In addition, the Appendix to the 2013 proposed preventive controls rule provided additional scientific information on activities such as product testing and environmental monitoring to support their role in ensuring safe food and how these align with international standards such as those of Codex Alimentarius (78 FR 3646 at 3818-3820); republished in its entirety with corrected reference numbers on March 20, 2013, 78 FR 17142 at 17149-17151).

(Comment 13) Some comments assert that the rule should be more concise, and that the average person without a team of experts should be able to understand the rule and manage the application of the rule.

(Response 13) We agree the rule needs to be understandable. We have incorporated plain language techniques—e.g., by using active voice in the new requirements for hazard analysis and risk-based preventive controls. We also have established additional definitions that enable us to improve readability (e.g., “qualified facility exemption,” “raw agricultural commodity,” “unexposed packaged food,” and “you.”) The comprehensive nature of the new requirements for hazard analysis and risk-based preventive controls reflects the extensive statutory provisions they implement and the broad range of activities and foods covered. We have used examples in the regulatory text, where relevant, and provided examples throughout the preamble to assist with understanding the requirements. Likewise, the long-standing CGMP requirements need to be comprehensive, because they are broadly directed to all stages of the production of food. We will be producing guidance documents that will be helpful in understanding the rule (see Response 2).

We will issue a Small Entity Compliance Guide (SECG) in accordance with section 212 of the Small Business Regulatory Enforcement Fairness Act (Pub. L. 104-121). A Small Entity Compliance Guide is a guidance that explains the actions a small or very small business must take to comply with a rule.

(Comment 14) Some comments ask whether we will translate the rule into foreign languages, such as Japanese.

(Response 14) We do not intend to translate the rule. As discussed in Response 13, to help small and very small businesses comply with a rule we issue a SECG. We are considering whether to translate the SECG and outreach and technical assistance materials into additional languages.

(Comment 15) Some comments assert that the rule incorrectly assumes that all bacteria are harmful.

(Response 15) We have long recognized that some bacteria have a role in food production, such as the lactic-acid producing bacteria that our regulations explicitly acknowledge as being added to yogurt (see, e.g., the standards of identity for yogurt, low fat yogurt, and nonfat yogurt, in 21 CFR 131.200, 131.203, and 131.206, respectively). The rule defines the terms “microorganism” and “pathogen,” and the definition of “microorganism” explains that the term “undesirable microorganism” includes those microorganisms that are pathogens, that subject food to decomposition, that indicate that food is contaminated with filth, or that otherwise may cause food to be adulterated. The CGMP provisions directed to either preventing the growth of undesirable microorganisms or preventing contamination with undesirable microorganisms are long-standing, and these comments do not provide any examples of how we have interpreted the CGMP requirements in the past in a way that does not recognize that some bacteria have a role in food production or that creates practical problems for the future. With regard to biological hazards, the new requirements for hazard analysis and risk-based preventive controls focus on pathogens.

(Comment 16) Some comments assert that the rule will disproportionately affect New England farmers because they are small and production costs are higher compared to elsewhere in the country and that the cost of the rule will have negative consequences on New England's food supply. Other comments assert that the rule will force small farmers out of business, forcing us to rely on foreign suppliers who are under very little FDA oversight, and that FDA oversight should be reduced so that the public can continue supporting small, local farmers. Other comments express concern that excessive rules will discourage farmers from supplying the Farm to School market.

(Response 16) We believe that the “farm” definition that we are establishing in this rule greatly reduces the impact on farms of all size, because several operations that would have been required to register as a food facility under the section 415 registration regulations as established in 2003 (68 FR 58894, October 10, 2003) will no longer be required to do so. (See the discussion of the changes to the “farm” definition in section IV.B) In addition, a farm mixed-type facility that is a small or very small business, and that only conducts low-risk activity/food combinations for manufacturing, processing, packing, and holding foods that are not RACs, is exempt from the new requirements for hazard analysis and risk-based preventive controls. A farm mixed-type facility that does not satisfy these criteria for exemption, but is a very small business, is a qualified facility that is subject to modified requirements. All of these factors will reduce the burden on small farms.

(Comment 17) Some comments express concern about contamination of produce and other food in open containers by sulfuric hydrogen being discharged from lead acid batteries that are used to operate forklifts.

(Response 17) The long-standing CGMP provisions require that the food establishment must appropriately use equipment to avoid the adulteration of food with such contaminants (see § 117.40(a)(2)).

(Comment 18) Some comments assert that we do not address comments submitted by individuals.

(Response 18) We address comments on the provisions of the rule regardless of who submits the comments. However, we group similar comments together, and do not discuss the specific text of each submitted comment letter when the point being made by one comment letter can be included in a general discussion of several comment letters that express similar points of view.

(Comment 19) Some comments assert that we need specific standards and quantifiable guidelines for compressed air.

(Response 19) We agree that specific standards and quantifiable guidelines for material such as compressed air could be useful to food establishments that use such material in the production of food. However, we disagree that such standards and guidelines need to be included in the rule. The rule is intended to establish procedures for the safe manufacturing, processing, packing, and holding of food, and for hazard analysis and risk-based preventive controls in the production of food, rather than to set standards for specific levels of contaminants in specific raw materials and other ingredients. If a facility believes that its use of compressed air should be addressed in its food safety plan, then it should do so.

(Comment 20) Some comments ask us to address model laboratory standards and accreditation to ensure that laboratories are using sound and reliable test methods for detecting and identifying pathogens.

(Response 20) We decline this request. A separate section of FSMA addresses “Laboratory Accreditation For Analyses Of Foods” (see section 202 of FSMA). This rule focuses on section 103 of FSMA (section 418 of the FD&C Act).

IV. Comments on Proposed Revisions to the Definitions in the Section 415 Registration Regulations (21 CFR Part 1, Subpart H) and the Section 414 Recordkeeping Regulations (21 CFR Part 1, Subpart J)

A. Definitions That Impact a Determination of Whether an Establishment Is a “Farm”

We previously described section 103(c) of FSMA (78 FR 3646 at 3674). In brief, section 103(c) of FSMA directs us to conduct rulemaking to clarify the on-farm manufacturing, processing, packing, and holding activities that would trigger a requirement for a farm to register as a food facility and, thus, be subject to section 418 of the FD&C Act. We discussed the current legal and regulatory framework for farms under sections 415 and 418 of the FD&C Act, and explained how the status of a food as a RAC or a processed food affects the requirements applicable to a farm under sections 415 and 418 of the FD&C Act. We then articulated a comprehensive set of organizing principles that formed the basis for proposed revisions to the section 415 registration regulations. Because these definitions also are established in the section 414 recordkeeping regulations, these organizing principles also formed the basis for proposed revisions to definitions in the section 414 recordkeeping regulations.

Our previous description (78 FR 3646 at 3675-3676) of the current legal and regulatory framework that governs the determination of when an establishment is required to register as a food facility in accordance with the section 415 registration regulations focused on the framework that governs whether an establishment that grows and harvests crops or raises animals satisfies the definition of “farm,” because the facility registration requirements of section 415 of the FD&C Act do not apply to “farms.” Under that framework, a key factor in whether an establishment falls within the definition of “farm,” even with respect to crops it grows and harvests itself, is whether the activities conducted by the establishment fall within definitions of “harvesting,” “packing” or “holding” (which are within the “farm” definition). Another key factor is whether activities conducted by the establishment fall within the definition of manufacturing/processing (which have been outside the “farm” definition).

We previously described comments regarding proposed revisions to the definitions of “farm,” “harvesting,” “packing” and “holding,” as well as comments regarding the triggers for an activity to be considered manufacturing/processing (79 FR 58524 at 58530-58538). In the 2014 supplemental human preventive controls notice, we proposed additional revisions to the definitions of “farm,” “harvesting,” “packing,” and “holding” to address these comments.

Even after the revisions we proposed in the 2014 supplemental human preventive controls notice, some comments assert that the overall “farm” definition still presents an unrealistic and incomplete understanding of how most farms in the United States are structured with regard to their physical location(s) and business models. Most of the comments suggest alternative or additional regulatory text (see, e.g., Comment 22, Comment 23, Comment 24, Comment 25, Comment 27, Comment 37, Comment 39, and Comment 50) or ask us to clarify how we will interpret the provisions (see, e.g., Comment 26, Comment 28, Comment 29, Comment 40, Comment 41, Comment 42, Comment 43, Comment 44, Comment 47, and Comment 48).

As discussed in section I.A, there are several FSMA-required regulations that provide the framework for industry's implementation of preventive controls and enhance our ability to oversee their implementation for both domestic and imported food (see the seven foundational rules listed in table 1). Two of the proposed rules listed in table 1 (i.e., the 2013 proposed animal preventive controls rule and the 2013 proposed intentional adulteration rule) proposed to include a cross-reference to the “farm” definition in § 1.227, and a third proposed rule (i.e., the 2013 proposed produce safety rule) proposed to establish the same “farm” definition as would be in § 1.227. A fourth proposed rule (i.e., the 2013 proposed FSVP rule) did not propose to establish the “farm” definition (or a cross-reference to the “farm” definition in § 1.227), but under its proposed definition of “foreign supplier” some foreign suppliers would be farms—i.e., establishments that harvest food that is exported to the United States. As a result, we received comments relevant to the “farm” definition for all of these rules. The majority of the comments submitted to these other rulemakings addressed issues that were the same as, or similar to, the issues raised in the comments submitted to this rulemaking. One comment submitted to the proposed rulemaking for the forthcoming FSVP rule requested clarification regarding harvesting companies, and we are also providing that clarification in this rulemaking. See Response 32.

We proposed to redesignate all definitions in § 1.227 in the section 415 registration regulations (i.e., current § 1.227) to eliminate paragraph designations (such as (a) and (b)). We received no comments that disagreed with our proposed redesignations and are finalizing them as proposed.

We proposed several technical amendments and conforming changes to the section 415 registration regulations and to the section 414 recordkeeping regulations. No comments opposed the proposed technical amendments and conforming changes, except for comments noting that our proposed technical amendment to § 1.361 was unnecessary because we had already made this change in a different rulemaking (see 77 FR 10662, February 23, 2012). We are finalizing these technical amendments and conforming changes without change.

In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed definitions as shown in table 4, with editorial and conforming changes as shown in table 52. We also are establishing a new provision to allow off-farm establishments that package, pack, and hold RACs that are produce as will be defined in the produce safety rule to comply with the CGMPs in part 117, subpart B by complying with the applicable requirements for packing and holding that will be established in the final produce safety rule (see § 117.8 and Response 25). Because the new provision refers to provisions in a future produce safety rule, we will publish a document in the Federal Register announcing the effective date of § 117.8 once we finalize the produce safety rule.

B. Proposed Revisions to the Definition of Farm

We proposed to revise the “farm” definition to: (1) Provide for on-farm packing and holding of RACs to remain within the farm definition regardless of ownership of the RACs; (2) include, within the “farm” definition, a description of packing activities that include packaging RACs grown or raised on a farm without additional manufacturing/processing; and (3) provide for drying/dehydrating RACs to create a distinct commodity (such as the on-farm drying of grapes to produce raisins), and packaging and labeling such commodities, without additional manufacturing/processing, to remain within the farm definition. We also requested comment on whether we should retain, remove, or modify the phrase “in one general physical location” in the “farm” definition.

(Comment 21) Most of the comments support our proposed revision to provide for on-farm packing and holding of RACs to remain within the farm definition regardless of ownership of the RACs. However, some comments oppose this proposed revision. Some comments ask us to require that a farm that packs, packs and sells, commingles lots, and holds produce grown on a farm under different ownership comply with the requirements of this rule for hazard analysis and risk-based preventive controls for six reasons: (1) Commingling. Contamination from one farm could find its way to another farm, leading to potential contamination of products from both farms, making it difficult to pinpoint the source of contamination in the event of a recall. (2) Recall Plan. It is critical for everyone in the produce supply chain to be “recall ready,” especially those packing, commingling lots, and selling produce grown on another farm under different ownership. (3) Traceability. It is important that produce be traceable from the specific farm where it was grown to the end-user, and from the end-user back to the farm where it was grown. (4) Exemptions. A covered farmer packing, packing and selling, commingling lots, or holding others' produce might be doing so from a farm that is exempt from the produce safety rule. (5) Supplier program. Under the human preventive controls rule a farmer would be required to have a valid supplier program. (We note that a farmer might be a supplier to a facility that is subject to the human preventive controls rule, and could be subject to the facility's supplier program, but would not itself be required to “have a valid supplier program.”) With this requirement, receiving facilities could purchase in confidence knowing that if the farm did pack others' produce it was produced in accordance with the rules required by FSMA. (6) Conflict with the National Organic Program (NOP). Under the NOP, a grower that purchases produce from another farm under different ownership, packs produce from another farm, or mixes produce is no longer considered a crop producer and must seek certification as a handler—an operation that has additional requirements to approve suppliers, segregate product, and maintain records necessary to demonstrate compliance. Comments assert that this NOP requirement is logical and is a practice that FDA should take into consideration.

Other comments assert that allowing a farm to pack produce from another farm must account for the problem created by our proposal to exempt farm vehicles transporting RACs from the sanitary transportation rule. These comments argue that unless we revise that rule to prevent possible contamination during transport, we should develop guidance for farms packing produce that is transported from another farm, particularly where the commodity is high risk.

(Response 21) The final “farm” definition continues to provide for on-farm packing and holding of RACs to remain within the farm definition regardless of ownership of the RACs. We have acknowledged that doing so would have consequences such as those described in these comments, as well as other consequences (see 79 FR 58524 at 58532). Although comments pointed out consequences that we had already considered, they did not point to any other consequences. Therefore, we affirm our tentative conclusion that impacts such as these, while not always optimal, are necessary to establish a sensible framework of risk-based regulations that both implement FSMA and reflect common farm activities. We intend to issue the final produce safety rule in the near future and respond to comments related to traceability of produce, including whether to include a requirement that a farm supplying produce to another farm that will pack or hold that produce should provide to the farm that receives the produce its name, complete business address, and description of the produce in any individual shipment, as well as respond to comments on whether it would be appropriate to also require the farm that receives the shipment maintain such record of information and, if so, for what specified period of time.

In the 2014 proposed sanitary transportation rule, we explained our reasons for tentatively concluding that the sanitary transportation practices that would be required by that proposed rule are not necessary to prevent RACs from becoming adulterated during transportation by farms (79 FR 7006 at 7016, February 5, 2014). For example, we explained that we are not aware of instances in which insanitary conditions (e.g., improper temperature control, improper equipment construction, inadequate equipment cleaning) with regard to transportation operations conducted by farms involving the transportation of RACs have contributed to foodborne illness, regardless of whether the farms are conducting transportation operations for their own RACs or for others' RACs. We will consider comments we receive on our proposal to exempt farm vehicles transporting RACs from the sanitary transportation rule when we issue a final sanitary transportation rule. We will consider necessary guidance in light of the final sanitary transportation rule, but we note that good transportation practices are already included in our 1998 guidance for industry entitled “Guide to Minimize Microbial Food Safety Hazards for Fresh Fruits and Vegetables” (Ref. 13).

(Comment 22) Some comments assert that farms are neither facilities nor establishments. These comments ask us to revise the “farm” definition to use a term more suited to the nature of farming.

(Response 22) We consider a farm to be a type of “establishment” but have nonetheless revised the “farm” definition to refer to an “operation” rather than an “establishment” as requested by these comments.

(Comment 23) Many comments address the role of “ownership” in the “farm” definition. Some of these comments emphasize that farming operations are complex, with complex business structures, and are often not held under sole ownership. Some comments describe the role of multiple business models (such as cooperatives, on-farm packinghouses under ownership by multiple growers, food aggregators, and food hubs) in modern farming and ask us to revise the “farm” definition to provide for such business models. Other comments emphasize ownership of the land on which crops are grown or animals are raised, noting that some farms are operated by “tenant” farmers who do not own the land used in the farm's operations. Some comments ask us to replace the concept of ownership with the concept of a responsible party, such as a “farm operator” and to define a farm operator as “the person or entity that has operational control over the farm and benefits in whole or in part from the farm's normal operation. A farm operator may be an owner, a tenant, a partner, or an employee.”

Some comments ask us to remove the phrase “under one ownership” to allow sugar makers who share equipment and sugarhouses to qualify as a farm. Other comments ask us to clarify how renting or leasing storage rooms or facilities would affect the definition of a farm.

(Response 23) We have revised the “farm” definition by replacing the phrase “under one ownership” with the phrase “under one management.” Although the original phrase “under one ownership” was not referring to a single owner, we agree that the “farm” definition should reflect modern business models (such as cooperatives, on-farm packinghouses under ownership by multiple growers, food aggregators, and food hubs) and use language that the modern farming community understands. We decline the request to define and introduce a new term, such as “farm operator.” The term “management” has a common meaning that captures the request of these comments and is suitable for the purposes of the farm definition. (Management. The person or persons controlling and directing the affairs of a business, institution, etc.) (Ref. 14).

Under either the previous or the revised “farm” definition, leasing land to grow or store crops or raise animals does not impact whether an operation is within the “farm” definition. Under the previous definition, “ownership” focused on ownership of the business entity conducting farm operations, not ownership of the land. Leasing land is a business practice common to a variety of business types, not just farms. Likewise, leasing buildings to store RACs does not impact whether an operation is within the “farm” definition. See also Response 24 regarding comments on “one general physical location.”

To the extent that sugar makers who share equipment and sugarhouses only conduct activities that are within the “farm” definition, the revision from “under one ownership” to “under one management” should clarify that those operations would be within the “farm” definition. However, when sugar makers conduct operations outside the “farm” definition, they are facilities that are required to register under the section 415 registration regulations, not “farms” that are exempt from that registration requirement. A sugar maker that is a small or very small farm mixed-type facility that only conducts the low-risk activity/food combinations listed in the exemptions in § 117.5(g) and (h) (such as making syrup and sugar (e.g., making maple syrup from maple sap)) is exempt from the requirements of this rule. However, a farm mixed-type facility that is not a small or very small business as those terms are defined in this rule, or that conducts activities in addition to the low-risk activity/food combinations listed in the exemptions in § 117.5(g) and (h), is subject to the requirements for hazard analysis and risk-based preventive controls. Consistent with the discussion in Response 228, a farm mixed-type facility that must comply with the requirements for hazard analysis and risk-based preventive controls and makes sugar from sugarcane or sugar beets can consider the findings of the section 103(c)(1)(C) RA (i.e., that this is a low-risk activity/food combination) in determining whether there are any hazards requiring a preventive control. A facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components. For additional information about the section 103(c)(1)(C) RA and the exemptions for on-farm low-risk activity/food combinations for farm mixed-type facilities that are small or very small businesses, see sections VI and XI.G.

(Comment 24) Many comments address the role of “one general physical location” in the “farm” definition and ask us to revise the “farm” definition to acknowledge that farms may be composed of multiple parcels, buildings, or structures that may or may not be contiguous. Some comments point out that there are many farming operations that may fall under the same management and ownership, but are separated by either a strip of land, body of water, or another structure, particularly with respect to sites designated for packing and holding operations. Some comments assert that as long as an economic unit is operating a farm it should be irrelevant where the land is located, and state that this interpretation is consistent with a USDA definition of a “farm operator.” Some comments note that sugar makers rely on sap from existing stands of trees that are often not concentrated in a single area or even nearby the sugarhouse where the maple products are made. Some comments suggest that the term “reasonable distance” could be used to better define “general physical location.” Some comments ask us to issue guidance that will clarify and further designate the boundaries of “one general physical location.”

Some comments note that the “farm” definition we proposed in the 2014 supplemental human preventive controls notice correctly considers a farm operation to remain within the “farm” definition even if it packs and holds produce from another farm. However, these comments state that it is confusing that if the same two farms pack and hold produce together at an off-farm location, using the exact same practices, that packing location is considered a “facility” even though there is no difference in risk. Other comments state that both in-line and off-line egg production facilities should be considered farms. According to these comments, off-line egg production facilities receive eggs laid by hens at nearby farms, whereas in-line egg production facilities receive eggs laid by hens in henhouses adjacent to the plant and located on the same property.

Some comments ask us to retain “one general physical location” in the “farm” definition because the word “farm,” and USDA's definition of “farm,' are “place-based.” Other comments assert that if we delete the phrase “in one general physical location” then a fully integrated operation could be a single farm even though it was made up of numerous distinct farms possibly in several different states. Other comments ask us to retain “one general physical location” in the “farm” definition because different locations may have different food safety risks, different water sources, different personnel, and even different types of crops. Some comments assert that considering each unique and individually State-permitted dairy farm to be an individual “farm” regardless of common ownership or geographic proximity will prevent conflict and interference with the permitting and inspection activities of the Grade “A” program while maintaining food safety. Other comments state that regardless of whether we retain “one general physical location” in the “farm” definition, we must interpret the term “farm” to cover a very limited geographic area and that separate locations that are not in close proximity to each other should not be considered the same “farm.”

(Response 24) We have revised the “farm” definition to specify that a farm is “in one general (but not necessarily contiguous) physical location.” We have concluded that adding “not necessarily contiguous” makes it clear that farming operations that are under one management but have some physical separation (e.g., with respect to the location of packing operations) can remain within the “farm” definition and that both in-line and off-line egg production facilities would be considered “farms.”

We agree that separate locations that are not in close proximity to each other should not be considered the same “farm.” As the comments point out, there already is a framework of State inspections for farms such as dairy farms, and we will need to work with our State regulatory partners to identify farms covered by the produce safety rule. However, even without the new phrase “not necessarily contiguous,” some situations would be complex. We intend to address these types of situations with our State food safety partners. (See Response 5.)

We do not see that adding “not necessarily contiguous” creates a “farm” definition that is not “place-based,” as was asserted by some comments, because the definition continues to specify “in one general physical location.” We also do not see that adding “not necessarily contiguous” presents any food safety concerns, as asserted by comments noting that different locations may have different food safety risks, different water sources, different personnel, and different types of crops. For example, a farm that will be covered by the forthcoming produce safety rule will be subject to standards for all of its water sources, all of its personnel, and all food subject to that rule. Likewise, we also do not believe that adding “not necessarily contiguous” affects a determination of whether a fully integrated operation could be a single farm.

(Comment 25) Some comments ask us to consider revising the regulatory text to ensure that similar activities would be treated the same way under either the produce safety rule or the human preventive controls rule and be held to the same risk-based requirements. These comments point out some of the differences between the requirements that would be established under the proposed human preventive controls rule and the requirements that would be established under the proposed produce safety rule. For example, comments state that the proposed human preventive controls rule, but not the proposed produce safety rule, would require off-farm packinghouses and off-farm cooling and storage facilities to have a written hazard analysis; written preventive controls; written procedures for monitoring and corrective actions; validation of process controls; a written recall plan; environmental monitoring and product testing requirements; and a written supplier program. As another example, comments state that off-farm packing and holding operations would be required to comply with the human preventive controls rule one year earlier than we proposed that similar sized on-farm packing and holding operations would be required to comply with the forthcoming produce safety rule.

Some comments recommend options to achieve the goal of regulating on-farm and off-farm packinghouses the same way. These options include adding an exclusion to the “farm” definition in the produce safety rule; adding provisions to the human preventive controls rule to enable off-farm packinghouses to meet their obligation by complying with specified, applicable subparts of the produce safety rule; shortening the “farm” definition to simply state “Farm means an establishment under one ownership devoted to the growing and/or harvesting of crops, the raising of animals (including seafood), or any or all of these activities;” addressing off-farm establishments engaged solely in “low-risk” farming and harvesting activities by adding low-risk activities such as hulling, shelling, and drying of tree nuts; expanding the scope of the produce safety rule to include registered facilities; and allowing modified requirements in the human preventive controls rule to allow off-farm packinghouses to be subject to requirements (and exemptions) of the produce safety rule within the framework of the human preventive controls rule.

Some comments emphasize that farm activities are farm activities, regardless of where they happen. Some comments assert that establishments that are engaged solely in traditional harvesting, holding, or packing activities associated with a RAC that will be covered by the produce safety rule should be subject to the produce safety rule, rather than the human preventive controls rule, regardless of physical location, ownership, or legal ties to an operation devoted to the growing and harvesting of produce. Some comments assert that an off-farm operation that packs and holds RACs could be regulated in an identical fashion to an on-farm operation that packs and holds RACs without changing the section 415 requirement for registration by making them subject to the requirements of the produce safety rule for compliance purposes. Some comments ask us to provide an exemption from, or waiver for, the requirements of the human preventive controls rule if a business entity provides documentation that the entity is following the standards of the produce safety rule even though it is not on a farm. Other comments ask us to clarify that a farm can pack or hold RACs that have already undergone packing or holding activities by another farm.

Some comments ask to revise the “farm” definition to include establishments solely engaged in “packing” and “holding” activities performed on RACs, regardless of whether the establishment grows crops. Other comments emphasize that any revisions to the “farm” definition must allow genuine farm operators to carry out harvesting, packing, and holding without opening loopholes for packing and processing businesses. Some comments ask us to revise the “farm” definition to provide for a multi-ownership operation provided that all of the partial owners are themselves farmers.

Some comments ask us to provide that off-farm packing and holding operations that do not change the status of a RAC into a processed food should be able to comply with either the produce safety rule or with the CGMPs in subpart B of the human preventive controls rule. According to these comments, we could simply apply the same logic that we applied when providing that the packing and holding of RACs that have been dried/dehydrated to create a distinct commodity that is a processed food (i.e., no longer a RAC) may achieve compliance with the CGMP requirements by complying either with subpart B of the human preventive controls rule or by complying with the applicable requirements for packing and holding produce RACs in the produce safety rule (see § 117.5(k)(2)).

(Response 25) We have revised the “farm” definition to provide for two types of farms: (1) A primary production farm and (2) a secondary activities farm (see § 117.3). We use the term “primary production farm” to refer to the “farm” definition as proposed, with the revisions described in this final rule. We use the term “secondary activities farm” to mean an operation, not located on a primary production farm, devoted to harvesting (such as hulling or shelling), packing, and/or holding of RACs, provided that the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm. A secondary activities farm may also conduct those additional activities allowed on a primary production farm. With the added definition of “secondary activities farm,” off-farm packinghouses that are managed by a business entity (such as a cooperative) that is different from the business entity growing crops (such as individual farms) can be within the “farm” definition. We are making these changes to reflect the current reality of what it means to be a farm. The changes will allow farms that use certain business models to harvest, pack, and/or hold produce to be able to comply with the produce safety rule for all of their operations. We believe that this flexibility allows for the requirements of the produce safety rule to apply to a wider array of activities than our original proposal without opening the “farm” definition to operations that have no connection to the growing of crops or the raising of animals—the core activities of a farm. By specifying that the farms that grow or raise the majority of the RACs harvested, packed, and/or held by the operation must own, or jointly own, a majority interest in the secondary activities farm, the revised “farm” definition does, as requested by comments, allow “farms” to carry out harvesting, packing, and holding activities in the same way as the produce safety rule.

We are, as requested by some comments, establishing a new provision to allow off-farm establishments that package, pack, and hold RACs that are produce as will be defined in the produce safety rule to comply with the CGMPs in part 117, subpart B by complying with the applicable requirements for packing and holding that will be established in the final produce safety rule (see § 117.8). Because the new provision refers to provisions in a future produce safety rule, we will publish a document in the Federal Register announcing the effective date of that provision once we finalize the produce safety rule.

However, the revised “farm” definition does not, as requested by some comments, establish the exact same regulatory framework for operations, such as certain packinghouses and hulling/shelling operations, that are within the “farm” definition as for operations that conduct similar activities but are outside the “farm” definition by allowing off-farm operations to be subject to the produce safety rule rather than the requirements for hazard analysis and risk-based preventive controls. We disagree that the statutory framework provides flexibility for entities such as packinghouses and hulling/shelling operations that do not have a connection to a farm to be subject to the requirements of the produce safety rule for compliance purposes. (See the discussion at 79 FR 58524 at 58536.) We continue to believe that an off-farm packinghouse that is subject to this rule will be able to draw from the provisions of the produce safety rule in developing its food safety plan and establishing preventive control management components that are appropriate in light of the nature of the preventive controls and their role in the facility's food safety system. For example, as previously discussed (79 FR 58524 at 58536) we expect that the food safety plan for an off-farm packinghouse would focus on a few key preventive controls, including some that would have counterparts in the proposed produce safety rule, such as maintaining and monitoring the temperature of water used during packing (which would have counterparts under proposed § 112.46(c) in the proposed produce safety rule). We also expect that an off-farm packinghouse would establish sanitation controls to address the cleanliness of food-contact surfaces (including food-contact surfaces of utensils and equipment) and the prevention of cross-contamination from insanitary objects and from personnel to food, food-packaging material, and other food-contact surfaces. On-farm packinghouses would be subject to similar, but not identical, requirements (see e.g., proposed § 112.111(b) for cleanliness of food-contact surfaces and proposed § 112.113 for protection against contamination).

We acknowledge that some of the provisions of the human preventive controls rule have no explicit counterparts in the proposed produce safety rule (e.g., the requirements for product testing and environmental monitoring as verification activities). As discussed in Response 525, we do not expect either product testing or environmental monitoring to be common in facilities that process, pack, or hold produce RACs.

Finally, in response to comments that ask for a clarification that a farm can pack or hold RACs that have already undergone packing or holding activities by another farm, we presume that the commenter was asking about a case where the farm that did the previous packing and holding activities was not the farm on which the RACs were grown and harvested. The definition of “farm” allows packing and holding of one's own RACs and other's RACs, even if they have been previously packed or held by another farm that was not the farm on which the RACs were grown and harvested.

(Comment 26) Some comments ask us to clarify whether the “and” between provisions that allow a farm to dry/dehydrate RACs to create a distinct commodity, and provisions that allow a farm to package and label RACs, means that an operation must do both of these activities to remain within the farm definition. These comments state that they do not think this is the intended (or logical) outcome, which is to provide that farms can do either or both activities and still be within the farm definition and ask us to consider editorial changes (such as replacing “and” with “or,” or adding a new paragraph that would encompass both activities).

(Response 26) The rule does not require a farm to do both activities (i.e., drying/dehydrating RACs to create a distinct commodity, and packaging and labeling RACs) to remain within the farm definition.

(Comment 27) Some comments ask us to add artificial ripening of RACs as an activity that is within the farm definition. Some comments assert that artificial ripening of RACs is not manufacturing/processing because artificial ripening does not transform a RAC into a processed food.

(Response 27) We have revised the “farm” definition to specify that treatment to manipulate the ripening of RACs (such as by treating produce with ethylene gas), and packaging and labeling the treated RACs, without additional manufacturing/processing, are within the “farm” definition. We agree that a treatment such as artificial ripening does not transform a RAC into a processed food but disagree that such a treatment is not manufacturing/processing. To make that clearer, we have added “treating to manipulate ripening” to the list of examples of manufacturing/processing in the definition of that term. As discussed during the rulemaking to establish the section 415 registration regulations, artificial ripening constitutes manufacturing/processing because it involves treating, modifying, or manipulating food (68 FR 58894 at 58912, October 10, 2003). See also our previous statements about artificial ripening in this rulemaking (78 FR 3646 at 3683 and 79 FR 58524 at 58572).

As previously discussed, the activities that transform a RAC into a processed food (and are sometimes therefore referred to as “processing” in the context of a food's status as a RAC or processed food) are not coextensive with the activities described in our definition of “manufacturing/processing” (78 FR 3646 at 3679). When we first established the section 415 registration regulations, a key criterion in determining whether a business entity was a “farm” or a “facility” was whether the operation conducted activities classified as “manufacturing/processing.” Indeed, in the 2013 proposed preventive controls rule we continued to rely on that key criterion in proposing revisions to the “farm” definition. However, as already discussed, some changes to the “farm” definition are necessary to establish a sensible framework of risk-based regulations that both implement FSMA and reflect common farm activities (see Response 21). One of these changes is to specify those manufacturing/processing activities that are within the “farm” definition, rather than attempt to re-classify an activity that arguably is manufacturing/processing as harvesting, packing, or holding in order to provide for the activity to remain within the “farm” definition.

(Comment 28) Some comments disagree that we should provide for drying/dehydrating RACs to create a distinct commodity to be within the “farm” definition because this activity is a manufacturing/processing activity and should be subject to the requirements for hazard analysis and risk-based preventive controls. Other comments agree that we should provide for this activity but assert that “drying/dehydrating RACs to create a distinct commodity” is confusing to the average reader and ask us to add examples of what this means. Some comments ask us to clarify whether this activity applies to specific situations, such as drying/baling of hops (because hops are a low-risk product and beer brewing should eliminate any pathogens on the hops), drying plums to create prunes, and concentrating maple sap into maple syrup, cream, and candy. Some comments assert that maple syrup should be considered a RAC because the process of producing maple syrup mirrors the regulatory text “drying/dehydrating RACs to create a distinct commodity,” because maple syrup can only be produced through the concentration of maple sap and the process of that concentration is akin to the harvesting of other raw products. Other comments assert that the processing of sap is more appropriately viewed as a harvesting activity (rather than food manufacturing).

Other comments ask us to clarify the specific methods of drying/dehydrating that we would consider to be within the “farm” definition—e.g., whether drying/dehydrating is constrained to in situ, with no heat or mechanical air circulation, because the example we discussed in the 2014 supplemental preventive controls notice was “natural condition raisins.” These comments ask us to specify the allowable methods of drying to avoid confusion, and assert that there is no food safety reason to exclude use of heat or air, especially if sun and light are to be permitted. Other comments ask us to clarify what we mean by “without additional manufacturing/processing.”

(Response 28) We are retaining drying/dehydrating RACs to create a distinct commodity as an activity that is within the “farm” definition even though it is manufacturing/processing. As previously discussed, the processes (described in comments to the 2013 proposed human preventive controls rule) for drying grapes to “natural condition raisins” are akin to other harvesting activities traditionally conducted by farms on RACs grown and harvested on farms, because they are traditionally performed by farms for the purpose of removing RACs from the place they were grown or raised and preparing them for use as food (79 FR 58524 at 58533). As also previously discussed, the information provided by the comments to the 2013 proposed human preventive controls rule included information that “natural condition raisins” are produced with either sun-drying or artificial dehydration (79 FR 58524 at 58533). We did not intend to limit the processes for drying/dehydrating RACs to sun-drying, and the regulatory text includes no such limitation. We decline the request to specify specific methods of drying/dehydrating that would remain within the “farm” definition because doing so could imply that the list of methods was exhaustive and preclude use of new technology in the future.

However, we are adding “boiling” and “evaporating” to the list of activities that we classify as manufacturing/processing to preclude interpretations, such as those expressed in some of these comments, that the processes to produce products such as maple syrup, maple cream, and maple candy are “drying/dehydrating.” In the 2013 proposed human preventive controls rule we included “Boiling/evaporation of maple sap to make maple syrup” as a low-risk manufacturing/processing activity/food combination in the exemption for small and very small businesses that only conduct specified on-farm low-risk activity/food combinations (proposed § 117.5(h)), and we have retained—and broadened—that activity/food combination as an on-farm, low-risk manufacturing/processing activity/food combination in the final human preventive controls rule (see § 117.5(h), which includes making sugar and syrup from fruits and vegetables (e.g., dates), grains (e.g., rice, sorghum), other grain products (e.g., malted grains such as barley), saps (e.g., agave, birch, maple, palm), sugar beets, and sugarcane). Processes such as “boiling,” “concentrating,” and “evaporating” are not “drying/dehydrating” as the term “drying/dehydrating” is used in this rule, and maple syrup is a processed food, not a RAC. See also the discussion in Response 23 regarding how a farm mixed-type facility that makes sugar from sugarcane or sugar beets can consider the findings of the section 103(c)(1)(C) RA (i.e., that this is a low-risk activity/food combination) in determining whether there are any hazards requiring a preventive control. A farm mixed-type facility that makes maple products from maple sap could follow the same approach.

We have added “slicing” to the regulatory text as an example of additional manufacturing/processing that would be outside the “farm” definition. We also have added “drying/dehydrating grapes to produce raisins” to the regulatory text as an example of what we mean by “drying/dehydrating RACs to create a distinct commodity.” Drying plums to produce prunes is another example of drying/dehydrating RACs to create a distinct commodity. Drying/baling hops is within the “farm” definition, but as a “holding” activity because drying/baling hops does not create a distinct commodity. As discussed in Response 39, we have revised the definition of “holding” to add drying/dehydrating RACs when the drying/dehydrating does not create a distinct commodity (such as drying/dehydrating hay or alfalfa) as an example of a holding activity.

(Comment 29) Some comments agree that the activities of packaging and labeling RACs should remain within the “farm” definition but ask us to reclassify these activities so that they are not considered manufacturing/processing because they do not transform a RAC into a processed food or change the nature of the RAC. These comments ask us to add examples to regulatory text to explain what we mean by “packaging and labeling without additional manufacturing/processing.” As an example, these comments ask whether a farm that packs produce grown by another farm, and washes the produce before packing it, would be conducting “additional manufacturing/processing.”

Other comments ask us to clarify whether packaged RACs are processed food because “packaging” is defined as a manufacturing/processing operation. These comments also ask us to clarify whether a farm would be precluded from holding RACs packaged in retail form because the packaged RACs are processed food.

(Response 29) See Response 27. We decline the request to reclassify packaging and labeling so that they would not be considered manufacturing/processing. Although we classify packaging and labeling as manufacturing/processing, packaging and labeling RACs do not transform the RACs into processed food, and we classify “packaged RACs” as RACs.

We classify washing RACs as a harvesting or packing activity when done on RACs before or during packing or packaging, regardless of whether a farm is packing or packaging its own RACs or others' RACs. As requested by the comments, we have added an example of additional manufacturing/processing that would not be within the “farm” definition—i.e., irradiating—to both the “farm definition” and to the definition of “manufacturing/processing.” This example is different from the example we used in the preamble of the 2014 supplemental human preventive controls notice to describe a limitation on activities within the “farm definition”—i.e., “modified atmosphere packaging” (see 79 FR 58524 at 58532). We have decided to not restrict the specific types of packaging procedures that are within the “farm” definition because doing so could be confusing. Moreover, the specific safety concern that can be associated with modified atmosphere packaging (i.e., the production of Clostridium botulinum toxin), would be addressed by a proposed provision in the forthcoming produce safety rule, if that provision is finalized (see proposed § 112.115; 78 FR 3504 at 3589 and 3638). To clarify that “modified atmosphere packaging” is a type of “packaging,” we have revised the definition of “manufacturing/processing” to specify “packaging (including modified atmosphere packaging)” as an example of a manufacturing/processing activity.

(Comment 30) Some comments assert that non-produce botanicals require treatments that do not create a new commodity and ask us to recognize these treatments as farm activities rather than manufacturing/processing activities. As examples, these comments assert that activities such as cutting, slicing, drying, freezing, wet or dry heat treating to kill plant tissues, and aging or fermenting are all activities that are traditionally performed by farms on non-produce botanicals for the purpose of removing non-produce botanical RACs from the place where they were grown and preparing them for use as food. These comments also assert that we have been inconsistent in our activity classifications because we both state that “heat treatment” is a food processing activity and state that activities traditionally performed by farmers to prepare crops for use are farm activities. These comments express concern that farmers won't use heat treatments to control pests, based on a misunderstanding of what constitutes “food processing.”

(Response 30) We note that these comments used the term “non-produce botanicals,” which is not a term we have used or defined, and it is not clear to us what the commenters intended this term to represent. In this document, we are not addressing the question of whether certain “botanicals” are or are not “produce.” The term “produce” was proposed to be defined in the forthcoming produce safety rule, and we intend to define it in that rule.

However, we can address in this rule these commenters' questions about activity classification. Some of these activities are within the “farm” definition. For example, drying/dehydrating a RAC without creating a distinct commodity is part of “holding” and drying/dehydrating a RAC that creates a distinct commodity, without additional manufacturing/processing, is manufacturing/processing that is included within the “farm” definition. (See Response 28.) Cutting (or otherwise separating) the edible portion of the RAC from the crop plant and removing or trimming part of the RAC (e.g., foliage, husks, roots or stems) are harvesting activities. (See Response 37.) We have revised the definition of “holding” to include the example of “fumigating food during storage.” (See Response 39.) We decided to include this example of a holding activity based on previous discussions of how we classify fumigating as a type of pest control (see, e.g., 78 FR 3646 at 3682 and 79 FR 28524 at 28571). Although we have not previously classified heat treatment for purposes of pest control, we agree that we should classify heat treatment for purposes of pest control the same way that we have classified fumigating for purposes of pest control—i.e., as a holding activity. Regarding classification of the other activities listed in these comments, see Response 3.

(Comment 31) Some comments assert that the “farm” definition is too limited and ask us to include standard farm activities such as culling, conveying, sorting, waxing, labeling, storing, packaging and shipping of raw, whole produce. These comments assert that these normal activities do not change the shape or structure of RACs, or alter the hazards, and should be covered under the produce safety rule rather than the human preventive controls rule.

(Response 31) All of the activities described by these comments could be within the “farm” definition (see 79 FR 58524 at 58571-58572), either because they are specified in the “farm” definition itself or because they are examples of activities within the definition of “packing” or holding.” Packaging and labeling RACs, without additional manufacturing/processing, are specified in the regulatory text of the “farm” definition. Sorting and culling are included in the regulatory text of the definition of “packing.” Storing is simply another term for “holding.” We had already included “weighing and conveying” as an example of a low-risk packing or holding activity in the exemption applicable to on-farm low-risk activity/food combinations (§ 117.5(g)). To give more prominence to this packing activity, we have added it to the definition of “packing” as well.

(Comment 32) One comment, submitted to Docket No. FDA-2011-N-0143 for the FSVP rulemaking, notes that RACs often are harvested by a contract harvest company (Ref. 16). This comment asks us to clarify what is meant by “establishment that harvests a food” in the definition of “foreign supplier” and whether, in such circumstances, the supplier of the RAC would be the contract harvest company or the establishment that owns the crop and sells it to an importer.

(Response 32) The 2014 supplemental human preventive controls notice had similar phrasing (“establishment that harvests the food”) in the definition of “supplier.” In the final rule the definition of “supplier” has changed in relevant part to include the “establishment that grows the food,” consistent with changes to the farm definition and as described in the following paragraphs.

There are several different business models in which RACs are harvested by a contract harvester (Ref. 17). In one business model, a grower contracts with a harvester to perform harvesting on behalf of the grower. In another business model, a third-party handler enters into separate contracts with the grower and the harvester. In another business model, a grower sells its crop to an entity that contracts with a separate harvester to harvest the RACs and then packs the RACs. There are variations on these business models, such as when a grower sells its crop to an entity that both harvests and packs the RACs, without a contract with a separate harvester.

Growing and harvesting operations are not under the same management in some of these business models. As discussed in Comment 23, comments emphasize that farming operations can have complex business structures, and ask us to revise the “farm” definition to provide for these business models. To explicitly include these business models in the “farm” definition, we have revised the “farm” definition to mean an operation under one management in one general (but not necessarily contiguous) physical location devoted to the growing of crops, the harvesting of crops, the raising of animals (including seafood), or any combination of these activities. With this revision, an operation can be within the “farm” definition if it grows crops but does not harvest them or if it harvests crops but does not grow them.

The “farm” definition established in the section 415 registration regulations in 2003 (68 FR 58894), and the proposed revisions to the “farm” definition in the 2013 proposed human preventive controls rule and the 2014 supplemental human preventive controls notice, all describe a “farm” as an entity “devoted to the growing and harvesting of crops” (emphasis added). In light of the revision to the “farm” definition and as discussed more fully in section IX.C.35, we have revised the “supplier” definition to include the establishment that “grows the food” rather than the establishment that “harvests the food.” With this change in the “supplier” definition, the supplier is the farm that grows the food regardless of the business model for harvesting the food.

(Comment 33) Some comments ask us to modify the “farm” definition to exclude feed mills that provide feed to more than 5 other farms. These comments assert that egg farms are most likely to be company owned and the median number of farms owned by a company is under 8 and cite USDA as the source of this information. These comments assert that setting the limit at 5 would not automatically exempt feed mills operated by these large egg laying businesses from the animal preventive controls rule.

(Response 33) We decline this request. The statutory exemption from the section 415 registration regulations (and, thus, from the requirements for hazard analysis and risk-based preventive controls) for “farms” is based on the activities that an operation conducts rather than on the size of the operation.

(Comment 34) Some comments assert that the hulling or dehydration of walnuts should not be considered processing and, thus, that an establishment that conducts hulling or dehydration activities on tree nuts such as walnuts should not be considered a facility subject to the requirements for hazard analysis and risk-based preventive controls. These comments also assert that all growers who hull and dry should operate under the same rules, regardless of whether or not they own their own crop. Some comments assert that the hulling and shelling operations in the nut industry are part of the harvesting operation in which the outer shells are removed. These comments state that regardless of whether activities are conducted on the farm in which they are grown or at an off-farm facility that provides hulling and shelling services, the food is a RAC, the activity is low-risk and does not transform the RAC into a processed food, and the product is delivered to a processing facility and is not distributed in commerce. The comments argue that for all these reasons and because hulling and shelling activities are not subject to subpart B, it is not appropriate to subject facilities that conduct such activities to subpart C. Comments request that hulling, shelling, and drying of tree nuts be considered “on farm” for the purposes of this rule. Other comments ask us to specify that the production of “natural dried raisins,” dried plums, and dried hops are within the “farm” definition.

(Response 34) Hulling of tree nuts (such as walnuts, almonds, and pistachios) is a harvesting activity that is within the “farm” definition when conducted on a farm or the farm part of a farm mixed-type facility. Drying/dehydrating RACs without creating a distinct commodity (such as drying walnuts and hops) is a holding activity that also is within the “farm” definition when conducted on a farm or farm mixed-type facility. As discussed in Response 25, we have revised the “farm” definition to provide that an operation, not located on a primary production farm, devoted to harvesting (such as hulling or shelling), packing, and/or holding of RACs is within the “farm” definition (as a “secondary activities farm”), provided that the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm.

Drying/dehydrating RACs (such as grapes and plums) to create a distinct commodity, and packaging and labeling such commodities, without additional manufacturing/processing is within the “farm” definition when conducted on a farm or farm mixed-type facility. (See Response 28.) However, additional manufacturing/processing activities (such as removing pits from dried plums) are outside the “farm” definition, and a farm or farm mixed-type facility that conducts such activities becomes a facility that is required to register and is subject to the requirements for hazard analysis and risk-based preventive controls for those activities outside the farm definition. The exception is when a farm is a small or very small business eligible for the exemptions in § 117.5(g) and (h) for a farm mixed-type facility that only conducts low-risk activity/food combinations. Such a small or very small business must still register as a food facility, but will be exempt from the requirements for hazard analysis and risk-based preventive controls. (See also the discussion in in the 2014 supplemental human preventive controls notice (79 FR 58524 at 58533-58534 and table 1 in the Appendix to the 2014 supplemental human preventive controls notice (79 FR 58524 at 58571-58572)).

(Comment 35) Some comments assert that we have referred to raw milk as being “inherently dangerous” and should not consider any activities that result in the preparation of an inherently unsafe product for sale to consumers to be within the “farm” definition (i.e., production of raw milk for direct human consumption should not be considered “harvesting” or “packing”). These comments ask us to re‐consider the definition of “farm” as it applies to the production of raw milk for human consumption. Specifically, these comments ask us to consider such activities to be outside the traditional business of a dairy farm and to subject businesses that conduct such activities to FSMA's requirements for hazard analysis and risk-based preventive controls requirements as a means of advancing public health.

(Response 35) We decline this request. Producing milk is a traditional activity of a dairy farm, regardless of whether the milk produced by that dairy farm is pasteurized and introduced into interstate commerce in accordance with § 1240.61 (Mandatory pasteurization for all milk and milk products in final package form intended for direct human consumption) or sold unpasteurized to consumers within a State consistent with applicable State laws and regulations. Distributing raw milk in interstate commerce would be unlawful, but would not form the basis for a decision that the business is “not a farm.”

(Comment 36) Some comments express concern that farmers who grow seed that is sold as animal feed must register as a food facility. These comments ask why sales of grain for animal feed are included in a rule that is focused on the safety of human food and ask us to exempt this category of farms and their sales of grain for animal feed from the registration rule.

(Response 36) Establishments that satisfy the “farm” definition, including farms that grow seed that is sold as animal food, are not required to register as a food facility. These comments may mistakenly believe that we intended any food establishment that is required to register as a food facility to comply with the regulations we are establishing in part 117 regarding human food, regardless of whether the facility produces food for consumption by humans or food for consumption by animals. This is not the case. We simply proposed to revise definitions in the section 415 registration regulations relevant to the definition of “facility” in the same notice in which we proposed to modernize the current CGMPs for food and establish requirements for hazard analysis and risk-based preventive controls for human food, because section 103 of FSMA addresses the definitions in the section 415 registration regulations, as well as the requirements for hazard analysis and risk-based preventive controls. If a facility sells grain for use as animal food, and is not exempt from the section 415 registration regulations, that facility would be subject to the animal preventive controls rule, not the human preventive controls rule that is the subject of this document.

C. Proposed New Definition of Harvesting

We proposed to define “Harvesting,” as a new definition in §§ 1.227 and 1.328, to apply to farms and farm mixed-type facilities and to mean activities that are traditionally performed by farms for the purpose of removing RACs from the place they were grown or raised and preparing them for use as food. We proposed that harvesting be limited to activities performed on RACs on a farm, and that harvesting does not include activities that transform a RAC into a processed food. The proposed definition included examples of activities that would be harvesting. As noted in table 52 of this document, we have reorganized the listed examples of harvesting to present them in alphabetical order. We also have modified the proposal that harvesting be limited to activities performed on RACs on a farm to provide that harvesting can also be performed on processed foods created by drying/dehydrating a RAC without additional manufacturing/processing, because processed foods created by drying/dehydrating RACs are within the “farm” definition. See Response 28 and 79 FR 58524 at 58533 regarding drying/dehydrating RACs to create a distinct commodity.

(Comment 37) Some comments ask us to provide more examples of harvesting activities, in the regulatory text and in guidance. Examples of the requested activities include braiding; bunching; cutting the edible portion of the crop from the plant; hydro-cooling; maintaining hydration of product; refrigerating; removing foliage; removing free water from (e.g., spinning); removing or trimming roots; trimming the tops of bunches of allium crops such as leeks, chives, or garlic and root crops such as carrots, beets, turnips, parsnips, etc. to prepare them for sale; and trimming the lower stems of harvested herb crops such as parsley, basil, or cilantro, or the lower stems of leafy greens. Other comments ask us to specify that harvesting also encompasses seed conditioning (i.e., cleaning the seed, including removal of leaves, stems, and husks to prepare for marketing), ripening (artificial or natural) of fruit, and waxing or coating of RACs.

(Response 37) We have added or modified several examples of harvesting in the regulatory text (i.e., cutting (or otherwise separating) the edible portion of the RAC from the crop plant, removing or trimming part of the RAC (e.g., foliage, husks, roots or stems), field coring, and hulling). In table 1 in the Appendix to the 2014 supplemental human preventive controls notice (79 FR 58524 at 58571-58572), we provided a more extensive list of examples of harvesting activities, including examples that are not in the regulatory text. Although we have classified some of these activities in more than one way (see 79 FR 58524 at 58571-58572), in general these activities would fall within the “farm” definition when conducted on RACs that are not otherwise processed. For example, coating RACs with wax/oil/resin for the purpose of storage or transport can be a packing (not harvesting) activity, but waxing also has long been considered a manufacturing/processing activity during the production of processed food (because it involves making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food) (see 78 FR 3646 at 3679). Artificial ripening of fruit is manufacturing/processing (not harvesting), but is now within the “farm” definition (see § 117.3 and Response 27). Regarding classification of the other activities listed in these comments, see Response 3.

(Comment 38) Some comments assert that fermenting cocoa beans and coffee beans should be classified as “harvesting” rather than “holding.”

(Response 38) We agree that the process of fermenting cocoa beans and coffee beans begins as a “harvesting” activity, when the pods are harvested and the beans are removed; it continues as “holding,” while the harvested beans ferment. Thus, fermenting cocoa beans and coffee beans has elements of both “harvesting” and “holding,” which are both within the “farm” definition. It is not necessary to place the process of fermenting cocoa beans and coffee beans squarely in one activity or the other for the regulatory purpose of determining whether an operation is within the “farm” definition. See also Response 41.

D. Proposed Revision to the Definition of Holding

We proposed to revise the definition of “Holding” in §§ 1.227 and 1.328 to add that holding also includes activities performed incidental to storage of a food, but does not include activities that transform a RAC into a processed food. Holding facilities could include warehouses, cold storage facilities, storage silos, grain elevators, and liquid storage tanks.

(Comment 39) Some comments ask us to provide more examples of holding activities, in the regulatory text and in guidance. Examples of the requested activities include fumigating RACs; application of chemicals (including fungicides, sanitizers, and anti-oxidants); application of ripening agents; using wax as a carrier of fungicides or anti-oxidants applied before storage; and waxing or coating of RACs, including “coating” grain RACs with diatomaceous earth to control insects. According to these comments, these activities are incidental to storage and do not transform RACs into processed food.

(Response 39) We have added or modified several examples of holding in the regulatory text (i.e., fumigating food during storage, and drying/dehydrating RACs when the drying/dehydrating does not create a distinct commodity (such as drying/dehydrating hay or alfalfa)). In table 1 in the Appendix to the 2014 supplemental human preventive controls notice (79 FR 58524 at 58571-58572), we provided a more extensive list of examples of holding activities, including examples that are not in the regulatory text. We have previously classified some of these activities in more than one way (see 79 FR 58524 at 58571-58572) depending on when the activity occurs. For example, sorting, culling, and grading RACs can be either a holding activity or a packing activity. Drying/dehydrating RACs is holding when the drying/dehydrating does not create a distinct commodity, but is manufacturing/processing when the drying/dehydrating creates a distinct commodity (see Response 28). Regarding classification of the other activities listed in these comments, see Response 3.

(Comment 40) Some comments ask us to clarify that mixing or blending intact RACs is considered “holding” regardless of whether the RACs are the same or different.

(Response 40) We use the term “blending” when referring to RACs such as grain and when the RACs are the same. For example, we consider the activity of “blending” different lots of the same grain to meet a customer's quality specifications to be a practical necessity for product distribution and, thus, to be within the definition of “holding” (see 79 FR 58524 at 58537). However, we use the term “mixing” when the RACs are different. For example, we consider the activity of “mixing” corn and oats in the production of animal food to be manufacturing/processing, because mixing two different foods is “making food from one or more ingredients” (which is our definition of “manufacturing/processing”), and the animal food produced by mixing corn and oats is a processed food.

We classify “mixing” intact RACs that does not create a processed food as incidental to, and therefore part of, “packing” or “holding” as applicable.

(Comment 41) Some comments ask us to clarify whether the expanded definition of holding that we proposed in the 2014 supplemental human preventive controls notice would mean that a warehouse that both stores cocoa beans and fumigates the cocoa beans to prevent pest infestation would be exempt from the requirements for hazard analysis and risk-based preventive controls for a facility solely engaged in the storage of RACs (other than fruits and vegetables) for further distribution or processing (§ 117.5(j)).

(Response 41) Fumigating RACs such as cocoa beans to prevent pest infestation would be within the definition of “holding.” Therefore, such fumigation would not prevent a facility that stores RACs (other than fruits and vegetables) from being eligible for the exemption in § 117.5(j), provided that the facility does not conduct other activities not classified as “holding.” However, a threshold question for any facility solely engaged in the storage of RACs is whether the stored RACs are fruits or vegetables. We classify cocoa beans within the category of “fruits and vegetables” (78 FR 3646 at 3690) and, thus, a facility that stores cocoa beans is not eligible for the exemption in § 117.5(j).

(Comment 42) Some comments ask us to clarify whether there is a timeframe associated with holding and to better distinguish between “holding” and “storage.”

(Response 42) There is no timeframe (maximum or minimum) associated with holding. The definition of holding states “Holding means storage of food” and, thus, there is no distinction between “holding” and “storing.”

(Comment 43) Some comments ask us to clarify how the definition of holding relates to practices, such as fumigation, on almond hull stockpiles held on a farm, a farm mixed-type facility, or off-farm.

(Response 43) Practices that are incidental to storage of food, such as fumigation of almond hull stockpiles, are holding, regardless of whether they are conducted on-farm, on a farm mixed-type facility, or off-farm.

(Comment 44) Some comments ask us to clarify that value added activities (such as repacking and blast freezing) conducted in facilities such as warehouses would be considered holding when product is not exposed to the environment.

(Response 44) We consider the activities described in these comments to be activities performed as a practical necessity for the distribution of the food and, thus, to be within the definition of holding.

(Comment 45) Some express concern that the definition of holding would prevent a facility that samples food (such as sugar) for grading or quality control purposes from qualifying for the exemption for facilities engaged solely in holding unexposed packaged food because they would temporarily expose otherwise unexposed packaged food to the environment. These comments ask us to make clear that the requirements for hazard analysis and risk-based preventive controls only apply to the sampling activities and that engaging in sampling activities does not remove a warehouse's exemption altogether.

(Response 45) We consider that sampling food in the manner described by this comment is a practical necessity for the distribution of the food within the definition of “holding,” and that the exemption still applies to a facility that conducts such sampling. Importantly, the sampling must be in done in accordance with CGMPs such that the exposure does not result in contamination of the food.

E. Proposed Revision to the Definition of Manufacturing/Processing

We proposed to revise the definition of “Manufacturing/Processing” in §§ 1.227 and 1.328 by adding to the existing definition a criterion applicable to farms and farm mixed-type facilities. As noted in table 52, we have reorganized the listed examples of manufacturing/processing to present them in alphabetical order.

(Comment 46) Some comments express concern that some activities included in the definition of “manufacturing/processing” overlap with activities (such as trimming, washing, and cooling) included in the definition of “harvesting.”

(Response 46) We acknowledge that there is some overlap in the activities that the regulatory text lists as examples of both “manufacturing/processing” and “harvesting,” because some activities can occur during more than one operation (see also the discussion at 79 FR 58524 at 58538 and table 1 in the Appendix to the 2014 supplemental human preventive controls notice (79 FR 58524 at 58571-58572)). For example, “cutting” the core of the lettuce from the crop plant can occur on-farm in the field where the lettuce is harvested, and “cutting” the core of the lettuce from the rest of the harvested lettuce also can occur in a fresh-cut processing facility. An important consequence of the multiple revisions we have made to the “farm” definition in this rulemaking is that there are fewer situations in which classification of a particular activity is the only trigger for an operation to be subject to the section 415 registration regulations. For example, the revised “farm” definition no longer classifies the packing and holding of others' RACs to be a manufacturing/processing activity that triggers the registration requirement. As another example, the revised “farm” definition specifies three manufacturing/processing activities that are within the “farm” definition. We conclude that the overlap in the examples of activities listed in the definitions of “harvesting” and “manufacturing/processing” does not create problems with determining the status of an operation as a “farm” or a “facility” and we are retaining examples in both definitions because doing so reflects current practices on farms and in manufacturing/processing facilities.

(Comment 47) Some comments ask us to clarify that the traditional activities of a packing shed—cleaning and packing intact fruits and vegetables—do not constitute “manufacturing/processing” that would trigger the requirement to register as a facility.

(Response 47) Packing activities are within the definition of “packing,” and holding activities are within the definition of “holding,” regardless of whether the packing or holding activities take place on-farm or off-farm. In other words, neither packing produce nor holding produce would be classified as manufacturing/processing merely because the business entity conducting the activity is a facility that is subject to the section 415 registration regulations. As discussed in Response 25, we have revised the “farm” definition to provide that an operation devoted to harvesting (such as hulling or shelling), packing, and/or holding of RACs is within the “farm” definition (as a “secondary activities farm”), provided that the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm. With this revision, some off-farm packinghouses that are managed by a business entity (such as a cooperative) that is different from the business entity growing crops (such as individual farms) can be within the “farm” definition, provided that the primary production farm(s) that grows, harvests, or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the packing operation.

(Comment 48) Some comments ask us to make clear, in our response to comments in the final rule, that any adjustments we make to the definition of manufacturing/processing in no way change the definitions of “raw agricultural commodity,” “processing,” and “processed food,” which were mutually agreed to by EPA and FDA (Ref. 15) to address regulatory responsibilities for antimicrobials applied to food, process water contacting food, or hard food-contact surfaces.

(Response 48) The revisions we made to the “farm” definition, and to the classification of activities relevant to the “farm” definition, do not change the statutory definitions of “raw agricultural commodity,” and “processed food,” or impact our interpretation of the definition of “processing,” with respect to regulatory jurisdiction for antimicrobials applied to food, process water contacting food, or hard food-contact surfaces.

F. Proposed New Definition of Mixed-Type Facility

We proposed to define “Mixed-type facility,” as a new definition in §§ 1.227 and 1.328, to mean an establishment that engages in both activities that are exempt from registration under section 415 of the FD&C Act and activities that require the establishment to be registered. We specified in the regulatory text that an example of such a facility is a “farm mixed-type facility,” which is an establishment that grows and harvests crops or raises animals and may conduct other activities within the farm definition, but also conducts activities that require the establishment to be registered. As a conforming change associated with the revisions to the “farm” definition, we have revised the example of a “farm mixed-type facility” to specify that it is an establishment that is a farm, but also conducts activities outside the farm definition that require the establishment to be registered.

(Comment 49) Some comments assert that there is no scientific basis for the definition of mixed-type facility.

(Response 49) The proposed definition is not a science-based definition. It is a descriptive term that we are using to refer to certain food establishments. We used this same term during the rulemaking to establish the section 415 registration regulations (see response to comment 46, 68 FR 58894 at 58906, October 10, 2003).

(Comment 50) Some comments ask us to revise the definition to add more details about activities that are inside the farm definition and activities that are outside the farm definition.

(Response 50) We decline the request of these comments. Adding such details would detract from the focus of the definition—i.e., that it refers to a facility that conducts both activities that are inside the farm definition and activities that are outside the farm definition. We have included additional examples of “harvesting,” “packing,” and “holding” activities in the regulatory text of the definitions for those terms (see §§ 1.227, 1.328 and 117.3 and Response 31, Response 37 and Response 39). (See also Response 3.)

(Comment 51) Some comments ask us to revise the definition to exclude those establishments that only conduct low-risk activities specified in the exemptions for on-farm, low-risk activity/food combinations (§ 117.5(g) and (h)).

(Response 51) We decline this request. Whether a particular establishment that falls within the definition of “mixed-type facility” is subject to the requirements for hazard analysis and risk-based preventive controls is governed by the exemptions established in this rule.

G. Proposed Revision to the Definition of Packing

We proposed to revise the definition of “Packing” in §§ 1.227 and 1.328 by adding that packing includes activities performed incidental to packing a food, but does not include activities that transform a RAC into a processed food. We have revised the definition to clarify that packing includes “re-packing.”

(Comment 52) Some comments ask us to include minimal “manufacturing/processing” of RACs in the definition of packing when the minimal “manufacturing/processing” does not transform the RAC into a processed food. The comments describe waxing of fresh fruit (such as apples) and vegetables as examples of activities that do not transform a RAC into a processed food.

(Response 52) As already discussed, the activities that transform a RAC into a processed food (and are sometimes therefore referred to as “processing” in the context of a food's status as a RAC or processed food) are not coextensive with the activities described in our definition of “manufacturing/processing.” (See Response 27.) Although waxing has long been considered a manufacturing/processing activity during the production of processed food (because it involves making food from one or more ingredients, or synthesizing, preparing, treating, modifying or manipulating food), we classify coating RACs with wax/oil/resin for the purpose of storage or transport as a packing activity. (See Response 37).

(Comment 53) Some comments ask us to clarify the distinction between “packing” and “packaging” because the terms are different but seem to be used interchangeably. These comments express concern that “placing food into containers” on farms that have traditionally done so will be classified as “manufacturing/processing” and trigger the requirement to register as a food facility and ask us to reclassify “packaging” within the definition of “packing.” Other comments ask us to remove the words “other than packaging of food” from the definition of “packing.” Some comments state that when a RAC is packed in the field and/or is placed into a clamshell container, as a practical matter it is considered to have been “packed,” not “packaged.”

(Response 53) We acknowledge that farms traditionally refer to field packing, including placing RACs into clamshell containers that will serve as a consumer package, as “packing,” not “packaging.” Indeed, in the 2013 human preventive controls rule we proposed to revise the definition of “packing” to specify that, for farms and farm mixed-type facilities, “packing” includes “packaging.” However, in the 2014 supplemental human preventive controls notice we proposed a simpler approach to accommodate requests such as those in these comments, by simply specifying in the “farm” definition that packaging and labeling RACs, without additional manufacturing/processing, is within the “farm” definition. We conclude that the distinctions between the terms “packing” and “packaging” do not create problems with determining the status of an operation as a “farm” or a “facility.” Further, we note that we have given these terms identical meanings across multiple FDA regulations that are applicable to facilities.

(Comment 54) Some comments refer to discussions at a “listening session” regarding harvesting several varieties of lettuce, washing them, and combining heads or bunches of the different varieties in one bag that is sealed with a knot or twist tie. During these discussions, this type of activity was classified as being within the “farm” definition. These comments ask how this activity can be classified as being within the “farm” definition when mixing and washing are listed as manufacturing/processing activities that trigger registration as a food facility and whether there is a discrepancy between what the rule requires and what they heard at the listening session. Other comments express the view that mixing RACs that have not been transformed into processed food (such as bagging mixed greens or different types of whole produce, such as potatoes, beets, and carrots) should not put a farm in the category of a mixed-type facility.

(Response 54) Removing several varieties of lettuce from the place in which they were grown, washing them on the farm, and combining heads or bunches of the different varieties in one bag that is sealed with a knot or twist tie on the farm are all activities within the “farm” definition. We classify “washing” and “mixing” in more than one way depending on when the activity occurs, and the “farm” definition now specifies that “packaging” RACs (without additional manufacturing/processing, such as slicing) is a farm activity, even though it is a type of “manufacturing/processing.” We have recognized “washing” as a harvesting activity since we first issued the section 415 registration regulations (68 FR 58894 at 58961, October 10, 2003), even though we also classify “washing” RACs as “manufacturing/processing” when done in a food processing facility (such as a fresh-cut processing facility). We classify “mixing” intact RACs that does not create a processed food as incidental to, and therefore part of, “packing” or “holding” as applicable. Mixing heads or bunches of lettuce as described in the example does not create a processed food, because he mixing has not created a distinct commodity, but only a set of mixed RACs. On the other hand, mixing that creates a processed food is not “packing” or “holding.” The definitions of both “packing” and “holding” are limited so that they do not include activities that transform a RAC into processed food. Some kinds of mixing of RACs do create a distinct commodity (for example, mixing corn and oats to make animal food). In such cases, the mixing is manufacturing/processing and is not within the farm definition. Likewise, although we classify placing RACs in a plastic bag with a twist tie as “packaging” rather than “packing” when the plastic bag is the container that the consumer receives, we have provided for ”packaging” RACs as an activity within the “farm” definition.

V. Comments on the Organizing Principles for How the Status of a Food as a Raw Agricultural Commodity or as a Processed Food Affects the Requirements Applicable to a Farm Under Sections 415 and 418 of the FD&C Act

In the 2014 supplemental human preventive controls notice, we discussed comments on the organizing principles that formed the basis for proposed revisions to the section 415 registration regulations and the section 414 recordkeeping regulations (79 FR 58524 at 58538). We also explained how our proposed revisions to the “farm” definition would require us to reconsider those organizing principles (79 FR 58524 at 58538).

(Comment 55) Some comments assert that we should revise the organizing principles to reflect the realities and range of activities that farms conduct to prepare their crops for market and to make the organizing principles consistent with FSMA's risk-based mandate. These comments ask us to revise the organizing principles as follows: (1) The basic purpose of farms is to produce RACs and deliver them for sale to end-users or other buyers; (2) activities that involve RACs and that farms perform for the purposes of selling their own RACs, including growing them, harvesting them, preparing them for consumption in their raw and unprocessed state, and packing, sorting, grading, packaging, labeling, holding, transporting, marketing, and delivering them, should all be within the definition of “farm;” (3) even though farms traditionally also do a wide variety of activities that may be considered processing, for the purpose of these organizing principles, activities should be classified based on whether the activity transforms a RAC into a processed food (as defined by these rules); (4) manufacturing/processing, packing, or holding food—whether RACs or processed foods, from any source—for consumption on the farm should remain within the farm definition.

(Response 55) We have revised the “farm” definition to refer to farms as “operations” rather than “facilities” or “establishments”; reflect modern business models (such as cooperatives, on-farm packinghouses under ownership by multiple growers, food aggregators, and some types of food hubs (e.g., those that consolidate and distribute RACs but do not conduct activities that transform the RACs into a processed food)); specify that a farm is in one general (but not necessarily contiguous) physical location; and provide that an operation devoted to harvesting (such as hulling or shelling), packing, and/or holding of RACs is within the “farm” definition as a secondary activities farm, provided that the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm (e.g., an off-farm produce packinghouse owned by farmers or a farmer-owned tree nut hulling and drying operation). (See Response 22, Response 23, Response 24, and Response 25.) All of these changes to the “farm” definition do, as requested by these and other comments, reflect the realities and range of activities that farms conduct. See table 5 for organizing principles regarding classification of activities on-farm and off-farm in light of the changes to the “farm” definition.

VI. Rulemaking Required by Section 103(c) of FSMA: On-Farm Activities

A. Section 103(c)(1)(C) of FSMA

We previously described provisions of FSMA that direct us to conduct a science-based risk analysis to cover specific types of on-farm packing, holding, and manufacturing/processing activities that would be outside the “farm” definition and, thus, subject to the requirements for hazard analysis and risk-based preventive controls (see section 103(c)(1)(C) of FSMA and 78 FR 3646 at 3674 and 3689-3691). Consistent with this statutory direction, we developed the section 103(c)(1)(C) draft RA and made it available for public comment (Ref. 18 and 78 FR 3824). We are including the final risk assessment (the section 103(c)(1)(C) RA) in the docket established for this document (Ref. 4).

We previously described provisions of FSMA that direct us to consider the results of the science-based risk analysis and exempt facilities that are small or very small businesses from the requirements for hazard analysis and risk-based preventive controls (or modify these requirements, as we determine appropriate), if such facilities are engaged only in specific types of on-farm activities that we determine to be low risk involving specific foods that we determine to be low risk (see section 103(c)(1)(D) of FSMA and 78 FR 3646 at 3675, 3691, and 3705-3707). Later in this document (see section XI.G), we discuss the provisions we are establishing in § 117.5(g) and (h), based on the results of the section 103(c)(1)(C) RA, to exempt farm mixed-type facilities that are small or very small businesses from requirements for hazard analysis and risk-based preventive controls if the only activities that the business conducts that are subject to those requirements are low-risk activity/food combinations.

We also previously described provisions of FSMA that direct us to: (1) Identify high risk-facilities and allocate resources to inspect facilities according to the known safety risks of the facilities (as determined by several factors) and immediately increase the frequency of inspection of all facilities (see the discussion of section 421 of the FD&C Act at 78 FR 3646 at 3654-3655); and (2) consider a possible exemption from or modification of requirements of section 421 of the FD&C Act as we deem appropriate (see the discussion of section 103(c)(1)(D) of FSMA at 78 FR 3646 at 3658). We tentatively concluded that we should not exempt or modify the frequency requirements under section 421 based solely upon whether a facility only engages in low-risk activity/food combinations and is a small or very small business and requested comment on this tentative conclusion.

B. Comments on Qualitative Risk Assessment of On-Farm Activities Outside of the Farm Definition

(Comment 56) Some comments address the qualitative nature of the section 103(c)(1)(C) draft RA and assert that it is based on professional judgment rather than data. These comments ask us to update the section 103(c)(1)(C) draft RA when more data become available. Some comments assert that we should not rely on data from the Food Processing Sector Study (Ref. 19), but instead collect data from large-scale surveys of actual farm mixed-type facilities and their activities. Other comments ask us to dedicate resources and enter into agreements with agencies/organizations to collect, analyze, and interpret data. Some comments ask us to consult with subject matter experts to ensure that the final risk assessment reflects sufficient geographic diversity.

(Response 56) We have acknowledged the limitations of the section 103(c)(1)(C) draft RA (Ref. 18; see section I.F in that document). Rather than limit public input to subject matter experts, we requested comment from all interested persons, and received a number of comments alerting us to activity/food combinations conducted on farms and farm mixed-type facilities, including comments from diverse geographic areas. We also received comments about activity/food combinations focused on botanicals that might be used in the production of dietary ingredients. We disagree that we need to conduct large scale surveys, or enter into agreements with agencies/organizations, to collect additional information in light of the previous opportunity for broad public input regarding the activity/food combinations conducted on farms and farm mixed-type facilities. (See also Response 139 regarding the Food Processing Sector Study.)

(Comment 57) Some comments state that it is not clear how certain high- or moderate-risk practices (e.g., washing), which are necessary to move product from the field, will affect exemptions. These comments recommend that future risk assessments examine the impact of these practices by commodity and volume of intact fruits and vegetables marketed through small and very small farm mixed-type facilities. Other comments ask us to re-examine our data sources in assessing commodity-specific risks, and assert that it is likely that many will be found to be low risk. Other comments suggest that the Centers for Disease Control and Prevention (CDC) expand its data analysis effort (Ref. 20) to separate out commodities to assess attribution of foodborne illnesses for additional commodities.

(Response 57) Because of changes we made to the farm definition, practices such as washing that are necessary to move product from the field are within the farm definition and are not addressed in the section 103(c)(1)(C) RA. We disagree that we should re-examine our data sources in assessing commodity-specific risks. As we discussed in the section 103(c)(1)(C) draft RA, we focused on considering the risk of activity/food combinations rather than separately considering the risk of specific food categories because doing so would better enable us to focus on whether a specific manufacturing, processing, packing, or holding activity conducted on food by a farm mixed-type facility warranted an exemption from, or modified requirements for, the provisions of section 418 of the FD&C Act. The comments did not identify additional data sources to use in assessing commodity-specific risks. However, we did revise the section 103(c)(1)(C) draft RA by taking into consideration: (1) Comments submitted to Docket FDA-2012-N-1258 on the section 103(c)(1)(C) Draft RA; (2) comments submitted to Docket FDA-2011-N-0920 on the proposed rule relevant to activities conducted on foods on farms; and (3) a revised Food Processing Sector Study on domestic establishments co-located on farms (Ref. 21). This led us to include additional activity/food combinations in our evaluation, and many were found to be low risk. With respect to CDC expanding its data analysis effort, the CDC publication cited by the comments (Ref. 20) is the most up-to-date publication available, and more finely grained data for additional commodities are not currently available.

(Comment 58) Some comments assert that we should revise the section 103(c)(1)(C) draft RA and then make it available for additional public comment before finalizing the rule.

(Response 58) As we previously noted (78 FR 3824 at 3826, January 16, 2013), we subjected the section 103(c)(1)(C) draft RA to peer review in accordance with the requirements of the Final Information Quality Bulletin for Peer Review (issued by the Office of Management and Budget to implement the Information Quality Act (Pub. L. 106-554)) before we made it available for broader public comment during a time period that exceeded 10 months. The additional iterative process recommended by these comments is not necessary and would go beyond the processes we routinely apply for public input on a risk assessment.

C. Comments Regarding an Exemption for Small and Very Small Farm Mixed-Type Facilities Under Section 421 of the FD&C Act

1. Request for Comment on Data Submission Requirements

We requested comment on whether we should establish data submission requirements that would allow us to identify types of facilities in order to exempt them from the inspection frequencies, or modify the inspection frequencies that apply to them, under section 421 of the FD&C Act. We provided examples of such data elements, including identification of a facility as a farm mixed-type facility, annual monetary value of sales, number of employees, and food category/activity type. We also requested comment on any other criteria that may be appropriate for the purposes of allocating inspection resources to these facilities.

Comments did not support these data submission requirements. We are not establishing any data submission requirements that would allow us to identify types of facilities in order to exempt them from the inspection frequencies, or modify the inspection frequencies that apply to them, under section 421 of the FD&C Act.

2. Request for Comment on an Exemption From the Requirements of Section 421 of the FD&C Act

We received no comments that disagreed with our tentative conclusion that we should not exempt or modify the inspection frequency requirements under section 421 based solely upon whether a facility only engages in low-risk activity/food combinations and is a small or very small business. We are not establishing any exemption from, or modification to, the inspection frequency requirements under section 421 for facilities that only engage in low-risk activity/food combinations and are a small or very small business.

VII. Comments on Proposed General Revisions to Current Part 110 (Final Part 117)

We proposed some general revisions to the CGMP requirements in part 110, including revising the title; redesignating the provisions in part 117; revising some terms for consistency within the rule; referring to the “owner, operator, or agent in charge” rather than to “plant management” or “operator”; revising provisions directed to preventing contamination of food and food-contact substances so that they also are consistently directed to preventing contamination of food-packaging materials; revising several provisions to explicitly address allergen cross-contact, as well as contamination; referring to “raw materials and ingredients” rather than “raw materials and other ingredients”; deleting some non-binding provisions; and making some editorial revisions (78 FR 3646 at 3692 to 3693).

Some comments support one or more of these proposed general revisions without change. For example, some comments agree that there is no meaningful distinction between “manufacturing/processing,” “packing,” and “holding” as defined in the proposed revisions to §§ 1.227 and 1.328 and those terms as they have been used in the long-standing CGMP requirements. These comments also agree that consistent use of these terms throughout proposed part 117, in reference to activities taking place in food facilities, establishments, or plants, would make the regulations more clear and have no substantive effect on the current requirements. Other comments support the proposed replacement of the term “facility” or “facilities” in the CGMP requirements with the term “establishment” or “plant” whenever the term “facility” or “facilities” could be confused with the firms that are subject to the proposed requirements for hazard analysis and risk-based preventive controls. Other comments agree that it is appropriate to replace the word “shall” with the term “must.” Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 59, Comment 63, and Comment 65).

We received no comments that disagreed with our proposed redesignations and are finalizing them as proposed. In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed provisions as shown in table 6.

A. Title of Part 117

We proposed to re-establish the provisions of current part 110 in new part 117 and to establish the title of part 117 as “Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food” (78 FR 3646 at 3691). (Note that in the 2013 proposed human preventive controls rule, we described this as revising the title of “current subpart B.” We should have described this as revising the title of current part 110.)

(Comment 59) Some comments ask us to revise the title to read “Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls for Human Food.”

(Response 59) We have revised the title of the rule as requested.

B. Proposed Revisions for Consistency of Terms

1. Activities Subject to Proposed Part 117

We noted that we had previously described activities that may be considered “manufacturing, processing, packing, or holding” by establishing definitions for these terms in the section 415 registration regulations and the section 414 recordkeeping regulations (78 FR 3646 at 3692). We proposed to revise these existing definitions (see sections IV.D, IV.E, and IV.G) and to incorporate the revised definitions in part 117. We tentatively concluded that there is no meaningful distinction between these terms as we would define them in the revised definitions and these terms as they had been used in the CGMPs. We also tentatively concluded that consistent use of these terms throughout part 117, in reference to activities taking place in food facilities, establishments, or plants, would make the regulations more clear and have no substantive effect on the current requirements (78 FR 3646 at 3692). In the 2014 preventive controls supplemental notice, we proposed revisions to the definitions of “holding” and “packing” after considering comments submitted to the 2013 proposed human preventive controls rule.

(Comment 60) Some comments ask us to clarify how we were “revising” the definitions of the terms manufacturing, processing, packing, and holding because these terms had not been defined in the CGMPs in part 110.

(Response 60) The comments are correct that these terms had not been defined in the CGMPs in part 110. We proposed to “revise” these definitions in the section 415 registration regulations and the section 414 recordkeeping regulations and then establish in part 117 those revised definitions.

(Comment 61) Some comments from the produce industry state that it is difficult to assess whether there is a meaningful distinction between “packing” and “holding” as would be defined in the proposed human preventive controls rule and as had been used in the CGMPs in part 110 because most harvesting and post-harvest handling activities of RACs had been excluded from the CGMP requirements under § 110.19.

(Response 61) We assume that these comments are concerned about distinguishing “packing” from “holding” because some exemptions (e.g., the exemption in § 117.5(k) from the CGMP requirements for holding RACs and the exemption in § 117.5(j) from the requirements for hazard analysis and risk-based preventive controls) apply to “holding” RACs. As previously discussed, we have previously classified several on-farm activities in more than one way (79 FR 58524 at 58538 and 58571) depending on when the activity occurs. For example, sorting, culling, and grading RACs can occur during both packing and holding activities. However, we disagree that the full regulatory text of the definitions for “packing” and “holding” are not adequate to provide a meaningful distinction between the two terms. “Packing” means, in part, “placing food into a container” whereas holding means, in part “storage of food.” “Placing food into a container” is in no way similar to “storage of food.”

(Comment 62) Some comments disagree with our tentative conclusion that there is no meaningful distinction between “manufacturing/processing,” “packing,” and “holding” as we would define them in the revised definitions and these terms as they had been used in the CGMPs. These comments ask us to define these terms differently in the human preventive controls rule. These comments state that although they do not object to the consistent use of these terms throughout part 117 in reference to activities taking place in food facilities, establishments, or plants, they believe there are significant distinctions in these terms that need to be considered when finalizing the requirements of part 117.

(Response 62) These comments provide neither specific suggestions for how we should define these terms for the purpose of the human preventive controls rule nor specific reasons for their assertion that there are significant distinctions in these terms that need to be considered when finalizing the requirements of part 117. Without more specific information, we assume that the changes we have made to the definitions of “farm,” “holding,” and “packing” adequately address these comments.

2. The Term “Facility”

We proposed to replace the term “facility” or “facilities” in current part 110 with the term “establishment” or “plant” in proposed part 117 whenever the term “facility” or “facilities” could be confused with the firms that are subject to the proposed requirements for hazard analysis and risk-based preventive controls required by section 418 of the FD&C Act (78 FR 3646 at 3692). However, we tentatively concluded that it would not be necessary to replace the use of the term “facilities” in current requirements directed to specific functional parts of a plant or establishment, such as “toilet facilities” and “hand-washing facilities,” because the use of the term “facilities” in these contexts would not create confusion.

(Comment 63) Some comments state that it would not be helpful to use “plant” interchangeably with “establishment” when referring to a business that is not required to register. These comments ask us to consistently use one of these terms and to define a term that would mean “a business that is not required to register” to help distinguish such businesses from “facilities.”

(Response 63) We agree that it is appropriate to consistently use one term when referring to a business entity. However, we disagree that it is necessary to establish a definition for a business entity that is not required to register. A business that meets the definition of “facility” is required to register; a business that is not required to register is simply a business that does not meet the definition of “facility.”

To address these comments, we have revised provisions of the rule in three ways. First, we have revised the definition of “plant” to focus it on the building, structure, or parts thereof, used for or in connection with the manufacturing, processing, packing, or holding of human food, rather than on the “building or establishment.” Second, we have revised applicable provisions of part 117 to use “establishment” rather than “plant” when focusing on a business entity rather than on buildings or other structures. Third, we have revised provisions that use the terms “plant,” “establishment,” or both to conform to the definition of “plant” and the described usage of “establishment.” For example, § 117.10 establishes requirements for “the management of the establishment” rather than “plant management,” because “establishment” is the term focusing on the business entity. As another example, § 117.20(a)(1) establishes requirements for properly storing equipment, removing litter and waste, and cutting weeds or grass within the immediate vicinity of the “plant” rather than within the immediate vicinity of the “plant buildings or structures,” because the defined term “plant” focuses on the buildings and structures, and it is not necessary to repeat “buildings and structures” when the term “plant” is used.

3. Owner, Operator, or Agent in Charge

In the 2013 proposed human preventive controls rule, we requested comment on whether there is any meaningful difference between the persons identified in current part 110 and the “owner, operator, or agent in charge” identified in section 418 of the FD&C Act. We also requested comment on whether it would be appropriate to refer to the “owner, operator, or agent in charge” of a plant, establishment, or facility throughout proposed part 117 and, if so, whether the requirements would be clear if we revised the proposed rule to use pronouns (such as “you” and “your”) within proposed part 117 (78 FR 3646 at 3693). In the 2014 supplemental human preventive controls notice, we described comments on these issues and we tentatively concluded that we could simplify the regulations directed to the “owner, operator, or agent in charge of a facility” in provisions in subparts C, D, and E by using pronouns, without creating confusion, if we (1) define the term “you” to mean, for purposes of part 117, the owner, operator, or agent in charge of a facility and (2) limit use of the term “you” to provisions in proposed subparts C, D, and E (79 FR 58524 at 58556).

We received no comments that disagreed with the proposed definition of “you” and are finalizing that proposed definition without change.

4. Food-Packaging Materials

We proposed that provisions of current part 110 directed to preventing contamination of food and food-contact surfaces consistently be directed to preventing contamination of food-packaging materials as well (78 FR 3646 at 3693). We received no comments that disagreed with this proposal and are finalizing provisions directed to preventing contamination of food-packaging materials as proposed. For additional discussion regarding the term “food-packaging materials,” see Comment 107.

C. Proposed Additions Regarding Allergen Cross-Contact

We proposed to revise several CGMP provisions to explicitly address cross-contact (see 78 FR 3646 at 3693 and table 10 of the 2013 proposed human preventive controls rule, 78 FR 3646 at 3718-3719). In the 2014 supplemental human preventive controls notice, we proposed to define and use the term “allergen cross-contact” rather than “cross-contact,” and we are finalizing the definition of the term “allergen cross-contact” in this rule (see § 117.3). As discussed in sections XIII-XXII, the CGMPs that we are establishing in subpart B explicitly address allergen cross-contact, with some revisions requested by comments.

(Comment 64) Some comments ask us to clarify that allergen cross-contact has a meaning that is distinct from “contamination.”

(Response 64) We previously noted that, in the past, inadvertent incorporation of an allergen into a food was referred to as “contamination” or “cross-contamination,” but that more recently the term “cross-contact” (rather than “contamination” or “cross-contamination”) has been applied with respect to unintentional transfer of allergenic proteins from a food containing the proteins to one that does not, because an allergen is a normal component of food, and not itself a contaminant (78 FR 3646 at 3693). Given this shift in the scientific literature distinguishing “cross-contact” from “contamination” and “cross-contamination,” we tentatively concluded that we should begin using the term “cross-contact” (now “allergen cross-contact”) to describe inadvertent incorporation of an allergen into food, rather than the general term “contamination,” for purposes of clarity. In this final rule, we affirm that tentative conclusion.

To further improve clarity, we reviewed the provisions of the rule directed to preventing both allergen cross-contact and preventing contamination and made editorial changes throughout. For example, § 117.10(b)(1) requires that hygienic practices must include wearing outer garments suitable to the operation in a manner that protects against allergen cross-contact and against the contamination of food, food-contact surfaces, or food-packaging materials. For additional provisions that include these editorial changes, see table 52.

D. Proposed Revisions for Consistency With the Definition of “Food”

We proposed to retain the definition for “food” as already defined in § 110.3 (78 FR 3646 at 3693). Food means food as defined in section 201(f) of the FD&C Act and includes raw materials and ingredients. For consistency with the definition of food (which refers to “raw materials and ingredients” rather than “raw materials and other ingredients”), we proposed to change the title of current § 110.80(a) (which would be proposed § 117.80(b)) to “Raw materials and ingredients” rather than “Raw materials and other ingredients.” As a companion change to this change in title, we proposed to substitute “ingredients” for “other ingredients” throughout provisions in current § 110.80 that refer to both raw materials and ingredients (78 FR 3646 at 3693-3694).

(Comment 65) Some comments ask us to add a definition for “raw materials.”

(Response 65) We decline this request. During a previous rulemaking to revise the umbrella CGMPs, we explained that it is not possible to categorically distinguish raw materials and other ingredients because raw materials are ingredients, and both raw materials and ingredients are food within the meaning of the FD&C Act (51 FR 22458 at 22461, June 19, 1986). We have broadly defined “food” in this rule to include both raw materials and ingredients.

However, we have decided to retain the current phrase “raw materials and other ingredients” (rather than the proposed phrase “raw materials and ingredients”) throughout the rule to make it clear that raw materials are ingredients. See the regulatory text of §§ 117.80(b), 117.80(c)(6), (7), and (9); and 117.130(c)(2)(iii).

(Comment 66) Some comments ask us to revise the current definition of food (see Comment 87, Comment 88, and Comment 89).

(Response 66) See Response 87, Response 88, and Response 89 for our reasons for declining to revise the definition of “food” in this rule.

E. Proposed Revisions To Address Guidance in Current part 110

We proposed to delete some non-binding provisions of current part 110 (e.g., provisions using “should” or “compliance may be achieved by”) (78 FR 3646 at 3694 and 3714-3717). We also requested comment on whether to revise other non-binding provisions to establish new requirements in proposed part 117 or to simply retain them as useful provisions of a comprehensive CGMP (78 FR 3646 at 3694 and 3728-3729).

(Comment 67) Some comments ask us to retain the provisions we proposed to delete—e.g., because the information helps to clarify the intended effect of the regulations, suggests means of compliance with the requirements, and can educate small, new, or foreign companies. These comments assert that the benefits to both the regulated industry and to the general public of retaining the information we proposed to delete far outweigh any stylistic or other concerns. Likewise, some comments ask us to retain any non-binding provisions that we proposed to re-establish as requirements if, after considering comments, we do not finalize these provisions as requirements.

(Response 67) We agree that the non-binding provisions we proposed to delete, or considered re-establishing as requirements, provide useful information for reasons such as those mentioned in the comments. However, these provisions are more appropriately included in guidance, and we are deleting those non-binding provisions of part 110 that we are not establishing as requirements. We intend to transfer some of the CGMP recommendations that are currently in part 110, but that will be deleted from part 117, to guidance with editorial changes and changes that reflect current technology and industry practices. For a list of non-binding provisions that we are deleting, see table 7 in this document and table 8 in the 2013 proposed human preventive controls rule (78 FR 3646 at 3714-3717). See Response 321 for a discussion of our reasons for deleting the recommendation listed in table 7 in this document.

F. Proposed Editorial Changes

We proposed to revise current part 110 to make five editorial changes: (1) Refer to the “Federal Food, Drug, and Cosmetic Act” rather than to “the act”; (2) replace the term “shall” with the term “must”; (3) replace the phrase “includes, but is not limited to” with “includes”; (4) replace the phrase “adulteration within the meaning of the act” with the single term “adulteration”; and (5) replace the term “whenever” with “when.”

We received no comments that disagreed with our proposed editorial changes regarding “Federal Food, Drug, and Cosmetic Act,” “must,” “adulteration,” and “when” and are finalizing these editorial changes as proposed.

(Comment 68) Some comments ask us to either retain “includes, but is not limited to” wherever the list which follows is not intended to be exhaustive, or replace “includes, but is not limited to” with “such as,” to make clear that a following list is not complete.

(Response 68) The word “include” means to have (someone or something) as part of a group or total; to contain (someone or something) in a group or as a part of something (Ref. 22). The word “includes” does not need to be followed by “but is not limited to” to clearly communicate that a following list is not complete.

We proposed that two provisions (proposed § 117.80(c)(14) and (15)) replace the term “such as” with the term “including” (or variations of “including”). In light of the comment's view that “such as” would be clearer, we have retained the term “such as” in those provisions. We decline the request to more broadly revise the rule to replace “includes” with “such as.” In many cases the term “such as” cannot replace “includes” when used as a verb. We note that several provisions of the rule do use “such as” when that term is grammatically appropriate, such as in parenthetical phrases (see, e.g., the definitions of “holding” and “packing” in § 117.3).

G. General Comments on Current Part 110 (Final Part 117)

We proposed specific revisions and deletions to our long-standing umbrella CGMP requirements to modernize them. We also proposed to redesignate some of these CGMP requirements. For example, we proposed to redesignate the provisions found in six sentences that precede current § 110.80(a) by creating paragraph designations (a)(1) through (6) in new § 117.80. As corresponding changes, we proposed to redesignate current § 110.80(a) as § 117.80(b) and to redesignate current § 110.80(b) as § 117.80(c).

Several comments suggest specific modifications to the umbrella CGMPs beyond what we proposed to revise. In this section and in sections XIII through XXII, we address these specific suggestions and have amended the regulatory text where warranted.

(Comment 69) Some comments ask us to reorganize some of the current provisions to reduce redundancy, such as by combining provisions that address similar topics or deleting some provisions that the comments view as unnecessary in light of other provisions. For example, one comment suggests we move § 117.80(b)(5) (storage of raw materials, other ingredients, and rework) to § 117.80(a)(1) (general requirements) and another comment suggests we delete requirements in § 117.80(b)(1) for storing raw materials and ingredients because they are redundant with the storage requirements in § 117.80(b)(7).

(Response 69) We decline these requests. We acknowledge that there is some redundancy in subpart B and that we could improve the logical structure of subpart B by moving some of the requirements as recommended by some comments. However, these provisions have been in effect for decades, either since 1969 (when the umbrella CGMPs were first established (34 FR 6977, April 26, 1969) or since 1986 (when we last revised the umbrella CGMPs (51 FR 22458, June 19, 1986), and the comments do not provide examples of how we have been interpreting these provisions in a way that does not accomplish the goal of the umbrella CGMPs. Furthermore, we disagree with some of the comments on whether some provisions are redundant. For example, we disagree that § 117.80(b)(1) is redundant with § 117.80(b)(7) because § 117.80(b)(7) is narrowly directed to raw materials and other ingredients received in bulk and § 117.80(b)(1) is more generally directed to all raw materials and other ingredients.

Rather than reorganize and combine requirements, or delete requirements that some comments view as redundant with other requirements, we have focused on comments requesting specific changes to the current requirements to reflect current practices in the manufacturing, processing, packing, and holding of human food and to make these current requirements clearer (see sections XIII through XXII). Doing so is consistent with the goals of modernizing the umbrella CGMP requirements. However, we have declined many of these requests to make specific changes to particular CGMP provisions. In general, in evaluating the requested specific changes, we considered whether the comments described a problem with the current regulatory text, or instead focused on hypothetical problems that could occur in the future. Because most of these comments do not explain how the long-standing regulatory text has created a problem, we have declined many of these requests.

Likewise, in this document, we describe several editorial revisions that we made to improve the clarity of the CGMP requirements. However, we do not discuss comments that suggest editorial changes that simply suggest using different words in the regulatory text, but without explaining why the editorial revisions would improve the clarity of the provisions. These long-standing CGMPs have been in place and interpreted for decades, and we see no reason to revise them without a reason to do so.

(Comment 70) Some comments ask us to specify that several of the CGMP requirements in subpart B only apply “where the potential for contamination exists.” (See table 8.) Other comments ask us to change some requirements to recommendations or to specify that they only apply “as appropriate.” (See table 8.)

(Response 70) We decline these requests. These long-standing provisions apply generally to the plant, equipment and utensils in the plant, sanitary operations and sanitary facilities in a plant, and operations conducted in a plant. To suggest otherwise is inconsistent with the precepts of good manufacturing practices.

For example, as required by § 117.20(a), an establishment must have control of its grounds regardless of the specific food being produced, because litter, waste, weeds, and grass can all attract and harbor pests, and the first step for pest control in the plant is to avoid attracting pests. As required by § 117.20(b), a plant requires suitable construction and design regardless of the specific potential for contamination at any particular location in the plant. Each of the seven more specific provisions governed by § 117.20(b) adds the context that the requirements are directed to what is “adequate” (e.g., adequate space, adequate precautions, and adequate cleaning), and the defined term “adequate” provides context that the purpose of the requirements for plant construction and design are related to public health. As required by § 117.40, a plant requires clean and sanitary equipment regardless of the specific potential for contamination associated with a particular piece of equipment or the type of food being produced, because dirty equipment at one location in a plant can attract pests or become a harborage for environmental pathogens that can eventually lead to contamination in multiple locations in the plant. As required by § 117.80(a)(10), a food plant requires adequate sanitation regardless of the specific potential for contamination, and the term “adequate” provides flexibility for how an establishment designs and implements its sanitation program when the potential for contamination is low. As required by § 117.80(a)(3), a plant requires adequate sanitation regardless of the specific potential for contamination, and someone must be in charge of sanitation to determine what needs to be done, where it needs to be done, and how often it needs to be done. The individual(s) who supervises the sanitation of the plant has flexibility in the design and implementation of a sanitation program when the potential for contamination is low.

In addition, the CGMP requirements are flexible requirements that each establishment can adapt to its own operations, equipment, and food products. For example, § 117.35(a) requires that buildings, fixtures, and other physical facilities of the plant must be maintained in a clean and sanitary condition and must be kept in repair adequate to prevent food from becoming adulterated. Cleaning and sanitizing of utensils and equipment must be conducted in a manner that protects against allergen cross-contact and against contamination of food, food-contact surfaces, or food-packaging materials. The standards established by the requirement are to protect against contamination and allergen cross-contact, and the defined term “adequate” provides the context that the specific measures adopted by an establishment are related to public health.

(Comment 71) Some comments ask us to change the phrase “work-in-process” to “in-process materials” in several provisions throughout proposed subpart B because they believe “in-process materials” to be more familiar, straightforward, and commonly understood than “work-in-process.”

(Response 71) “Work-in-process” is the common industry term used in widely disseminated industry publications (Ref. 23) (Ref. 24) and has been in use for more than 30 years in the umbrella CGMPs. In addition, we did not receive any comments objecting to the use of this term when we proposed to include it in previous revisions to the umbrella CGMPs (proposed rule 44 FR 33238 at 33247, June 8, 1979; final rule, 51 FR 22458, June 19, 1986). Therefore, we have retained the phrase “work-in-process” in the final rule.

VIII. Subpart A: Comments on Proposed § 117.1—Applicability and Status

We proposed to redesignate § 110.5 as proposed § 117.1, and to add a provision relevant to FSMA's statutory provisions for a prohibited act under section 301(uu) of the FD&C Act (21 U.S.C. 331(uu)). Some comments support the proposed provisions without change. For example, one comment expresses the view that one strength of the long-standing CGMPs is their applicability to the broad spectrum of food manufacturing, from the manufacture of processed products and packaging of fresh produce to production of food additives and GRAS substances. (We note that some packaging of fresh produce (e.g., packaging of RACs on a farm) is not subject to the CGMPs.)

Some comments that support the proposed provisions ask us to clarify how we will interpret the provisions (see, e.g., Comment 72).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we are finalizing the provisions as proposed, with editorial and conforming changes as shown in table 52.

A. Comments on Proposed § 117.1(a)—Applicability

We proposed that the criteria and definitions in part 117 apply in determining whether a food is adulterated: (1) Within the meaning of section 402(a)(3) of the FD&C Act in that the food has been manufactured under such conditions that it is unfit for food; or (2) within the meaning of section 402(a)(4) of the FD&C Act in that the food has been prepared, packed, or held under insanitary conditions whereby it may have become contaminated with filth, or whereby it may have been rendered injurious to health. We also proposed that the criteria and definitions in part 117 also apply in determining whether a food is in violation of section 361 of the Public Health Service Act (42 U.S.C. 264).

(Comment 72) Some comments ask us to clarify that part 117 does not apply to activities that are subject to the requirements for CGMPs, hazard analysis and risk-based preventive controls for animal food and feed by inserting “intended for consumption by humans” after “food” in § 117.1(a).

(Response 72) We decline this request. As discussed in Response 6, the applicability of these regulations to human food is specified in the regulatory text by the title of the rule and by its placement in Subchapter B, rather than Subchapter E, of 21 CFR.

(Comment 73) Some comments assert that there is a clear difference between the criteria in proposed § 117.1(a)(1) used to describe adulterated food and the referenced criteria in section 402(a)(3) of the FD&C Act, in that proposed § 117.1(a)(1) describes manufacturing conditions whereas section 402(a)(3) of the FD&C Act describes actual adulterated product.

(Response 73) We disagree with these comments. We interpret “otherwise unfit for food” in this long-standing statement of applicability to be broader than physical properties of the food and to apply to the manufacturing conditions of the food.

(Comment 74) Some comments note that FSMA granted FDA mandatory recall authority for adulterated food. These comments express concern that theoretically we could use a violation of the requirements for hazard analysis and risk-based preventive controls to determine that food is adulterated, thereby providing the basis for a mandatory recall of that food. These comments raise three issues regarding how we will apply § 117.1(a), with consequences for a potential mandatory recall of food.

First, these comments note that the regulatory text stating that the “criteria and definitions” apply in making a determination of adulteration appears to encompass the entirety of the rule. As a result, farms or facilities that violate any of the requirements in the proposed rule, including components not directly related to the safety of the food (such as recordkeeping requirements), could face a risk that we would deem their food adulterated.

Second, these comments assert that the regulatory text suggests that we would not automatically consider a food adulterated as a result of a violation of the proposed rule, because it states that the criteria and definitions “apply in determining” whether a food will be considered adulterated, rather than that the food “is” adulterated.

Third, these comments state that it is not clear how the exemption applicable to qualified facilities is included in the “criteria and definitions” used in making a determination of adulteration. These comments ask us to clarify that we will not just automatically assume that qualified facilities are selling adulterated food because they are by definition exempt from the requirements for hazard analysis and risk-based preventive controls.

(Response 74) The comments are correct that the criteria and definitions “apply in determining” whether a food will be considered adulterated, rather than that the food “is” adulterated. In determining whether a food that is manufactured, processed, packed, or held in violation of part 117 (including a violation of the recordkeeping requirement) is adulterated, we would consider the totality of the available data and information about the violation and the food before reaching a conclusion that the food is adulterated.

Although this rule does not address the mandatory recall provisions of FSMA, the statutory provisions establish two basic criteria. (See section 423(a) of the FD&C Act (21 U.S.C. 350l).) First, we must determine that there is a “reasonable probability” that the food is adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. A violation of part 117 would be relevant to determining whether a food is adulterated under section 402. Second, we must determine that there is a reasonable possibility that the use of, or exposure to, that food will cause serious adverse health consequences or death to humans or animals. Not all food that is adulterated has a reasonable probability of causing serious adverse health consequences or death to humans or animals. For examples of food contamination with a reasonable probability of causing serious adverse health consequences or death to humans or animals, see the annual reports of the Reportable Food Registry (RFR) (Ref. 25) (Ref. 26) (Ref. 27) (Ref. 28).

A facility that is exempt from any requirement of part 117, including the requirements for hazard analysis and risk-based preventive controls, would not be in violation of part 117 if it did not comply with provisions that it is not subject to.

B. Comments on Proposed § 117.1(b)—Prohibited Act

We proposed that the operation of a facility that manufactures, processes, packs, or holds food for sale in the United States is a prohibited act under section 301(uu) of the FD&C Act (21 U.S.C. 331(uu)) if the owner, operator, or agent in charge of such facility is required to comply with, and is not in compliance with, section 418 of the FD&C Act or subparts C, D, E, or F of part 117 (proposed § 117.1(b)).

(Comment 75) Some comments from State regulatory agencies note that this new provision is not covered under the applicable State statute and that making any changes to the State statute can be a lengthy process that takes up to 3 years to complete.

(Response 75) See Response 5 for a discussion of our approach to working with our food safety partners in the States.

C. Comments on Proposed § 117.1(c)—Specific CGMP Requirements

We proposed to redesignate § 110.5(b) as proposed § 117.1(c) with no changes. We received no comments that disagreed with our proposal, and are finalizing the proposed provision without change.

IX. Subpart A: Comments on Proposed § 117.3—Definitions

We proposed to revise some definitions that had been established in part 110, redesignate and re-establish the remaining definitions in part 117 (except for the definition of “shall,” which we proposed to delete), and establish several new definitions in part 117. Some comments support one or more of these proposed definitions without change. For example, some comments state that they support the proposed definitions for the following terms with no suggested revisions: critical control point, facility, food allergen, food-contact surfaces, microorganism, mixed-type facility, monitor, plant, safe-moisture level, subsidiary, and validation. Some comments support our proposal, in the 2014 supplemental preventive controls notice, to use the phrase “chemical (including radiological)” in the definition of “hazard,” noting that doing so is consistent with FSMA, current industry practice, and Codex and global HACCP standards. Some comments that support a proposed definition suggest alternative or additional regulatory text, such as adding examples to make the definition clearer (see, e.g., Comment 81 and Comment 87). Some comments that support a proposed definition ask us to clarify how we will interpret the definition (see, e.g., Comment 77 and Comment 87).

In the following sections, we discuss comments that ask us to clarify the proposed definitions or that disagree with, or suggest one or more changes to, the proposed definitions. After considering these comments, we have revised the proposed requirements as shown in table 9, with editorial and conforming changes as shown in table 52. We also have deleted the definition of “should,” because the final rule does not use that term.

We also discuss definitions for additional terms (i.e., “audit,” “correction,” “defect action level,” “full-time equivalent employee,” “qualified facility exemption,” “raw agricultural commodity,” “supply-chain-applied control,” “written procedures for receiving raw materials and other ingredients,” and “unexposed packaged food”) that we are establishing in the final rule to simplify the regulatory text throughout the regulations and improve clarity. We also discuss a new name (i.e., “preventive controls qualified individual”) for the definition of a term that we had proposed to name “qualified individual” and are establishing a new definition for the term “qualified individual.” Finally, we discuss definitions that comments ask us to add, but that we did not add, to the final rule.

A. Redesignation

We proposed to redesignate all definitions in § 110.3(a) through (r) as proposed § 117.3, eliminate paragraph designations (such as (a), (b), and (c)), and add new definitions in alphabetical order. We received no comments that disagreed with our proposal, and are finalizing the proposed redesignations.

B. Definitions in Current Part 110 That We Proposed To Delete

We proposed to delete the definition of “shall” and use “must” instead. We received no comments that disagreed with our proposal, and are deleting the definition of “shall” as proposed.

C. Definitions That We Proposed To Establish in Part 117

1. Adequate

We proposed to define the term “adequate” to mean that which is needed to accomplish the intended purpose in keeping with good public health practice.

(Comment 76) Some comments assert that the definition is vague and ask us to clarify what constitutes “adequate” for systems such as operating systems for waste treatment and disposal. Other comments ask us to develop guidance on thresholds and processes that qualify as “adequate.” Other comments assert that the word “adequate” must be used in combination with the word “reasonable” to properly describe the intended measures and precautions. As an example, these comments assert that the definition of “adequate” could lead to excessive requirements when applied to the provisions for disease control and hygiene (§ 117.10).

(Response 76) We disagree that this long-standing definition of the term “adequate” is vague. The comments do not provide any examples of how we have interpreted this definition in the past in a way that creates practical problems when applying CGMP requirements, including requirements directed to the management of waste or the provisions for disease control and hygiene. Our intent in using the term “adequate” is to provide flexibility for a food establishment to comply with the requirement in a way that is most suitable for its establishment. We decline the request to develop guidance to explicitly address “thresholds” or to describe processes that qualify as adequate. The CGMPs established in this are broadly applicable procedures and practices rather than very specific procedures and practices where additional interpretation from FDA might be appropriate.

2. Affiliate and Subsidiary

We proposed to define the term “affiliate” to mean any facility that controls, is controlled by, or is under common control with another facility. We proposed to define the term “subsidiary” to mean any company which is owned or controlled directly or indirectly by another company. These proposed definitions would incorporate the definition in sections 418(l)(4)(A) and (D) of the FD&C Act and would make the meanings of these terms clear when used in the proposed definition of “qualified facility.”

(Comment 77) Some comments ask us to clarify that a facility that has no material connection with another food processing operation would not be considered as an “affiliate” of that operation.

(Response 77) It is not clear what the comments mean by “no material connection with another food processing operation.” To the extent that a facility does not control, is not controlled by, or is not under common control with another facility, we agree that the facility would not be considered an affiliate of that food processing operation.

(Comment 78) Some comments assert that the definitions of “affiliate” and “subsidiary” fail to account for the legal differences between a piece of property (i.e., a facility) and a business entity or person. These comments ask us to consider amending the proposed definition of “qualified facility” to clarify what sales to include in determining whether a facility so qualifies.

(Response 78) See Response 118.

3. Allergen Cross-Contact

We proposed to define the term “allergen cross-contact” to mean the unintentional incorporation of a food allergen into a food.

(Comment 79) Some comments assert that the term “incorporation” used in the definition is a vague term that has entirely different meanings when used by different segments of the food industry (e.g., the term would mean something different to a produce wholesaler than to a cereal manufacturer). These comments ask us to provide either a clarification or a definition for the term “incorporation.”

(Response 79) By “unintentional incorporation of a food allergen into food” we mean that the food allergen would be in a food when the producer of the food did not intend it to be in the food—e.g., if a milk-based beverage contains soybeans in addition to milk. Several provisions of the rule require that a facility take steps to prevent such unintentional incorporation of a food allergen into food. See our previous discussion of the importance of preventing allergen cross-contact (78 FR 3646 at 3693).

4. Critical Control Point

We proposed to revise the definition for “critical control point” to mean a point, step, or procedure in a food process at which control can be applied and is essential to prevent or eliminate a food safety hazard or reduce such hazard to an acceptable level.

(Comment 80) Some comments ask us to specify that a critical control point is essential to reduce the presence of hazards such as microorganisms to “minimize the risk of foodborne illness” rather than to “reduce such hazard to an acceptable level.” These comments assert that this revision would be consistent with the approach in the proposed produce safety rule. Other comments disagree with the proposed definition because it does not define a term (i.e., acceptable level) used in the definition.

(Response 80) We decline to modify the definition as requested by these comments. The proposed definition matches the statutory definition in section 418(o)(1) of the FD&C Act and is consistent with definitions in the NACMCF HACCP guidelines, the Codex HACCP Annex, and Federal HACCP regulations for seafood, juice, and meat and poultry (78 FR 3646 at 3695). The proposed produce safety rule, which did not propose to define “critical control point,” focused on biological hazards. However, critical control points may be established to control chemical or physical hazards in addition to biological hazards. The standard suggested by the comments is not inconsistent with the definition we proposed for “critical control point” in the human preventive controls rule, because preventing or eliminating a food safety hazard or reducing such hazard to an acceptable level would minimize the risk of foodborne illness. However, the standard suggested by the comments was narrowly directed to biological hazards, because chemical and physical hazards generally cause injury rather than illness.

We do not need to define every term used in the definition. By specifying that a point, step, or procedure in a food safety process would reduce a hazard to an “acceptable level,” the definition provides flexibility for a facility to determine an appropriate level in a particular circumstance. Consistent with the approach recommended in the proposed produce safety rule (78 FR 3504 at 3545), a facility could use current FDA guidance on microbiological hazards (e.g., Ref. 29 and Ref. 30) to inform its decision on what constitutes an acceptable level. In those documents, we use the phrase “adequately reduce” to mean capable of reducing the presence of Salmonella to an extent sufficient to prevent illness. The extent of reduction sufficient to prevent illness usually is determined by the estimated extent to which Salmonella spp. may be present in the food combined with a safety factor to account for uncertainty in that estimate. For example, if it is estimated that there would be no more than 1000 (i.e., 3 logs) Salmonella organisms in the food, and a safety factor of 100 (i.e., 2 logs) is employed, a process adequate to reduce Salmonella spp. would be a process capable of reducing Salmonella spp. by 5 logs.

5. Environmental Pathogen

We proposed to define the term “environmental pathogen” to mean a pathogen capable of surviving and persisting within the manufacturing, processing, packing, or holding environment such that food may be contaminated and may result in foodborne illness if that food is consumed without treatment to significantly minimize or prevent the environmental pathogen. We also proposed to specify that environmental pathogen does not include the spores of pathogenic sporeformers.

(Comment 81) Some comments ask us to include Salmonella spp. and L. monocytogenes in the regulatory text as examples of environmental pathogens because of the likelihood that these environmental pathogens could contaminate ready-to-eat (RTE) food. Other comments ask us to provide a broader list (including Escherichia coli, Campylobacter, pathogenic Vibrio, Staphylococcus aureus, Clostridium botulinum, Shigella, Yersinia enterocolitica, and viruses such as rotoviruses and noroviruses) in the preamble to the final rule or in guidance, and to make clear that the list is not all-inclusive. Some comments emphasize the need for flexible language because any list of microorganisms might change over time, particularly as new environmental pathogens emerge.

Some comments ask us to include the indicator organism Listeria spp. in the regulatory text, because analysis of Listeria spp. is faster than analysis of L. monocytogenes. Other comments ask us to include pathogens that have been associated with RACs, as reported by CDC.

(Response 81) We agree that Salmonella spp. and L. monocytogenes are useful examples of environmental pathogens and have added these two examples to the proposed definition, which had not included examples. As the comments point out, adding these two examples to the definition does not mean that these two pathogens are the only environmental pathogens that a facility must consider in its hazard analysis. New environmental pathogens can emerge at any time, and other pathogens (e.g., Cronobacter spp.) can also be environmental pathogens (78 FR 3646 at 3816).

We have not included the indicator organism Listeria spp. as an example of an environmental pathogen, whether in the regulatory text, in the preamble of this document, or in guidance. Although we agree that Listeria spp. is an appropriate indicator organism when conducting verification testing for sanitation controls, the definition in question is for a pathogen, not for indicators of a pathogen. Other provisions of the rule are more appropriate to provide the context that a facility has flexibility for how to conduct verification testing for an environmental pathogen, including an option to test for an indicator organism. (See, e.g., § 117.165(a)(2) and (3).)

L. monocytogenes, Salmonella spp., and some of the other pathogens mentioned in the comments have been associated with RACs. To the extent that the comments are asking us to identify some environmental pathogens that have been associated with RACs, by identifying these pathogens in the regulatory text or in this preamble we have done so. However, it is important to note that the term “environmental pathogen” as defined in this rule is directed to pathogens in the food processing environment (such as the insanitary conditions in a facility that packed cantaloupes linked to an outbreak of listeriosis (78 FR 3646 at 3814)), not to pathogens present in the growing environment for a RAC.

(Comment 82) Some comments ask us to define “environmental pathogen” as a microorganism that is of public health significance and is capable of surviving and persisting within the manufacturing, processing, packing, and holding environment of the food being prepared.

(Response 82) We decline this request. The definition of “environmental pathogen” should not change depending on the food being prepared in a particular facility. As a practical matter, the facility will consider the manufacturing, processing, packing, and holding environment of the food being prepared when it conducts its hazard analysis (§ 117.130).

(Comment 83) Some comments ask us to focus attention on the areas where environmental monitoring is particularly important by modifying the definition to address the risk of contamination to RTE food and to foods exposed to the environment after a lethality step. Other comments ask us to consider the number and types of different products produced, the complexity of processing procedures, the amount of product produced, and whether an environmental sampling program is in place.

(Response 83) We decline these requests, which are asking us to specify in a definition factors associated with developing an environmental monitoring program. The purpose of a definition is to simply explain what a term means, not to establish requirements, or provide guidance about requirements, that use the term.

(Comment 84) Some comments ask us to clarify the meaning of the term “persisting” as used in the definition, such as whether it means that a sanitation process will not remove the microorganism.

(Response 84) We use the term “persisting” to mean that a pathogen can become established if cleaning is not adequate. Once a pathogen becomes established, appropriate sanitation measures can remove the pathogen. However, sanitation procedures necessary to eliminate an environmental pathogen that has become established generally are more aggressive than routine sanitation procedures.

(Comment 85) Some comments ask us to revise the definition to specify that the microorganisms are “potentially” of public health significance.

(Response 85) We decline this request. The definition is only directed at those microorganisms that are of public health significance.

(Comment 86) One comment asserts that the proposed definition of “environmental pathogen” excludes the waterborne pathogens Cyclospora and Cryptosporidium and asks us to revise the definition so that these pathogens will be considered “environmental pathogens” for the purposes of the human preventive controls rule. The comment asserts that excluding these waterborne pathogens does not take into account the considerable food safety hazard of “spores” of “pathogenic sporeformers” that can be present in and delivered to a food processing facility by processing and ingredient water, both well water and surface water from either private or municipal supply, in both domestic and foreign facilities. The comment asks us to delete the statement that an environmental pathogen does not include the spores of pathogenic sporeformers so that, according to the comment, Cyclospora and Cryptosporidium would fall within the definition of “environmental pathogen.”

(Response 86) We disagree that the pathogens Cyclospora and Cryptosporidium should be considered “environmental pathogens” as we use that term in this rule. Our definition of “environmental pathogen” is directed to those pathogens that are capable of surviving and persisting within the manufacturing, processing, packing, or holding environment of a food establishment, not the water that is used in a food processing establishment. See the discussion of environmental pathogens in the food processing environment in section I.D of the Appendix to the 2013 proposed human preventive controls rule (78 FR 3646 at 3813-3815, with corrected reference numbers at 78 FR 17142 at 17144-17146). As discussed in that Appendix, the available data and information associate insanitary conditions in food facilities with contamination of a number of foods with Salmonella spp. and L. monocytogenes. Such contamination has led to recalls and to outbreaks of foodborne illness. As a result, the rule includes several provisions directed to those pathogens, such as Salmonella spp. and L. monocytogenes, that are capable of surviving and persisting within a food establishment (thereby serving as a source of contamination of the food establishment environment) and uses the defined term “environmental pathogens” to describe those pathogens. These specific provisions do not apply to waterborne pathogens that do not survive and persist within a food establishment.

By “pathogenic sporeformers,” we mean “pathogenic sporeforming bacteria,” and we are substituting the term “pathogenic sporeforming bacteria” for “pathogenic sporeformers” in the definition of “environmental pathogen” to make that clearer. Both of the waterborne pathogens discussed by this comment are protozoan parasites, not bacteria (Ref. 31).

The fact that waterborne organisms such as Cyclospora and Cryptosporidium are not “environmental pathogens” as that term is used in this rule does not mean that a facility has no responsibility to evaluate whether Cyclospora or Cryptosporidium are known or reasonably foreseeable hazards that require a preventive control. For example, when a fresh-cut produce processing facility receives produce from a geographic region where Cyclospora or Cryptosporidium have been associated with food safety problems, the facility likely would address the potential for contamination of incoming produce with Cyclospora or Cryptosporidium in its supply-chain program (see subpart G for the requirements of the supply-chain program).

6. Facility

We proposed to define the term “facility” to mean a domestic facility or a foreign facility that is required to register under section 415 of the FD&C Act in accordance with the requirements of 21 CFR part 1, subpart H. Comments directed to the meaning of the term “facility” address its meaning as established in the section 415 registration regulations, rather than this definition established in part 117. See Comment 4 and Response 4.

7. Farm

We proposed to define the term “farm” by reference to the definition of that term in proposed § 1.227 rather than by repeating the full text of the “farm” definition in part 117. See section IV.B for a discussion of the “farm” definition that we are establishing in § 1.227.

8. Food

We proposed to define the term “food” to mean food as defined in section 201(f) of the FD&C Act and to include raw materials and ingredients. Under section 201(f), the term “food” means: (1) Articles used for food or drink for man or other animals, (2) chewing gum, and (3) articles used for components of any such article.

(Comment 87) Some comments ask us to include examples in the definition, particularly dietary supplements and dietary ingredients. These comments also ask us to clarify whether the definition applies to food for human consumption, animal consumption, or both.

(Response 87) We decline the request to include examples in the definition. Dietary supplements and dietary ingredients are articles used for food or drink for man, as are many other articles. There are many examples of food and adding a limited list of examples could be confusing rather than helpful. Although the definition of food includes food for both human consumption and animal consumption, the provisions of the rule are clearly directed to food for human consumption (see Response 6 and Response 72).

(Comment 88) Some comments ask us to consider fundamental and important differences between food additives and GRAS substances and finished food. These comments explain that food additives and GRAS substances may be synthesized using various chemical and biochemical processes, or may be extracted, hydrolyzed or otherwise modified from their natural sources, and result in food safety hazards that are quite different from finished food preparations. These comments also explain that food additives and GRAS substances are often produced using processes that minimize microbial contamination hazards and are almost always used in food products that undergo further downstream processing. These comments assert that food additives and GRAS substances generally present a significantly lower public health hazard compared to finished food and should be regulated accordingly.

(Response 88) Substances such as food additives and GRAS substances are food and are subject to the requirements of this rule. Both the CGMP requirements in subpart B and the requirements for hazard analysis and risk-based preventive controls in subparts C and G provide flexibility to address all types of food. (As discussed in section XLII, the final rule establishes the requirements for a supply-chain program in subpart G, rather than within subpart C as proposed. As a result, this document refers to subparts C and G when broadly referring to the requirements for preventive controls.) Some comments point out that one strength of the long-standing CGMPs is their applicability to the broad spectrum of food manufacturing, from the manufacture of processed products to production of food additives and GRAS substances (see section VIII). A manufacturer of a food additive or GRAS substance has flexibility to comply with the requirements of the rule based on the nature of the production processes and the outcome of the hazard analysis for that food substance. (See also Response 221.)

(Comment 89) Some comments ask us to limit the definition of “food” as it would apply to the new requirements for hazard analysis and risk-based preventive controls to only cover produce and processed foods covered by the rules, rather than all food (human and animal, produce and non-produce, low-risk and high-risk).

(Response 89) We decline this request. It is not necessary to modify the definition of “food” to limit applicability of the rule to human food. (See Response 6.) The umbrella CGMPs that we are establishing in subpart B are long-standing provisions that establish basic requirements for the manufacturing, processing, packing, and holding of food to prevent adulteration and are not “one-size-fits-all.” (See Response 221.) The new requirements for hazard analysis and risk-based preventive controls likewise are not “one-size-fits-all,” and facilities that are subject to the rule would consider the risk presented by the products as part of their hazard evaluation; a facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components. (See Response 222.)

9. Food Allergen

We proposed to define the term “food allergen” to mean a major food allergen as defined in section 201(qq) of the FD&C Act.

(Comment 90) Some comments ask us to narrow the definition of food allergen by specifying that a substance is only a food allergen when it is not disclosed on the product label.

(Response 90) We decline this request, which appears to confuse the distinction between what a food allergen is and when a product would be misbranded under section 403(w) of the FD&C Act. The substances listed in section 201(qq) of the FD&C Act are food allergens; if any of those substances are not disclosed on the product label, then the product would be misbranded under section 403(w) of the FD&C Act.

(Comment 91) Some comments ask us to expand the existing exemption for RACs from the definition of major food allergen in section 403(w)(1) of the FD&C Act to include raw fish.

(Response 91) This comment is unclear and appears to be confusing the definition of “major food allergen” in section 201(qq) of the FD&C Act with criteria for when a food shall be deemed to be misbranded under section 403(w) of the FD&C Act. Under section 403(w), a food shall be deemed misbranded if it is not a raw agricultural commodity and it is, or it contains an ingredient that bears or contains, a major food allergen, unless certain labeling requirements are met. Under section 201(r) of the FD&C Act, the term “raw agricultural commodity” means any food in its raw or natural state, including all fruits that are washed, colored, or otherwise treated in their unpeeled natural form prior to marketing. Fish are food and, thus, raw, unprocessed fish are RACs within the meaning of section 403(w). Thus, the misbranding provisions of section 403(w) would not apply to raw, unprocessed fish, because those misbranding provisions do not apply to RACs. However, the exemption in section 403(w) from the conditions under which a food shall be deemed to be misbranded do not establish an exemption for RACs in the definition of “major food allergen” in section 201(qq).

To the extent that the comment is asking us to revise either the statutory definition of “major food allergen” in section 201(qq) of the FD&C Act, or to revise the criteria for when a food shall be deemed misbranded under section 403(w) of the FD&C Act, we do not have authority to do so.

(Comment 92) Some comments ask us to include an example of an ingredient derived from an allergen in the definition.

(Response 92) We decline this request. The definition of “major food allergen” in section 201(qq) of the FD&C Act is sufficient to define the term. Casein and whey protein, each of which are derived from milk, are examples of ingredients that would satisfy the definition of “major food allergen” in section 201(qq).

10. Harvesting

We proposed to establish in § 117.3 the same definition of “harvesting” as we proposed to establish in §§ 1.227 and 1.328. See section IV.C for a discussion of comments we received to the proposed definition of “harvesting” in §§ 1.227 and 1.328, and our responses to those comments.

11. Hazard

We proposed to define the term “hazard” to mean any biological, chemical (including radiological), or physical agent that is reasonably likely to cause illness or injury in the absence of its control.

(Comment 93) Some comments express concern that the rule would refer to four levels of “hazard”—i.e., “hazard,” “known or reasonably foreseeable hazard,” “significant hazard,” and “serious adverse health consequences or death to humans or animals” hazard. These comments ask us to provide sufficient clarity to be able to distinguish between these types of hazards and to provide examples in guidance as to how these terms will be applied in determining compliance with the rule. Other comments express concern that the definitions do not establish a meaningful distinction between “hazard” and “significant hazards” and do not sufficiently distinguish between the hazards identified in the first and second steps of the hazard analysis (first narrowing hazards to “known or reasonably foreseeable hazards” and then narrowing the “known or reasonably foreseeable hazards” to “significant hazards”).

(Response 93) The rule uses three of these terms (i.e., “hazard,” “known or reasonably foreseeable hazard,” and the proposed term “significant hazard”) to establish a tiered approach to the requirements for hazard analysis and risk-based preventive controls. The term “hazard' is the broadest of these three terms—any biological, chemical (including radiological), or physical agent that is reasonably likely to cause illness or injury. To conduct its hazard analysis, a facility starts by first narrowing down the universe of all potential hazards to those that are “known or reasonably foreseeable” for each type of food manufactured, processed, packed, or held at its facility. The outcome of the facility's hazard analysis is a determination of “significant hazards”—i.e., the subset of those known or reasonably foreseeable hazards that require a preventive control.

To make this clearer, we have: (1) Revised the proposed definition of “hazard”; (2) changed the term “significant hazard” to “hazard requiring a preventive control”; and revised the definition of “hazard requiring a preventive control” (formerly “significant hazard”). See Response 94, Response 126, Response 127, Response 128, and Response 129.

The rule does not define the term “serious adverse health consequences or death to humans or animals” hazard. However, the requirements for a supply-chain program refer to a hazard for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans (see § 117.430(b)). For additional information on how we interpret “serious adverse health consequences or death to humans or animals,” see our guidance regarding the Reportable Food Registry (Ref. 32) (Ref. 33), which addresses statutory requirements regarding “reportable foods.” As explained in that guidance, a “reportable food” is an article of food (other than dietary supplements or infant formula) for which there is a reasonable probability that the use of, or exposure to, such article of food will cause serious adverse health consequences or death to humans or animals. The guidance includes examples of circumstances under which food might be reportable.

(Comment 94) Some comments assert that the distinction between the definitions of “hazard” and “significant hazard” is not discernable because the proposed definition of “hazard” currently takes into account whether or not a “hazard” is or is not controlled. These comments ask us to delete the phrase “in the absence of its control” from the definition of “hazard” to clarify that hazards are simply the agents that are reasonably likely to cause illness or injury. Likewise, other comments assert that any hazard that is “reasonably likely to cause illness or injury in the absence of its control” will, if known or reasonably foreseeable, likely be controlled by any knowledgeable person.

(Response 94) We have deleted the phrase “in the absence of its control” from the definition of “hazard.” As previously discussed, the phrase “in the absence of its control” is not included in the definition of “hazard” in the Codex HACCP Annex, our HACCP regulation for seafood, or the HACCP regulation for meat and poultry, although it is included in the NACMCF HACCP Guidelines and our HACCP regulation for juice (78 FR 3646 at 3697). We agree that deleting this phrase from the definition of “hazard” will more clearly distinguish between the terms “hazard” and “hazard requiring a preventive control” that we are establishing in this rule. We see no reason to propose an analogous change to the definition of “hazard” in our HACCP regulation for juice because that regulation only defines the single term “hazard” and, thus, the issue discussed in these comments does not apply.

We also replaced the phrase “that is reasonably likely to cause illness or injury” with “that has the potential to cause illness or injury” to more clearly distinguish “hazard” from “known or reasonably foreseeable hazard.” This increases the alignment of the definition of “hazard” in this rule with the Codex definition of “hazard.”

(Comment 95) Some comments ask us to add that the term hazard also means any agent that would cause a food to become adulterated under section 402 of the FD&C Act.

(Response 95) The suggested addition is inconsistent with current national and international understanding of what constitutes a hazard (Ref. 34) (Ref. 35) because it would include agents such as filth, which would adulterate food within the meaning of section 402(a)(4) of the FD&C Act but would be unlikely to cause illness or injury (Ref. 36).

12. Holding

We proposed to establish in § 117.3 the same definition of “holding” as we proposed to establish in §§ 1.227 and 1.328. See section IV.D for a discussion of comments we received to the proposed definition of “holding” in §§ 1.227 and 1.328, and our responses to those comments.

13. Known or Reasonably Foreseeable Hazard

We proposed to define the term “known or reasonably foreseeable hazard” to mean a biological, chemical (including radiological), or physical hazard that has the potential to be associated with the facility or the food.

(Comment 96) Some comments support the definition as proposed, noting that it implies that the implementation of a preventive control is based both on the severity and likelihood of the hazard, can help to distinguish between the requirements of this rule and HACCP requirements, and provides for the proper consideration of both the food and the facility when determining whether a hazard is “known or reasonably foreseeable.” Other comments ask us to modify the definition to specify that the term means a hazard “that is known to be, or has the potential to be,” associated with the facility or the food” to better align with the term as FDA proposed to define it in the proposed FSVP rule. (See 79 FR 58574 at 58595.)

(Response 96) We have revised the definition as requested by the comments to better align with the proposed FSVP rule.

(Comment 97) Some comments ask us to revise the definition so that it addresses a hazard that is known to be, or has the potential to be, associated with a food, the facility in which it is manufactured/processed, or the location or type of farm on which it is grown or raised. These comments assert that the type of farm may affect those hazards that are known or reasonably foreseeable.

(Response 97) We decline this request, which appears related to another difference between the definition proposed in this rule and the definition of this term in the proposed FSVP rule. The proposed FSVP rule would define “known or reasonably foreseeable hazard” as a hazard that is known to be, or has the potential to be, associated with a food or the facility “in which it is manufactured/processed.” (See 79 FR 58574 at 58595.) In this rule, we do not need to specify that the applicable facility is the one “in which the food is manufactured/processed” because this rule applies to the owner, operator, or agent in charge of the facility in which the food is manufactured, processed, packed, or held, and that applicability does not need to be repeated in each provision. To the extent that this comment is expressing concern about raw materials or other ingredients that a facility would receive from a farm, those concerns would be considered in the facility's hazard analysis, which would include a hazard evaluation that considers factors such as those related to the source of raw materials and other ingredients (see § 117.130(c)(2)(iii)).

(Comment 98) Some comments ask us to include “food allergens” in the parenthetical where we list radiological hazards as a type of chemical hazard.

(Response 98) We decline this request. As previously discussed, the definitions of “hazard” or “food hazard” in the NACMCF HACCP guidelines, the Codex HACCP Annex, and Federal HACCP regulations for seafood, juice, and meat and poultry all define hazard with respect to biological, chemical, and physical agents, and we proposed to include radiological agents to implement section 418(b)(1)(A) of the FD&C Act (78 FR 3646 at 3697). We subsequently proposed to include radiological hazards as a subset of chemical hazards because comments recommended that we do so, and we believe that facilities in the past have considered radiological hazards as chemical hazards when conducting a hazard analysis for the development of HACCP plans (79 FR 58524 at 58557).

In this document, we affirm our proposal to implement section 418(b)(1)(A) of the FD&C Act by specifically including radiological hazards in the definition of hazard. We acknowledge that food allergen hazards (together with pesticide and drug residues, natural toxins, decomposition, and unapproved food or color additives) also are a subset of chemical hazards but do not find it necessary to list all examples of chemical hazards in the definition of hazard, just as we do not find it necessary to list multiple examples of biological and physical hazards in the definition of hazard. The requirement to consider food allergen hazards in the hazard analysis is already explicit in the requirements for hazard identification (see § 117.130(b)(1)(ii)).

(Comment 99) Some comments suggest using the phrase “reasonably anticipated contaminants” as a useful phrase that clearly defines all hazards, whether deliberate or accidental, that can cause adulteration in the food supply.

(Response 99) We decline this request. We see no meaningful difference between “reasonably expected” and “reasonably anticipated.” We also see no benefit in specifying that a hazard is a “contaminant” rather than an “agent” (which is the term used in the definition of “hazard”).

14. Lot

We proposed to define “lot” to mean the food produced during a period of time indicated by a specific code.

(Comment 100) Some comments ask us to modify the proposed definition to make it more flexible and robust. These comments assert that the proposed definition appears to ignore other potential definitions, such as products with common characteristics (such as origin, variety, type of packing, packer, consignor, markings) and that multiple “lots” can be produced during the same time but with different lot designations. Other comments ask us to modify the proposed definition so that it is not limited by a period of time and suggest using an approach that would allow for a lot to be defined by either time or by a specific identifier. Other comments express the view that the individual operators should be able to define their lot designations and make these definitions available to FDA upon request. Other comments assert that the proposed definition is too prescriptive and inflexible in that timeframe is not necessarily the most logical way to identify a lot (e.g., for batch production). Some comments suggest specific changes to the text of the proposed definition, such as “Lot means a body of food designated by the facility with common characteristics, e.g., origin, variety, type of packing, packer, consignor, markings or time of harvest, packing or processing, which is separable by such characteristics from other bodies of food.”

(Response 100) As judged by these comments, the long-standing definition of “lot” has the potential to be misinterpreted to mean that the “specific code” must be based on time, such as a date. This is not the case. Although the term “lot” is associated with a period of time, an establishment has flexibility to determine the code, with or without any indication of time in the code. For example, a code could be based on a date, time of day, production characteristic (such as those mentioned in the comments), combination of date/time/production characteristic, or any other method that works best for the establishment. To clarify that the rule does not require that time be “indicated” by the code, and emphasize the establishment's flexibility to determine the code, we have revised “period of time indicated by a specific code” to “period of time and identified by an establishment's specific code.”

(Comment 101) Some comments ask us to clarify the purpose of the “specific code” associated with the lot (i.e., that it should give insight into production history of the associated food) and to define a term such as “lot code” or “production code.”

(Response 101) The purpose of the specific code associated with a lot is to identify the food and associated production records—e.g., when investigating a food safety problem or conducting a recall. We decline the request to define a term such as “lot code” or “production code.” The definition of “lot” is intended to provide flexibility for an establishment to determine the mechanism of assigning a code that is best suited to the food it produces.

(Comment 102) Some comments ask us to clarify the factors that can affect the size of a “lot.” These comments assert that minimizing the size of a lot could be beneficial to an establishment if a recall is needed and express concern that our proposed definition may differ from that used by a specific establishment.

(Response 102) The definition provides a company with flexibility to determine an appropriate size of a lot.

15. Manufacturing/Processing

We proposed to establish in § 117.3 the same definition of “manufacturing/processing” as we proposed to establish in §§ 1.227 and 1.328. See section IV.E for a discussion of comments we received to the proposed definition of “manufacturing/processing” in §§ 1.227 and 1.328, and our responses to those comments.

16. Microorganisms

We proposed to define the term “microorganisms” to mean yeasts, molds, bacteria, viruses, protozoa, and microscopic parasites and include species having public health significance. We also proposed that the term “undesirable microorganisms” includes those microorganisms that are of public health significance, that subject food to decomposition, that indicate that food is contaminated with filth, or that otherwise may cause food to be adulterated.

(Comment 103) Some comments express concern that the term “undesirable microorganisms” includes microorganisms that subject food to decomposition. These comments assert that the definition would expand regulation beyond food safety and ask us to clarify that decomposition means a degradation of product that is only relevant when it affects the safety of the product, rather than simple spoilage, because the presence of microorganisms that can cause spoilage is an unavoidable condition of fresh produce.

(Response 103) We have not modified the regulatory text of this long-standing definition of the term “undesirable microorganisms” regarding microorganisms that subject food to decomposition. As we noted during the rulemaking to first establish this definition, the regulations are designed to prevent the growth of undesirable microorganisms, and the scope of the definition is not limited to pathogens because these regulations are also concerned with sanitation, decomposition, and filth (51 FR 22458 at 22460). The comments do not provide any examples of how we have interpreted this provision in the past in a way that creates practical problems to the fresh produce industry when applying CGMP requirements directed to preventing the growth of undesirable microorganisms.

(Comment 104) Some comments ask us to specify that the term “undesirable microorganisms” includes microorganisms that are resistant to drugs or antibiotics.

(Response 104) We decline this request. The requirements of this rule directed to preventing contamination with microorganisms are intended to keep microorganisms out of food regardless of whether a particular strain of a specific microorganism (including a pathogen, a microorganism that subjects food to decomposition, and a microorganism that indicates that food is contaminated with filth) has the particular characteristic of being resistant to drugs or antibiotics.

(Comment 105) Some comments ask us to provide lists of microorganisms that we consider indicative of “contamination with filth” and our rationale for such consideration.

(Response 105) We decline this request, which is better suited for guidance. In other circumstances, we have discussed coliforms and fecal coliforms as indicators that food has been contaminated by manufacturing practices conducted under insanitary conditions (see, e.g., the discussion in the proposed rule to establish Current Good Manufacturing Practice, Quality Control Procedures, Quality Factors, Notification Requirements, and Records and Reports, for the Production of Infant Formula, 61 FR 36154 at 36171, July 9, 1996). As another example, “Compliance Policy Guide Sec. 527.300 Dairy Products—Microbial Contaminants and Alkaline Phosphatase Activity” provides that dairy products may be considered adulterated within the meaning of section 402(a)(4) of the FD&C Act (21 U.S.C. 342(a)(4)), in that they have been prepared, packed, or held under insanitary conditions whereby they may have become contaminated with filth, when (nontoxigenic) E. coli is found at certain levels (Ref. 37).

17. Mixed-Type Facility

We proposed to establish in § 117.3 the same definition of “mixed-type facility” as we proposed to establish in §§ 1.227 and 1.328. See section IV.F for a discussion of comments we received to the proposed definition of “mixed-typed facility” in §§ 1.227 and 1.328, and our responses to those comments.

18. Monitor

We proposed to define the term “monitor” to mean to conduct a planned sequence of observations or measurements to assess whether a process, point, or procedure is under control and to produce an accurate record for use in verification.

(Comment 106) Some comments assert that our proposed definition of monitoring is directed to the narrow circumstance of monitoring that would be applied to a CCP under the NACMCF HACCP guidelines and the Codex HACCP Annex. These comments also assert that, using such definitions, monitoring would not apply to control measures for which parameters cannot be established and that are not amenable to documentation. These comments suggest that we use a definition of monitoring consistent with that provided in ISO 22000:2005 (conducting a planned sequence of observations or measurements to assess whether control measures are operating as intended) to clarify that monitoring may be conducted where appropriate for preventive controls that are not CCPs. (ISO is an abbreviation for “International Organization for Standardization.” ISO develops and publishes international standards.) According to these comments, an advantage of this definition is that it also would clarify the difference between monitoring activities (observations conducted during the operation of a control measure to ensure that it is under control) and verification activities (to evaluate performance of a control measure).

(Response 106) We have revised the definition of monitor to mean to conduct a planned sequence of observations or measurements to assess whether control measures are operating as intended. We agree that the revised definition, which reflects an international standard, more effectively communicates that monitoring also applies to controls that are not at CCPs and may apply to control measures for which parameters cannot be established. However, we disagree that this definition signals that it is not possible to obtain documentation when monitoring preventive controls that are not at CCPs, such as for controls that are not process controls and do not involve parameters and maximum or minimum values, or combinations of values, to which a parameter must be controlled to significantly minimize or prevent a hazard requiring a preventive control. For example, it is possible to monitor that a specific sanitation control activity has taken place, such as the cleaning of a piece of equipment to prevent allergen cross-contact.

The requirement for documenting monitoring in records is established by the requirements for monitoring, not by the definition of monitor. As discussed in Response 468, we have made several revisions to the regulatory text, with associated editorial changes, to clarify that monitoring records may not always be necessary.

19. Packaging (When Used as a Verb)

We proposed to establish in § 117.3 the same definition of “packaging (when used as a verb)” as we proposed to establish in §§ 1.227 and 1.328.

(Comment 107) Some comments express concern about establishing the definition of “packaging (when used as a verb)” in part 117. These comments ask us to clarify how this proposed definition relates to other uses of the word “packaging” in part 117, including use as an adjective in the common phrase “food-packaging materials,” and including some provisions directed to controlling allergen cross-contact and contamination in “food-packaging materials.” Some comments ask us to establish definitions for terms such as “food-packaging materials” or “primary packaging” to clarify the meaning of the term “packaging” as it has previously been used in part 110. Other comments ask us to clarify that provisions directed to preventing allergen cross-contact and contamination in “food-packaging materials” apply only to “food-contact packaging,” not “secondary packaging.” Some comments focus on the differences between the definition of the term “packing” and “packaging” with respect to activities conducted on RACs. Some comments ask us to clarify how the term “packaging (when used as a noun)” would apply when used in part 117, even though we did not propose to establish a definition for “packaging (when used as a noun)” in part 117.

(Response 107) We have decided not to establish the definition “packaging (when used as a verb)” in part 117. That definition was established in the section 415 registration regulations, in part, to identify those food establishments that would be subject to those regulations based, in part, on the activity of placing food into a container that directly contacts the food and that the consumer receives. In addition, because the term “packaging” (when used as a noun) can be used in a very general way to refer to both the container that directly contacts the food and to the outer packaging of food that does not contact the food, the section 414 recordkeeping regulations established a definition of “packaging” (when used as a noun) to narrowly refer to “the outer packaging of food that bears the label and does not contact the food,” because this narrow definition was also necessary for the purposes of those recordkeeping regulations.

However, the term “packaging” has long been used as a noun in the CGMPs to generally refer to the container that directly contacts the food, rather than to the outer packaging of food that does not contact the food (as it means in the section 414 recordkeeping regulations). Thus, the very specific connotation for the term “packaging” (when used as a noun) that was established in the section 414 recordkeeping regulations does not apply, and is causing confusion. As the comments point out, our proposed definition of “packaging (when used as a verb)” is already causing confusion in the context of part 117. Therefore, for clarity and simplicity in part 117 we are not including in the final rule a definition of “packaging (when used as a verb).” A definition for “packaging (when used as a verb)” remains in the section 415 registration regulations, where a business can continue to use the definition for purposes of determining whether either or both of those regulations applies to its business.

Part 117 establishes requirements for manufacturing, processing, packing, and holding human food. The definition of “manufacturing/processing” we are establishing in this rule makes clear that “packaging” (when used as a verb) is a manufacturing/processing activity and, thus, that requirements that apply to manufacturing or processing activities apply to packaging activities. Because part 117 is not the regulation that describes whether a food establishment is subject to the section 415 registration regulations or the section 414 recordkeeping regulations, it is not necessary for part 117 to do more.

The comments that express concern about the distinction between “packing” and “packaging (when used as a verb)” with respect to activities conducted on RACs no longer apply in light of the revised “farm” definition that we are establishing in the section 415 registration regulations. The revised “farm” definition provides for packaging RACs when packaging does not involve additional manufacturing/processing (such as cutting).

20. Packing

We proposed to establish in § 117.3 the same definition of “packing” as we proposed to establish in §§ 1.227 and 1.328. See section IV.G for a discussion of comments we received to the proposed definition of “packing” in §§ 1.227 and 1.328, and our responses to those comments.

21. Pathogen

We proposed to define the term “pathogen” to mean a microorganism of public health significance.

(Comment 108) Some comments ask us to revise the definition to mean a “microorganism of such severity and exposure that it would be deemed of public health significance” because the significance of pathogens to public health depends on the organism's severity and the nature of exposure.

(Response 108) We decline this request. Our purpose in defining the term pathogen was to simplify the regulations, including our long-standing CGMP regulations, by substituting a single term (i.e., “pathogen”) for a more complex term (i.e., “microorganism of public health significance”) throughout the regulations. These comments appear to be objecting to the use of the long-standing phrase “microorganism of public health significance,” which has been in our CGMP regulations for decades, rather than to our proposal to define and use a simpler term in its place. These comments fail to explain how we have interpreted the current term “microorganism of public health significance” in a way that does not take into account factors such as the severity of illness and the route of exposure.

22. Pest

We proposed to define the term “pest” to refer to any objectionable animals or insects including birds, rodents, flies, and larvae.

(Comment 109) Some comments ask us to include reptiles in the definition due to a past instance of Salmonella linked to lizard feces in an RTE nut-manufacturing facility.

(Response 109) We decline this request. This long-standing definition does not limit pests to those already included as examples. Reptiles are objectionable animals that are known to carry human pathogens and are considered pests.

(Comment 110) Some comments ask us to clarify the meaning of the term “objectionable.” These comments state that, under the Canadian Pest Control Products Act, objectionable means that an animal does not belong in a food processing environment and suggest that we follow this meaning of “objectionable.” These comments also note that there may be circumstances where the presence of an animal is acceptable, such as the use of guide dogs.

(Response 110) We decline this request. The meaning of the term “objectionable” as described in these comments is consistent with our interpretation of this long-standing definition of “pest,” but we do not believe it is necessary to provide a definition. See the provisions for pest control (§ 117.35(c)), which allow the use of guard, guide, and pest-detecting dogs.

23. Plant

We proposed to define the term “plant” to mean the building or establishment or parts thereof, used for or in connection with the manufacturing, processing, packing, or holding of human food. See Comment 63 for the comments on the definition of “plant” and Response 63 for our response to those comments.

24. Preventive Controls

We proposed to define the term “preventive controls” to mean those risk-based, reasonably appropriate procedures, practices, and processes that a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would employ to significantly minimize or prevent the hazards identified under the hazard analysis that are consistent with the current scientific understanding of safe food manufacturing, processing, packing, or holding at the time of the analysis.

(Comment 111) Some comments ask us to clarify the meaning of “current scientific understanding” because scientific understanding can vary depending on the risk profile of a commodity.

(Response 111) By “current scientific understanding,” we mean to emphasize that scientific information changes over time and a facility needs to keep current regarding safe handling and production practices such that the facility has the information necessary to apply appropriate handling and production practices.

25. Preventive Controls Qualified Individual

We proposed to define the term “qualified individual” to mean a person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply a food safety system. We have changed the proposed term “qualified individual” to “preventive controls qualified individual” because we are establishing a new definition for “qualified individual,” with a meaning distinct from “preventive controls qualified individual.” To minimize the potential for confusion for when the term “qualified individual” refers to the proposed meaning of the term and when the term “qualified individual” refers to the meaning of that term as finalized in this rule, in the remainder of this document we use the new term “preventive controls qualified individual” whenever we mean “a person who has successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by the FDA or is otherwise qualified through job experience to develop and apply a food safety system,” even though the proposed rule used the term “qualified individual.” Likewise, we use the new term “preventive controls qualified individual” for the proposed term “qualified individual” when describing the comments to the proposed rule, even though those comments use the term “qualified individual.”

In the following paragraphs, we discuss comments on this proposed definition. (See also our discussion (in section XXXVI) of the requirements applicable to the preventive controls qualified individual (§ 117.180(c)).)

(Comment 112) Some comments assert that the proposed definition of preventive controls qualified individual is ambiguous.

(Response 112) The comments provide no basis for asserting that this definition is ambiguous, such as difficulties in how we have interpreted similar regulatory text in enforcing our HACCP regulations for seafood and juice (§§ 123.10 and 120.13(b), respectively). The proposed definition includes a performance standard (qualified to develop and apply a food safety system), two criteria for how a person can become qualified (specialized training or job experience), and a description of the type of applicable training (development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum). The proposed definition provides flexibility for how an individual can become qualified, but this flexibility does not make the definition ambiguous.

(Comment 113) Some comments ask us to expand the definition so that it includes a team of preventive controls qualified individuals, not just a single person.

(Response 113) We decline this request. The definition applies to each preventive controls qualified individual that a facility relies on to satisfy the requirements of the rule without limiting the number of such preventive controls qualified individuals. The requirements of the rule make clear that a facility may rely on more than preventive controls qualified individual (see, e.g., § 117.180(a)).

(Comment 114) One comment asks us to include “trusted trader” (i.e., a company or entity in the supply chain proven to be low risk) in the definition of preventive controls qualified individual.

(Response 114) We decline this request. The concept of “trusted trader” applies to a facility's suppliers, not to individuals qualified to develop and apply a food safety system.

26. Qualified Auditor

We proposed to define the term “qualified auditor” to mean a person who is a preventive controls qualified individual as defined in this part and has technical expertise obtained by a combination of training and experience appropriate to perform the auditing function as required by § 117.180(c)(2). As discussed in Response 569, we have revised the definition to specify that “qualified auditor” means a person who is a “qualified individual” as that term is defined in this final rule, rather than a “preventive controls qualified individual,” because some auditors may be auditing businesses (such as produce farms) that are not subject to the requirements for hazard analysis and risk-based preventive controls, and it would not be necessary for such an auditor to be a “preventive controls qualified individual.” We also have clarified that the technical expertise is obtained through education, training, or experience (or a combination thereof) necessary to perform the auditing function to align the description of applicable education, training, and experience with the description of applicable education, training, and experience in the definition of “qualified individual” (see § 117.3).

(Comment 115) Some comments ask us to revise the definition of qualified auditor to include persons who have technical expertise obtained by a combination of training, experience, or education appropriate to perform audits. Some comments ask us to recognize that training and/or experience can make a person a qualified auditor; the comments state that people with experience performing audits likely have applicable training but might not have completed a specific regimen of courses. Some comments maintain that we should recognize the role of the education of a potential qualified auditor, as well as training and experience to meet the criteria.

(Response 115) We agree that a qualified auditor might obtain the necessary auditing expertise in part through education, as well as through training and experience, and we have revised the definition of qualified auditor accordingly. However, we conclude that a person must have at least some actual experience in auditing to meet the definition of a qualified auditor, i.e., the necessary technical expertise cannot be obtained solely through education and/or training. Therefore, the revised definition retains the proposed criterion that a qualified auditor has technical expertise obtained by experience, as well as by education and training.

(Comment 116) Some comments that support the proposed definition ask us to revise the definition to specify certain individuals who would be considered qualified auditors, such as FDA inspectors, properly trained Federal auditors, and State and private auditors operating under a contract with the Federal Government.

(Response 116) We have revised the regulatory text to specify that examples of a qualified auditor include: (1) A government employee, including a foreign government employee and (2) an audit agent of a certification body that is accredited in accordance with regulations in part 1, subpart M (i.e., regulations in our forthcoming third-party certification rule implementing section 808 of the FD&C Act (21 U.S.C. 348d)). Although we agree that it is useful to include examples of individuals who would have the appropriate qualifications, the example of an audit agent of a certification body that has been accredited in accordance with regulations in our forthcoming third-party certification rule adds context about the standard for such individuals. Because paragraph (2) of the new provision refers to provisions in a future third-party certification rule, we will publish a document in the Federal Register announcing the effective date of paragraph (2) once we finalize the third-party certification rule.

27. Qualified End-user

We proposed to define the term “qualified end-user” to mean, with respect to a food, the consumer of the food (where the term consumer does not include a business); or a restaurant or retail food establishment (as those terms are defined in § 1.227) that: (1) Is located (a) in the same State as the qualified facility that sold the food to such restaurant or establishment; or (b) not more than 275 miles from such facility; and (2) is purchasing the food for sale directly to consumers at such restaurant or retail food establishment. We have revised the definition of “qualified end-user” to add “or the same Indian reservation” to clarify for purposes of this rule so that “in the same State” under section 418(l)(4)(B)(ii)(I) of the FD&C Act includes both within a State and within the reservation of a Federally-Recognized Tribe.

(Comment 117) Some comments object to the description of a qualified end-user as being not more than 275 miles from a facility that sold the food and assert that there is no scientific or risk-based reason to support the distance of 275 miles. Other comments ask us to clarify whether the criterion of not more than 275 miles from a facility that sold the food would provide for qualified end-users to be located across State lines and/or international borders relative to the facility that sold the food. Other comments ask us to revise the definition of “restaurant or retail food establishment” to include businesses such as supermarkets, supermarket distribution centers, food hubs, farm stands, farmers markets, and CSA.

(Response 117) We have not revised the definition of “qualified end-user,” which reflects section 418(l)(4) of the FD&C Act, in response to these comments. As discussed in Response 581, we intend to focus on records demonstrating that a facility is a very small business (i.e., financial records demonstrating that a business averages less than a specified dollar threshold) rather than records demonstrating sales directly to qualified end-users. Likewise, we have not revised the definition of “restaurant or retail food establishment” to clarify whether particular businesses such as those mentioned in the comments would be considered as “qualified end-users.” Focusing on whether a facility is a very small business makes it unnecessary to determine whether an enterprise that receives the food is a retail food establishment. However, as discussed in section I.E, we have issued a separate proposed rule to amend the definition of “retail food establishment” in the section 415 registration regulations. We intend to issue a final rule to amend the definition of “retail food establishment” in the section 415 registration regulations in the near future. (See also Response 4.)

28. Qualified Facility

We proposed to define “qualified facility” by incorporating the description of “qualified facility” in section 418(l)(1) of the FD&C Act with editorial changes to improve clarity. That definition includes two types of facilities: (1) A facility that is a very small business as defined in this rule; and (2) A facility to which certain statutory criteria apply regarding the average monetary value of food sold by the facility and the entities to whom the food was sold.

Some comments discuss issues related to the definition of very small business. See Comment 154, Comment 156, Comment 157, and Comment 158 and our associated responses.

(Comment 118) Some comments assert that the definitions of “affiliate” and “subsidiary” in the definition of “qualified facility” fail to account for the legal differences between a piece of property (i.e., a facility) and a business entity or person. These comments ask us to consider revising the proposed definition of “qualified facility” to clarify what sales to include in determining whether a facility so qualifies.

(Response 118) We have not revised the proposed definition of “qualified facility” as requested by these comments. The sales to be included when a facility determines whether it meets the definition of a qualified facility are the sales of human food by a business entity, which includes the parent company and all its subsidiaries and affiliates. The total sales are applicable to each entity, whether it is the parent, the subsidiary, or the affiliate. We intend to address issues such as these in guidance as directed by section 418(l)(2)(B)(ii) of the FD&C Act. (See also Comment 77 regarding the definitions of “affiliate” and “subsidiary” and our associated responses. See also Response 154 regarding the applicability of the monetary threshold of sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee).)

(Comment 119) Some comments ask us to clarify who will determine whether a particular facility is a qualified facility.

(Response 119) Any facility that determines that it satisfies the criteria for a “qualified facility” must notify FDA of that determination (see § 117.201) and, thus, the first determination will be made by the facility itself. During inspection, the investigator could ask to see the records that support the facility's determination to verify the facility's determination.

(Comment 120) Some comments address that part of the definition that discusses “average annual monetary value of the food manufactured, processed, packed, or held at such facility, that is sold.” These comments ask us to clarify whether the operative word in the clause is “held” or “sold.”

(Response 120) The operative word, for the purpose of calculating the average monetary value of that food, is “sold.” (See also Response 154 regarding the applicability of the monetary threshold of sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee).)

29. Ready-to-Eat Food (RTE Food)

We proposed to define the term “ready-to-eat food” to mean any food that is normally eaten in its raw state or any other food, including processed food, for which it is reasonably foreseeable that the food would be eaten without further processing that will significantly minimize biological hazards.

(Comment 121) Some comments ask us to substitute “reasonably expected” for “reasonably foreseeable.”

(Response 121) We decline this request. We see no substantive difference between “reasonably expected” and “reasonably foreseeable.” The term “reasonably foreseeable” is used in other provisions of the rule, including the defined term “known or reasonably foreseeable hazard.”

(Comment 122) Some comments ask us to clarify the distinction between a food that satisfies the definition of “ready-to-eat” and a food that satisfies the definition of a RAC. Some of these comments express concern that if tree fruits are classified as “RTE food” rather than as a RAC, we could force packers to do mandatory product testing.

(Response 122) The terms RTE food and RAC are not mutually exclusive. Some RACs (such as lettuce, tomatoes, berries, and apples) are ready-to-eat, whereas other RACs (such as artichokes and potatoes) are not. The requirements for product testing as a verification activity are flexible requirements that depend on the facility, the food, and the nature of the preventive control (see § 117.165). See also Response 525.

30. Receiving Facility

We proposed to define the term “receiving facility” to mean a facility that is subject to subpart C of this part and that manufactures/processes a raw material or ingredient that it receives from a supplier.

(Comment 123) Some comments ask us to modify the definition to specify that the receiving facility could receive the raw material or ingredient directly from a supplier or by means of an intermediary entity. These comments assert that without this added regulatory text the proposed definition implies that the material or ingredient must be received directly from the supplier.

(Response 123) We decline this request. As discussed in Response 658, the two parties that are critical to the supplier verification program are the receiving facility and the supplier, even if there are entities in the supply chain between the two. The definition of receiving facility does not preclude the participation of intermediary entities in the supply chain, and the rule does provide for such participation (see Response 657). However, the definition of receiving facility does highlight the fact that a receiving facility must have a link to a supplier.

(Comment 124) Some comments that support the definition of receiving facility ask us to clarify that a cold storage facility is not by definition a receiving facility because it is not engaged in manufacturing/processing, but could be a supplier if temperature controls are needed to control a significant hazard.

(Response 124) We agree that a cold storage facility is not likely to be a receiving facility if it is not engaged in manufacturing/processing. However, it is the nature of the activity as manufacturing/processing, rather than the use of a preventive control for purposes other than manufacturing/processing, that is relevant here. By definition, the supplier must also be engaged in manufacturing/processing, raising animals, or growing food (see the definition of “supplier” in § 117.3). A cold storage facility has a responsibility to maintain foods that require temperature control for safety at an appropriate temperature, but generally does not engage in manufacturing/processing. However, a cold storage facility in the supply chain between the supplier and the receiving facility could participate in supplier verification activities (see Response 657).

31. Sanitize

We proposed to define “sanitize” to mean to adequately treat cleaned food-contact surfaces by a process that is effective in destroying vegetative cells of microorganisms of public health significance, and in substantially reducing numbers of other undesirable microorganisms, but without adversely affecting the product or its safety for the consumer. We proposed to revise this otherwise long-standing definition by inserting the term “cleaned” before “food-contact surfaces” because chemical sanitizers can be inactivated by organic material and, thus, are not effective unless used on clean surfaces (78 FR 3646 at 3697).

(Comment 125) Some comments ask us to adopt a definition of “sanitize” similar to that found in the Pasteurized Milk Ordinance (PMO), which recognizes that cleaning and sanitizing do not always have to be separate, sequential steps. These comments report that the definition in the PMO is “the application of any effective method or substance to properly cleaned surfaces for the destruction of pathogens, and other microorganisms, as far as is practicable.” Other comments agree with the proposed definition as it applies to chemical sanitizers, but disagree that clean surfaces are required for effective sanitizing for those systems that use steam and dry heat, such as those authorized by Appendix F of the PMO. These comments ask us to clarify that the “cleaning” should be appropriate to the specific food system and method used for sanitizing, and that cleaning should only be required when the sanitizing process alone would not be effective without a prior cleaning step.

Some comments express concern about whether the proposed definition of “sanitize” would preclude the continued, routine use of dry cleaning methods with no sanitizing step. These comments note that adding routine aqueous-based cleaning and sanitizing procedures could create a public health risk in certain operations such as low-moisture food production. These comments also note that dry cleaning procedures can result in equipment that, while sanitary, is neither visibly clean nor suitable for aqueous chemical sanitizers.

(Response 125) We consider that systems such as steam systems clean the surfaces, as well as sanitize them and, thus, satisfy the definition of “sanitize.” The definition of “sanitize” does not preclude the continued use of dry cleaning methods with no sanitizing step because the definition describes the meaning of the term “sanitize” without establishing any requirement for when equipment must be sanitized.

We have revised the definition so that it means adequately treating “surfaces” rather than “food-contact surfaces.” Doing so is consistent with the definition of “sanitize” in the PMO. As a technical matter, adequately treating any surface—regardless of whether it is a food-contact surface—by a process that is effective in destroying vegetative cells of pathogens, and in substantially reducing numbers of other undesirable microorganisms, but without adversely affecting the product or its safety for the consumer, is “sanitizing” the surface. Clarifying this technical meaning of the term “sanitize” imposes no requirements to sanitize surfaces other than food-contact surfaces; the requirements for sanitizing surfaces are established by provisions such as § 117.37(d), not by the definition of the term “sanitize.”

32. Significant Hazard (Hazard Requiring a Preventive Control)

We proposed to define the term “significant hazard” to mean a known or reasonably foreseeable hazard for which a person knowledgeable about the safe manufacturing, processing, packing, or holding of food would, based on the outcome of a hazard analysis, establish controls to significantly minimize or prevent the hazard in a food. The rule would use the term “significant hazard” rather than “hazard reasonably likely to occur” to reduce the potential for a misinterpretation that all necessary preventive controls must be established at CCPs (79 FR 58524 at 58526).

(Comment 126) Comments support using a term other than “hazard reasonably likely to occur” and agree that using a term other than “hazard reasonably likely to occur” throughout the rule will reduce the potential for a misinterpretation that all necessary preventive controls must be established at CCPs.

Some comments support the regulatory text of the proposed definition of the term “significant hazard.” These comments state that the proposed regulatory text more closely aligns with the principles in FSMA (“reasonably foreseeable” and “significantly minimize or prevent”) and provides operators the flexibility to implement a range of preventive controls that are commensurate with the risk and probability posed by a specific hazard. Some comments agree that the proposed regulatory text can clarify the difference between HACCP rules and the human preventive controls rule. Some comments state that the proposed regulatory text plainly reflects the concept that significant hazards are those hazards to be addressed through the very broad category of preventive controls, and the rule is explicit that preventive controls may be controls other than at CCPs. Some comments state that the definition reflects the risk-based nature (i.e., both the severity of a potential hazard and the probability that the hazard will occur) of the requirements and provides additional flexibility so that facilities can take into account the nature of the preventive control in determining when and how to establish and implement appropriate preventive control management components. Some comments support including the phrase “based on the outcome of a hazard analysis” in the definition because it ensures that identification of significant hazards will be risk based. Some comments ask us to preserve in the final definition two key aspects that grant the food industry the flexibility that it needs: (1) The logical conclusion that not all hazards will have the same impact or will even constitute “significant hazards” at all, depending on the facility's products and position in the supply chain; and (2) the fact that a “person knowledgeable about the safe manufacturing, processing, packing, or holding of food” must be knowledgeable about the specific food produced at that facility and in that specific sector of the food industry.

Some of the comments that support the regulatory text of the proposed definition nonetheless express concern about the term “significant hazard.” Some of these comments express concern that a facility may not recognize hazards that need to be controlled because they do not rise to the commonly understood meaning of “significant.” Other comments express concern that the adjective “significant” is subject to many interpretations and suggest that the term “hazard requiring control” would be more straightforward, accurate, and suitable.

Other comments express concern that the term “significant hazard” could cause confusion because it has implications in HACCP systems. For example, “significant hazard” is often used in the context of CCPs, and preventive controls are not necessarily established at CCPs. Some of these comments suggest that we eliminate the term and instead use the full regulatory text of the proposed definition in place of “significant hazard” throughout the regulations. Other comments suggest using a term such as “food safety hazard” or “actionable hazard” instead of “significant hazard” to avoid a term that has HACCP implications. Other comments state that the term “significant hazard” has implications for facilities that follow the Codex HACCP Annex and express concern that foreign facilities would be especially likely to be confused by the term “significant hazard.”

Some comments ask us to ensure that the term “significant hazard” is used consistently and express the view that some regulatory text refers to a “hazard” or “known or reasonably foreseeable hazard” where “significant hazard” should instead be used. As discussed in Comment 93, some comments express concern that the rule would refer to multiple levels of hazard and ask us to provide sufficient clarity to be able to distinguish between these types of hazards.

(Response 126) We have changed the term “significant hazard” to “hazard requiring a preventive control.” The new term uses the explicit language of FSMA (i.e., “preventive control”), is consistent with the specific suggestion of one comment (i.e., hazard requiring a control”), and is not commonly associated with HACCP systems. We decline the request to use the term “food safety hazard” because that term already is established in Federal HACCP regulations for seafood and meat/poultry, and the comments are particularly concerned about using a term that has implications for HACCP systems. We also decline the request to use the term “actionable hazard,” because the term “actionable” is associated with violations at a food processing plant.

We reviewed the full regulatory text of proposed subpart C and replaced “significant hazard” with “hazard requiring a preventive control” in most cases. See table 10 for the provisions where we made that change and for an explanation of those provisions where we replaced “significant hazard” with “hazard” or “hazard requiring a process control.”

We also reviewed the full regulatory text of proposed subpart C to evaluate whether there were any circumstances where the regulatory text should more appropriately refer to “hazard requiring a preventive control” rather than “hazard” or “known or reasonably foreseeable hazard.” The term “known or reasonably foreseeable hazard” appears only once, in the requirement for a facility to conduct a hazard analysis (§ 117.130(a)). We are retaining “known or reasonably foreseeable hazard” in that requirement because it is necessary to implement the tiered approach to the requirements for hazard analysis and risk-based preventive controls (see Response 93). To reinforce this tiered approach, and emphasize that the facility only conducts a hazard analysis for known or reasonably foreseeable hazards, we revised “hazard” to “known or reasonably foreseeable hazard” in two additional provisions in the requirements for hazard identification (see the introductory regulatory text for § 117.130(b)(1) and (2)).

In our review of the full regulatory text of proposed subpart C, we did not identify any circumstances where we believe it is appropriate and necessary to specify “hazard requiring a preventive control” in place of “hazard.” It is not necessary for the regulatory text of requirements for preventive controls, the supply-chain program, the recall plan, corrective actions, and verification to specify “hazard requiring a preventive control” every time that the requirements use the term “hazard” because the context of the requirement establishes the applicability to “hazards requiring a preventive control.” Although we acknowledge that using “hazard requiring a preventive control” in place of “hazard” throughout applicable provisions of proposed subpart C would emphasize the tiered approach to the requirements for hazard analysis and risk-based preventive controls, doing so would make the regulatory text unnecessarily bulky and awkward and would be inconsistent with comments that ask us to make the regulatory text understandable (see Comment 13).

(Comment 127) Some comments express concern that the proposed definition of “significant hazard,” which contains the phrase “for which a person . . . would establish controls” is problematic in that facilities are likely to have already established preventive controls for a variety of hazards that may not rise to the level of control management required for a “significant hazard” and would instead routinely be addressed in “prerequisite programs.” These comments express particular concern that identification of these hazards in and of themselves should not elevate control of these hazards to the category of being a “significant hazard.” Some comments ask us to allow facilities to continue to implement existing controls outside the framework of this rule (i.e., outside the framework that requires preventive control management components as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the food safety system) when a hazard addressed by the existing controls does not rise to the level of “significant hazard.”

Other comments express concern that the term “significant hazard” may create a disincentive for facilities to voluntarily implement preventive controls for hazards that only pose a remote risk or are very rarely encountered, because implementing preventive controls for hazards of very low probability and severity may be misinterpreted as requiring preventive controls applicable to a “significant hazard” even if the hazard does not meet the definition of “significant hazard” established in the rule. Some comments ask us to revise the definition to provide facilities with the flexibility and discretion to establish appropriate preventive controls for hazards that do not rise to the criteria of a “significant hazard,” as well as ensuring that preventive controls that address remote or very unlikely hazards not be subject to the preventive control management requirements for a “significant hazard.”

(Response 127) We have revised the definition to specify that the term “hazard requiring a preventive control” applies when a knowledgeable person would, based on the outcome of a hazard analysis, “establish one or more preventive controls” rather than “establish controls.” By narrowing “controls” to “one or more preventive controls,” we mean to signify that the proposed term “significant hazard” (which we now refer to as “hazard requiring a preventive control”) only applies to those controls that the facility establishes to comply with the requirements of subparts C and G for hazard analysis and risk-based preventive controls. A facility that establishes other controls (such as those that the comments describe as “prerequisite programs,” or controls directed to hazards of very low probability and severity) for hazards that are not, based on the outcome of the facility's hazard analysis, “hazards requiring a preventive control” would not need to establish preventive control management components for such controls. However, some controls previously established in “prerequisite programs” would be considered “preventive controls.” We provide some flexibility for facilities with respect to how they manage preventive controls, and the preventive control management components may be different for hazards that have been managed as “prerequisite programs” compared to those managed with CCPs. A facility that is concerned about the potential for an investigator to disagree during inspection that certain controls are not directed to “hazards requiring a preventive control” could, for example, include information relevant to its classification of those other controls in its hazard analysis, whether by merely listing the “other controls” or by providing a brief explanation why such controls are not “preventive controls” as that term is defined in this rule.

(Comment 128) Some comments assert that the proposed definition of “significant hazard” is tautological because it essentially establishes a “significant hazard” to be a known or reasonably foreseeable hazard (i.e., the type of hazards identified in the first step of the analysis) for which preventive controls should be implemented. These comments assert that the proposed definition of “significant hazard” would collapse the second step of hazard analysis into the first, which in turn would lead to the unintended consequence of facilities identifying the same hazards in the second step as in the first. Other comments ask us to revise the definition to clarify and distinguish the two steps of the hazard analysis by specifying within the definition that a significant hazard is a known or reasonably foreseeable hazard for which there is a reasonable probability, based on experience, illness data, scientific reports, or other information relevant to the food or the facility, that adverse health consequence or death will occur in the absence of its control. Some comments ask us to revise the definition to include evaluation of severity and probability, because these concepts are integral for making a proper determination of whether a hazard is significant. Other comments ask us to revise the definition to better reflect the risk-based approach that preventive controls be implemented to control hazards that have a higher probability of resulting in public health consequence in the absence of control.

(Response 128) We have revised the definition of “significant hazard” (which we now refer to as “hazard requiring a preventive control”) to specify that the hazard analysis includes an assessment of the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls. By specifying that the determination of a “significant hazard” is based on the outcome of a hazard analysis, the proposed definition did, as requested by the comments, include the risk-based nature of the determination. However, explicitly adding that the hazard analysis is based on probability and severity (i.e., risk) makes the risk-based nature of the determination clearer.

We disagree that the proposed definition was tautological and would collapse the second step of hazard analysis into the first. As discussed in Response 93, a facility begins its hazard analysis by narrowing down the universe of all hazards to those that are “known or reasonably foreseeable” for each type of food manufactured, processed, packed, or held at its facility. The outcome of the facility's hazard analysis is a determination of a subset of those known or reasonably foreseeable hazards—i.e., those hazards requiring a preventive control. To the extent that these comments are asserting that the tautology was created by the phrase “in the absence of its control” in the proposed definition of “hazard,” we have deleted that phrase from the final definition of “hazard” (see Response 94).

We decline the request to modify the definition to specify that a hazard requiring a preventive control is one for which there is a reasonable probability, based on experience, illness data, scientific reports, or other information relevant to the food or the facility, that adverse health consequence or death will occur in the absence of its control. The standard for harm in the definition of “hazard” is illness or injury. We disagree that the standard for harm in the definition of “hazard requiring a preventive control” should be different from (i.e., adverse health consequences), or greater than (i.e., death), the standard for harm in the definition of “hazard.” We also disagree that the definition of “hazard requiring a preventive control” needs to be modified to state that preventive controls are implemented to control hazards that have a higher probability of resulting in public health consequence in the absence of control. The definition already communicates the role of risk (i.e., severity and probability) in conducting the hazard analysis that identifies those hazards requiring a preventive control.

We also decline the request to repeat in the definition of “hazard requiring a preventive control” the requirement for the types of information that a facility would consider in conducting its hazard analysis. The requirements for hazard analysis clearly specify that a facility must conduct its hazard analysis based on experience, illness data, scientific reports, and other information (see § 117.130(a)).

(Comment 129) Some comments that broadly address the overall framework for the new requirements for hazard analysis and risk-based preventive controls ask us to consistently refer to “the nature of the preventive control” (rather than simply to “the preventive control”) when communicating the flexibility that a facility has in identifying preventive controls and associated preventive control management components. (See Comment 455). Other comments that broadly address the overall framework for the new requirements for hazard analysis and risk-based preventive controls ask us to emphasize that the requirements for preventive control management components convey not only that the application of a particular element is appropriate (i.e., capable of being applied), but also necessary for food safety. Some comments recommend that we do so by specifying that preventive control management components take into account the role of the preventive control in the food safety system. (See Comment 455.)

(Response 129) We agree with these comments and have revised the definition of “hazard requiring a preventive control” to specify that preventive control management components are established as appropriate to “the nature of the preventive control and its role in the facility's food safety system.” (See also Response 455, where we describe additional provisions that we have revised to clarify that preventive control management components are established as appropriate to the nature of the preventive control and its role in the facility's food safety system.)

(Comment 130) Some comments ask us to modify the definition of “significant hazard” to specify that the preventive control management components be established as appropriate to both the food and the intended use of the food.

(Response 130) We decline this request. It is not necessary to repeat in the definition of “hazard requiring a preventive control” the requirement for the hazard evaluation to consider the intended use of the food. The requirements for hazard evaluation clearly specify that a facility must consider the intended or reasonably foreseeable use of the food (see § 117.130(c)(2)(viii)).

(Comment 131) Some comments assert that the problem is how to separate the hazards addressed by “HACCP” from those addressed by CGMPs. These comments suggest that control measures that are implemented for hazards from ingredients and food-contact packaging material, and from production and process, be called CCPs and that control measures that are implemented for hazards from personnel, equipment, and the plant be called preventive controls.

(Response 131) The facility must control hazards through the application of CGMPs and preventive controls as appropriate to the hazard. Although some preventive controls will be established at CCPs, and “CCP” is a term commonly used in HACCP systems, this rule establishes requirements for hazard analysis and risk-based preventive controls, not “HACCP,” and this rule provides that preventive controls include controls at CCPs, if there are any CCPs, as well as controls, other than those at CCPs, that are also appropriate for food safety (see § 117.135(a)(2)).

Under the rule, some hazards may be addressed by CGMPs and others by preventive controls. For example, if a facility manufactures egg biscuit sandwiches, it could establish a preventive control, as a CCP, for cooking the eggs and establish CGMP controls to address the potential for personnel to contaminate the cooked egg and the egg biscuit sandwiches. As another example, a facility could control a physical hazard such as metal using screens and magnets under CGMPs and then use a metal detector as a preventive control. See also Response 437, in which we give examples regarding when a facility might control food allergen hazards through a combination of CGMP controls and “food allergen controls,” which are a particular type of preventive control (see § 117.135(c)(2)).

(Comment 132) Some comments ask us to add examples throughout the regulatory text (e.g., in the requirements for hazard analysis, preventive controls, and recall plan) to reflect food allergens as a significant hazard.

(Response 132) We decline this request. Food allergens are included as an example of a chemical hazard that a facility must consider when determining whether there are any known or reasonably foreseeable hazards requiring a preventive control (§ 117.130(b)(1)(ii)), and the rule specifically provides for food allergen controls where relevant. It is not necessary to include examples of food allergens as hazards requiring a preventive control throughout the regulatory text.

(Comment 133) Some comments express concern that too much flexibility may make it harder for us to inspect conditions in a facility over time. These comments emphasize that we must not permit facilities to interpret the term “significant hazard” as allowing them to substitute inadequate sanitation programs—which may not require documentation of monitoring or verification measures—for necessary critical control points.

(Response 133) We acknowledge that there can be a tension between the need for flexible requirements that must apply to diverse food processing facilities and the regulatory need to evaluate compliance with requirements. See Response 5 regarding our approach to enforcing the rule. Although preventive controls, such as sanitation controls, are not always directed to critical control points (see § 117.135(a)(2)(ii)), we agree that there could be circumstances where we would disagree with a facility about the measures it has in place regarding sanitation. We will address such circumstances on a case-by-case basis.

(Comment 134) Some comments express concern that the term “significant hazard” may lead to misunderstanding by medium and smaller processors and ask how businesses with limited food safety experience will understand the difference between a food safety hazard that is “reasonably likely to occur” (and, thus, must be controlled by a full HACCP Plan) and a “Significant Hazard” that can be controlled by a preventive control plan.

(Response 134) In most cases, it will not be necessary for a food processor to understand the difference between a hazard that is “reasonably likely to occur” in the concept of HACCP requirements and a “hazard requiring a preventive control” in the context of this rule. Instead, a food processor must identify those regulations that apply to it. For example, a processor of juice products is subject to our HACCP regulations for juice, but is not subject to the requirements of this rule.

(Comment 135) Some comments express concern about the potential for divergent interpretations of the definition by industry and regulators. Some comments state that a baseline understanding between industry and regulatory officials will need to be established as to what constitutes a “significant hazard” and what preventive controls will be deemed to be adequate to control such a hazard. Some comments ask us to provide guidance or allow “inter-state compacts” to provide guidelines on what constitutes significant hazards in major food industries. Other comments assert that the FSPCA provides the best forum to identify what constitutes “significant hazards” in food, and to develop timely and appropriate guidance and training for addressing such hazards. Other comments ask to engage with us early and often on the development of applicable guidance documents regarding what constitutes a “significant hazard” for produce industry operations and provide an opportunity to explain and discuss current industry best practices and preventive controls to address identified significant hazards. Some comments ask us to develop an administrative procedure to adjudicate differences in professional opinion between a regulated firm and a Federal or State regulatory agency regarding hazard “significance.”

(Response 135) We agree that guidance will help create an understanding between industry and regulatory officials as to FDA recommendations for hazards that require preventive controls and appropriate preventive controls for those hazards. See Response 2 and Response 5. We decline the request to develop an administrative procedure to adjudicate differences in professional opinion between a regulated firm and a Federal or State regulatory agency regarding hazard “significance.” We note that existing procedures provide for an outside party to obtain internal agency review of a decision by an employee other than the Commissioner (see § 10.75). The comments do not explain what they mean by “inter-state compacts” or provide any examples of “inter-state compacts” and, thus, it is not clear what, if any, role an “inter-state compact” could play in determining what constitutes a significant hazard in major food industries.

(Comment 136) Some comments ask us to concur that “temporal hazards” in milk and dairy products (specifically, aflatoxin, pesticides, and radiological contamination) do not represent “significant hazards” that require monitoring and verification activities on an ongoing basis. These comments also ask us to acknowledge that in many cases the testing done by FDA and others is sufficient for protecting public health and that it is not necessary to require ongoing monitoring by individual dairy facilities to comply with the rule.

(Response 136) We decline these requests because such a determination should be facility specific. However, we have revised the considerations for the hazard evaluation to clarify that in making the determination as to what hazards require preventive controls, the facility can consider factors such as the temporal nature of the hazard (see § 117.130(c)(2)(x) and Response 407). In determining the appropriate preventive control management components, the facility can take into account the nature of the preventive control and its role in the facility's food safety system (see § 117.140(a)).

(Comment 137) One commenter asserts that municipal drinking water supplies can be variable such that they could be a hazard that is reasonably likely to occur and that relying on municipal water will compromise food safety. The commenter asks us to “close the gap” in Federal risk assessment policies by adding regulatory text to the proposed definition of “significant hazard” to specify that the hazards are based on the outcome of a hazard analysis that includes any water used by the facility, whatever its source. The commenter further asserts that FDA must require full scientific water risk analysis and written water safety plans and water treatment where necessary and that the written water safety plans must comply with FSMA standards for accurate and precise measurement instruments, monitoring, verification, and documentation. The commenter asserts that in lieu of a full assessment and testing, the plant could disinfect all incoming water to a preventive control standard, and track and document compliance. The commenter further asserts that its commercially available technology provides the most cost effective disinfection for a wide range of sporeformers, bacteria, viruses, algae and molds.

In addition, the commenter asserts that food manufacturers who are not required to make a special effort to understand the status of their water supply through a required risk assessment process will not be aware of the need to institute preventive controls for their water supply. To support its position, the commenter makes assertions about the purpose of water standards established by the U.S. Environmental Protection Agency (EPA), the risk presented by water quality to the production of safe food, and the impact to food safety of EPA's 2013 changes to the National Primary Drinking Water regulations (EPA's NPDW regulations; 41 CFR parts 141 and 142) regarding total coliforms (EPA's total coliform rule) (78 FR 10270, February 13, 2013).

The commenter asserts that EPA's NPDW regulations hold public water suppliers to a standard that is protective of drinking water, not food manufacturing water. For example, the commenter describes EPA's NPDW regulations as requiring water suppliers to treat at least 95 percent of the water they distribute to the public to the treatment technique standard of the treatment they use and then argues that a user of the water would not necessarily know if it was getting some of the “allowable 5 percent off-spec water.” The commenter also asserts that current standards in EPA's NPDW regulations are not universally achieved by all public water systems. The commenter also asserts that EPA's total coliforms rule further reduces the applicability of municipal water standards to food manufacturing (e.g., because it reduced the frequencies of water monitoring and public notices about water quality and instead shifted the regulatory scheme towards corrective action).

According to the commenter 95,000 public water systems do not disinfect the water they provide to the public, and some studies have found infective viruses in drinking water samples in communities that did not disinfect their water. According to the commenter, water supplies close to aquifers that were not disinfected before distribution have recently had boil water advisories, demonstrating that problems with the water supply are reasonably likely to occur. The commenter questions whether the food manufacturing plants using that water had water safety back-up plans, stopped production, had monitoring measures in place to determine the impact of the unsafe water, or recalled product manufactured during the period when the municipal water systems had coliform positive tests but had not yet confirmed these tests and therefore had not yet issued the advisory. The commenter also asks whether the facilities relied on the traditional assumption that if they use municipal water their food safety risk analysis does not have to cover water, they do not need a written water safety plan, and they do not need to monitor the safety of their water.

(Response 137) We decline the request to change the regulatory text to explicitly require that the hazard analysis address any water used by the facility, whatever its source. Many of the commenter's assertions address issues under the jurisdiction of EPA, such as “allowing” “5 percent off-spec water”; whether current standards are universally achieved by all public water systems; and whether it is appropriate to allow some water systems to not disinfect the water they supply. Such issues that are under the jurisdiction of EPA are outside the scope of this rulemaking. We consider that water standards directed to drinking water for household use would also be adequate for the production of food products and, thus, have no reason to question whether a facility can rely on the standards in EPA's NPDW regulations to satisfy the long-standing CGMP requirement that any water that contacts food, food-contact surfaces, or food-packaging materials must be safe and of adequate sanitary quality (§ 117.37(a)). For example, we consider that water standards that EPA concludes are appropriate for drinking water are also appropriate for the production of water-based beverages, which are mostly water. We also see no reason to specifically require that a facility that satisfies the CGMP requirement for water also address water quality in its hazard analysis. Further, if a facility chooses to address the safety of water in its hazard analysis (e.g., water used in washing fresh-cut produce), we consider it more likely that the facility would treat the water onsite, obtain the water supplier's records documenting the results of its water testing, or simply test the water on a periodic basis, rather than conduct a risk assessment for the water source.

Under § 117.37(a), we expect any food establishment—regardless of whether it is a facility subject to FSMA's requirements for hazard analysis and risk-based preventive controls—to be vigilant regarding public health advisories such as a “boil water advisory” and to take appropriate action in light of such advisories. It is not necessary for the regulatory text to specify each potential problem or to specify the actions a food establishment must take to address each potential problem.

33. Significantly Minimize

We proposed to define the term “significantly minimize” to mean to reduce to an acceptable level, including to eliminate.

(Comment 138) Some comments assert that the definition of “acceptable level” for fresh produce is unclear because of the presence of spoilage microorganisms, which subject food to decomposition and reduce quality, but are not a public health concern. These comments ask us to revisit and change regulatory text that either does not clarify, or over-steps the intention of, the rule.

(Response 138) We proposed to define “significantly minimize” to give context to the term used in FSMA to define “preventive control.” Thus, in this rule the term “significantly minimize” relates to hazards that will be addressed by preventive controls. The term “significantly minimize” would not be relevant to spoilage microorganisms unless the facility determines, through its hazard analysis, that the spoilage microorganisms are a hazard requiring a preventive control. The standard of “acceptable level” is a flexible standard. By “acceptable level,” we mean a level that will not cause illness or injury or result in adulterated food.

34. Small Business

We proposed to define the term “small business” to mean, for the purposes of part 117, a business employing fewer than 500 persons. As previously discussed, we conducted a Food Processing Sector Study as required by section 418(l)(5) of the FD&C Act (Ref. 19) and used the results of the study in defining the term “small business” (78 FR 3646 at 3700 to 3701). We made the results of the Food Processing Sector Study available in Docket No. FDA-2011-N-0920 and requested public comment on that study.

(Comment 139) Some comments express concern that the Food Processing Sector Study is not comprehensive. Some comments assert that FDA did not sufficiently collaborate with USDA, and that FDA significantly underestimated the number of mixed-use facilities, particularly by neglecting to count farms that perform the processing steps on RACs to become a processed food. Other comments assert that the Food Processing Sector Study is woefully inadequate and must be undertaken again to comply with the law.

(Response 139) We previously acknowledged the limitations of the Food Processing Sector Study (78 FR 3646 at 3700-3701). We have revised and extended the results of our earlier study by expanding our data sources and by including representatives from USDA's Economic Research Service, USDA's Agricultural Marketing Service, and the American Farm Bureau to help oversee the revised study. The revised Food Processing Sector Study is available in the docket of this rule (Ref. 21).

Our original analysis was based on the merger of Dun & Bradstreet data and FDA's Food Facility Registration data to help us estimate the number of manufacturing facilities that are also classified as farms. We have updated that data source and added data sources. To better account for farms that perform processing activities, we included Census of Agriculture (Ag Census) data both to provide a count of total U.S. farms and to estimate the number of farms conducting food processing activities, to the extent that the data identifies processing activities. We also included the Agricultural Resource Management Survey (ARMS) data because it included questions about some processing activities for select commodities.

Both the Ag Census and ARMS are silent about many processing activities. Therefore, we also obtained estimates from commodity specialists at trade associations, USDA, and universities with in-depth knowledge of the processing activities for specific agricultural commodities. We also reached out to directors of promotion and marketing boards, and considered marketing agreements and marketing orders for various vegetables, fruits, and tree nuts to obtain information about the portion of farms that conduct food processing activities for use in this study.

(Comment 140) Some comments ask us to explain how to calculate the number of full-time equivalent employees—e.g., with respect to temporary workers, seasonal workers, and part-time workers.

(Response 140) As previously discussed, we proposed to establish the same definition for small business as that which has been established by the U.S. Small Business Administration (SBA) under 13 CFR part 121 for most food manufacturers, and the limit of 500 employees would include all employees of the business rather than be limited to the employees at a particular facility (78 FR 3646 at 3701). We will base the calculation on “full-time equivalent employees” and use the same approach to calculating full-time equivalent employees for the purpose of this rule as we used to calculate full-time equivalent employees in the section 414 recordkeeping regulations (see § 1.328). This approach is similar to the approach we used to calculate the small business exemption for nutrition labeling of food (21 CFR 101.9(j)(18)(iv)(D)). Under this approach, the number of full-time equivalent employees is determined by dividing the total number of hours of salary or wages paid directly to employees of the business entity claiming the exemption and of all of its affiliates and subsidiaries by the number of hours of work in 1 year, 2,080 hours (i.e., 40 hours × 52 weeks).

We received similar comments during the rulemaking to establish the section 414 recordkeeping regulations, and in response to those comments we established the definition of “full-time equivalent employee” in the definitions for that rule. As with the section 414 recordkeeping regulations and the nutrition labeling regulations, the calculation for the number of employees affects exemptions (i.e., the exemptions for on-farm, low-risk activity/food combinations in § 117.5(g) and (h), which apply only to small and very small businesses), not just compliance dates. Therefore, we are establishing the definition of “full-time equivalent employee” in the definitions for this rule (§ 117.3) and modifying the definition of “small business” to use the term “500 full-time equivalent employees” rather than “500 persons.”

(Comment 141) Some comments ask us to base the definition of “small business” on the amount of sales, rather than on the number of employees, for consistency with the definition of “very small business.”

(Response 141) We decline this request. As previously discussed, we based the definition of “very small business” on sales because the criterion of being a “very small business” plays a significant role in determining whether a facility is a “qualified facility,” and because the other principal criterion for being a “qualified facility” is based on sales (section 418(l)(1)(C) of the FD&C Act; see 79 FR 58524 at 58556). In contrast, section 418(l) of the FD&C Act does not specify any particular criterion (whether sales or number of employees) for the definition of “small business,” other than direct us to consider the results of the Food Processing Sector Study. Basing the definition of “small business” on the number of employees is consistent with our approach to defining “small business” for our HACCP regulation for juice (§ 120.1(b)(1)), the section 414 recordkeeping regulations (69 FR 71562, December 9, 2004), and our CGMP regulation for manufacturing, packaging, labeling, or holding operations for dietary supplements (72 FR 34752, June 25, 2007).

(Comment 142) Some comments assert that the specified number of employees (i.e., 500) has no relevance to food safety.

(Response 142) The definition of “small business” is relevant to two aspects of this rule. First, it is relevant to the compliance date for the establishment, and provides an additional year for establishments satisfying the definition to comply with the rule. As discussed in the Final Regulatory Impact Analysis (FRIA) (Ref. 38), we estimate that the number of small businesses that will be eligible is 45,936, accounting for 5.4 percent of the food supply. Although the purpose of the rule is to improve food safety, delaying the effective date for approximately 6 percent of the food supply will not significantly affect food safety in the long term.

Second, the definition of “small business” is relevant to the statutory exemptions for on-farm, low-risk activity/food combinations for manufacturing/processing, packing, and holding food by farm mixed-type facilities. These statutory exemptions, although expressly authorized only for small and very small businesses, encompass risk and are limited, because a small or very small farm mixed-type facility is only eligible for the exemption if the only activities that the facility conducts are the specified on-farm low-risk activity/food combinations.

(Comment 143) Some comments assert that the specified number of employees (i.e., 500) may or may not be indicative of business size. As an example, the comment notes that harvest employees may operate under contract rather than be the grower's employees.

(Response 143) If a farm mixed-type facility that is subject to this rule employs harvest employees under contract, the facility would include these employees in its calculation of full-time equivalent employees and would adjust for the temporary, seasonal nature of the increased number of employees when it calculates the 12 month average number of full-time equivalent employees. (See Response 140 for the calculation of full-time equivalents.)

(Comment 144) Some comments assert that the human preventive controls rule and the produce safety rule should use the same definition of “small business.”

(Response 144) We tailored the definitions of “small business” to the characteristics of the sectors of industry subject to the two rules.

(Comment 145) Some comments assert that the definition of a small business as less than 500 employees makes the very small business exemption irrelevant. These comments ask us to create a simple and broad small business exemption for any small business conducting “low-risk activities.”

(Response 145) We disagree that the definition of a small business makes the very small business exemption irrelevant and decline the request to create a “simple and broad small business exemption” for any small business conducting “low-risk activities.” Although both small and very small businesses are eligible for the exemption for such businesses that only conduct specified low-risk activity/food combinations, other provisions apply solely to very small businesses. For example, the compliance date for a very small business is different from the compliance date for a small business, and a very small business (but not a small business) is eligible for modified requirements.

35. Supplier

We proposed to define the term “supplier” to mean the establishment that manufactures/processes the food, raises the animal, or harvests the food that is provided to a receiving facility without further manufacturing/processing by another establishment, except for further manufacturing/processing that consists solely of the addition of labeling or similar activity of a de minimis nature.

As discussed in Response 32, we have revised the “farm” definition to explicitly include business models in which one operation grows crops but does not harvest them, and another operation, not under the same management, harvests crops but does not grow them. As also discussed in Response 32, this revision represents a change from the existing and proposed “farm” definitions, which describe a “farm” as an entity “devoted to the growing and harvesting of crops” (emphasis added). We proposed the “supplier” definition in the context of a single business entity “devoted to the growing and harvesting of crops” (emphasis added). We used the term “harvesting,” rather than “growing,” to reflect the last stage of production on a farm, except for packing.

Because the proposed “supplier” definition contemplated that the same business entity that grows crops also harvests them, we have revised the “supplier” definition so that the grower remains the supplier when the harvester is under separate management. Specifically, “supplier” is now defined to include an establishment that “grows” food rather than an establishment that “harvests” food. Doing so focuses the requirements for the supply-chain program (see subpart G) on the entity that produces the food, rather than on the entity that removes the food from the growing area, when the grower and the harvester are not under the same management. Doing so also simplifies the determination of who the supplier is in complex business models, such as when a “handler” arranges for harvest by another business entity.

As discussed in Response 22, we consider a farm to be a type of “establishment” even though we revised the “farm” definition to refer to an “operation” rather than an “establishment” within that definition.

(Comment 146) Some comments assert that the definition of supplier is not workable because the status of warehouses and brokers is unclear in the definition. Other comments ask us to modify the definition to specify, in addition to the proposed definition, that the supplier could be an intermediary entity that takes responsibility on behalf of the receiving facility to ensure that the food meets the requirements of this part.

(Response 146) As discussed in Response 657, we agree that the role of intermediaries in the supply chain is critical, and we have added options for entities other than the receiving facility to perform certain supplier verification activities, provided that the receiving facility reviews and assesses the documentation produced by the other entity and documents that review and assessment. However, this does not mean that these entities take on the role of the supplier. As discussed in Response 658 and Response 123, we believe it is important to supplier verification to retain the identities of two parties involved—the receiving facility and the supplier. Therefore, we are retaining our definition of supplier.

(Comment 147) Some comments regarding RACs ask us to modify the definition of supplier in the case of commingled RACs, such that the supplier would be the person immediately back from the receiving facility in the supply chain provided that this entity (presumably a warehouse or aggregator) voluntarily complies with the requirements of subpart C of this part.

(Response 147) We decline this request. As discussed in Response 657, we recognize that doing supplier verification with commingled products will be a challenge. However, we believe it is important that there be a link between the receiving facility (which is manufacturing/processing the food) and the supplier (who controlled the hazard(s) in the food). We are allowing an entity such as an aggregator or distributor to perform some verification activities, so the outcome requested by these comments will be achieved while maintaining the identities of the two primary parties in the supplier verification relationship (see Response 657).

(Comment 148) One comment asks us to clarify who would be the supplier in a situation in which dairy farms are providing milk to a cooperative collecting milk.

(Response 148) In this example, the dairy farms would be the suppliers because they are raising the animals.

(Comment 149) One comment asks us to clarify that the proposed definition of supplier does not include sources of processing aids or chemicals required for post-harvest treatments and packing processes (including waxes, fungicides, detergents and sanitizers).

(Response 149) As defined, the supplier is the establishment growing the food, not those establishments providing inputs (such as waxes, fungicides, detergents and sanitizers) to that entity.

36. Validation and Verification

We proposed to define the term “validation” to mean that element of verification focused on collecting and evaluating scientific and technical information to determine whether the food safety plan, when properly implemented, will effectively control the identified hazards. We proposed to define the term “verification” to mean those activities, other than monitoring, that establish the validity of the food safety plan and that the system is operating according to the plan.

(Comment 150) Some comments ask us to revise the definitions of “validation” and “verification” to be consistent with the Codex definitions. (Codex defines “validation” to mean obtaining evidence that a control measure or combination of control measures, if properly implemented, is capable of controlling the hazard to a specified outcome. Codex defines “verification” to mean the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure is or has been operating as intended (Ref. 39).)

Some comments ask us to more clearly distinguish between “validation” and “verification.” Some comments assert that validation is not an element of verification as stated in our proposed definition and suggest that we clearly separate requirements for validation from requirements for verification—e.g., by moving the proposed requirements for verification to a distinct section in the regulatory text.

(Response 150) We have explained how our proposed definitions for “validation” and “verification” align with a variety of widely recognized definitions, including definitions established by Codex, the NACMCF HACCP guidelines, and Federal HACCP regulations for seafood, juice, and meat and poultry (78 FR 3646 at 3700). We disagree that validation is not an element of verification, but acknowledge it is not necessary to say so within the definition of “validation.” Although we have moved the details of the requirements for validation from its proposed location within the requirements for verification (i.e., proposed § 117.155(a)) to a separate section (§ 117.160), we did so as an editorial change to improve clarity and readability rather than as a substantive change to signal that validation is not an element of verification (see table 8 in the 2014 supplemental human preventive controls notice, 79 FR 58524 at 58557).

We agree that validation can apply to a specific control measure as specified in the Codex definition. We also agree that validation can apply to a combination of control measures as specified in the Codex definition. The food safety plan is one example of a combination of control measures.

Although we likewise agree that verification can apply to a specific control measure as specified in the Codex definition, we disagree that to be consistent with the Codex definition we should adopt a definition that excludes the application of verification to the food safety plan. It is well established that some verification measures, such as testing for a pathogen, verify that multiple control measures operated as intended. (See, e.g., Codex's discussion of verification for uncooked fermented sausages (Ref. 39)).

To more clearly distinguish between “validation” and “verification,” the definition of “validation” we are establishing in this rule specifies that validation means obtaining and evaluating scientific evidence that a control measure, combination of control measures, or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards (emphasis added). We also made conforming changes associated with the revised definition of “validation” in the requirements for validation (see § 117.160(b)(2)). The definition of “verification” we are establishing in this rule specifies that verification means the application of methods, procedures, tests and other evaluations, in addition to monitoring, to determine whether a control measure or combination of control measures is or has been operating as intended and to establish the validity of the food safety plan as a whole (emphasis added). Consistent with the request of the comments, the definition of “verification” uses the Codex description of verification as the application of methods, procedures, tests and other evaluations, in addition to monitoring.

37. Very Small Business

We proposed to define the term “very small business” to mean, for the purposes of proposed part 117, a business that has less than $1,000,000 in total annual sales of human food, adjusted for inflation. As discussed in the proposed rule, we conducted a Food Processing Sector Study as required by section 418(l)(5) of the FD&C Act (Ref. 19) and used the results of the study in defining the term “very small business” (78 FR 3646 at 3700 to 3702). We made the results of the Food Processing Sector Study available in Docket No. FDA-2011-N-0920 and requested public comment on that study. As discussed in Response 139, we have updated that study (Ref. 21).

(Comment 151) Some comments support the proposed dollar threshold of $1,000,000, noting that it would provide sufficient flexibility to companies that receive the exemption to allow them to continue to operate. Some comments that support the proposed dollar threshold of $1,000,000 state that this threshold is consistent with Congress's mandate that the FSMA rules provide flexibility for all sizes and types of businesses and facilities, including small processing facilities co-located on farms, and provide special considerations for small and very small businesses. These comments also state that our proposal to adopt the $1,000,000 threshold is appropriate in light of the two options Congress provided for facilities to qualify for modified requirements, and that although Congress directed us to consider the Food Processing Sector Study in establishing the very small business definition, it did not otherwise establish parameters for us to use in setting this definition, leaving it largely to our discretion. These comments argue that although Congress set out two options whereby facilities could qualify for modified requirements, Congress did not bind us to using both options. These comments express the view that when Congress is silent on an issue, the agency may reasonably interpret its authority. These comments state that proposing the $1,000,000 threshold for a very small business is entirely reasonable given that businesses this size account for such a small percentage of the food supply, and given Congress's mandate that FDA establish flexible standards considering the effects of the rules on small and very small businesses.

Other comments disagree with the proposed dollar threshold of $1,000,000. Some of these comments assert that the proposed dollar threshold of $1,000,000 would create a new category of exemption not contemplated by FSMA and will create confusion for both those who may be subject to the rule and those trying to enforce it. These comments ask us to instead adopt the $500,000 threshold we considered as “Option 2” in the 2013 proposed preventive controls rule (78 FR 3646 at 3702). Some comments assert that the proposed $1,000,000 threshold would expose a larger number of consumers to a heightened risk of contracting a foodborne illness.

Other comments reiterate their previous assertions that any dollar threshold that exceeds $250,000 would be contrary to Congressional intent and conflict with section 418(l) of the FD&C Act. Some of these comments assert that adopting a $1,000,000 threshold would conflict with the statutory structure of the qualified facility program in a way that effectively nullifies a section of the law. Some of these comments assert that the discussion in the 2014 supplemental human preventive controls notice did not adequately address their comments submitted to the 2013 proposed human preventive controls rule because that discussion does not explain why we believe the proposed $1,000,000 threshold is consistent with the statute's definitions of a qualified facility in section 418(l)(1) of the FD&C Act. These comments assert that the discussion in the 2014 supplemental human preventive controls notice clearly indicates that the definition is intended to abrogate the definition of a qualified facility under section 418(l)(1)(C) of the FD&C Act because the “definition would . . . simplify a facility's determination of whether it is a qualified facility because the facility would only need to calculate its total sales of human food rather than determine how much food was sold to qualified end‐users.” The comments assert that this discussion shows that we have made a deliberate decision to write qualified facilities under section 418(l)(1)(C) and the limitations on sales under section 418(l)(4)(B) out of the law and state that an agency has no authority to repeal a well‐considered act of Congress by fiat in a rulemaking.

(Response 151) We are establishing a $1,000,000 threshold for the definition of “very small business.” We disagree that a $1,000,000 threshold would create a new category of exemption not contemplated by FSMA. Under section 418(l)(1)(A) and (B) of the FD&C Act, a very small business is a qualified facility; under the exemption authorized in section 418(l)(2) of the FD&C Act, a qualified facility is subject to modified requirements rather than the requirements for hazard analysis and risk-based preventive controls. We have acknowledged that a $1,000,000 threshold exempts a greater portion of the food supply than thresholds of either $250,000 or $500,000 (79 FR 58524 at 58555), but reaffirm that under the $1,000,000 threshold the businesses that would be exempt from the requirements for hazard analysis and risk-based preventive controls would represent a small portion of the potential risk of foodborne illness; businesses that fall within this definition of “very small business,” collectively, produce less than 0.6 percent of the food supply (Ref. 38). In addition, most of these facilities will be subject to the CGMP requirements in subpart B; the only exemption from those CGMP requirements is the exemption in § 117.5(k) (which applies to: (1) Farms; (2) certain fishing vessels; (3) establishments solely engaged in the holding and/or transportation of one or more RACs; (4) activities of “farm mixed-type facilities” that fall within the definition of “farm”; and (5) establishments solely engaged in hulling, shelling, drying, packing, and/or holding nuts (without additional manufacturing/processing)).

We disagree that a $1,000,000 threshold for the definition of “very small business” will create confusion for both those who may be subject to the rule and those trying to enforce it; in contrast, it is our view that a $1,000,000 threshold will be less burdensome for both the qualified facilities and FDA. (See Response 581, where we explain that for compliance purposes we intend to focus on financial records demonstrating that a business averages less than the specified dollar threshold rather than records demonstrating that the average annual monetary value of the food manufactured, processed, packed, or held at such facility that is sold directly to qualified end-users during a three-year period exceeded the average annual monetary value of the food sold by the facility to all other purchasers.)

We reaffirm our view, expressed in the 2014 supplemental human preventive controls notice, that section 418 of the FD&C Act does not limit how we may define “very small business” other than by requiring us to consider the Food Processing Sector Study, and we have done so. (See also Response 152.) Therefore, we disagree that adopting a $1,000,000 threshold would conflict with the statutory structure of the qualified facility program in a way that effectively nullifies an entire section of the law. We also disagree that our explanation in the 2014 supplemental human preventive controls notice demonstrates that we have made a deliberate decision to write qualified facilities under section 418(l)(1)(C) of the FD&C Act, and the limitations on sales under section 418(l)(4)(B) of the FD&C Act, out of the law. Likewise, we disagree that we are in any way “repealing” a well‐considered act of Congress by fiat in a rulemaking.

(Comment 152) Some comments that support a dollar threshold of $250,000 rather than $1,000,000 assert that the rationale we presented in the 2014 supplemental human preventive controls notice for a $1,000,000 threshold is inconsistent with the rationale we presented in our “original draft” of the 2013 proposed human preventive controls rule. These comments quote that “original draft” of the 2013 proposed human preventive controls rule as follows: “FDA is proposing to define the term “very small business” to mean, for the purposes of part 110, a business that has less than $250,000 in total annual sales of foods, adjusted for inflation. We are proposing to define very small business using a dollar amount that is, for practical purposes, the same as the dollar amount of sales by a qualified facility to end users other than those that would satisfy the definition of “qualified end users.” The proposed definition is consistent with the findings of a study that we conducted as required by section 418(l)(5) of the FD&C Act.” These comments note that we acknowledged, in the 2014 supplemental preventive controls notice, that section 418(n)(1)(B) of the FD&C Act requires us to consider the Food Processing Sector Study for the purpose of defining “very small business” (79 FR 58524 at 58555) and argue that it is difficult to see how the same study that supported defining a very small business as one that has less than $250,000 in total annual sales of food now supports a definition that puts that threshold at less than $1,000,000.

(Response 152) These comments are citing a rationale in a draft version of the 2013 proposed human preventive controls rule, which we submitted to the Office of Management and Budget in 2011 (Ref. 40, p. 259). In that draft, we proposed a single option for the definition of “very small business” (i.e., less than $250,000) and explained the reasons for proposing that single option, including an explanation that the option was consistent with the findings of the Food Processing Sector Study. In contrast, in the published 2013 proposed human preventive controls rule that we issued for public comment we identified three options as part of a co-proposal for the definition of very small business, and provided a basis to support each option. For each option of the co-proposal, we made the same statement regarding the Food Processing Sector Study when we discussed the impact of the option on mixed-type facilities—i.e., that it is apparent that the number of co-located facilities is concentrated at the smaller end of the size spectrum. We see no conflict between a statement (made in the context of a single proposed option for the definition of “very small business”) that a specific proposed definition was consistent with the findings of the Food Processing Sector Study and a statement (made in the context of three proposed options for the definition of “very small business”) that it is apparent that the number of co-located facilities is concentrated at the smaller end of the size spectrum. (See also Response 139 regarding the Food Processing Sector Study.)

(Comment 153) Some comments assert that the proposed $1,000,000 threshold would be inconsistent with our explanation, in the 2014 proposed sanitary transportation rule, of the definition of a “non-covered business” as one having less than $500,000 in total annual sales. These comments note that we considered whether a less than $1 million threshold should be applied but concluded: “[W]e believe such an expansion would result in a greater risk of food becoming adulterated during transport due to insanitary food transportation practices.” (Ref. 41) These comments assert that if we were to apply the same analysis we used in the 2014 proposed sanitary transportation rule to the human preventive controls rule, the threshold for a very small business would be below $500,000.

(Response 153) The $500,000 threshold we proposed in the 2014 proposed sanitary transportation rule would apply to “non-covered businesses”—i.e., businesses that would be completely exempt from the requirements of the sanitary transportation rule. In contrast, the $1,000,000 threshold we are establishing in this rule applies to very small businesses that will be subject to modified requirements rather than be completely exempt. A very small business will have two options to comply with the modified requirements in the human preventive controls rule (the food safety practices option and the option to demonstrate compliance with other applicable non-Federal food safety law; see § 117.201(a)(2) and the discussion in sections XXXVIII.C.2 and XXXVIII.C.3). Regardless of which option a very small business chooses to comply with the modified requirements, we will inspect the business for compliance with the CGMPs and the modified requirements. In contrast, if the final sanitary transportation rule excludes a “non-covered business” as would be defined in that rule, that business would be completely exempt rather than subject to modified requirements and, thus, would be not be inspected for compliance with any aspect of the sanitary transportation rule.

(Comment 154) Some comments ask us to clarify how to classify the size of a business that does not take ownership of or directly sell food (e.g., warehouses and re-packing facilities) to determine status as a qualified facility.

(Response 154) We have revised the definition to specify that the $1,000,000 threshold applies to sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee). When there are no sales of human food, market value of the human food manufactured, processed, packed, or held without sale is a reasonable approach to calculating the dollar threshold for very small business.

(Comment 155) Some comments ask us to specify that the monetary threshold for the definition be based on average sales during a three-year period on a rolling basis because otherwise firms may be subject to significant changes in status from year to year. These comments also ask us to clarify that the sales are to be evaluated retrospectively, not prospectively.

(Response 155) We have revised the definition of very small business to specify that it is based on an average during the 3-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee). The applicable calendar year is the year after the 3 calendar years used to determine whether a facility is a very small business. The most recent applicable calendar year is the current year. For example, on June 3, 2024, 2024 is the most recent applicable calendar year and is the applicable calendar year when the 3 calendar years used to determine whether a facility is a very small business are 2021-2023. The exception is when 3 calendar years of records are not available, such as when a facility begins business after the compliance date for very small businesses. In such situations the applicable calendar year refers to the year during which the calculation is made but is not preceded by 3 calendar years used to determine whether a facility is a very small business.

As a companion change, we are explicitly requiring that a facility determine and document its status as a qualified facility on an annual basis by no later than July 1 of each calendar year (see § 117.201(c)(1)). Although this requirement was implicit in the proposed requirement that a facility must resubmit a notification to FDA if its status changes as a qualified facility (proposed § 117.201(c)(2), which we are finalizing as § 117.201(c)(3)), we are making this requirement explicit to clarify the responsibility of the facility to affirmatively determine its status when the calendar years that apply to the 3-year average change. The July 1 deadline for a facility to determine its status provides facilities with 6 months to make the determination after the end of the previous 3 calendar years.

We also are establishing an earlier compliance date for the financial records that a facility maintains to support its status as a very small business that is eligible for the qualified facility exemption in § 117.5(a). Specifically, the compliance date for a facility to retain records to support its status as a qualified facility is January 1, 2016. Even with this earlier compliance date for these records, we realize that although the calculation for “very small business” in the regulatory text is based on 3 calendar years, a facility will only be required to have 2 calendar years of records as of the general compliance date for very small businesses. Specifically, by September 17, 2018 a facility that begins retaining applicable financial records on January 1, 2016, would only have such records for 2 previous calendar years. Therefore, it would be reasonable for a facility to make the calculation based on the 2 previous calendar years. If a facility has records for 3 previous calendar years, the facility could make the calculation based on the longer time period. During inspection in 2018, when a facility has records for the preceding 2 calendar years, but not for the preceding 3 previous calendar years, we will accept records for the preceding 2 calendar years as adequate to support status as a qualified facility. We note that in some situations, a shorter time period is sufficient to determine that a facility is not a very small business. For example, a facility with sales exceeding $3,000,000 for the preceding calendar year cannot qualify as a very small business because no amount of sales from other years will reduce average sales below the threshold of $1,000,000.

The available financial records for a facility that begins operations between January 1, 2017 and September 17, 2018 would not cover even 2 calendar years by September 17, 2018. During the first 3 years of such a facility's operation, it would be reasonable for a facility to make the calculation based on records it has (i.e., for one or two preceding calendar years), and we will accept records for the preceding one or two years as adequate to support status as a qualified facility in these circumstances.

When a facility does not begin operations until after January 1, 2018, it would be reasonable for the facility to rely on a projected estimate of revenue (or market value) when it begins operations. We would evaluate the credibility of the projection considering factors such as the facility's number of FTEs. After the facility has records for one or two preceding years, it would be reasonable for the facility to make the calculation based on records it has (i.e., for one or two preceding calendar years) and we will accept records for the preceding one or two calendar years as adequate to support status as a qualified facility in these circumstances.

(Comment 156) Some comments ask us to only include the total annual sales of food in the United States, adjusted for inflation, for foreign facilities that export food to the United States.

(Response 156) We decline this request. The purpose of the definition of “very small business” is principally to enable such businesses to comply with modified requirements, because they have fewer resources to direct to full compliance with the rule. A foreign business that sells more than the threshold dollar amount of food has more resources than the businesses being excluded, even if less than that threshold dollar amount reflects sales to the United States. Likewise, a domestic business that sells more than the threshold dollar amount of food has more resources than the businesses being excluded, even if that domestic business exports some of its food and, as a result, less than that threshold dollar amount reflects sales within the United States.

As discussed in Response 154, to address facilities such as those warehouses and re-packing facilities that do not take ownership or directly sell food we have revised the definition of “very small business” to specify that the $1,000,000 threshold applies to sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee). As with “sales,” facilities such as those warehouses and re-packing facilities that pack or hold more than the $1,000,000 threshold would have more resources than the facilities being excluded.

(Comment 157) Some comments ask us to apply the rule to dairy farms with sales greater than $1 million annually of processed or packaged dairy products, rather than bulk sales of fluid milk. Other comments ask us to only include the annual monetary value of food covered by the preventive controls rule, rather than all human food. In particular, these comments argue that food covered by the produce safety rule should not be counted in the calculation of the sales of food for the purpose of defining very small business for the preventive controls rule. Some of these comments assert that basing the threshold on the monetary value of food covered by the preventive controls rule, rather than all human food, would be necessary to be consistent with the approach used in the proposed animal preventive controls rule, in which the sales threshold was based on sales of animal food (i.e., the product regulated by the rule).

(Response 157) We decline these requests. As discussed in Response 156, the purpose of the definition of “very small business” is principally to enable such businesses to comply with modified requirements, because they have fewer resources to direct to full compliance with the rule. Because of the exemptions in the human preventive controls rule (e.g., for processors of seafood, juice, low-acid canned foods (LACF), and dietary supplements), basing the threshold on the monetary value of food covered by the preventive controls rule, rather than all human food, could lead to a situation where a very large food processor (such as a juice processor with more than $20,000,000 in annual sales) would not need to comply with the human preventive controls rule for milk- and soy-based beverages that it produces, if the annual sales of milk- and soy-based beverages is less than $1,000,000.

We disagree that a threshold based on sales of human food, rather than food covered by the preventive controls rule, would be inconsistent with the threshold we proposed for the animal preventive controls rule. The threshold we proposed for the animal preventive controls rule was based on “total annual sales of food for animals, adjusted for inflation,” which is exactly parallel to our proposal to base the threshold on “total annual sales of human food, adjusted for inflation.” We proposed several exemptions to the animal preventive controls rule (see proposed § 507.5 (proposed 21 CFR 507.5)) and, thus, not all food for animals will be subject to the animal preventive controls rule.

(Comment 158) Some comments ask us to base the threshold on the total “volume of product” or “amount of product” handled or sold. These comments assert that an approach using product volume or amount would be more risk-based because it would correlate more closely to consumer exposures than dollar amounts, which can be skewed by product values.

(Response 158) We use sales as a proxy for volume. We acknowledge that dollar amounts can be skewed by product values and, thus, sales are an imperfect proxy for volume. However, we are not aware of a more practical way to identify a threshold based on volume or amount of product that could be applied across all product sectors, and the comments provide no suggestions for how their recommendation could be carried out.

(Comment 159) Some comments assert that our conclusion that our proposed definition of very small business is controlled by the two references in sections 418(l)(5) and 418(n)(1)(B) of the FD&C Act does not provide a reasonable justification for our decision. These comments assert that it is equally true that those two provisions would not prevent us from adopting one threshold (less than $250,000) for purposes of defining a qualified facility (and for a very small business conducting on‐farm low‐risk activity/food combinations) and another (less than $1 million) for setting compliance dates. These comments also assert that this is exactly the determination we made for our proposed animal preventive controls rule, where we proposed to define very small business, under the constraints of these same two references, as one with less than $2,500,000 in sales. To give full effect to the design of the qualified facility program while providing an adequate compliance deadline, these comments ask us to revise the definition of very small business to mean “a business that has less than $250,000 in total annual sales of human food, adjusted for inflation, except that for purposes of the effective dates in section 103(i) of the FDA Food Safety Modernization Act (21 U.S.C. 350g note) the term means less than $1,000,000 in total annual sales of human food.”

(Response 159) These comments are unclear. We agree that we proposed to define very small business, for the purposes of the animal preventive controls rule, as one with less than $2,500,000 in sales (79 FR 58476 at 58510), but disagree that we proposed to adopt one threshold for purposes of defining a qualified facility and another threshold for setting compliance dates. Regardless, we decline the request to adopt a threshold lower than $1,000,000 for purposes of defining a qualified facility, which appears to be the principal request of these comments (see Response 151).

(Comment 160) Some comments support the proposed dollar threshold of $1,000,000, provided that we also make changes to the “farm” definition to encompass activities of food hubs performing low-risk packing and holding activities on RACs for distribution in local food markets. If we do not revise the “farm” definition to encompass such activities, these comments assert that a threshold dollar amount of $2,000,000 would be necessary to allay concerns that making food hubs subject to the requirements for hazard analysis and risk-based preventive controls would cause many food hubs to fail, and would prevent the start of new food hubs.

(Response 160) See Response 23 and Response 25. Food hubs that pack and hold RACs are covered by the “farm” definition if the farm(s) that grow or raise the majority of the RACs packed and held by the food hub own, or jointly own, a majority interest in the food hub. Thus some food hubs will not be required to register as a food facility and, thus, will not be subject to the requirements for hazard analysis and risk-based preventive controls. Those food hubs that exceed the specified dollar threshold for a very small business and are not within the “farm” definition would be subject to the requirements for hazard analysis and risk-based preventive controls. However, the preventive controls that the food hub would establish and implement would depend on the food hub, the food, and the outcome of the facility's hazard analysis, and the preventive control management components that the food hub would establish and implement for its preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. A facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components. (See Response 222).

(Comment 161) Some comments express concern that establishing a threshold based on U.S. dollars would place domestic firms at a disadvantage relative to foreign firms whose sales are often denominated in currencies valued lower than the dollar and often reflect much lower costs for factors such as land, labor, and environmental compliance. These comments ask us to base the threshold on an alternate measure, such as number of employees, or to calculate the sales of foreign very small businesses using an appropriate measure of purchasing power parity, if there is a straightforward way to do so.

(Response 161) We decline these requests. As previously discussed, we use dollar estimates to evaluate the percentage of all food produced in the United States that would not be covered by the rule (79 FR 58524 at 58555). We acknowledge that the definition of “small business” is based on number of employees, and that two exemptions (i.e., the exemptions in § 117.5(g) and (h) for on-farm, low-risk activity/food combinations) apply to small businesses. However, the exemptions for on-farm, low-risk activity/food combinations are limited to a narrow sector of the food industry, whereas the exemption applicable to a very small business will apply to all sectors of the food industry.

We do not know of a straightforward way to calculate the sales of foreign very small businesses using an appropriate measure of purchasing power parity and are basing the threshold only on U.S. dollars.

(Comment 162) Some comments assert that the reach of potential harm from foods imported from very small businesses that would meet the proposed threshold of $1,000,000 may be greater because they are more likely to be ingredients, such as spices, and argue that small amounts of spice can contaminate a large volume of food and, thus, cause widespread illnesses. Other comments assert that it is very likely that more facilities in exporting countries will be exempt under the definition, thus putting those located in the United States at a disadvantage. These comments assert that the definition of “very small business” should reflect the probability and severity of potential hazards in order to align with the rest of the regulation and promote public health interests.

(Response 162) We acknowledge that ingredients such as spices, which have been associated with outbreaks of foodborne illness and large recalls, can contaminate a large volume of food (78 FR 3646 at 3665 and 3737). However, the suggestion that we define “very small business” in a way that reflects the probability and severity of potential hazards is neither practical nor aligned with a size-based nature of the term.

The comments asserting that it is very likely that more facilities in exporting countries will be exempt under the definition, thus putting those located in the United States at a disadvantage, provided no basis for the assertion. As discussed in Response 156, we have declined the request to only include the total annual sales of food in the United States, adjusted for inflation, for foreign facilities that export food to the United States.

(Comment 163) Some comments express concern that the Food Processing Sector Study is not comprehensive.

(Response 163) See Response 139 regarding the Food Processing Sector Study.

38. You

We proposed to define the term “you” for purposes of part 117, to mean the owner, operator, or agent in charge of a facility. We received no comments that disagreed with this proposed definition and are finalizing it as proposed.

D. Comments Asking FDA To Establish Additional Definitions or Otherwise Clarify Terms Not Defined in the Rule

1. Corrections

(Comment 164) Some comments assert that clearly distinguishing between the terms “corrective actions” and “corrections” will be imperative for industry to comply with the rule and for regulators to enforce the rule. Some comments ask us to use the ISO definitions of “corrective actions” and “corrections.” (According to ISO 22000:2005 definition 3.13, a “correction” is action to eliminate a detected nonconformity; according to ISO 22000:2005 definition 3.14, corrective action is action to eliminate the cause of a detected nonconformity or other undesirable situation.) Other comments ask us to eliminate the term “correction” and instead revise the rule to clarify the type of situation in which “corrective actions” are neither necessary nor appropriate. As an example, these comments suggest that the proposed provisions for corrections could refer to “prompt actions taken in response to minor and isolated deviations that do not directly impact product safety.”

Other comments agree with the concept of simple “corrections” but assert that the term “corrections” is unnecessary and could be confusing because different facilities may use the term differently. These comments explain that sometimes “correction” is used to refer to the action taken to fix a deviation, and may or may not be part of an overall corrective action taken to identify the root cause of the deviation and to prevent a similar occurrence. These comments suggest that the provisions explain that prompt actions taken to address minor and isolated deviations are not subject to the same requirements as corrective actions to address potentially systemic concerns, without defining the term “corrections.”

(Response 164) We are defining the term “correction” to mean an action to identify and correct a problem that occurred during the production of food, without other actions associated with a corrective action procedure (such as actions to reduce the likelihood that the problem will recur, evaluate all affected food for safety, and prevent affected food from entering commerce). We agree that clearly distinguishing between the terms “corrective actions” and “corrections” will be important for both industry and regulators. We acknowledge that one way to distinguish between “corrective actions” and actions that we would consider “corrections” could be to avoid the term “corrections” and instead say what we mean each time the rule uses the term “corrections.” However, after reviewing the full regulatory text of proposed subpart C we concluded that it was not practical to do so, because the term “corrections” was used more often in a title or a cross-reference than in a provision where the full text of what we mean by the term “corrections” is necessary to communicate a requirement. Our definition of “corrections” focuses on the first step in a “corrective action procedure” (i.e., identify and correct the problem) and also specifies those aspects of a corrective action procedure that do not apply to a correction (i.e., actions to reduce the likelihood that the problem will recur, evaluate all affected food for safety, and prevent affected food from entering commerce). (A note to the ISO 22000:2005 definition of corrective action indicates that it includes cause analysis and is taken to prevent recurrence.) We believe that this definition will be adequate to distinguish “corrective actions” from “corrections.”

As an example, if a facility applies sanitation controls for an environmental pathogen such as L. monocytogenes and food residue is observed on “clean” equipment prior to production, corrections would involve re-cleaning and sanitizing the equipment before it is used. Because the observation of food residue was made prior to production of food, no food is affected, and no actions are needed with respect to food. Although there are actions that can be taken to prevent reoccurrence, such as re-training sanitation personnel, these types of actions are not always needed.

2. Defect Action Level

(Comment 165) Some comments that address the proposed provisions regarding “defect action levels” (proposed § 117.110) ask us to define that term so that its meaning will be clear.

(Response 165) We have added a definition of the term “defect action level” to mean a level of a non-hazardous, naturally occurring, unavoidable defect at which FDA may regard a food product “adulterated” and subject to enforcement action under section 402(a)(3) of the FD&C Act. This definition derives from the definition in our long-standing “Defect Levels Handbook” (Ref. 36), which we continue to reference in the provisions established in this rule regarding defect action levels. This definition also derives from the long-standing provisions in § 110.110, which referred to natural or unavoidable defects in food for human use that present no health hazard and noted that some foods contain natural or unavoidable defects that at low levels are not hazardous to health. These long-standing provisions also noted that we establish maximum levels for these defects in foods produced under current good manufacturing practice and use these levels in deciding whether to recommend regulatory action.

3. Food-Packaging Material

(Comment 166) Some comments point out that the proposed human preventive controls rule would amend certain provisions requiring prevention of contamination and allergen cross-contact of food and food-contact surfaces to add “food-packaging materials,” a term which is not defined. These comments ask us to clarify that “food-packaging materials” is limited to packaging materials that are capable of contaminating food and does not include shipping containers such as cartons and crates that pose no risk of introducing contaminants or food allergens into food.

(Response 166) For the purposes of the provisions that require protection against allergen cross-contact and against contamination of food, food-contact surfaces, and food-packaging materials, the term “food-packaging materials” does not include shipping containers such as cartons and crates that pose no risk of introducing contaminants or food allergens into food. We are not adding a definition of “food-packaging materials” to the definitions in § 117.3 because the provisions requiring protection against contamination are long-standing provisions that have been applied in the manner requested by the comment and, thus, adding a definition is not necessary to address the comment's request.

4. Must

(Comment 167) Some comments ask us to define the term “must.”

(Response 167) We decline this request. The term “must” has a common meaning, and it is not necessary to establish a specific meaning for this term specifically for this rule.

5. Parameter and Value as Used in the Requirements for Process Controls

(Comment 168) Some comments ask us to define the terms “parameter” and “value” used in the requirements for preventive controls (§ 117.135). These comments ask us to define “parameter” as a measurable attribute and “value” as a specific measurement.

(Response 168) We decline this request. Both of these terms are used in the context of process controls and both have common meanings when associated with process controls. Therefore, it is not necessary for the rule to define them.

6. Raw Materials

Some comments ask us to define “raw materials” (see Comment 65). As discussed in Response 65, we have declined to do so.

7. Qualified Facility Exemption

(Comment 169) Some comments note that some of the terminology associated with the exemption for qualified facilities in the human preventive controls rule is different from terminology associated with an exemption in the proposed produce safety rule. These comments point out that the exemption in the proposed produce safety rule refers to “qualified exemptions” (§ 112.5), whereas the exemption in the proposed human preventive controls rule refers to “exemptions” and “qualified facilities” (§ 117.5(a)). These comments ask us to harmonize the terminology associated with the exemption for qualified facilities in the human preventive controls rule with the terminology associated with “qualified exemptions” in the proposed produce safety rule.

(Response 169) We have revised the human preventive controls rule in two ways to better harmonize the terminology associated with the exemption for qualified facilities in the human preventive controls rule with an analogous exemption in the proposed produce safety rule. First, we have added a definition for the term “qualified facility exemption,” to mean an exemption applicable to a qualified facility under § 117.5(a) (see the regulatory text in § 117.3). Second, we also have made conforming changes throughout the rule to use the term “qualified facility exemption” when it applies. (See table 52.) It is not practical to fully harmonize the relevant terminology in these two rules due to differences in the framework applicable to food businesses subject to section 418 of the FD&C Act compared to the framework applicable to farms subject to section 419 of the FD&C Act. For example, a farm is not a “facility” and, thus, it would be confusing to refer to the applicable exemption established in the final produce safety rule as a “qualified facility exemption” or to refer to the business entities that would be exempt from the final produce safety rule as “qualified facilities.”

8. Unexposed Packaged Food

As discussed in section XII, some comments ask us to clarify that modified requirements for packaged food that is not exposed to the environment only apply to such food that requires time/temperature control for safety (TCS food). To do so, we are defining the term “unexposed packaged food” to mean packaged food that is not exposed to the environment and using this term throughout the rule. Doing so simplifies the regulatory text and makes it clearer.

(Comment 170) Some comments note that certain fruits and vegetables must be stored and distributed in vented packaging to allow for proper air circulation and the escape of gases produced in the ripening process. These comments ask us to interpret “not exposed to the environment” in a way that would include produce packed in such vented crates. Some comments assert that “exposed to the environment” must be meaningful from a food-safety standpoint and that produce shipped in vented crates presents virtually no food-safety risk because its environmental exposure is minimal. Some comments state that they do not believe Congress intended the term “not exposed to the environment” to mean only airtight, sealed containers.

(Response 170) We acknowledge that certain fruits and vegetables may need to be distributed in vented crates but disagree that such produce is “packaged food not exposed to the environment.” We consider “packaged food not exposed to the environment” and “unexposed packaged food” to mean that the food is in a form that prevents any direct human contact with the food (78 FR 3646 at 3712). Although environmental exposure to produce packed in vented crates would be less than environmental exposure to produce packed in open crates, a vented crate can subject produce to contamination from condensate in aerosols carried by the air handling system, moisture dripping onto containers, particulates blown through the facility by the air handling system, fingers of handlers during handling of crates, objects that may be inadvertently inserted through the vents, pests that can access the produce through the vents, etc. We believe it is appropriate for facilities storing produce in vented crates to conduct a hazard analysis and evaluate whether there are hazards that would require a preventive control.

(Comment 171) Some comments ask us to interpret “not exposed to the environment” to mean packaged with food grade material that is impermeable to outside bacteria or other contamination. These comments state that materials that prevent human contact with the food can nonetheless permit passage of contaminants and express concern about migration of chemicals, not approved as food-contact substances, from outer wrappers.

(Response 171) We decline this request. A facility that packages “unexposed packaged food” is responsible for complying with all applicable requirements for the production of the food, including requirements established under section 409 of the FD&C Act (21 U.S.C. 348) regarding indirect food additives and food contact substances when packaging food. Likewise, a facility that packs “unexposed packaged food” in outer wrappers is responsible to ensure the safety of the food it packed, including ensuring that food is not contaminated from chemicals in the outer wrappers. The exemption applicable to “unexposed packaged food” applies to the storage of such foods, not the manufacturing, processing, or packing of such foods. For practical purposes, food that is not exposed to the environment will be protected from outside bacteria by the packaging. See also the discussions in Response 170 and Response 232 regarding produce packed in “vented crates,” which is not “unexposed packaged food.”

E. Additional Definitions To Clarify Terms Not Defined in the Proposed Rule

1. Audit

As already noted, some comments ask us to make the various rules we are establishing to implement FSMA consistent with each other, and we have worked to align the provisions of this rule with the provisions of the FSVP rule to the extent practicable. (See Comment 9 and Response 9.) To align these provisions, we are establishing in this final rule a definition of “audit” analogous to the definition of “audit” we proposed for the FSVP rule. For the purposes of this rule, “audit” means the systematic, independent, and documented examination (through observation, investigation, records review, discussions with employees of the audited entity, and, as appropriate, sampling and laboratory analysis) to assess a supplier's food safety processes and procedures.

2. Full-Time Equivalent Employee

As discussed in Response 140, we have established a definition for “full-time equivalent employee” as a term used to represent the number of employees of a business entity for the purpose of determining whether the business qualifies for the small business exemption. The number of full-time equivalent employees is determined by dividing the total number of hours of salary or wages paid directly to employees of the business entity and of all of its affiliates and subsidiaries by the number of hours of work in 1 year, 2,080 hours (i.e., 40 hours × 52 weeks). If the result is not a whole number, round down to the next lowest whole number.

3. Raw Agricultural Commodity

We have added a definition of the term “raw agricultural commodity” to have the meaning given in section 201(r) of the FD&C Act. We decided to define this term in the rule to simplify the provisions in part 117 that refer to raw agricultural commodities.

4. Supply-Chain-Applied Control

We have added a definition of the term “supply-chain-applied control” to mean a preventive control for a hazard in a raw material or other ingredient when the hazard in the raw material or other ingredient is controlled before its receipt. We decided to define this term in the rule to simplify the provisions in part 117, and in the discussions in this document, that refer to preventive controls applied by a supplier before receipt by a receiving facility.

5. Written Procedures for Receiving Raw Materials and Other Ingredients

We have added a definition of the term “written procedures for receiving raw materials and other ingredients” to mean written procedures to ensure that raw materials and other ingredients are received only from suppliers approved by the receiving facility (or, when necessary and appropriate, on a temporary basis from unapproved suppliers whose raw materials or other ingredients are subjected to adequate verification activities before acceptance for use). We decided to define this term in the rule to simplify the provisions in part 117, and in this document, that refer to these procedures.

6. Qualified Individual

As discussed in section X.A., we are clarifying in new § 117.4(b)(1) that each individual engaged in manufacturing, processing, packing, or holding food (including temporary and seasonal personnel) or in the supervision thereof must have the education, training, or experience (or a combination thereof) necessary to manufacture, process, pack, or hold clean and safe food as appropriate to the individual's assigned duties. To better align with the FSVP rule, we using the term “qualified individual” in new § 117.4(b)(1) and are defining the term “qualified individual” to mean a person who has the education, training, or experience (or a combination thereof) necessary to manufacture, process, pack, or hold clean and safe food as appropriate to the individual's assigned duties. A qualified individual may be, but is not required to be, an employee of the establishment.

X. Subpart A: Comments on Qualifications of Individuals Who Manufacture, Process, Pack, or Hold Food

In 2002, FDA convened a CGMP Modernization Working Group (CGMP Working Group) to determine whether part 110 is in need of further revision. In 2005, the CGMP Working Group issued a report (CGMP Working Group Report) summarizing the comments we received, as well as our key findings (78 FR 3646 at 3651). One of the specific areas identified in the CGMP Working Group Report that presented an opportunity to modernize the regulation was to “require appropriate training for supervisors and workers to ensure that they have the necessary knowledge and expertise in food hygiene, food protection, employee health and personal hygiene to produce safe food products.” (78 FR 3646 at 3729)

As previously discussed, FSMA recognizes the importance of both training and CGMPs in preventing hazards from occurring in foods in its definition of preventive controls, which identifies supervisor, manager, and employee hygiene training, and CGMPs under part 110, as some of the procedures, practices, and processes that may be included as preventive controls (see sections 418(o)(3)(B) and 418(o)(3)(F) of the FD&C Act, respectively) (78 FR 3646 at 3729).

We proposed to re-establish part 110's recommendations for training as proposed § 117.10(c) (FR 3646 at 3720). In addition, we requested comment on how best to revise part 110's current recommendations to implement section 418(o)(3) of the FD&C Act and the recommendations of the CGMP Working Group with respect to training (FR 3646 at 3729). Specifically, we requested comment on whether we should merely replace the current recommendations for personnel education and experience with requirements or whether more detail would be appropriate. As examples of additional specificity, we requested comment on whether the rule should specify that each person engaged in food manufacturing, processing, packing, or holding (including temporary and seasonal personnel and supervisors) must receive training as appropriate to the person's duties; specify the frequency of training (e.g., upon hiring and periodically thereafter); specify that training include the principles of food hygiene and food safety, including the importance of employee health and personal hygiene, as applied at the facility; and specify that records document required training of personnel and, if so, specify minimum requirements for the documentation (e.g., the date of the training, the type of training, and the person(s) trained). We also requested comment on whether to establish some or all of the potential requirements for education and training in subpart B, subpart C, or both.

In the following paragraphs, we discuss comments that respond to our requests for comment on potential requirements for education and training and for whether to establish any requirements in subpart B, subpart C, or both. After considering these comments, we are establishing requirements for the qualifications of individuals engaged in manufacturing, processing, packing, or holding food in new § 117.4 in subpart A, with associated recordkeeping requirements established in § 117.9 in subpart A. The regulatory text makes clear that these requirements, established in subpart A, apply to individuals engaged in manufacturing, processing, packing, or holding food regardless of whether the individuals conduct these activities under the framework of the CGMPs established in subpart B or the framework for hazard analysis and risk-based preventive controls established in subparts C, D, E, and G. The regulatory text also makes clear that the qualification requirements apply to the recordkeeping requirements of subpart F. See table 11 for a description of these provisions.

A. Applicability and Qualifications of All Individuals Engaged in Manufacturing, Processing, Packing, or Holding Food (Final § 117.4(a), (b), and (d))

(Comment 172) Some comments support changing the current recommendations for training to requirements, e.g., by replacing “should” with “must.” However, some of these comments also ask that the requirement allow sufficient flexibility for establishments to determine the scope and frequency of the training based on the establishment, types of products, and job responsibilities of the employee. Some of these comments assert that this position is consistent with the concept in the food safety plan of tailoring controls to the specific facility and operations, and also aligns with the Global Food Safety Initiative guidance document, which was based on the recommendations of the Codex Alimentarius Commission (Codex). Some of these comments ask that we specify “as applicable to the plant operation” and “applicable to their assigned duties” to allow establishments flexibility in establishing risk-based training requirements specific to their operations.

Other comments prefer more detail and ask that we establish requirements addressing all of the recommendations of the CGMP Working Group. Some of these comments note that doing so would be consistent with the proposed training requirements for the produce safety rule.

Other comments prefer that we continue to only provide recommendations for education and training and allow the food industry to determine the appropriate level of specific employee training that may be needed. These comments assert that overly prescriptive and binding requirements may not consider variables such as training course content, training provider, effectiveness of the course, and instructor and frequency of training per topic. In addition, comments assert that factors such as an employee's type and length of experience, nature of formal education, and the food product type and point in the food supply chain at which the employee works with the food product (close to the farm or close to the fork) will need to be considered. Other comments ask us to establish the recommendations of the CGMP Working Group in guidance rather than in the rule.

Some comments recommend that employees be trained “initially” and “periodically thereafter” but ask that we recognize the seasonal nature of a facility's workforce. Some comments ask that the training include the principles of food hygiene and food safety, including the importance of employee health and personal hygiene as applied at the facility.

Some comments ask that training requirements be established in subpart B so that the requirements apply to all establishments that manufacture, process, pack, or hold food, including establishments that are not subject to FSMA's requirements for hazard analysis and risk-based preventive controls. These comments assert that this broad training requirement would improve food safety overall. Some comments that recommend establishing the training requirement in subpart B assert that training is more appropriately considered a prerequisite program than a preventive control that would belong in subpart C.

Other comments ask that the training and related recordkeeping requirements for the facility's preventive controls qualified individuals be established under subpart C because this is directly related to the facility's food safety plan. Other comments ask that training requirements be established in both subpart B and subpart C. Other comments assert that including requirements for education and training in both subparts B and C would be confusing.

(Response 172) We are establishing a series of requirements for the qualifications of individuals engaged in manufacturing, processing, packing, or holding food in new § 117.4. First, to clarify how these qualification requirements apply to establishments subject to subparts B and F, we are requiring that the management of an establishment ensure that all individuals who manufacture, process, pack, or hold food subject to subparts B and F are qualified to perform their assigned duties (§ 117.4(a)(1)). To clarify how these qualification requirements apply to facilities, we are requiring that the owner, operator, or agent in charge of a facility ensure that all individuals who manufacture, process, pack, or hold food subject to subparts C, D, E, F, or G are qualified to perform their assigned duties (§ 117.4(a)(2)).

We are not requiring training specific to the person's assigned duties. Each establishment engaged in the manufacturing, processing, packing, and holding of food for human consumption would already have procedures in place to ensure that all individuals who manufacture, process, pack, or hold food know how to do their jobs. However, to emphasize that we expect all individuals who conduct such activities to know how to do their jobs, we are specifying that each individual engaged in manufacturing, processing, packing, or holding food (including temporary and seasonal personnel) or in the supervision thereof must have the education, training, or experience (or a combination thereof) necessary to manufacture, process, pack, or hold clean and safe food as appropriate to the individual's assigned duties (§ 117.4(b)(1)). To better align with the forthcoming FSVP rule, we are using the term “qualified individual” in new § 117.4(b)(1) and are defining the term “qualified individual” to mean a person who has the education, training, or experience (or a combination thereof) necessary to manufacture, process, pack, or hold clean and safe food as appropriate to the individual's assigned duties. A qualified individual may be, but is not required to be, an employee of the establishment. See the discussion of the term “preventive controls qualified individual” in section IX.C.25, including a discussion of how we have changed the proposed term “qualified individual” to “preventive controls qualified individual” because we are establishing a new definition for “qualified individual,” with a meaning distinct from “preventive controls qualified individual.”

We also are requiring that each individual engaged in manufacturing, processing, packing, or holding food (including temporary and seasonal personnel) or in the supervision thereof, receive training in the principles of food hygiene and food safety, including the importance of employee health and personal hygiene, as appropriate to the food, the facility and the person's assigned duties (see § 117.4(b)(2)). Records that document this required training must be established and maintained and are subject to the recordkeeping requirements of subpart F (§§ 117.4(d) and 117.9). The rule does not specify the frequency of the required training. We expect that production employees will receive training before working in production operations. Based on a 2010 survey of the domestic food manufacturing industry, we expect that most facilities will also provide some form of refresher training (Ref. 54).

We disagree that we should continue to only provide recommendations for education and training. Although the comments express concern about overly prescriptive requirements that may not consider variables that would affect an establishment's training program (such as training course content, training provider, effectiveness of the course and instructor and frequency of training per topic, an employee's type and length of experience, nature of formal education, and the food product type and point in the food supply chain at which the employee works with the food product), the training requirement we are establishing in the rule provides flexibility for each establishment to provide training, and determine the scope and frequency of the training, in a way that works best for the establishment.

We agree that it is appropriate to establish training requirements so that the requirements apply to all establishments that manufacture, process, pack, or hold food, including establishments that are not subject to FSMA's requirements for hazard analysis and risk-based preventive controls, and we are establishing the qualification and training requirements in subpart A to clarify the applicability of these requirements to all establishments and facilities subject to part 117. Although we agree that employees in facilities that are subject to the requirements for hazard analysis and risk-based preventive controls need to understand their responsibilities under the facility's food safety plan, we are setting forth a training requirement focused on the principles of food hygiene and food safety, including the importance of employee health and personal hygiene, as recommended in the report of the CGMP Working Group (Ref. 3). We consider training in the principles of food hygiene and food safety, including the importance of employee health and personal hygiene, to be fundamental to the concept of CGMPs. We agree that establishing a training requirement in both subpart B and subpart C could be confusing.

(Comment 173) Some comments ask that training not be limited to a narrow class of processors. Other comments assert that anyone who works in the food industry should have mandatory training and re-training.

(Response 173) The training applies to all individuals engaged in manufacturing, processing, packing, or holding food, consistent with the requests of these comments.

(Comment 174) Some comments agree that training should be documented and assert that those records should show the date of training, a description of the training, and the name of the person trained. However, comments ask that we allow flexibility in the way these records are kept. Other comments assert that requiring that records document required training of personnel is burdensome, arbitrary, and capricious.

(Response 174) The rule requires that records that document training required by § 117.4(b)(2) be established and maintained without prescribing any content of those records. Although one approach to documenting training would be to provide the date of training, a description of the training, and the name of the person trained, the rule provides flexibility for each establishment to document its training in a way that works best for that establishment. We disagree that requiring records to document required training is burdensome, arbitrary, and capricious in light of the strong support in the comments regarding CGMP modernization for records documenting training and the flexibility provided by the rule for the content of training records.

(Comment 175) Some comments that support mandatory training nonetheless caution us to be flexible towards the development and deployment of mandatory training, including issuance of certificates, so as not to create road blocks for third-party service providers. These comments state that education and training and/or capacity building is a growing, rapidly evolving, and well-developed third-party service industry today, and that food companies often deliver their training to other raw material suppliers and contract manufacturers. Some comments assert that the training and education programs should be developed and implemented in close cooperation with State agencies, public institutions, and stakeholder organizations.

(Response 175) The requirements do not address issuance of certificates or any other provisions that could create road blocks for third-party providers. An establishment has flexibility to develop or otherwise provide training in cooperation with public and private organizations in a manner that suits its needs.

(Comment 176) Some comments agree that any requirements should include training appropriate to the person's duties but emphasize that the decision as to what is appropriate to the person's assigned duties should be determined by the establishment.

(Response 176) The requirement for employees to receive training in the principles of food hygiene and food safety, including the importance of employee health and personal hygiene, as appropriate to the person's assigned duties, provides flexibility for the establishment to provide training that is appropriate for its employees in light of each person's assigned duties. However, the rule does not require training specific to the person's assigned duties.

(Comment 177) Some comments assert that the training requirement would be an unreasonable burden for small businesses and that companies may incur substantial cost for the time that workers would be in training rather than in production. Some comments ask us to provide non-specific training recommendations for smaller food processors that need flexibility to control the cost of training. Some comments assert that the training and education requirements must be accessible and flexible enough to allow employers to bring in temporary help when demand is high without causing a delay in hiring.

Some comments assert that we must provide ongoing education, training, and outreach for previously regulated firms, newly regulated firms, regulators that will be responsible for implementing the rules, and educators who will help farmers and facilities understand and manage the new requirements. Some comments assert that training is needed to educate farmers, the food industry, and State and local authorities as well.

(Response 177) All employees will need enough training to do their jobs and understand the importance of hygiene for food safety. The training offered does not need to be expensive (e.g., off-site training or off-the-shelf purchased training) and we expect that much of the training will be provided in-house by knowledgeable employees. As discussed in Response 2, the FSPCA is developing a preventive controls training curriculum. These training materials will be available online, and we expect these training materials to be useful to small businesses to use for in-house training.

(Comment 178) Some comments ask us to continue to work with foreign governments on access to training and education to ensure that the industry as a whole is moving towards better advancements in food safety practices, no matter the size, channels of distribution, or geographic location.

(Response 178) As discussed in Response 717, we intend to work with the food industry, education organizations, USDA, the U.S. Agency for International Development, and foreign governments to develop tools and training programs to facilitate implementation of this rule.

(Comment 179) Some comments assert that the preventive controls qualified individual should perform the trainings. Some comments assert that the preventive controls qualified individual should be responsible for determining the appropriate frequency and scope of training for each facility and employee, and the records necessary to document that appropriate training has been conducted.

(Response 179) We decline these requests. Although we agree that the person delivering such training should be knowledgeable, we are providing flexibility for facilities to provide training as appropriate to the facility, including through on-line CGMP or other food safety courses.

(Comment 180) Some comments ask that this rule provide FDA (and those States under contract) the ability to require certification of industry managers and training of employees if serious operational hazards are found and management and staff are unable to answer basic questions concerning hazards and controls in the facility.

(Response 180) We decline this request. We address each compliance situation on a case-by-case basis.

B. Additional Requirements Applicable to Supervisory Personnel (Final § 117.4(c))

We received no comments that disagreed with our proposal to retain the requirement in part 110 that responsibility for ensuring compliance by all personnel with all requirements of this subpart must be clearly assigned to competent supervisory personnel. We are correcting “all requirements of this subpart” to “all requirements of this part.” As a conforming change for consistency with the provisions of § 117.4(b), we are replacing the phrase “competent supervisory personnel” with the phrase “supervisory personnel who have the education, training, or experience (or a combination thereof) necessary to supervise the production of clean and safe food.”

XI. Subpart A: Comments on Proposed § 117.5—Exemptions

We proposed to establish a series of exemptions from the requirements for hazard analysis and risk-based preventive controls that would be established in subpart C, with modified requirements in some cases. We also proposed to redesignate § 110.19(a) (a pre-existing exemption from CGMP requirements applicable to establishments engaged solely in the harvesting, storage, or distribution of one or more RACs) as § 117.5(k) and to revise this exemption to adjust and clarify what activities fall within this exemption based on experience and changes in related areas of the law since issuance of the CGMP regulation.

Some comments support one or more of the proposed exemptions without change. For example, some comments note that the exemptions are specified in FSMA and, thus, reflect the intent of Congress. Some comments state that some exemptions (i.e., those for products already subject to our HACCP regulations for seafood and juice, or to regulations for the control of microbiological hazards for LACF) make sense because they are risk-based. Other comments that support one or more of the proposed exemptions ask us to clarify particulars associated with these exemptions (see, e.g., Comment 209, Comment 210, Comment 211, and Comment 212) or expand the scope of some of these exemptions (see, e.g., Comment 185, Comment 196, Comment 197, Comment 208, and Comment 221). Other comments ask us to include additional exemptions in the rule (see section XI.K).

In the remainder of this section, we discuss comments that ask us to clarify the proposed exemptions or that disagree with, or suggest one or more changes to, the proposed exemptions. We also discuss comments that ask us to include additional exemptions in the rule. After considering these comments, we have revised the proposed exemptions as shown in table 12 with editorial and conforming changes as shown in table 52. A key conforming change that affects all proposed exemptions from the requirements of subpart C is that the final exemptions are from the requirements of subpart G, as well as subpart C. As discussed in section XLII, the final rule establishes the requirements for a supply-chain program in subpart G, rather than within subpart C as proposed.

A. General Comments on the Proposed Exemptions

(Comment 181) Some comments ask us to provide the same flexibility for foreign small businesses as for domestic small businesses.

(Response 181) The exemptions apply to both foreign small businesses and domestic small businesses.

(Comment 182) Some comments note that proposed § 117.10(c) recommends, but would not require, that the responsible individual at a food establishment have a background of education, experience or a combination of both to provide a level of competence necessary to produce clean and safe food. These comments ask us to make this a requirement, rather than a recommendation, for the responsible individual at any facility that is exempt from the requirements for hazard analysis and risk-based preventive controls. These comments also ask us to require presentation of the training information to us before an exemption is granted.

(Response 182) We decline these requests. The statute does not require that we pre-qualify a facility for an exemption.

(Comment 183) Some comments ask us to clarify whether an establishment that is exempt from the requirements for hazard analysis and risk-based preventive controls in subpart C remains subject to the CGMP requirements in subpart B.

(Response 183) An establishment that is exempt from the requirements for hazard analysis and risk-based preventive controls in subparts C and G remains subject to the CGMP requirements in subpart B, unless that establishment is exempt from subpart B under § 117.5(k) (which applies to: (1) Farms; (2) certain fishing vessels; (3) establishments solely engaged in the holding and/or transportation of one or more RACs; (4) activities of “farm mixed-type facilities” that fall within the definition of “farm”; and (5) establishments solely engaged in hulling, shelling, drying, packing, and/or holding nuts (without additional manufacturing/processing)).

B. Proposed § 117.5(a)—Exemption Applicable to a Qualified Facility

We proposed that subpart C would not apply to a qualified facility, except as provided by subpart E (Withdrawal of an Exemption Applicable to a Qualified Facility), and that qualified facilities would be subject to the modified requirements in § 117.201.

(Comment 184) Some comments support the proposed exemption for a qualified facility and assert that all farms should be eligible for this exemption until it is shown that food obtained from these farms makes people sick. Other comments oppose this proposed exemption, asserting that it is not risk based and expressing concern that qualified facilities would cause significant food safety problems. Some comments ask us to strictly construct and narrowly apply the exemptions to as few businesses as possible.

Some comments do not agree that qualified facilities should be subject to modified requirements because even the modified requirements are burdensome. Some comments assert that qualified facilities having an average annual value of food sold during the previous three-year period of $25,000 or less should be exempt from all requirements related to hazard analysis and risk-based preventive controls, including modified requirements.

(Response 184) The exemption for qualified facilities, including the criteria for being a qualified facility and the applicability of modified requirements, is expressly directed by section 418(l) of the FD&C Act. In defining “very small business” to mean a business (including any subsidiaries and affiliates) averaging less than $1,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee), we constructed this exemption to apply to businesses that, collectively, produce less than 0.6 percent of the food supply (Ref. 38). In addition, as discussed in Response 151, most of these facilities will be subject to the CGMP requirements in subpart B.

(Comment 185) Some comments assert that a qualified facility should be exempt from the CGMP requirements of subpart B, as well as the requirements for hazard analysis and risk-based preventive controls in subpart C.

(Response 185) The exemption for qualified facilities is expressly directed by section 418(l) of the FD&C Act and is limited to an exemption from the requirements for hazard analysis and risk-based preventive controls in subparts C and G. The comments provide no basis for why new statutory requirements for hazard analysis and risk-based preventive controls should in any way impact the long-standing CGMPs requirements that apply to the manufacturing, packing, and holding of human food. CGMPs provide the basic requirements for ensuring production of safe and sanitary food. Following the CGMPs is essential to properly address public health risks from very small facilities that are provided an exemption from subparts C and G in order to minimize the burden on such facilities. (See also Response 221.)

(Comment 186) Some comments ask us to clarify how the exemption applies to diversified farms that produce both exempt and non-exempt products.

(Response 186) We assume that this comment is referring to a farm mixed-type facility that produces some products (such as juice or dietary supplements) that are exempt from the requirements for hazard analysis and risk-based preventive controls, as well as some products that are not exempt from these requirements. The exemption only applies to products that are not otherwise exempt from the requirements for hazard analysis and risk-based preventive controls. However, see the discussion in Response 157 with our response to comments requesting that we base the dollar threshold for the definition of very small business only on the annual monetary value of food covered by the preventive controls rule, rather than all human food; we declined that request.

(Comment 187) Some comments ask us to provide that a qualified facility may voluntarily choose to comply with the requirements for hazard analysis and risk-based preventive controls.

(Response 187) A qualified facility may voluntarily choose to comply with the requirements for hazard analysis and risk-based preventive controls without a specific provision authorizing it to do so.

(Comment 188) Some comments ask us to specify in guidance that a qualified facility is not required to prepare and implement a food safety plan.

(Response 188) We intend to recommend in guidance how a qualified facility could comply with the modified requirements in § 117.201 without satisfying all of the requirements in subparts C and G.

C. Proposed § 117.5(b) and (c)—Exemptions Applicable to Food Subject to HACCP Requirements for Fish and Fishery Products (21 CFR Part 123) or for Juice (21 CFR Part 120)

We proposed that subpart C would not apply with respect to activities that are subject to part 123 (21 CFR part 123) at a facility if the owner, operator, or agent in charge of the facility is required to comply with, and is in compliance with, part 123 with respect to such activities. We also proposed that subpart C would not apply with respect to activities that are subject to part 120 (21 CFR part 120) at a facility if the owner, operator, or agent in charge of the facility is required to comply with, and is in compliance with, part 120 with respect to such activities. We requested comment on the criteria that should be used to determine whether a facility is in compliance with part 123 or part 120 (78 FR 3646 at 3704).

(Comment 189) Some comments ask us to clarify whether a seafood allergen that is identified as a hazard should be included in a seafood HACCP plan or in a facility's food safety plan. These comments also ask whether a food allergen that is identified as a hazard in juice subject to part 120 should be included in a juice HACCP plan or in a facility's food safety plan

(Response 189) There is no specific requirement in the seafood HACCP regulation in part 123 that food allergen hazards be addressed in the seafood HACCP plan. However, Chapter 19 in our guidance entitled “Fish and Fishery Products Hazards and Controls Guidance (Fourth Edition)” includes recommendations for the control of undeclared food allergens (Ref. 42). The juice HACCP regulation in part 120 requires that a juice processor consider the presence of undeclared ingredients that may be food allergens as part of its hazard analysis, and several sections in our guidance entitled “Juice HACCP Hazards and Controls Guidance (First Edition)” include recommendations for the control of food allergens (Ref. 43). Both seafood processors and juice processors would also address allergen hazards through application of CGMPs.

Facilities that are exempt from the requirements of subparts C and G with respect to activities that are subject to part 120 or part 123 are not required to prepare and implement a food safety plan in addition to their HACCP plans.

(Comment 190) Some comments note that our HACCP regulations for juice and seafood do not require facilities subject to those regulations to address radiological hazards and ask how radiological hazards should be addressed for activities that are subject to part 120 or part 123.

(Response 190) A facility that conducts activities that are subject to part 120 or part 123 is not required to address radiological hazards in its HACCP plan if the facility is required to comply with, and is in compliance with, part 120 or part 123 with respect to such activities. However, under some circumstances radiological hazards might need to be considered. Moreover, the facility would be subject to the CGMP requirement that storage and transportation of food must be under conditions that will, among other things, protect against chemical (including radiological) contamination of food (§ 117.93).

(Comment 191) Some comments state that what is needed to assess compliance with the applicable HACCP regulation is evidence of compliance with each specific requirement of the regulation, such as compliance with requirements for a written hazard analysis and Sanitation Standard Operating Procedures (SSOPs). Other comments ask us to provide guidance to industry and the regulatory community regarding the criteria that will be used to determine when a facility is “in compliance with” part 120 or part 123. Some comments note that any determination of compliance with one of our HACCP regulations would be product specific, and that we would only be able to assess compliance on the inspected product, not all of the products being produced at the facility. Some comments ask us to establish a transparent process to follow when determining when to nullify an exemption applicable to food subject to HACCP in part 120 or part 123. These comments made specific suggestions for such a process, including through a HACCP inspection of a domestic facility or a review of a facility's HACCP plan and corresponding HACCP records for a foreign facility. These comments assert that FDA actions such as issuing inspectional observations, issuing a Warning Letter, or making an imported product subject to detention without physical examination, should not be the basis for determining non-compliance because in such situations a facility would have an opportunity to respond to FDA with its approach to correcting problems.

Some comments assert that the key question for us to answer is when a situation will be so severe that it warrants requiring compliance with the human preventive controls rule rather than the applicable HACCP regulation. These comments raise questions about the practicality of requiring compliance with the human preventive controls rule for some products manufactured at a facility while continuing to require compliance with the applicable HACCP regulation for other products manufactured at that facility. These comments ask us to specify the added food safety protections that the human preventive controls rule can provide that cannot be obtained by compliance with the applicable HACCP regulation. These comments also ask us to consider the likelihood that a facility that cannot comply with the applicable HACCP regulation would be able to comply with the human preventive controls rule. Other comments ask whether we will modify existing guidance on compliance with applicable HACCP regulations to help facilities and inspectors understand what is needed for a facility to maintain its exemption.

Some comments assert that the statutory intent for compliance would be satisfied by enforcement actions (such as administrative detention, registration suspension, or mandatory recall) that will either ensure compliance with the applicable HACCP regulation, or prohibit that facility from distributing food.

(Response 191) We acknowledge the issues raised by these comments and agree that in many situations the appropriate action for us to take when a facility is out of compliance with an applicable HACCP regulation will be to employ existing enforcement tools to bring the facility into compliance with the applicable regulation. However, we also believe that there may be circumstances where an added food safety benefit could be achieved by requiring compliance with the human preventive controls rule when a facility does not comply with an applicable HACCP regulation. For example, the seafood HACCP regulation recommends—but does not require—that a seafood processor have and implement a written SSOP. In contrast, the human preventive controls rule requires that all preventive controls be written, and that preventive controls include, as appropriate to the facility and the food, sanitation controls, which include procedures, practices, and processes to ensure that the facility is maintained in a sanitary condition adequate to significantly minimize or prevent hazards such as environmental pathogens, biological hazards due to employee handling, and food allergen hazards (§ 117.135(c)(3)). A seafood processing facility that has ongoing sanitation problems and contamination with, for example, an environmental pathogen, but does not have a written SSOP, may be better able to address its sanitation problems by a combination of written sanitation controls and verification of those sanitation controls through environmental monitoring (§ 117.165(a)(3)). Likewise, a juice processor that has ongoing problems with microbial contamination of fruit it receives for processing may be better able to address its supply of fruit by complying with the specific requirements of the human preventive controls rule for a supply-chain program (subpart G).

We expect that situations in which enforcement actions to ensure compliance with an applicable HACCP regulation are insufficient to correct problems, and lead to a facility losing its exemption from the requirements of subparts C and G, will be rare and will depend on very specific circumstances. Therefore, at this time we do not anticipate issuing guidance on when violations of one of our HACCP regulations would cause us to require compliance with subparts C and G.

(Comment 192) Some comments ask us to revise our HACCP regulations for seafood and juice to be consistent with subpart C to avoid the burden of having two systems within facilities that produce seafood or juice products, as well as other foods.

(Response 192) We decline this request. Our HACCP regulations are already consistent with—though not identical to—subpart C. Further, it is not clear that such facilities would need two separate systems, given the similarities in requirements and flexibility we have provided for implementing preventive controls. The food safety plan for the products not subject to the HACCP regulations is likely to be very similar to that for the foods subject to the HACCP regulations (which includes monitoring of SSOPs). To the extent that subparts C and G contain additional requirements, a facility is free to perform similar actions for its products produced under a HACCP regulation.

(Comment 193) Some comments ask us to exempt the production of fresh cider from the rule.

(Response 193) Fresh cider is juice. A facility that produces fresh cider is eligible for the exemption for products subject to our HACCP regulation for juice.

D. Proposed § 117.5(d)—Exemption Applicable to Food Subject to Part 113—Thermally Processed Low-Acid Foods Packaged in Hermetically Sealed Containers

We proposed that subpart C would not apply with respect to activities that are subject to part 113 at a facility if the owner, operator, or agent in charge of the facility is required to comply with, and is in compliance with, part 113 with respect to such activities. We also proposed that this exemption would apply only with respect to the microbiological hazards that are regulated under part 113. We requested comment on the criteria that should be used to determine whether a facility is in compliance with part 113 (78 FR 3646 at 3704).

(Comment 194) Some comments express concern that the partial exemption for products subject to part 113 could generate confusion for both regulators and regulated facilities. These comments also assert that the partial exemption for products subject to part 113 would generate duplicative recordkeeping requirements under the two rules.

(Response 194) We acknowledge the potential for confusion and expect any confusion to decrease over time as both regulators and facilities gain experience with the new requirements. We also expect that in most instances a facility that is subject to part 113, and that evaluates potential microbiological hazards as part of its hazard analysis, would conclude that the potential hazards are controlled by the targeted requirements of part 113 and conclude there are no microbiological hazards that require preventive controls to significantly minimize or prevent the hazards.

We disagree that the partial exemption for products subject to part 113 would generate duplicative recordkeeping requirements. The requirements of part 113 to control biological hazards are different from the requirements of subparts C and G to conduct a hazard evaluation for chemical and physical hazards, and implement preventive controls and associated preventive control management components to address significant chemical and physical hazards. Likewise, the records associated with the control of biological hazards under part 113 are not the same as the records associated with a hazard analysis, preventive controls, and associated preventive control management components for control of chemical and physical hazards. However, to the extent that a facility appropriately determines that existing records required by part 113 can be used to demonstrate compliance with the requirements of subparts C and G, a facility may rely on those records (see § 117.330).

(Comment 195) Some comments ask us to provide guidance to industry and the regulatory community regarding the criteria that will be used to determine when a facility is “in compliance with” part 113.

(Response 195) We discuss similar comments regarding the exemptions for products subject to one of our HACCP regulations in Response 191. As an example, an LACF manufacturing facility that has ongoing problems controlling biological hazards may be better able to address biological hazards by preparing and implementing a written food safety plan. As with facilities subject to our HACCP regulations, we expect that situations in which enforcement actions to ensure compliance with part 113 are insufficient to correct problems, and lead to a facility losing its exemption from the requirements of subparts C and G, will be rare and will depend on very specific circumstances. Therefore, at this time we do not anticipate issuing guidance on when violations of part 113 could lead to this outcome.

E. Proposed § 117.5(e)—Exemption Applicable to a Facility That Manufactures, Processes, Packages, or Holds a Dietary Supplement

We proposed that subpart C would not apply to any facility with regard to the manufacturing, processing, packing, or holding of a dietary supplement that is in compliance with the requirements of part 111 (Current Good Manufacturing Practice in Manufacturing, Packing, Labeling, or Holding Operations for Dietary Supplements) and section 761 (Serious Adverse Event Reporting for Dietary Supplements) of the FD&C Act. We requested comment on the criteria that should be used to determine whether a facility is in compliance with part 111 and section 761 of the FD&C Act (78 FR 3646 at 3705). As noted in table 52, we corrected the exemption to match the title of part 111—i.e., “Current Good Manufacturing Practice in Manufacturing, Packaging, Labeling, or Holding Operations for Dietary Supplements.”

(Comment 196) Some comments assert that the entire facility should be exempt from the requirements of subpart C if the facility implements the dietary supplement CGMP regulation even if the facility also makes food products that are not dietary supplements. Some comments assert that the exemption applicable to the manufacturing, processing, packing, or holding of a dietary supplement should also apply to the manufacturing, processing, packing, or holding of a dietary ingredient if the facility chooses to follow the dietary supplement CGMP regulation.

(Response 196) The proposed exemption is directed by section 103(g) of FSMA. None of these comments explain how the desired expansion of the exemption is consistent with section 103(g), which limits the provision to “the manufacturing, processing, packing, or holding of a dietary supplement” (78 FR 3646 at 3705).

(Comment 197) Some comments ask us to revise the exemption applicable to dietary supplements to add that subparts B and F do not apply to any facility with regard to the manufacturing, processing, packing, or holding of a dietary supplement that is in compliance with the requirements of part 111. These comments assert that it would be illogical to subject the dietary supplement industry to industry-specific CGMPs (part 111), as well as a more general (and inherently less applicable) CGMP standard in part 117. These comments also assert that the intent of the CGMPs in part 117 is to regulate industries and industry segments that have not previously been regulated and that failing to acknowledge the regulations already applicable to dietary supplements would be duplicative, redundant, and provide no additional safety or public health protection.

(Response 197) As discussed in the final rule establishing the dietary supplement CGMP regulation, we included in part 111 the existing requirements in part 110 that we believe are common to dietary supplement manufacturing (72 FR 34752 at 34764, June 25, 2007). We recognized that there may be operations related to the manufacturing of dietary supplements for which certain provisions in part 110 (now largely subpart B of part 117) apply, but that we did not determine to be common to most dietary supplement manufacturing operations (e.g., for dietary supplements that are dehydrated and rely on the control of moisture consistent with current § 110.80(b)(14) (proposed § 117.80(c)(14)). As was the case when we issued the final rule to establish dietary supplement CGMPs and continues to be the case now, a manufacturer would be required to comply with the CGMP regulations in subpart B of part 117 in addition to the regulations in part 111, unless the regulations conflict. To the extent that the regulations conflict, the dietary supplement manufacturer would comply with the regulation in part 111.

(Comment 198) Some comments ask us to clarify how the exemption applies to foods, other than dietary supplements, that may be held in a facility that conducts activities in compliance with the dietary supplement CGMP regulation.

(Response 198) The exemption does not apply to foods, other than dietary supplements, that may be held in a facility that conducts activities in compliance with the dietary supplement CGMP regulation. The owner, operator, or agent in charge of a facility that produces both dietary supplements and foods that are not dietary supplements must comply with the requirements of this rule for hazard analysis and risk-based preventive controls, unless another exemption applies as specified in § 117.5.

(Comment 199) Some comments ask us to use information collected in the biennial food facility registration to help determine whether a facility is in compliance with part 111.

(Response 199) We decline this request. It would be the observations and findings from an inspection, rather than information in a facility's registration, that could help us determine whether a facility is in compliance with part 111. Information collected during registration provides information on how we should inspect a facility, but has no bearing on whether the facility is complying with applicable regulations.

F. Proposed § 117.5(f)—Exemption Applicable to Activities Subject to Standards for Produce Safety in Section 419 of the FD&C Act

We proposed that subpart C would not apply to activities of a facility that are subject to section 419 (Standards for Produce Safety) of the FD&C Act (21 U.S.C. 350h). We received no comments that disagreed with this proposal and are finalizing it as proposed.

G. Proposed §§ 117.5(g) and (h)—Exemptions Applicable to On-Farm Low-Risk Activity/Food Combinations Conducted by a Small or Very Small Business

As discussed in section VI.A, consistent with the statutory direction in section 103(c) of FSMA, including conducting a qualitative risk assessment, we proposed three exemptions for on-farm activity/food combinations conducted by farm-mixed-type facilities that are small or very small businesses (proposed §§ 117.5(g), (h)(1), and (h)(2)).

1. General Comments on the Proposed Exemptions Applicable to On-Farm Low-Risk Activity/Food Combinations Conducted by a Small or Very Small Business

(Comment 200) Some comments assert that conducting a low-risk activity/food combination should be sufficient to qualify any facility for exemption from subpart C, regardless of whether the activity is conducted on-farm or off-farm, or meets the economic threshold for a small or very small business.

(Response 200) The statute provides specific direction for those facilities that can qualify for this exemption. (See sections 418(l) and 418(o)(2) of the FD&C Act.) See also Response 184 and Response 222.

(Comment 201) Some comments ask why the activity/food combinations listed in proposed § 117.5(g) are not consistent with the activity/food combinations listed in proposed § 117.5(h). Some comments state that the exemptions for farming activities are confusing.

(Response 201) The items listed in § 117.5(g) only specify the food or food category (rather than an activity/food combination) because the activities addressed in § 117.5(g) are, in all cases, the same—i.e., packing and holding activities. In contrast, the items listed in § 117.5(h) specify a particular activity (e.g., coating, mixing) in addition to a food or food category (e.g., peanuts and tree nuts) because there are multiple manufacturing/processing activities, each associated with a particular food or food category, listed in the provisions.

Although these exemptions are more complex than other exemptions (e.g., because they are directed to specific activities conducted on specific foods or food categories), the final “farm” definition has simplified them to the extent practicable. For example, under the “farm” definition in the 2013 proposed preventive controls rule, whether an activity was packing or manufacturing/processing depended, in part, on whether the RACs being packed were the farm's own RACs or others' RACs. In contrast, under the “farm” definition established in this rule, packing RACs is a “packing” activity, regardless of ownership of the RACs being packed.

(Comment 202) Some comments note a distinction between the exemptions for on-farm low-risk activity/food combinations conducted by small and very small businesses and the exemption for qualified facilities. Specifically, a farm mixed-type facility that only conducts low-risk activity/food combinations (such as making certain jams or syrups) would be exempt from the requirements of subpart C, whereas an off-farm qualified facility making those same jams and syrups, while exempt from the requirements of subpart C, would nonetheless be subject to modified requirements in § 117.201. These comments ask whether it would be better for a farm or farm mixed-type facility that satisfies criteria for a small or very small business, and also satisfies criteria for a qualified facility, to classify itself as a small or very small business or to classify itself as a qualified facility.

(Response 202) In light of the final “farm” definition, these comments no longer apply with respect to activities within the farm definition.

For activities conducted by a farm mixed-type facility, we acknowledge that the exemptions provided by § 117.5(g) and (h) for on-farm low-risk activity/food combinations are different from the exemption provided by § 117.5(a) for a qualified facility. A farm mixed-type facility that only conducts low-risk activity/food combinations listed in § 117.5(g) and (h) is fully exempt from the requirements of subparts C and G, and is not subject to the modified requirements in § 117.201, even if that farm mixed-type facility is also a very small business (and, thus, also is a qualified facility). To make this clear, we have revised proposed § 117.5(g) to specify that § 117.201 does not apply to on-farm packing or holding of food by a very small business if the only packing and holding activities subject to section 418 of the FD&C Act that the business conducts are the listed low-risk packing or holding activity/food combinations. Likewise, we have revised proposed § 117.5(h) to specify that § 117.201 does not apply to on-farm manufacturing/processing activities conducted by a very small business for distribution into commerce, if the only manufacturing/processing activities subject to section 418 of the FD&C Act that the business conducts are the listed low-risk manufacturing/processing activity/food combinations.

With these changes, a farm mixed-type facility that is a very small business and that only conducts the low-risk activity/food combinations listed in § 117.5(g) and/or (h) may find it advantageous to classify itself as a very small business eligible for the exemption in § 117.5(g) and/or (h) rather than as a qualified facility, which would be subject to the modified requirements in § 117.201.

(Comment 203) Some comments ask us to list activity/food combinations that are not low-risk activity/food combinations, or that should have modified requirement rather than be exempt (e.g., if the foods have been the subject of Class I recalls or outbreaks of foodborne illness).

(Response 203) We decline this request. With few exceptions, the exemptions are established by specifying the activities that are not subject to the requirements for hazard analysis and risk-based preventive controls, rather than the activities that are subject to these requirements. When an exemption does specify activities that are subject to certain requirements of the rule, the specified activities are a narrow exception (see § 117.5(k)). In the case of the exemptions for the low-risk activity/food combinations listed in § 117.5(g) and (h), the activity/food combinations that are subject to the requirements of subparts C and G are extensive and it is not feasible to identify and list all of them.

In developing the low-risk activity/food combinations that are exempt from the requirements, we conducted a qualitative risk assessment (Ref. 4) that considered whether manufacturing, processing, packing, or holding activities conducted on a farm mixed-type facility had been implicated in food that has been the subject of a Class I recall or outbreak of foodborne illness. However, whether specific types of food had been the subject of a Class I recall or outbreak of foodborne illness was only one factor we considered. For example, we also considered factors that impact the frequency and levels of contamination of the food (Ref. 4). For additional discussion, see the section 103(c)(1)(C) RA (Ref. 4).

(Comment 204) Some comments ask for a process to keep the list of low-risk activity/food combinations up to date, such as through guidance.

(Response 204) We decline this request. The exemptions established in this rule are binding, whereas any list of additional activity/food combinations established in a guidance document would not be binding. We established the list of activity/food combinations included in these exemptions through an extensive public process, including a request for comments on the section 103(c)(1)(C) draft RA. From this time forward, the process available to a person who wishes us to consider an additional activity/food combination is to submit a citizen petition in accordance with 21 CFR 10.30.

2. Proposed § 117.5(g)—Exemption Applicable to On-Farm Low-Risk Packing or Holding Activity/Food Combinations Conducted by a Small or Very Small Business

We proposed that subpart C would not apply to on-farm packing or holding of food by a small or very small business if the only packing and holding activities subject to section 418 of the FD&C Act that the business conducts are low-risk packing or holding activity/food combinations on food not grown, raised, or consumed on that farm mixed-type facility or another farm or farm mixed-type facility under the same ownership. As a consequential change in light of the final “farm” definition, the final exemption no longer identifies any packing or holding activities for any RACs (whether the farm's own RACs or others' RACs), because an on-farm establishment would no longer be subject to the requirements for hazard analysis and risk-based preventive controls when it packs or holds RACs, regardless of whether it is packing and holding its own RACs or others' RACs.

(Comment 205) Some comments ask us to expand the list of on-farm low-risk packing and holding activities to include packing and holding of food products not expressly covered by the proposed exemption. See the food products listed in table 13 and table 14.

(Response 205) We considered these comments within the context of the section 103(c)(1)(C) RA. Table 1 in the section 103(c)(1)(C) draft RA listed activity/food combinations that we identified as likely to be conducted by farm mixed-type facilities using broad food categories such as “grain” and “grain products.” In light of comments such as those described in Comment 205, table 1 in the final section 103(c)(1)(C) RA lists more types of food categories. The purpose of listing more types of food categories was to make it clearer when a particular food is encompassed within a particular activity/food combination. As one example, table 1 in the final section 103(c)(1)(C) RA lists food categories such as baked goods, milled grain products, and other grain products (e.g. dried pasta), in place of the original category “grain products.” As another example, table 1 in the section 103(c)(1)(C) RA lists the broad term “sap” and provides examples of different types of sap to make clear that activity/food combinations regarding sap are broader than “maple sap.”

We have revised the final exemption to list food categories consistent with the food categories included in table 1 in the section 103(c)(1)(C) RA and include those packing and holding activity/food combinations that the section 103(c)(1)(C) RA determines to be low-risk. For additional details about the outcome of the section 103(c)(1)(C) RA on the specific activity/food combinations described in the comments, see the section 103(c)(1)(C) RA (Ref. 4).

We also revised the proposed exemption to add two sets of information that we believe will be useful to a farm mixed-type facility when evaluating whether the farm's packing activities satisfy the criteria for the exemption.

First, we have added a new provision (§ 117.5(g)((1)) explaining that the exemption in § 117.5(g) applies to packing or holding of processed foods on a farm mixed-type facility, except for processed foods produced by drying/dehydrating RACs to create a distinct commodity (such as drying/dehydrating grapes to produce raisins, and drying/dehydrating fresh herbs to produce dried herbs), and packaging and labeling such commodities, without additional manufacturing/processing (such as chopping and slicing), the packing and holding of which are within the “farm” definition in § 1.227. Activities that are within the “farm” definition, when conducted on a farm mixed-type facility, are not subject to the requirements of subparts C and G of this part and therefore do not need to be specified in the exemption.

Second, we have added a provision (§ 117.5(g)((2)) describing the food categories listed in the exemption. For example, this provision explains that “milled grain products” include processed food products such as flour, bran, and cornmeal.

The first column in table 13 lists the food or food category that comments ask us to include in the exemption for on-farm, low-risk packing and holding activities. The second column lists the regulatory citation for the relevant exemption for on-farm packing and holding. Importantly, the full regulatory text of the exemption includes some limitations that were not specified in the comments, and table 13 should not be viewed as equating the requests of the comments with the final regulatory text of the exemption. For example, § 117.5(g)(2)(ix) specifies that the food category “baked goods” includes processed food products such as breads, brownies, cakes, cookies, and crackers, but does not include products that require time/temperature control for safety (such as cream-filled pastries). See § 117.5(g)(2) for a description of those food categories listed in the exemption for on-farm, low-risk packing and holding activity/food combinations in table 13.

In table 14, we list those foods or food categories, requested by comments, that are not included in the exemption for on-farm, low-risk packing and holding activities, and explain why.

3. Proposed § 117.5(h)—Exemption Applicable to On-Farm Low-Risk Manufacturing/Processing Activity/Food Combinations Conducted by a Small or Very Small Business

We proposed that subpart C would not apply to on-farm low-risk manufacturing/processing activities conducted by a small or very small business if the only manufacturing/processing activities subject to section 418 of the FD&C Act that the business conducts are those listed in the proposed exemption. The proposed exemption specified those activity/food combinations that would be exempt when conducted on a farm mixed-type facility's own RACs and those activity/food combinations that would be exempt when conducted on food other than the farm mixed-type facility's own RACs for distribution into commerce.

As a consequential change in light of the final “farm” definition, the final exemption no longer distinguishes between manufacturing/processing activities conducted on a farm mixed-type facility's own RACs and manufacturing/processing activities conducted on food other than the farm mixed-type facility's own RACs. As another consequential change, the exemption has been revised to eliminate activities, conducted on others' RACs, which no longer are classified as manufacturing/processing and instead are classified as harvesting, packing, or holding. In addition, as discussed in Response 205 we have revised the final exemption to list food categories consistent with the food categories included in table 1 in the section 103(c)(1)(C) RA.

We also revised the proposed exemption to add two sets of information that we believe will be useful to a farm mixed-type facility when evaluating whether the farm's manufacturing/processing activities satisfy the criteria for the exemption.

First, we have added a new provision (§ 117.5(h)((1)) explaining that the exemption in § 117.5(h) applies to manufacturing/processing of foods on a farm mixed-type facility, except for manufacturing/processing that is within the “farm” definition in § 1.227. Drying/dehydrating RACs to create a distinct commodity (such as drying/dehydrating grapes to produce raisins, and drying/dehydrating fresh herbs to produce dried herbs), and packaging and labeling such commodities, without additional manufacturing/processing (such as chopping and slicing), are within the “farm” definition in § 1.227. In addition, treatment to manipulate the ripening of RACs (such as by treating produce with ethylene gas), and packaging and labeling the treated RACs, without additional manufacturing/processing, is within the “farm” definition. In addition, coating intact fruits and vegetables with wax, oil, or resin used for the purpose of storage or transportation is within the “farm” definition. Activities that are within the “farm” definition, when conducted on a farm mixed-type facility, are not subject to the requirements of subparts C and G of this part and therefore do not need to be specified in the exemption.

Second, we have added a provision (§ 117.5(h)((2)) specifying that § 117.5(g)(2) describes the food categories listed in the exemption.

(Comment 206) Some comments ask us to include in the exemption a single list of low-risk manufacturing/processing activity/food combinations applicable to farm mixed-type facilities conducting activities on their own RACs and farm mixed-type facilities conducting activities on other's RACs.

(Response 206) These comments no longer apply. As a consequence of the “farm” definition established by this rule, the exemption no longer distinguishes between manufacturing/processing activities conducted on a farm mixed-type facility's own RACs and manufacturing/processing activities conducted on food other than the farm mixed-type facility's own RACs.

(Comment 207) Some comments ask us to include additional activity/food combinations in the exemption. See table 15 and table 16 for a list of the requested additional activity/food combinations.

(Response 207) We evaluated each of the requested activity/food combinations within the qualitative risk assessment (Ref. 4), unless the activity/food combination was out of scope of this rule (for example, if the requested activity/food combination was directed to animal food rather than human food). See table 15 and table 16 for the outcome of our evaluation of these requests, based on the findings of the section 103(c)(1)(C) RA as to whether the requested activity/food combination satisfies the criteria in that risk assessment for a low-risk activity/food combination. When we determined through the section 103(c)(1)(C) RA that the requested activity/food combination did not satisfy the criteria for a low-risk activity/food combination, table 16 explains why. See § 117.5(g)(2) for a description of the food categories listed in the exemption for on-farm, low-risk manufacturing/processing activity/food combinations in table 15 and table 16.

The first column in table 15 lists the activity/food combination that comments ask us to include in the exemption for on-farm, low-risk manufacturing/processing activity/food combinations. The second column lists the regulatory citation for the relevant exemption for an on-farm manufacturing/processing activity/food combination. Importantly, the full regulatory text of the exemption includes some limitations that were not specified in the comments, and table 15 should not be viewed as equating the requests of the comments with the final regulatory text of the exemption. For example, § 117.5(g)(2)(ix) specifies that the food category “baked goods” includes processed food products such as breads, brownies, cakes, cookies, and crackers, but does not include products that require time/temperature control for safety (such as cream-filled pastries).

H. Proposed § 117.5(i)—Exemptions Related to Alcoholic Beverages

Section 116 of FSMA (21 U.S.C. 2206) (Alcohol-Related Facilities) provides a rule of construction for certain facilities engaged in the manufacturing, processing, packing, or holding of alcoholic beverages and other food. In the proposed human preventive controls rule, we discussed our interpretation of section 116 of FSMA and requested comment on our interpretation. Based on our interpretation, we proposed that subpart C would not apply with respect to alcoholic beverages at facilities meeting two specified conditions (78 FR 3646 at 3707 to 3709). We also proposed that subpart C would not apply with respect to food other than alcoholic beverages at facilities described in the exemption, provided such food is in prepackaged form that prevents direct human contact with the food and constitutes not more than 5 percent of the overall sales of the facility.

(Comment 208) Some comments ask us to include the production of spent grains, distillers' grains, grape pomace, and other by-products of the manufacturing process within the alcohol exemption. These comments argue that the mere act of separating and disposing of those by-products by sale or otherwise should not trigger an obligation to meet the requirements of subpart C.

(Response 208) The exemption established under the rule of construction in section 116 of FSMA applies to alcoholic beverages, not to any other food (see section 116(c) of FSMA (21 U.S.C. 2206(c)), and we have revised the exemption to make the statutory applicability clearer (see table 52 and the regulatory text of § 117.5(i)). As previously discussed (79 FR 58524 at 58558), the by-products described in these comments appear to be products that would be used in food for animals rather than in human food, and we addressed these by-products in the 2014 supplemental animal preventive controls notice (79 FR 58476 at 58487-58489). (See also the discussion in section L regarding the specific CGMP provisions that will apply to these foods.)

I. Proposed § 117.5(j)—Exemption Applicable to Facilities Solely Engaged in Storage of Raw Agricultural Commodities Other Than Fruits and Vegetables Intended for Further Distribution or Processing

We proposed that subpart C would not apply to facilities that are solely engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing. In the following paragraphs, we discuss comments that ask us to clarify how the proposed exemption would apply to specific circumstances.

(Comment 209) Some comments ask whether this proposed exemption (proposed § 117.5(j)) would apply to facilities such as peanut buying points or bean elevators and assert that such commodities are analogous to grains and the activities conducted at such facilities are analogous to those performed by grain elevators.

(Response 209) We classify peanuts and beans (such as kidney beans, lima beans, and pinto beans) within the category of “fruits and vegetables”; we classify soybeans as grain (see the discussion of fruits and vegetables, 78 FR 3646 at 3690 and proposed §§ 112.1 and 112.2 in the proposed produce safety rule). The exemption for facilities solely engaged in storage of RACs intended for further distribution or processing does not apply to facilities that store fruit and vegetable RACs and, thus, does not apply to facilities such as peanut buying points and bean elevators. As discussed in Response 25, we have revised the “farm” definition to provide that an operation devoted to harvesting (such as hulling or shelling), packing, and/or holding of RACs is within the “farm” definition as a secondary activities farm, provided that the primary production farm(s) that grows, harvests, and/or raises the majority of the RACs harvested, packed, and/or held by the secondary activities farm owns, or jointly owns, a majority interest in the secondary activities farm. With this revision, some operations dedicated to holding RACs, including fruit and vegetable RACs, will be within the “farm” definition.

Peanut buying points and bean elevators that do not meet the revised farm definition are storing RACs that are “fruits and vegetables” and do not meet the criteria for exemption under § 117.5(j). However, we would not expect such facilities to need an extensive food safety plan. A facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components.

(Comment 210) Some comments refer to our statement that there would not be significant public health benefit to be gained by subjecting facilities that solely store non-fruit and vegetable RACs intended for further distribution or processing to the requirements of subpart C (78 FR 3646 at 3709) and assert that the same conclusion applies to those portions of oilseed processing facilities that are devoted solely to RAC storage. According to these comments, in the overwhelming majority of cases the inclusion of a separate RAC storage area in the same building as the oilseed processing area will not introduce additional risk either to the processing area or to the operations that take place there and that storage areas, whether standing alone as a separate facility or incorporated into a larger processing facility, store RACs safely. These comments ask us to recognize that storage activities may include grain drying to standardize moisture levels and preserve product quality. These comments also ask us to expand the exemption in § 117.5(j) to also apply to distinct and physically separate storage areas that are used solely for storage of RACs (other than fruits and vegetables) intended for further distribution or processing.

(Response 210) The activities included within the definition of holding include activities that are performed as a practical necessity for the distribution of RACs. In the 2014 supplemental human preventive controls notice, we explained that facilities that conduct operations similar to those conducted at grain elevators and silos, such as some facilities that hold oilseeds, may satisfy the criteria for exemption if activities other than storage are performed as a practical necessity for the distribution of RACs (see 79 FR 58524 at 58537 and the definition of “holding” in § 117.3). Examples of holding activities include drying/dehydrating RACs when the drying/dehydrating does not create a distinct commodity (see § 117.3). Thus, the specific example of drying grains to standardize moisture levels and preserve product quality would fall within the definition of holding as a practical necessity for the distribution of RACs. A facility that stores oilseeds, and dries them as a practical necessity for the distribution of RACs, would be covered by the exemption in § 117.5(j).

However, we decline the request to modify the exemption in § 117.5(j) to also apply to distinct and physically separate storage areas that are used solely for storage of RACs (other than fruits and vegetables) intended for further distribution or processing. To the extent that the comments are asking us to do so to provide for facilities that conduct activities as a practical necessity for the distribution of RACs to be eligible for the exemption, doing so is not necessary in light of the definition of holding. To the extent that the comments are asking us to do so to provide for facilities that conduct manufacturing/processing activities in addition to holding activities, we disagree that doing so would be consistent with the statutory direction in FSMA. As previously discussed, section 418(m) of the FD&C Act provides in relevant part that we may by regulation exempt or modify the requirements for compliance under section 418 of the FD&C Act with respect to facilities that are solely engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing (78 FR 3646 at 3709). The plain meaning of “solely” is only, completely, entirely; without another or others; singly; alone (Ref. 44). Facilities that conduct manufacturing/processing activities in addition to holding activities are not “solely” engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing. See also Response 233 regarding a similar request regarding the applicability of the requirements for hazard analysis and risk-based preventive controls to a facility solely engaged in the storage of unexposed packaged food.

J. Proposed § 117.5(k)—Exemption Applicable to Farms, Fishing Vessels, Activities of “Farm Mixed-Type Facilities” Within the Definition of “Farm,” the Holding or Transportation of One or More Raw Agricultural Commodities, and Specified Activities Conducted on Specified Raw Agricultural Commodities

We proposed to redesignate § 110.19(a) as proposed § 117.5(k) and revise the exemption that had been in § 110.19(a) to provide that subpart B would not apply to: (1) Farms; (2) fishing vessels that are not required to register as a food facility; (3) the holding or transportation of one or more RACs; (4) activities of “farm mixed-type facilities” that fall within the definition of “farm”; and (5) hulling, shelling, and drying nuts (without manufacturing/processing, such as roasting nuts).

(Comment 211) Some comments ask us to clarify whether the proposed exemption for the holding or transportation of one or more RACs (proposed § 117.5(k)) would apply to any food establishment, or only apply to farms and farm mixed-type facilities.

(Response 211) The exemption applies to any food establishment.

(Comment 212) Some comments ask us to clarify that CGMP requirements (such as requirements for the plant design to permit the taking of adequate precautions to protect food in outdoor bulk vessels (§ 117.20(b)(3)) and requirements for warehousing and distribution (§ 117.93) do not apply to the bulk outdoor storage of RACs for further processing.

(Response 212) We are returning to the long-standing approach that the exemption applies to establishments “solely engaged” in specific activities. Under the exemption we are establishing in § 117.5(k)(1)(iii), those activities are holding and/or transportation of RACs. Under the exemption we are establishing in § 117.5(k)(1)(v), those activities are hulling, shelling, drying, packing, and/or holding nuts. We explain why in the following paragraphs.

These comments appear to interpret the proposed exemption in a way that goes beyond the long-standing “RAC exemption” in § 110.19 and is inconsistent with our intent in updating § 110.19 to adjust and clarify what activities fall within this exemption based on experience and changes in related areas of the law since issuance of this exemption from the CGMPs (78 FR 3646 at 3710). The suggestion of these comments—i.e., that CGMPs should not apply to the holding of RACS in a facility that manufactures, processes, or packs RACs-would not make sense in some circumstances and would create difficulties for establishments (in determining how to comply with the CGMP requirements) and for regulators (in determining how to enforce the CGMP requirements). For example, it does not make sense for the part of a facility that holds RACs prior to processing to be exempt and the parts of the facility that are processing the RACs and storing them after processing to be covered. Likewise, it does not make sense for part of a transportation vehicle to be covered and part to be exempt.

By revising these two proposed exemptions that derive from the “RAC exemption” so that they apply only to establishments “solely engaged” in the storage and/or transportation of RACs, and to establishments “solely engaged” in the hulling, shelling, drying, packing, and/or holding of nuts, we are providing for a predictable framework for interpreting exemptions for facilities “solely engaged” in other activities. For example, as discussed in Comment 209, comments ask us to expand the exemption (in § 117.5(j)) from the requirements for hazard analysis and risk-based preventive controls for facilities that are “solely engaged” in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing to also apply to distinct and physically separate storage areas that are used solely for storage of such RACs. In our response, we noted that facilities that conduct manufacturing/processing activities in addition to holding activities are not “solely engaged” in the storage of such RACs (see Response 209). In addition, as discussed in Comment 233, comments ask us to apply the exemption (in § 117.7) from the requirements for hazard analysis and risk-based preventive controls for facilities that are “solely engaged” in the storage of unexposed packaged food to storage areas of facilities that also engage in food processing activities—e.g., for distributors that are engaged in limited food processing, such as cutting vegetables or packing ready-to-eat foods. In our response, we noted that such distributors are not “solely” engaged in the storage of unexposed packaged food (see Response 233).

The questions raised by these comments led us to reexamine the reasons we gave, in the 2013 proposed human preventive controls rule and the 2014 supplemental human preventive controls notice, for describing these exemption in terms of the activities conducted without specifying that the establishment is “solely engaged” in conducting these activities. For example, in the 2013 proposed human preventive controls rule we explained our assumption that if activities subject to the CGMPs take place in the same establishment, compliance with the CGMPs with respect to those activities should provide necessary protection. The comments led us to question that assumption. For example, with respect to the question posed by the comments about the outdoor bulk storage of RACs for further processing, it is not clear how conducting subsequent activities on the RACs in accordance with the CGMP requirements would protect the RACs during outdoor bulk storage. As discussed more fully in Response 660, processing fresh produce into fresh-cut products increases the risk of bacterial growth and contamination. RACs stored in bulk outdoors before being processed into fresh-cut produce must be stored in clean containers or vessels such that these do not contribute to contamination of the produce before it is processed. In addition, as already noted in this response, in interpreting the exemptions from subparts C and G for facilities that are solely engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing (§ 117.5(j)) and for facilities solely engaged in the storage of unexposed packaged food (§ 117.7), we do not consider that the exemption for these “holding” activities applies when holding is part of other operations conducted by the facility. For example, the exemption in § 117.7 would not apply to a packaged food warehouse of a processing facility, even if the warehouse only stores unexposed packaged food.

In the 2013 proposed human preventive controls rule we tentatively concluded that it would be reasonable to revise the RAC exemption in § 110.19 so that it would exempt the specifically identified activities when performed on RACs, regardless of whether the establishment that conducts those activities also conducts other activities that do not qualify for the exemption, in part because the exemptions in section 418(j)(1) applied to “activities” (i.e., covered by parts 120, 123, and 113) (see 78 FR 3646 at 3710). However, section 418(j)(1) is premised on the existence of similar mandatory requirements for those specific foods. In contrast, there are no requirements similar to subpart B in some situations that would be exempt under an exemption broadly directed to the activities of holding and transportation. For example, there would be no other requirements similar to subpart B (e.g., for pest control) applicable to an off-farm establishment that stores apples in a controlled atmosphere storage facility or to an establishment that stores harvested dry beans. We now believe that a better comparison is to other exemptions in FSMA, such as the exemption in section 103(c)(1)(D)(i) of FSMA for facilities engaged only in specific types of on-farm manufacturing, processing, packing or holding activities, and the exemption in section 418(m) of the FD&C Act for facilities solely engaged in storage of RACs (other than fruits and vegetables) intended for further distribution or processing. It is reasonable to infer that one reason for the use of “solely” in the statutory provisions in section 103(c)(1)(D)(i) of FSMA and in section 418(m) of the FD&C Act is to avoid some of the problems we have discussed in this response.

In the 2013 proposed human preventive controls rule, we stated our belief that activities should be regulated the same way regardless of whether activities subject to the CGMP requirements take place in same establishment. However, as with the exemptions in section 103(c)(1)(D)(i) of FSMA and section 418(m) of the FD&C Act, this is a situation where context matters. RACs that are the sole food in a warehouse are different from RACs being held in a manufacturing operation. As already noted in this response and as discussed more fully in Response 660, processing fresh produce into fresh-cut products increases the risk of bacterial growth and contamination, and produce being stored before processing into fresh-cut produce must be protected against contamination while being stored.

The exemptions we are establishing in this rule for establishments solely engaged in the storage and/or transportation of RACs, and for establishments solely engaged in hulling, shelling, drying, packing, and/or holding nuts (without additional manufacturing/processing, such as roasting nuts), remain consistent with our announced intent to adjust and clarify what activities fall within this exemption based, in part, on changes in related areas of the law since this exemption from the CGMP requirements was first issued. As discussed in section IV, we have made a number of changes to the “farm” definition, including changes that provide for an operation devoted to harvesting, packing, and/or holding of RACs to be a “farm” (i.e., a “secondary activities farm”) (and, thus, be exempt from the CGMP requirements under § 117.5(k)(1)(i)) even though the operation does not grow RACs (see § 117.3). With this revised “farm” definition, some establishments that had relied on the “RAC exemption” in § 110.19 to be exempt from CGMP requirements as establishments solely engaged in the “storage” of RACs, or because they were solely engaged in the harvesting (such as hulling and shelling) and storage (which includes drying) of nuts, will be exempt from the CGMP requirements because they are a “farm.” As a result, there are fewer operations that need to rely on exemptions that are an outgrowth of the long-standing RAC exemption in § 110.19.

K. Comments Requesting Additional Exemptions

1. Introduction

(Comment 213) We received comments requesting several additional exemptions from the requirements for hazard analysis and risk-based preventive controls in subpart C, the CGMP requirements of subpart B, or both. See the remainder of section XI.K for a description of the specific requests.

(Response 213) Each year, about 48 million Americans (1 in 6) get sick, 128,000 are hospitalized, and 3,000 die from foodborne diseases, according to recent estimates from the Centers for Disease Control and Prevention (CDC) (Ref. 45). This is a significant public health burden that is largely preventable. We believe that improvements to our CGMP regulations, coupled with implementation of FSMA's directives to focus more on preventing food safety problems than on reacting to problems after they occur, can play an important role in reducing foodborne illness (other than foodborne illnesses that are the result of improper food handling practices in the home and food service settings, which would not be addressed by this rule). We did not propose any exemptions or exceptions from the requirements of subpart C other than those contained in section 103 of FSMA (78 FR 3646 at 3657). Likewise, we did not propose any additional exemptions from the CGMP requirements other than to adjust and clarify what activities fall within a long-standing exemption related to RACs based on experience and changes in related areas of the law since issuance of the CGMP regulation (78 FR 3646 at 3709-3711).

In the remainder of section XI.K, we respond to the specific requests for additional exemptions from the requirements of subparts C and G for hazard analysis and risk-based preventive controls. None of these specific requests describe (or otherwise provide) evidence demonstrating that the regulatory framework associated with the request would address all of the requirements of subparts C and G. Therefore, we have declined all of these requests. In some cases, a facility that is subject to other Federal, State, or local regulations that have some of the same requirements as subparts C and G will not have to repeat the same activity and will be able to use any existing records to demonstrate compliance and supplement those actions and records as necessary to demonstrate compliance with the remaining requirements of subparts C and G (see, e.g., 79 FR 58524 at 58542, Response 215, Response 216, Response 219, and the discussion of § 117.330 in section XLI.G). In one case (for facilities subject to the PMO; see Response 214), we have extended the date for compliance with the requirements of subparts C and G in light of comments expressing an intent to revise the current requirements of a Federal/State cooperative program to incorporate the requirements of this rule. In other cases, a facility may determine and document through its hazard analysis that no preventive controls are necessary to prevent its food products from being adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act (see, e.g., Response 222, Response 226, Response 229, and the discussion of § 117.130 in section XXV). Such facilities, although not exempt, will have a reduced burden to comply with the rule, if the outcome of their hazard analysis is that there are no hazards requiring preventive controls.

Likewise, in the remainder of section XI.K we respond to the specific requests for additional exemptions from the CGMP requirements of subpart B. None of these requests provide a basis for why the long-standing CGMP provisions that establish basic requirements for the manufacturing, processing, packing, and holding of food to prevent adulteration should no longer apply to a particular type of food establishment and, thus, we have declined these requests.

2. Facilities That Comply With the Pasteurized Milk Ordinance

(Comment 214) Some comments discuss facilities that comply with the Grade “A” PMO and are regulated under the National Conference on Interstate Milk Shipments (NCIMS) system (PMO facilities). NCIMS has been part of a cooperative program among the U.S. Public Health Service/FDA, the States and the dairy industry since 1950. Procedures for Governing the Cooperative Program of the NCIMS include procedures establishing milk sanitation standards, rating procedures, sampling procedures, laboratory procedures, laboratory evaluation and sample collector procedures. As previously discussed (78 FR 3646 at 3662), the PMO is a model regulation published and recommended by the U.S. Public Health Service/FDA for voluntary adoption by State dairy regulatory agencies to regulate the production, processing, storage and distribution of Grade “A” milk and milk products to help prevent milkborne disease. Appendix K—HACCP Program of the PMO—describes a voluntary, NCIMS HACCP Program alternative to the traditional inspection system. A milk plant, receiving station or transfer station may not participate in the voluntary NCIMS HACCP Program unless the regulatory agency responsible for the oversight of the facility agrees to participate with the dairy plant(s), receiving station(s) and transfer station(s) in the NCIMS HACCP Program. Currently all 50 States, the District of Columbia, and Puerto Rico have adopted the PMO by reference or have codified the PMO or similar provisions in State regulations. At its biennial conferences, the NCIMS considers changes and modifications to the Grade “A” PMO to further enhance the safety of Grade “A” milk and milk products, including the administrative and technical details on how to obtain satisfactory compliance. Changes ultimately accepted by NCIMS voting delegates (representatives from States and territories) are forwarded to FDA for concurrence before they become effective.

Some comments recommend that we make full use of the existing milk safety system of State regulatory oversight for Grade “A” milk and milk products provided through the NCIMS and the food safety requirements of the PMO. Some comments assert that we are exceeding our authority by requiring PMO-regulated facilities to comply with both the PMO and the requirements of FSMA for hazard analysis and risk-based preventive controls.

Some comments ask us to exempt PMO-regulated facilities (or the PMO-regulated part of a PMO facility that also produces food products not covered by the PMO) from the requirements of the rule for hazard analysis and risk-based preventive controls, or to otherwise determine that facilities operating in compliance with the PMO are also in compliance with those requirements. These comments suggest we could, as an interim step if we find it necessary, stay the application of these requirements to PMO-regulated facilities and work with the NCIMS cooperative program to enact any modifications to the PMO as may be needed to warrant an exemption or comparability determination. The comments characterize these changes as “minor.”

Some comments ask for clarification as to whether the human preventive controls rule would preempt the PMO if there are any conflicts or duplications between the human preventive controls rule and the PMO. Some comments ask us to explain our position concerning the interstate movement of milk and milk products and imported milk if the final rule does not recognize that PMO-regulated facilities are also in compliance with the requirements of the human preventive controls rule for hazard analysis and risk-based preventive controls. These comments ask: (1) Whether the final rule will become the de facto standard or the standard enforced by the FDA for the movement of milk in interstate commerce and for imported milk; (2) how the final rule will affect States that have adopted the PMO as their law/regulation for the production and processing of products such as fluid milk products and cottage cheese; and (3) how a final rule that does not recognize the PMO and the products made under the PMO will affect other Federal rules, policy, procedures, or practices that require compliance with the PMO.

(Response 214) We agree that we should make use of the existing system of State regulatory oversight for Grade “A” milk and milk products provided through the NCIMS and the food safety requirements of the PMO. The NCIMS program has been effective from a regulatory standpoint, and has likely had a significant public health impact in reducing the incidence of foodborne illness attributable to milk and milk products. FDA is committed to the mission of the NCIMS and ensuring the continuance of an effective milk safety system with State regulatory oversight. However, the PMO does not address all of the requirements of subparts C and G, such as requirements relevant to the potential presence of environmental pathogens in the food processing environment (see, e.g., §§ 117.130(c)(1)(ii) and 117.150(a)(1)(ii)(B)). Such provisions could help to prevent food safety problems from the consumption of food produced by PMO facilities and play an important role in reducing foodborne illness. For example, in 2007, contamination of a PMO-regulated facility with the environmental pathogen L. monocytogenes was the cause of three deaths via listeriosis (Ref. 46). As another example, there have been large-scale recalls as a result of contamination of dried milk with the environmental pathogen Salmonella (Ref. 47).

In addition, the NCIMS HACCP Program is a voluntary program and, as of March 17, 2015, had been utilized by only 11 of approximately 625 PMO facilities (Ref. 48). Further, the current NCIMS HACCP Program does not address all of the requirements of subparts C and G, such as environmental monitoring as a verification of sanitation controls for environmental pathogens and a supply-chain program for non-dairy ingredients (Ref. 49). The PMO also does not address food allergen controls, which are appropriate for those Grade “A” facilities that also handle food containing allergens other than milk. The comments do not provide a basis for why we should exempt PMO facilities from the rule in light of the differences between the requirements of this rule and the requirements of the PMO.

NCIMS has initiated work to modify the PMO and that work is expected to include all of the requirements in a final human preventive controls rule. FDA has committed resources to work with the appropriate NCIMS Committees to make the necessary changes. However, the NCIMS process will not be complete in time for PMO facilities to meet the first two compliance dates for this rule (i.e., September 19, 2016 for businesses other than small and very small businesses, and September 18, 2017 for small businesses), because the next scheduled Conference following the publication of this final rule would be April 2017. Therefore, to make use of the existing system of State regulatory oversight for Grade “A” milk and milk products provided through the NCIMS and the food safety requirements of the PMO, we are extending the compliance date for PMO-regulated facilities to comply with the requirements of subparts C and G to September 17, 2018. Doing so is consistent with the request of comments asking us to “stay” the application of the requirements for hazard analysis and risk-based preventive controls to PMO-regulated facilities and work with the NCIMS cooperative program to effect the necessary modifications to the PMO so that it will include all of the requirements in the human preventive controls rule. The extended compliance date is not equivalent to an exemption. Regardless of whether the PMO is modified to include the requirements of a final human preventive controls rule by the extended compliance date, PMO facilities must comply with the human preventive controls rule on September 17, 2018.

The extended compliance date also is responsive to comments that identified complex implementation issues concerning the interstate movement of milk and milk products and imported milk. If the requirements of this rule for hazard analysis and risk-based preventive controls are incorporated into the PMO by the compliance date, such implementation issues will be moot, because a facility that complies with the revised PMO would also comply with this rule. As the compliance date approaches, it will be clearer as to whether any or all of the necessary revisions to the PMO will be in place by the compliance date for PMO facilities. If it appears that these revisions will not be in place by the compliance date for PMO facilities, we will take steps to address implementation issues specific to this Federal/State cooperative program.

In establishing a compliance date of September 17, 2018 for PMO facilities, we considered: (1) The extent of revisions that must be made to incorporate the requirements of this rule for hazard analysis and risk-based preventive controls into the PMO; (2) the process to revise the PMO; and (3) the date at which the necessary revisions to the PMO could begin to be made. We discuss each of these considerations in the following paragraphs.

We disagree that the necessary revisions to incorporate the requirements of this rule for hazard analysis and risk-based preventive controls into the PMO are “minor.” There are gaps between the requirements of this rule and the current required and voluntary provisions of the PMO (Ref. 49), and gaps such as provisions directed to environmental monitoring, supply-chain controls, and food allergen controls are not “minor.”

With respect to process, NCIMS considers changes and modifications to the Grade “A” PMO at its biennial conferences, and proposals with the necessary changes must be voted on at such a biennial meeting. The next scheduled biennial conference is in the spring of 2017. Although it may be possible for NCIMS to convene a special conference in 2016 for the purpose of voting on proposals to revise the PMO to make it comply with the requirements of this rule, practicalities such as the availability of funds for a special conference could interfere with any plans for a special conference. In addition, given that we do not view the necessary changes as “minor,” it could take more than one round of proposals for revising the PMO before a proposal receives the votes necessary to be adopted. Because the provisions of this rule will not be established until the date of publication of this final rule, any preliminary drafts of proposals to modify the PMO (e.g., to incorporate the provisions that we proposed in the 2014 supplemental preventive controls notice) before today's date may need revision to reflect the final provisions of the rule.

In light of all these considerations, we are establishing September 17, 2018 as the date for PMO facilities to comply with the requirements for hazard analysis and risk-based preventive controls in part 117, subparts C and G. The compliance date for PMO facilities to comply with the CGMP requirements of subpart B is also September 17, 2018, and PMO facilities will continue to comply with part 110 until that date. Under NCIMS procedures, changes agreed to by the voting delegates at the 2017 NCIMS conference (and to which FDA concurs) would be effective within one year of the electronic publication of the NCIMS documents; or by official notification by FDA to the States and the dairy industry of “Actions from the 2017 NCIMS Conference;” or by a previously determined effective date (e.g., September 17, 2018). We believe that the date of September 17, 2018 appropriately balances the need to realize the benefits of FSMA's requirements for hazard analysis and risk-based preventive controls with the practicalities associated with revising the PMO to incorporate the requirements of this rule.

3. Facilities That Have an Established HACCP Program

(Comment 215) Some comments ask us to recognize operations that have an established HACCP Program implemented by a trained individual as meeting the requirements of the human preventive controls rule. Some of these comments note that the NCIMS HACCP Program describes a voluntary, NCIMS HACCP Program alternative to the traditional inspection system. Other comments discuss the EU Dairy HACCP Program and assert that the preventive controls system mandated by FSMA is a HACCP-like system but is not as robust as the EU Dairy HACCP Program. Other comments ask us to support and recognize industry-driven, mandatory programs that afford the same level of public health protection as the human preventive controls rule.

Other comments note that facilities such as pizza manufacturing facilities are “dual jurisdiction” facilities, regulated and inspected by both FDA and USDA's Food Safety and Inspection Service (FSIS). These comments assert that such facilities already are operating under FSIS-approved HACCP plans, and their HACCP plans cover FDA-regulated products, as well as FSIS-regulated products. These comments acknowledge that there are differences between FSIS' HACCP regulation and FDA's proposed requirements for hazard analysis and risk-based preventive controls but nonetheless assert that requiring dual jurisdiction facilities to operate under two different food safety plans would result in unnecessary duplication of effort and confusion.

(Response 215) Whether a particular HACCP program implemented by a trained individual would satisfy the requirements of the human preventive controls rule will depend on whether the particular HACCP program satisfies all of the requirements of the rule. (See Response 213.) For operations that have implemented HACCP programs that are generally similar to the provisions of part 117, the burden of complying should be minimal in light of the provisions of § 117.330, which provides for use of existing records. As an example, if a facility has an existing HACCP plan (or multiple HACCP plans for different types of foods), supported by certain prerequisite programs that include food safety controls, the facility would not need to duplicate or re-write its existing HACCP plans or prerequisite programs, as long as the existing HACCP plans and prerequisite programs contain all of the required information and satisfy the requirements of subpart F, or are supplemented as necessary to include all of the required information and satisfy the requirements of subpart F (see § 117.330(a)). Because the rule also provides that the required information does not need to be kept in one set of records, a facility may supplement existing records associated with its HACCP plans and prerequisite programs with other required components of a food safety plan (such as recall plan and, when applicable, a supply-chain program and written verification procedures for environmental monitoring) (see § 117.330(b)). Moreover, the rule provides additional flexibility for a facility that relies on both existing records and newly established records to keep the records either separately or combined (see § 117.330(b)).

The flexibility provided by the provisions for use of existing records also enables a facility to comply with the requirement (in § 117.310) for the owner, operator, or agent in charge of a facility to sign and date the facility's food safety plan, even when components of the food safety plan are kept separately. For example, when the food safety plan consists of one or more existing HACCP plans, one or more prerequisite programs that include food safety controls, a recall plan, a written supply-chain program, written verification procedures such as environmental monitoring, and any other components required by the rule, one approach for signing and dating the food safety plan could be to collect all these documents in a single location (e.g., a binder or folder) with a cover page containing the signature of the owner, operator, or agent in charge of the facility and the date on which the cover page was signed. However, because the food safety plan also could be a set of documents kept in different locations within the facility, a facility could sign and date a list of the relevant documents (e.g., as in a Table of Contents). (See also the discussion in Response 369 that a food safety plan may be prepared as a set of documents kept in different locations within the facility (e.g., based on where they will be used)).

4. Facilities That Are Subject to Requirements for Acidified Foods

(Comment 216) Some comments ask us to exempt (or partially exempt) facilities that produce acidified foods from the requirements of subpart C, because acidified foods are subject to the specific food safety regulation in part 114 (21 CFR part 114) in addition to the CGMP requirements in subpart B. If we do not do so, these comments ask us to clarify whether a scheduled process established for an acidified food would be accepted as a process that had been validated as a preventive control for a microbiological hazard. Some of these comments mention specific acidified food products, such as salsa. Other comments ask us to withdraw part 114 and regulate acidified foods under part 117 to avoid confusion, and then consider acidification as a preventive control.

(Response 216) We agree that the specific CGMP requirements already established in part 114 play a key role in the safe production of acidified foods, but disagree that it would be appropriate to exempt facilities that are subject to part 114 from the requirements of subparts C and G. As the comments suggest, the long-standing requirements of part 114 could function as a type of preventive control. However, part 114 does not address all of the requirements of subparts C and G, such as the requirement to address chemical and physical hazards.

We also disagree that we should withdraw part 114 and simply consider acidification as a preventive control under subparts C and G. The long-standing requirements of part 114 provide many details that do not fit within the framework of this rule, and we do not believe that it is in the best interest of public health to simply eliminate those details.

A processor of acidified foods can consider its current scheduled processes, established in accordance with part 114, when conducting the hazard analysis required by this rule (§ 117.130). A processor of acidified foods could, through its hazard analysis, determine and document that the microbiological hazards associated with its products are addressed by preventive controls in its scheduled processes established under part 114. To the extent that the processor considers an existing scheduled process to be a preventive control as that term is defined in this rule, the processor would establish and implement preventive control management components (i.e., monitoring, corrective actions and corrections, and verification (including validation)) as appropriate to ensure the effectiveness of that preventive control, taking into account the nature of the preventive control. Again, a processor of acidified foods can consider its current procedures, established in accordance with part 114, when determining what preventive control management components to establish and implement. For example, a facility that previously validated a scheduled process can rely on its existing validation records and would not need to repeat the validation or make a new record. Processes issued by a process authority for acidified foods are generally accepted as validated processes. As another example, a facility can consider its current procedures for complying with the requirements of part 114, including frequent pH testing and recording of results, to exercise sufficient control so that the finished equilibrium pH values for acidified foods are not higher than 4.6 (§ 114.80(a)(2)), and to address deviations from scheduled processes (§ 114.89). A facility that produces acidified foods could demonstrate compliance with the requirements of subparts C and G of this rule by relying on the records it is currently required to establish and maintain (§ 114.100), as applicable, supplemented as necessary (see § 117.330).

(Comment 217) Some comments ask whether a qualified facility with activities that are subject to part 114 (Acidified Foods) would be exempt from the requirements of Subpart C.

(Response 217) A qualified facility is exempt from the requirements of subparts C and G, and instead subject to the modified requirements in § 117.201, for all foods that it produces, including acidified foods.

5. Egg Facilities

(Comment 218) Some comments ask us to exempt shell egg facilities that are also regulated by USDA and by State shell egg grading programs from the requirements of both subpart B and subpart C or at least recognize these establishments as meeting the requirements for subpart B and Subpart C without further routine FDA inspection. Some comments ask us to exempt shell egg establishments subject to part 118 (21 CFR part 118) (Production, Storage, And Transportation Of Shell Eggs) from the requirements of subpart C because part 118 already requires shell egg establishments to take specific, concrete, steps to prevent the hazard Salmonella from contaminating eggs on the farm and from further growth during storage and transportation.

(Response 218) Shell eggs are RACs. The on-farm production of shell eggs is exempt from both the CGMP requirements in subpart B (see the exemption for farms in § 117.5(k)(1)(i)) and from the requirements for hazard analysis and risk-based preventive controls in subparts C and G (because a “farm” is exempt from the requirement to register as a food facility). Likewise, the packing of shell eggs by egg packinghouses that are within the “farm” definition established during this rulemaking are exempt from both the CGMP requirements in subpart B and the requirements for hazard analysis and risk-based preventive controls in subparts C and G, (see Response 25).

Establishments that are solely engaged in the holding or transportation of shell eggs are exempt from the CGMP requirements in subpart B (see the exemption for establishments solely engaged in the holding or transportation of one or more RACs in § 117.5(k)(1)(iii)). Facilities that are required to register, but are solely engaged in the storage of shell eggs intended for further distribution or processing, are exempt from the requirements for hazard analysis and risk-based preventive controls in subparts C and G (see the exemption in § 117.5(j)).

Shell egg processing facilities that are regulated exclusively, throughout the entire facility, by USDA under the Egg Products Inspection Act (21 U.S.C. 1031 et seq.) are exempt from the section 415 registration regulations and, thus, are not subject to the requirements of this rule for hazard analysis and risk-based preventive controls (subparts C and G).

6. Facilities That Produce Infant Formula

(Comment 219) Some comments ask us to exempt the production of infant formula from the requirements of subpart C after we issue a final rule establishing requirements for CGMPs and quality control procedures for infant formula.

(Response 219) We issued an interim final rule entitled “Current Good Manufacturing Practices, Quality Control Procedures, Quality Factors, Notification Requirements, and Records and Reports, for Infant Formula” on February 10, 2014 (79 FR 7934) and a final rule (the infant formula rule) adopting, with some modifications, that interim final rule on June 10, 2014 (79 FR 33057).

We agree that the requirements of the infant formula rule play a key role in the safe production of infant formula, but disagree that it would be appropriate to exempt facilities that are subject to the infant formula rule from the requirements of subparts C and G. The infant formula rule does not address all of the requirements of subparts C and G, such as requirements relevant to the potential presence of environmental pathogens in the food processing environment (see, e.g., §§ 117.130(c)(1)(ii) and 117.150(a)(1)(ii)(B)). As with products such as acidified foods (see Response 216), a manufacturer of infant formula could demonstrate compliance with the requirements of subparts C and G of this rule by relying on the records it is currently required to establish and maintain (§ 106.100), as applicable, supplemented as necessary (see § 117.330).

7. Small Businesses

(Comment 220) Some comments ask us to provide more exemptions for small farms and small facilities.

(Response 220) We decline this request. As discussed in Response 213, the exemptions we are establishing are those provided by section 103 of FSMA. Small farm that only conduct activities within the “farm” definition are not subject to the human preventive controls rule. Small farms that also conduct activities outside the “farm” definition (such as manufacturing jams or jellies) (and, thus, are farm mixed-type facilities) are eligible for an exemption if the only such activities they conduct are the low-risk activity/food combinations specified in the exemptions in § 117.5(g) and (h). Small farms that are subject to this rule as farm mixed-type facilities, and other small businesses, will have an extra year to comply with the rule. As discussed in Response 222, the new requirements for hazard analysis and risk-based preventive controls are flexible, and the preventive controls (if any) that a facility would establish and implement would depend on the outcome of the facility's hazard analysis and therefore would be tailored to the operation. These aspects of this rulemaking provide ample flexibility to small businesses.

8. Exemptions Based on Risk

(Comment 221) Some comments ask us to exempt facilities identified as conducting low-risk activities from the CGMP requirements.

(Response 221) We decline this request. The umbrella CGMPs that we are establishing in subpart B are long-standing provisions that establish basic requirements for the manufacturing, processing, packing, and holding of food to prevent adulteration. For example, food that is exposed must be protected against contamination from the plant's grounds, the design and construction of the plant, and sanitary operations regardless of whether the uncontaminated food could be “high-risk” or “low-risk”; contamination introduced during the production of food can adulterate any food. In addition, these umbrella CGMPs are not “one-size-fits-all” in that many provisions provide flexibility to tailor specific practices to the nature of the food and the activities being conducted. For example, many provisions establish a performance standard in which the measures taken must be “adequate” to comply with the rule, where adequate is defined as that which is needed to accomplish the intended purpose in keeping with good public health practice. As another example, provisions directed to raw materials require that they be washed or cleaned “as necessary” to remove soil or other contamination (see § 117.80(b)(1)). Moreover, some comments point out that one strength of the long-standing CGMPs is their applicability to the broad spectrum of food manufacturing, from the manufacture of processed products and packaging of fresh produce to production of food additives and GRAS substances (see section VIII). (As already noted, some packaging of fresh produce (e.g., packaging of RACs on a farm) is not subject to the CGMPs.)

(Comment 222) Some comments assert that we should not base the requirements for hazard analysis and risk-based preventive controls on the status of a business as a facility that is required to register under the section 415 registration regulations if there is no risk from consumption of food produced by that business. Some comments assert that a food safety plan should only be required for high-risk processing facilities because adhering to CGMPs is sufficient for low-risk facilities. Some comments assert a food safety plan should be required for large businesses, but not for small and medium-size businesses, including small businesses that manufacture low-risk foods that are sterilized before being eaten and already undergo a 48-point inspection twice a year.

Some comments ask us to adopt a commodity-specific approach to the exemptions and to only apply the requirements for hazard analysis and risk-based preventive controls to RACs that fall within the five highest-risk commodity groups and to any other specific commodities that we determine pose a comparable risk based on outbreak history and the commodity's characteristics.

Other comments note that some States provide “exemptions” for “non-potentially-hazardous foods.” These comments assert that there should be national agreement on what such foods are and, if such foods are truly low risk, there should not be onerous requirements regardless of the size of the business.

(Response 222) We decline these requests to establish additional exemptions based on risk, other than the exemptions for on-farm low-risk activity/food combinations provided by section 103(c)(1)(D) of FSMA (§ 117.5(g) and (h)). The applicability of the requirements of the human preventive controls rule to facilities that are required to register is required by the statute (see the definition of facility in section 418(o)(2) of the FD&C Act). Section 418(h) of the FD&C Act requires that a facility prepare and implement a food safety plan, unless an exemption applies. Neither FSMA nor this rule establishes a broad exemption for “low-risk” facilities, including “low-risk” facilities that are regularly inspected by State, local, or tribal government agencies. As discussed in Response 213, the exemptions we are establishing are those specifically authorized by the statute.

The new requirements for hazard analysis and risk-based preventive controls are not “one-size-fits-all,” and facilities that are subject to the rule would consider the risk presented by the products as part of their hazard evaluation. (See § 117.130(c)(1)(i), which requires that the hazard analysis include an evaluation of identified known or reasonably foreseeable hazards to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls.) Although each facility subject to the rule must prepare and implement a food safety plan, the preventive controls that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis (§§ 117.130 and 117.135(c)). In addition, the preventive control management components (i.e., monitoring, corrective actions and corrections, and verification) that a facility would establish and implement for its preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system (§ 117.140(a)). A facility that appropriately determines through its hazard analysis that no preventive controls are necessary to prevent its food products from being adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act would document that determination in its written hazard analysis but would not need to establish preventive controls and associated preventive control management components for its products. A facility that is a very small business as that term is defined in this rule is exempt from the requirements of subparts C and G, including the requirement to prepare and implement a food safety plan, and is instead subject to the modified requirements in § 117.201.

We expect that there will be many circumstances in which a facility appropriately determines that certain biological, chemical, or physical hazards are not hazards requiring a preventive control that must be addressed in the food safety plan. There are several types of food products for which a facility may determine that there are no hazards requiring a preventive control. Such products could include, but are not limited to: many crackers, most bread, dried pasta, many cookies, many types of candy (hard candy, fudge, maple candy, taffy and toffee), honey, molasses, sugar, syrup, soft drinks, and jams, jellies, and preserves from acid fruits.

9. Hullers/Shellers

(Comment 223) Some comments ask us to clarify whether an operation solely engaged in hulling/shelling would qualify for the exemption from the requirements for hazard analysis and risk-based preventive controls for facilities that solely are engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing (§ 117.5(j)). Other comments ask us to clarify whether an operation that is solely engaged in hulling/shelling and, thus, is exempt from the CGMP requirements of subpart B would also be exempt from the requirements for hazard analysis and risk-based preventive controls in subpart C. Some of these comments assert that it seems contrary to the principles of HACCP that a facility that is not required to implement CGMPs (which is a foundation of HACCP) would still need to develop a food safety plan. Some comments assert that requiring these operations to apply HACCP standards to what is an extension of harvesting is overkill, because the consumer is ultimately protected by processes at the handler (processor) level. Other comments assert that our clarification that operations that hull/shell/dry nuts are exempt from the CGMP requirements recognizes that hulling/shelling activities are low risk and do not alter the status of a RAC. Because the requirements for hazard analysis and risk-based preventive controls will be applied by those receiving product from the huller/sheller, it does not seem appropriate for an operation that is explicitly exempt from CGMP requirements to be required to conduct a hazard analysis, implement controls, conduct monitoring, etc.

(Response 223) Under the revised “farm” definition, some hulling/shelling operations will be within the “farm” definition (i.e., if the primary production farm(s) that grows, harvests, and/or raises the majority of the nuts owns, or jointly owns, a majority interest in the hulling/shelling operation). Because hulling/shelling is a harvesting activity, not a holding activity, those hulling/shelling operations that are not within the “farm” definition are not eligible for the exemption for facilities solely engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing (§ 117.5(j)). As discussed in Response 222, there is no exemption for “low-risk operations.” However, a facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components.

10. Fruit and Vegetable RACs

(Comment 224) Some comments ask us to clarify the two exemptions applicable to RACs—i.e., the exemption from CGMP requirements for the holding or transportation of one or more RACs (§ 117.5(k)) and the exemption from the requirements for hazard analysis and risk-based preventive controls for facilities solely engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing (§ 117.5(j)). These comments ask whether an off-farm holding facility that strictly deals with fruit and vegetable RACs would be exempt from subpart B, but not subpart C.

Some comments assert that operations that pack RACs other than fruits and vegetables intended for further distribution or processing should be exempt from both CGMP requirements and requirements for hazard analysis and risk-based preventive controls. These comments ask us to expand the exemption from CGMP requirements for the holding or transportation of one or more RACs to include the packing of RACs (other than fruits and vegetables). These comments also ask us to include packing RACs in the exemption from subpart C for facilities solely engaged in the storage of RACs (other than fruits and vegetables) intended for further distribution or processing.

(Response 224) Under the revised “farm” definition, some operations that pack RACs will be within the “farm” definition (i.e., if the farms that grow or raise the majority of the RACs own, or jointly own, a majority interest in the packing operation). Packing operations that are within the “farm” definition are exempt from the CGMP requirements (§ 117.5(k)(1)). However, the packing of RACs is not otherwise exempt from either the CGMP requirements or the requirements for hazard analysis and risk-based preventive controls. As discussed in Response 221, the umbrella CGMPs that we are establishing in subpart B are long-standing provisions that establish basic requirements for the manufacturing, processing, packing, and holding of food to prevent adulteration.

Packing operations that are within the “farm” definition are exempt from the requirements for hazard analysis and risk-based preventive controls (because “farms” are exempt from the section 415 registration requirements for “facilities”). As discussed more fully in Response 222, the new requirements for hazard analysis and risk-based preventive controls are not “one-size-fits-all.” Although each facility subject to the rule must prepare and implement a food safety plan, the preventive controls that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis. In addition, the preventive control management components that a facility would establish and implement for its preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system.

11. Enclosed Outdoor Vessels

(Comment 225) Some comments ask us to exempt enclosed outdoor vessels from the specific CGMP provisions (such as requirements for the plant design to permit the taking of adequate precautions to protect food in outdoor bulk vessels (§ 117.20(b)(3)) and requirements for warehousing and distribution (§ 117.93)) if they are properly “risk assessed” and covered by appropriate procedures for preventing contamination, and system verification is implemented.

(Response 225) We decline this request. The long-standing CGMP requirements are comprehensive, interrelated provisions intended to prevent the adulteration of food. Specifying particular provisions that would not apply if a food establishment appropriately implements other provisions would be contrary to this comprehensive approach to food safety, in addition to being both impractical and difficult to administer. If a food establishment has appropriately determined that its procedures for preventing contamination adequately address the requirements for the safe storage of food in enclosed outdoor vessels, it should have no difficulty demonstrating that during inspection.

12. Supermarket Distribution Centers

(Comment 226) Some comments ask us to exempt supermarket distribution centers from the requirements of subpart C and instead require them to have written CGMPs. If this request is not accepted, then these comments ask us to either exempt supermarket distribution centers from the requirements of subpart C for those packaged foods not exposed to the environment (with modified requirements for unexposed, refrigerated, packaged TCS foods), or specify that there are no significant hazards for such a facility to address in a food safety plan.

(Response 226) A supermarket distribution center must register as a food facility because it holds food for human consumption and does not satisfy any of the criteria for entities that are not required to register (see § 1.226). As discussed in Response 222, the preventive controls that a facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis, and any preventive control management components associated with a facility's preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. In the case of a facility that is a supermarket distribution center, the facility would, as part of its evaluation, determine whether any preventive controls are necessary for unexposed, non-refrigerated packaged foods. The facility might determine that the modified requirements in § 117.206 for unexposed, refrigerated, packaged TCS foods are appropriate to apply to such foods that it holds. If so, the facility could establish its food safety plan by building on the provisions established in § 117.206.

13. Local and Regional Facilities Such as Kitchen Incubators, Food Hubs, and Grower Marketing Cooperatives

(Comment 227) Some comments ask us to provide flexibility to local and regional facilities that do not qualify for an exemption from subpart C (e.g., “kitchen incubators” and farm mixed-type facilities that are subject to State or local laws). Some comments ask us to exempt (or partially exempt) food hubs, grower marketing cooperatives, “produce auctions,” and similar entities. Some comments ask us not to cover facilities with less than $25,000 in annual sales (similar to a provision being considered under the 2013 proposed produce safety rule) or to establish a higher sales limit (i.e., $100,000) applicable to both the human preventive controls rule and the produce safety rule.

(Response 227) We decline the requests to exempt (or partially exempt) the business models described in these comments. (See Response 213.) None of these requests describe or provide evidence that the regulatory framework associated with the business model would address all of the requirements of subparts C and G. Many of the types of facilities listed have multiple business models that conduct different types of activities. For example, USDA defines a regional food hub as “a business or organization that actively manages the aggregation, distribution, and marketing of source-identified food products primarily from local and regional producers to strengthen their ability to satisfy wholesale, retail, and institutional demand.” (Ref. 50). Some food hubs have facilities at which they conduct activities, including dry and cold storage, grading, packing, labeling, and light processing (trimming, cutting, and freezing), whereas other food hubs never physically handle the product sold but instead rely on farmers and contract trucking firms to provide aggregation and transportation services (Ref. 50). Some food hubs have a farm-to-business model (e.g., selling to food cooperatives, grocery stores, institutional foodservice companies, and restaurants), while others have a farm-to-consumer model (i.e., selling directly to the consumer, e.g., through a CSA), and some are hybrids that do both (Ref. 50). Some food hubs combine produce distribution with food processing operations (shared commercial processing space, or “incubator kitchens”). Thus, some of these operations could be exempt. For example, some of these operations may fall within the revised “farm” definition (e.g., if the farms that grow or raise the majority of the RACs own, or jointly own, a majority interest in a food hub or a grower marketing cooperative and the food hub or grower marketing cooperative does not conduct any activities outside of the “farm” definition). Other operations could be exempt if they fall within the definition of “retail food establishment” (see Response 4). With respect to produce auction houses, to the extent that these operations are simply a location for buyers and sellers to meet and to sell and transfer produce and the food is not stored, we do not consider such facilities to be holding food and would not expect them to register; therefore these operations would not be subject to the requirements of subparts C and G for hazard analysis and risk-based preventive controls.

We also decline the request not to cover facilities with less than $25,000 or $100,000 in annual sales. (See the discussion in Response 220, in which we declined the request to provide more exemptions for small farm mixed-type facilities and other small facilities). However, if a local or regional facility such as those described in the comments is a very small business, the facility would be subject to modified requirements (§ 117.201) rather than to the full requirements for hazard analysis and risk-based preventive controls. When such an operation is not a farm, a retail food establishment, or a very small business, the preventive controls that a facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis, and any preventive control management components associated with a facility's preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. (See Response 222.)

14. Production of Raw Sugar

(Comment 228) Some comments ask us to exempt the production of raw sugar that is destined for refining from the requirements in subpart C for hazard analysis and risk-based preventive controls.

(Response 228) Making sugar from sugarcane or sugar beets is a low-risk activity/food combination (see § 117.5(h)), and the statutory exemption in § 117.5(h) would apply to a small or very small business that makes sugar on-farm if the only other activities it conducts outside the farm definition are the low-risk activity/food combinations in § 117.5(g) and (h).

We decline the request to extend this exemption to a small or very small business that makes sugar off-farm or to a business that is not a small or very small business (see Response 213). As discussed in Response 222, the preventive controls that such businesses would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis, and any preventive control management components associated with a facility's preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. An off-farm facility that makes sugar from sugarcane or sugar beets can consider the findings of the section 103(c)(1)(C) RA (i.e., that this is a low-risk activity/food combination) in determining whether there are any hazards requiring a preventive control. A facility that appropriately determines through its hazard analysis that there are no hazards requiring preventive controls would document that determination in its written hazard analysis but would not need to establish preventive controls and associated management components.

15. Biological Hazards in Olive Oil

(Comment 229) Some comments ask us to establish an exemption for the consideration of biological hazards such as Salmonella and pathogenic E. coli in olive oil.

(Response 229) We decline this request. The rule requires the facility to conduct a hazard analysis to determine hazards requiring a preventive control. If the facility appropriately determines through its hazard analysis that biological hazards such as Salmonella and pathogenic E. coli are not hazards requiring a preventive control in its product, then these hazards would not be addressed in the facility's food safety plan.

We expect that there will be many circumstances in which a facility appropriately determines that certain biological, chemical, or physical hazards are not hazards requiring a preventive control that must be addressed in the food safety plan. The provisions of the rule that allow a facility to appropriately determine that a particular hazard is not a hazard requiring a preventive control in certain food products are not equivalent to an exemption from the rule. For example, a facility that appropriately determines that there are no hazards requiring a preventive control associated with its food products must document that determination in its written hazard analysis (§ 117.130(a)(2)); however, no preventive controls, including supplier verification activities, and associated management components would be required in such a situation. As discussed in Response 222, there are several types of food products for which a facility may determine that there are no hazards requiring a preventive control.

XII. Subpart A: Comments on Proposed § 117.7—Applicability of Part 117 to a Facility Solely Engaged in the Storage of Unexposed Packaged Food

We proposed that subpart C would not apply to a facility solely engaged in the storage of packaged food that is not exposed to the environment (proposed § 117.7(a)). We also proposed that a facility solely engaged in the storage of packaged food that is not exposed to the environment would be subject to the modified requirements that would be established in § 117.206 of subpart D (proposed § 117.7(b)).

Some comments support these proposed provisions without change. For example, one comment expresses the view that the safety of these products would be ensured during the manufacturing process by companies that comply with the stringent requirements of the proposed rule, and no new hazards will be introduced to the food at these facilities. Other comments that support the proposed provisions ask us to clarify some aspects of the provisions (see, e.g., Comment 230) or to clarify how the provisions will apply in particular circumstances (see, e.g., Comment 231 and Comment 232). Other comments that support the proposed provisions ask us to broaden them (see, e.g., Comment 233, Comment 234, and Comment 235).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 17, with editorial and conforming changes as shown in table 52. A key conforming change that affects § 117.7 is that the final exemption is from the requirements of subpart G, as well as subpart C. As discussed in section XLII, the final rule establishes the requirements for a supply-chain program in subpart G, rather than within subpart C as proposed.

(Comment 230) Some comments ask us to clarify the interplay between the proposed exemption (proposed § 117.7) and the proposed modified requirements (proposed § 117.206) to better reflect that the modified requirements would apply only to TCS foods. Some comments ask us to clarify that if a facility stores both TCS food and non-TCS food (i.e., unexposed packaged food that does not require time/temperature control for safety), then the modified requirements only apply for the portion of the facility that holds the TCS foods.

(Response 230) We have revised § 117.7(b) to clarify that a facility solely engaged in the storage of unexposed packaged food, including unexposed packaged food that requires time/temperature control to significantly minimize or prevent the growth of, or toxin production by, pathogens is subject to the modified requirements in § 117.206 of subpart D for any unexposed packaged food that requires time/temperature control to significantly minimize or prevent the growth of, or toxin production by, pathogens.

(Comment 231) Some comments ask us to revise the regulatory text to be explicit that frozen unexposed packaged food is not a TCS food subject to modified requirements.

(Response 231) We decline this request. In the 2013 proposed human preventive controls rule, we tentatively concluded that it would be rare for a frozen food to be a TCS food (78 FR 3646 at 3774), and we affirm that conclusion in this document. However, specifying in the regulatory text that a frozen food is not a TCS food would require us to conclude that a frozen food would “never” (rather than “rarely”) be a TCS food, and we lack information to support “never.”

(Comment 232) Some comments assert that a hazard analysis of the risks associated with storage of produce in vented crates would reveal no significant hazards and, thus, that even if we do not agree that produce packaged in vented crates satisfies the criterion “not exposed to the environment,” we should exercise enforcement discretion for produce packaged in vented crates.

(Response 232) As discussed in Response 170, produce stored in vented crates is not “unexposed packaged food.” Although environmental exposure to produce packed in vented crates would be less than environmental exposure to produce packed in open crates, a vented crate can subject produce to contamination. Thus, we disagree that we should not enforce the provisions of the rule for such produce. A facility that stores produce packed in vented crates must conduct a hazard analysis and evaluate whether there are any hazards requiring a preventive control. However, as discussed in Response 222, the preventive controls that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis, and any preventive control management components associated with a facility's preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. A facility that appropriately determines through its hazard analysis that there are no hazards requiring a preventive control associated with its food products would document that determination in its written hazard analysis (§ 117.130(a)(2)) but would not need to establish preventive controls and associated preventive control management components for its products.

(Comment 233) Some comments ask us to apply the exemption to storage areas of facilities that also engage in food processing activities—e.g., for distributors that are engaged in limited food processing, such as cutting vegetables or packing RTE foods. These comments assert that the intent of the term “solely” is to make clear that a facility that conducts an activity subject to the exemption does not escape responsibility for complying with the requirements for hazard analysis and risk-based preventive controls when conducting activities that are not exempt. In the comment's example, a facility that cuts vegetables or packs RTE foods would prepare and implement a food safety plan for cutting vegetables and packing RTE foods, but would not conduct a hazard analysis to determine whether there are significant hazards for storing unexposed packaged food.

(Response 233) We disagree with the comment's interpretation of the term “solely.” The plain meaning of “solely” is only, completely, entirely; without another or others; singly; alone (Ref. 44). The facility described in the comment is not “solely” engaged in the storage of unexposed packaged food.

Such a facility must conduct a hazard analysis that addresses all activities conducted by the facility. As discussed in Response 222, the preventive controls that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis, and any preventive control management components associated with a facility's preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. A facility that stores unexposed packaged food that is not a TCS food could, for example, determine that no preventive controls and associated management components would be necessary for those foods. A facility that stores unexposed refrigerated packaged TCS food could, for example, determine that preventive controls and management components patterned after the modified requirements in § 117.206 are adequate to address hazards requiring a preventive control associated with that food.

(Comment 234) Some comments ask us to allow a facility to designate a storage area as a separate facility for purposes of compliance with the requirements for hazard analysis and risk-based preventive controls. In the comments' view, an area solely engaged in the storage of unexposed packaged food could fall within the exemption in § 117.7 even though other areas would be subject to the requirements for hazard analysis and risk-based preventive controls.

Some comments contrast our proposed approach to applying the statutory provision for facilities “solely engaged in . . . storage” with our proposed approach to applying section 418 of the FD&C Act to farm mixed-type facilities and facilities that conduct activities subject to one of our HACCP regulations. These comments point out that, for farm mixed-type facilities, we determined that section 418 applies only with respect to the activities that trigger registration (78 FR 3646 at 3705). Likewise, these comments point out that for facilities that conduct activities subject to our HACCP regulations for seafood or juice, we determined that the facilities can be exempt from the requirements of section 418 with respect to the activities subject to those regulations but not with respect to other activities (78 FR 3646 at 3704).

(Response 234) We disagree that a designated storage area in an establishment that conducts manufacturing, processing, or packing in addition to storage can fall within the exemption for facilities “solely engaged in . . . storage.” The statute provides authority for us to exempt or modify the requirements for compliance with respect to “facilities” that are solely engaged in the storage of packaged foods that are not exposed to the environment (section 418(m) of the FD&C Act). The statute defines “facility” as a domestic facility or a foreign facility that is required to register under section 415 of the FD&C Act (section 418(o)(2) of the FD&C Act). The section 415 registration regulations define facility as “any establishment, structure, or structures under one ownership at one general physical location . . .” The comment's interpretation that we could view “areas” of registered facilities to be “facilities that are solely engaged in . . . the storage of packaged foods that are not exposed to the environment” is inconsistent with the statutory and regulatory framework under sections 415 and 418 of the FD&C Act.

See also the discussion in Response 233 regarding how a facility that both stores unexposed packaged food and conducts activities such as food processing or packing could address the requirements for hazard analysis and risk-based preventive controls for the storage activities conducted by the facility.

(Comment 235) Some comments ask us to consider an alternative to the exemption for unexposed packaged foods when a facility conducts manufacturing, processing, packing, or holding activities in addition to storing unexposed packaged food. Specifically, these comments ask us to recognize that the minimal risks of storing unexposed packaged foods can be addressed through a combination of compliance with the modified requirements for TCS foods (if applicable) and the CGMPs in subpart B and state that doing so would be consistent with our discussion in the 2013 proposed human preventive controls rule.

(Response 235) These comments appear to suggest the outcome of a facility's hazard analysis for storing unexposed packaged food—i.e., that the only hazards requiring a preventive control are the potential for growth of pathogens in refrigerated unexposed packaged foods and that the preventive controls and preventive control management components specified in the modified requirements for TCS food are adequate to address such hazards. It is the responsibility of the facility's preventive controls qualified individual to identify the hazards requiring a preventive control associated with the facility and the food it stores, as well as the appropriate preventive controls and preventive control management components. However, we agree that in some cases the approach suggested in these comments would be appropriate.

(Comment 236) Some comments assert that it is difficult to identify TCS foods and that the benefits of undertaking that work are unclear when existing CGMP requirements protect public health. These comments ask us to work with industry and professional organizations to develop guidance on when the modified requirements apply. Other comments ask us to specify that specific foods such as yogurt are not TCS foods and provide scientific information to support their request.

(Response 236) This document does not include guidance on whether specific foods, such as yogurt, are TCS foods. Information on whether specific foods are TCS foods is already widely available—e.g., in Annex 3, Chapter 1 (Purpose and Definitions) of the Food Code (Ref. 51) and in a report prepared for us under contract by the Institute of Food Technologists (Ref. 52). A facility solely engaged in storage of unexposed packaged food can consult the Food Code or work with the manufacturer of the food to identify TCS food. Alternatively, such a facility could simply treat any refrigerated food as a TCS food.

Although we agree with comments that in general yogurt would not be a TCS food, whether a particular yogurt is a TCS food would depend on what is added to the yogurt. For example, in 1989 an outbreak of foodborne botulism in the United Kingdom from the consumption of yogurt containing added hazelnut conserve (puree) caused 27 illnesses and one death (Ref. 53). The hazelnut puree had not been adequately processed to prevent toxin production by C. botulinum. Even though this particular outbreak was not related to the question of whether yogurt is a TCS food, it demonstrates the importance of having a preventive controls qualified individual consider all hazards associated with a product to determine whether there are hazards requiring a preventive control, including temperature control.

XIII. Subpart B: Comments on Proposed § 117.10—Personnel

We proposed to re-establish the provisions of § 110.10 in new § 117.10 with some revisions to modernize them. Some comments agree with one or more of these proposed provisions without change. For example, some comments state that the proposed provisions for disease control are already widely practiced across the produce industry and are part of most food safety guidance and standards. Some comments that support the proposed revisions suggest alternative or additional regulatory text (see, e.g., Comment 243 and Comment 244) or ask us to clarify how we will interpret the revised provision (see, e.g., Comment 239). Other comments that support provisions that we proposed to re-establish in part 117 without change ask us to revise or clarify those provisions (see, e.g., Comment 237, Comment 238, Comment 240, and Comment 241).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we proposed to re-establish in § 117.10 with no changes. After considering these comments, we have revised the proposed provisions as shown in table 18, with editorial and conforming changes as shown in table 52.

A. Management Responsibility for Requirements Applicable to Personnel

We proposed no revisions to the requirement that plant management must take all reasonable measures and precautions to ensure compliance with the provisions for disease control, cleanliness, and training.

(Comment 237) Some comments ask us to remove “all” because it is too extreme and prescriptive. These comments ask us to instead specify that the intended measures and precautions must be “adequate.”

(Response 237) We have revised the regulatory text to delete “all.” We disagree that the term “all” in this long-standing provision is too extreme and prescriptive, but find that the term “all” is not necessary to communicate the intent of the requirement. We decline the request to add “adequate.” The intent of the requirement is to communicate our expectation that these measures and precautions are reasonable. Other, more specific provisions that management must address specify that particular measures and precautions must be “adequate” (see § 117.10(b)(2), (3), and (4)).

B. Proposed § 117.10(a)—Disease Control

We proposed no revisions to the requirement that any person who, by medical examination or supervisory observation, is shown to have, or appears to have, an illness, open lesion, including boils, sores, or infected wounds, or any other abnormal source of microbial contamination by which there is a reasonable possibility of food, food-contact surfaces, or food-packaging materials becoming contaminated, must be excluded from any operations which may be expected to result in such contamination until the condition is corrected. Personnel must be instructed to report such health conditions to their supervisors.

(Comment 238) Some comments ask us to provide flexibility to not exclude from operations personnel who have an open lesion (such as boils, sores or any other infected wounds) that is covered completely using appropriate first aid materials.

(Response 238) We have revised the regulatory text to reflect flexibility such as that provided in FDA's Food Code (Ref. 51). Under the Food Code, workers need not be excluded if an open lesion on hands and wrists, or on exposed portions of arms, is protected by an impermeable cover, and workers need not be excluded if an open lesion on other parts of the body is covered by a dry, durable, tight-fitting bandage.

C. Proposed § 117.10(b)—Cleanliness

1. Proposed § 117.10(b)(1)—Outer Garments

We proposed that the methods for maintaining cleanliness include wearing outer garments suitable to the operation in a manner that protects against the contamination of food, food-contact surfaces, or food-packaging materials and to protect against the cross-contact of food.

(Comment 239) Some comments ask us to clarify whether the newly proposed requirement to prevent allergen cross-contact would require a line worker to change outer garments when switching between individual food-production lines if separate major allergens are present on the food production lines.

(Response 239) The provision does not prescribe the specific methods by which wearing outer garments must protect against allergen cross-contact and, thus, the establishment has flexibility to take appropriate steps to satisfy the requirements in the context of the establishment and the food it produces. Requiring a line worker to change outer garments when switching between individual food-production lines could be an appropriate precaution for some establishments. When a facility that is subject to the requirements for hazard analysis and risk-based preventive controls determines that it is necessary to require a line worker to change outer garments to prevent allergen cross-contact between food-production lines, the facility could decide to establish such a procedure as a food allergen control under § 117.135(c)(2).

2. Proposed § 117.10(b)(4)—Unsecured Jewelry and Other Objects

We proposed to require that the methods for maintaining cleanliness include removing all unsecured jewelry and other objects that might fall into food, equipment, or containers, and removing hand jewelry that cannot be adequately sanitized during periods in which food is manipulated by hand. If such hand jewelry cannot be removed, it may be covered by material which can be maintained in an intact, clean, and sanitary condition and which effectively protects against the contamination by these objects of the food, food-contact surfaces, or food-packaging materials.

(Comment 240) Some comments ask us to modify the requirements to provide that they only apply as appropriate to each operation and recommend that jewelry be removed when the company's hazard analysis determines that it is a hazard. These comments acknowledge that jewelry is a physical hazard in some instances, but assert that objects such as jewelry are not a physical hazard for operations conducted on many medium- to large-sized RACs (e.g., melons, apples, oranges, potatoes).

(Response 240) We decline this request. We included this long-standing provision of the umbrella CGMPs during our last revision of the food CGMPs based on public comments during that rulemaking (51 FR 22458 at 22463). The provision provides flexibility for an establishment to do what is appropriate in the context of its own operations—e.g., by limiting some requirements to “unsecured” jewelry and by providing options to cover hand jewelry during periods in which food is manipulated by hand. Although a facility could decide to also establish preventive controls for jewelry as a physical hazard following a hazard analysis, such preventive controls would be distinct from the more general CGMP requirements in this provision.

3. Proposed § 117.10(b)(5)—Gloves

We proposed that the methods for maintaining cleanliness include maintaining gloves, if they are used in food handling, in an intact, clean, and sanitary condition. We also proposed to delete a recommendation that gloves should be of an impermeable material. Although some comments ask us to retain this nonbinding recommendation, as discussed in Response 67 we are deleting those non-binding recommendations of part 110 that we are not establishing as requirements.

4. Proposed § 117.10(b)(7)—Clothing and Other Personal Belongings

We proposed to require that the methods for maintaining cleanliness include storing clothing or other personal belongings in areas other than where food is exposed or where equipment or utensils are washed.

(Comment 241) Some comments ask us to specify that the requirements only apply to “extra” clothing. These comments express concern that the requirement otherwise might be interpreted to mean that no personal clothing is allowed in these areas (e.g., that employees are permitted to wear only company‐issued uniforms).

(Response 241) We decline this request. This long-standing provision of the umbrella GMPs has been in place for decades. The comments do not provide any examples of how we have interpreted this provision in the past to mean that employees must wear company-issued uniforms.

5. Proposed § 117.10(b)(8)—Eating Food, Drinking Beverages, and Using Tobacco

We proposed to require that the methods for maintaining cleanliness include confining the following to areas other than where food may be exposed or where equipment or utensils are washed: eating food, drinking beverages, or using tobacco.

(Comment 242) Some comments note that the provision would no longer require that chewing gum be confined to areas other than where food may be exposed or where equipment or utensils are washed. These comments ask us whether this omission was intentional, or whether we are simply considering that requirements applicable to “chewing gum” are covered by those for “eating food.” Some comments state that it would not be immediately obvious to many laypersons as to whether the chewing of gum is included in “eating food.”

(Response 242) We agree that removing the phrase “chewing gum” from this provision could make it unclear that this long-standing requirement regarding chewing gum still applies and we have revised the proposed regulatory text to retain the express requirement regarding chewing gum. As the comments point out, the statute includes chewing gum in its definition of “food” (see section 201(f) of the FD&C Act). However, in this long-standing provision, the term “chewing gum” is used to mean “the act of chewing” rather than to refer to the gum itself.

(Comment 243) Some comments regarding processes conducted on RACs ask us to modify the regulatory text to distinguish “drinking beverages” from “drinking water.” These comments note that this provision is of concern to their industry because drinking water needs to be readily available to workers.

(Response 243) We decline this request. We acknowledge that workers may need ready access to drinking water when conducting activities on RACs, particularly in an environment that is largely outdoors (such as in an off-farm packinghouse that has a roof but is otherwise largely unenclosed). However, this provision does not apply to on-farm activities such as harvesting of RACs. During packing activities covered by this rule, workers must move away from the packing operations to get a drink. The establishment can make drinking water available in a designated area that is nearby, and provide multiple designated areas when appropriate to make drinking water readily available to all workers.

6. Proposed § 117.10(b)(9)—Any Other Necessary Precautions

We proposed that the methods for maintaining cleanliness include taking any other necessary precautions to protect against contamination of food, food-contact surfaces, or food-packaging materials with microorganisms or foreign substances (including perspiration, hair, cosmetics, tobacco, chemicals, and medicines applied to the skin) and to protect against cross-contact of food.

(Comment 244) Some comments ask us to specify that the provision applies to “medicines or other products” applied to the skin.

(Response 244) We decline this request. The comment does not explain what “other products” applied to the skin are not already covered by “cosmetics” and “medicines.” For example, powders and lotions applied as “make-up” generally would be cosmetics and products such as sunscreen generally are classified as over-the-counter medicines.

XIV. Subpart B: Comments on Proposed § 117.20—Plant and Grounds

We proposed to re-establish the provisions of § 110.20 in new § 117.20 with some revisions to modernize them. Some comments agree with one or more of these proposed revisions without change. Some comments that support the proposed revisions suggest alternative or additional regulatory text (see, e.g., Comment 251 and Comment 256) or ask us to clarify how we will interpret the revised provision (see, e.g., Comment 253). Other comments that support provisions that we proposed to re-establish in part 117 without change ask us to revise or clarify those provisions (see, e.g., Comment 246, Comment 247, Comment 248, Comment 250, and Comment 254).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we proposed to re-establish in § 117.20 with no changes. After considering these comments, we have revised the proposed provisions as shown in table 19, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.20(a)—Grounds

1. Proposed § 117.20(a)—Management Responsibility for Maintaining Grounds

We proposed no revisions to the requirement that the grounds about a food plant under the control of the operator must be kept in a condition that will protect against the contamination of food.

(Comment 245) Some comments ask us to specify that the requirements do not apply to test/pilot kitchens.

(Response 245) We decline this request. An establishment must have control of the grounds under its control regardless of the specific food or amount of food being produced, because litter, waste, weeds, and grass can all attract and harbor pests, and the first step for pest control in the plant is to avoid attracting pests.

2. Proposed § 117.20(a)(1)—Equipment, Litter, Waste, Weeds, and Grass

We proposed no revisions to the requirement that the methods for adequate maintenance of grounds include properly storing equipment, removing litter and waste, and cutting weeds or grass within the immediate vicinity of the plant buildings or structures that may constitute an attractant, breeding place, or harborage for pests.

(Comment 246) Some comments ask us to specify “immediately adjacent to” rather than “the immediate vicinity.” These comments also ask us to provide guidance on the importance of pollinator habitat so that inspectors will view such areas within the greater context of the farm and not immediately see that the farm is out of compliance.

(Response 246) We decline the request to modify the regulatory text of this long-standing provision. We note that a “farm” is not subject to the CGMP requirements of subpart B (see § 117.5(k)). We do not see that the suggested modification would provide any specific information to investigators who are inspecting a food establishment (such as a farm mixed-type facility or packing shed) that has pollinator habitat near plant buildings or structures. We expect that investigators will adapt their inspection programs to account for such circumstances and food establishments will take steps to prevent weeds or grass in a pollinator habitat from leading to problems with pests in the plant.

3. Proposed § 117.20(a)(4)—Operating Systems for Waste Treatment and Disposal

We proposed no revisions to the requirement that the methods for adequate maintenance of grounds must include operating systems for waste treatment and disposal in an adequate manner so that they do not constitute a source of contamination in areas where food is exposed. If the plant grounds are bordered by grounds not under the operator's control and not maintained in the manner described in § 117.20(a)(1) through (a)(3), care must be exercised in the plant by inspection, extermination, or other means to exclude pests, dirt, and filth that may be a source of food contamination.

(Comment 247) Some comments assert that the term “adequate” has been added to this provision and is ambiguous when used to describe the way in which “operating systems for waste treatment and disposal” must be managed, even though that term is defined in the rule. These comments ask us to clarify what constitutes “adequate” for the purpose of this provision, such as whether it requires compliance with local plumbing codes.

(Response 247) The term “adequate” has been in § 110.20(a) and (a)(4) since 1986 (51 FR 22477). This long-standing provision addresses matters under FDA's jurisdiction rather than local plumbing codes. An example of waste disposal under FDA's jurisdiction is an operating system for water disposal. Such an operating system would be inadequate if it allowed water to accumulate on the facility grounds and become an attractant for pests.

(Comment 248) Some comments ask us to clarify how the requirements in § 117.20(a) would apply to potential problems associated with neighboring grounds. Other comments note that we proposed to address potential problems with neighboring grounds within the final sentence of this provision (proposed § 117.20(a)(4)) and suggest editorial changes to more clearly identify the requirements regarding grounds under the control of a neighboring entity.

(Response 248) These provisions do not require an establishment to take action on its neighbor's property to protect against contamination, but do require an establishment to be aware of any problems that may affect its own grounds. For example, if a neighbor's grass is long, the establishment is not required to mow the neighbor's grass, but if the long grass in the neighbor's property provides a breeding ground for pests, the establishment needs to be aware of this potential for contamination and may need to take mitigating actions (e.g., enhanced pest control in the bordering areas).

We have clarified the proposed requirements by redesignating the final sentence of proposed § 117.20(a)(4) as § 117.20(a)(5) and specifying that the requirements of newly designated § 117.20(a)(5) apply if the plant grounds are bordered by grounds not under the operator's control and not maintained in the manner described in § 117.20(a)(1) through (a)(4) (rather than in § 117.20(a)(1) through (a)(3)).

B. Proposed § 117.20(b)—Plant Construction and Design

1. Proposed § 117.20(b)—Suitability of Plant Construction and Design

We proposed that the plant buildings and structure must be suitable in size, construction, and design to facilitate maintenance and sanitary operations for food-production purposes (i.e., manufacturing, processing, packing, and holding).

(Comment 249) Some comments ask us to specify that the requirements for suitability of plant construction and design apply only where the potential for contamination exists.

(Response 249) We decline this request. A plant requires suitable construction and design regardless of the specific potential for contamination at any particular location in the plant. Each of the seven more specific provisions governed by § 117.20(b) adds the context that the requirements are directed to what is “adequate” (e.g., adequate space, adequate precautions, and adequate cleaning). The defined term “adequate” provides context that the purpose of the requirements for plant construction and design are related to public health.

2. Proposed § 117.20(b)(1)—Placement of Equipment and Storage of Materials

We proposed no revisions to the requirement that the plant must provide sufficient space for such placement of equipment and storage of materials as is necessary for the maintenance of sanitary operations and the production of safe food.

(Comment 250) Some comments assert that the phrase “maintenance of sanitary operations” is unclear because it does not clearly communicate that maintenance of equipment and the facility is necessary for the production of safe food. These comments ask us to revise the provision to specify that the plant must provide sufficient space for such placement of equipment and storage of materials as is necessary for maintenance, sanitary operations, and the production of safe food.

(Response 250) We agree that the suggested revision adds clarity and have modified the provision as requested. The revised requirement is consistent with the governing paragraph in § 117.20(b), which clearly addresses both maintenance and sanitary operations.

3. Proposed § 117.20(b)(2)—Reduce Potential for Contamination and Allergen Cross-Contact Through Adequate Food Safety Controls and Operating Practices or Effective Design

We proposed that the plant must permit the taking of proper precautions to reduce the potential for contamination of food, food-contact surfaces, or food-packaging materials with microorganisms, chemicals, filth, and other extraneous material, and to reduce the potential for cross-contact. The potential for cross-contact and contamination may be reduced by adequate food safety controls and operating practices or effective design, including the separation of operations in which cross-contact and contamination are likely to occur, by one or more of the following means: Location, time, partition, air flow, enclosed systems, or other effective means.

(Comment 251) Some comments ask us to specify both air flow systems and dust control systems as examples of separation of operations in which allergen cross-contact and contamination are likely to occur.

(Response 251) We agree that both air flow systems and dust control systems are appropriate examples of separation of operations and have added these examples as requested.

4. Proposed § 117.20(b)(3)—Food in Outdoor Bulk Vessels

We proposed that the plant must permit the taking of proper precautions to protect food in outdoor bulk vessels by any effective means, including using protective coverings, controlling areas over and around the vessels to eliminate harborages for pests, checking on a regular basis for pests and pest infestation, and skimming fermentation vessels.

(Comment 252) Some comments express concern about applying these provisions to the transport of large RACs such as watermelons and assert that there would be no food safety advantage to doing so after the RACs had spent the growing season in an uncovered environment.

(Response 252) The comments are mistaken about these requirements, which relate to installed bulk vessels such as outdoor tanks, silos, etc. Moreover, this section addresses the construction and design of the plant, not transportation. To make this clearer, we have revised the provision to specify that it applies to “installed outdoor bulk vessels.”

(Comment 253) Some comments ask us to clarify that the requirements do not apply to open containers of RACs that are subject to further processing. Other comments assert that lugs, totes, corrugated bins, and harvest containers used to hold fruit are not bulk vessels that are subject to the provision. The comments explain that these containers are designed and built to be open at the top, with air holes on the sides and bottom that provide an adequate air flow to the fruit.

(Response 253) The requirement applies to installed bulk vessels, not containers (including lugs, totes, corrugated bins, and harvest containers generally) that are delivered to a food establishment for packing or processing. (See discussion in Response 252.) Thus, the provision does not preclude the use of such containers. Although the provision specifies the use of protective coverings, it does so only as an example of an effective means of precautions to protect food held in outdoor vessels. Other specified examples of precautions to protect food held in outdoor bulk vessels include controlling areas over and around the vessels to eliminate harborages for pests, and checking on a regular basis for pests and pest infestation. Such measures to protect against pests are appropriate when food such as fruit is held in outdoor containers. (See also Response 327.)

We agree that the measures taken by the establishment are those applicable to public health protection. To make this clearer, we have revised the provision to refer to “adequate precautions” rather than “proper precautions,” because the defined term “adequate” focuses on public health.

5. Proposed § 117.20(b)(5)—Lighting

We proposed no revisions to the requirement that the plant must provide adequate lighting in hand-washing areas, dressing and locker rooms, and toilet rooms and in all areas where food is examined, processed, or stored and where equipment or utensils are cleaned; and provide safety-type light bulbs, fixtures, skylights, or other glass suspended over exposed food in any step of preparation or otherwise protect against food contamination in case of glass breakage.

(Comment 254) Some comments ask us to add that the plant must provide adequate lighting in areas where food is packed and to substitute the term “shatter-resistant” for the term “safety-type.”

(Response 254) We have revised the provision to specify that it applies to areas in the plant where food is examined, manufactured, processed, packed, or held. Doing so makes the terms in this provision consistent with terms used throughout the CGMPs (78 FR 3646 at 3692). We also have substituted the term “shatter-resistant” for the term “safety-type.” “Shatter-resistant” is a more modern term describing the safety features that are specified in the provision.

6. Proposed § 117.20(b)(6)—Ventilation

We proposed that a plant must provide adequate ventilation or control equipment to minimize odors and vapors in areas where they may contaminate food; and locate and operate fans and other air-blowing equipment in a manner that minimizes the potential for contaminating food-contact surfaces and for cross-contact.

(Comment 255) Some comments ask us to specify “where necessary” to modify “adequate.”

(Response 255) We decline this request because “where necessary” is captured by “is needed” in the long-standing definition of “adequate.”

(Comment 256) Some comments ask us to specify that the provision requires minimizing dust and that the applicable areas include areas where dust could cause allergen cross-contact.

(Response 256) We agree that it is important to minimize dust (e.g., dust from milk powder that could be a source of allergen cross-contact) and have modified the provision as requested.

7. Proposed § 117.20(b)(7)—Screening

We proposed no revisions to the requirement that the plant must provide, where necessary, adequate screening or other protection against pests.

(Comment 257) Some comments ask us to add examples of adequate screening, such as by window screens, door sweeps, gap sealant, or other appropriate measures.

(Response 257) We decline this request. Although the examples suggested by the comment appear to be acceptable, examples of screening are not necessary in this long-standing requirement.

XV. Subpart B: Comments on Proposed § 117.35—Sanitary Operations

We proposed to re-establish the provisions of § 110.35 in new § 117.35 with some revisions to modernize them. Some comments agree with one or more of these proposed provisions without change. Some comments that support the proposed revisions suggest alternative or additional regulatory text (see, e.g., Comment 258, Comment 261, Comment 263, Comment 269, Comment 272, and Comment 273) or ask us to clarify how we will interpret the revised provision (see, e.g., Comment 260, Comment 267, Comment 268, and Comment 270). We also proposed to delete current § 110.35(d)(5) (requirements for sanitizing agents) because it would be redundant with another proposed provision (proposed § 117.35(b)(1)). We received no comments that disagreed with this proposed deletion and are not re-establishing current § 110.35(d)(5) in part 117.

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions. After considering these comments, we have revised the proposed provisions as shown in table 20, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.35(a)—General Maintenance

We proposed that buildings, fixtures, and other physical facilities of the plant must be maintained in a sanitary condition and must be kept in repair sufficient to prevent food from becoming adulterated. Cleaning and sanitizing of utensils and equipment must be conducted in a manner that protects against cross-contact and contamination of food, food-contact surfaces, or food packaging materials.

(Comment 258) Some comments ask us to specify that buildings, fixtures, and other physical facilities of the plant must be maintained in a “clean” condition in addition to a “sanitary” condition.

(Response 258) We have revised the requirement as requested. Doing so is consistent with other provisions of subpart B that specify clean and sanitary conditions (e.g., the personnel cleanliness provisions in § 117.10(b)(4) and (5)), including the requirements for sanitary operations (see the requirements for substances used in cleaning and sanitizing in § 117.35(b)(1) and the requirements for sanitation of food-contact surfaces in § 117.35(d)).

(Comment 259) Some comments ask us to qualify the level of sanitation required for different areas of the plant because the degree of sanitation required for a warehouse or utility room is different from the degree of sanitation required for a processing room.

(Response 259) We decline this request. The requirement is a long-standing provision that has been used in this context for decades. The comments do not provide any examples of how we have interpreted this provision in the past in a manner that does not acknowledge the appropriate degree of sanitation required in different areas of a plant. Importantly, however, the fact that the degree of sanitation may be different does not mean that it could be appropriate, for example, for pests to be present in areas, like utility rooms, that may not need the same degree of sanitation as a processing room.

(Comment 260) Some comments assert that by its nature, the operations of some facilities generate dust and debris. For example, although equipment such as conveyors and screens used for hulling and shelling almonds can be cleaned before use, as soon as operations begin dust will accumulate on the surfaces of the equipment. Some comments ask us to clarify that the intent of the CGMP requirements for sanitary operations is to ensure that equipment is clean prior to use, with the understanding that once operations commence, dust will accumulate and that the presence of this type of dust and debris does not necessarily mean that sanitation is not being regularly conducted.

(Response 260) We agree that the intent of the CGMP requirements for sanitary operations is to ensure that equipment is clean prior to use. However, the fact that dust and debris can accumulate during some production operations does not excuse the establishment from taking appropriate steps to prevent food from becoming contaminated. The timing and extent of such steps would depend on the nature of the food and the production operation.

B. Proposed § 117.35(b)—Substances Used in Cleaning and Sanitizing; Storage of Toxic Materials

1. Proposed § 117.35(b)(1)—Cleaning Compounds and Sanitizing Agents

We proposed that cleaning compounds and sanitizing agents used in cleaning and sanitizing procedures must be free from undesirable microorganisms and must be safe and adequate under the conditions of use. We also proposed that mechanisms to comply with provisions related to cleaning compounds and sanitizing agents must be safe and effective and provided examples of ways to achieve such compliance (78 FR 3646 at 3721). Only the toxic materials listed in this provision may be used or stored in a plant where food is processed or exposed.

(Comment 261) Some comments ask us to specify that “Cleaning and sanitizing agents used on food-contact surfaces must contain only ingredients which are generally recognized as safe or are approved in § 178.1010 for use in cleaning and sanitizing food-contact surfaces” because this information will be useful to processors who may be unaware of the specific kinds of substances approved for food-contact surfaces. Other comments ask us to specify that residual levels of cleaning and sanitizing agents which are generally recognized as safe or are approved for use on food-contact surfaces are permissible.

(Response 261) We decline these requests. Requirements such as those applicable to substances added to food or substances used in cleaning and sanitizing food-contact surfaces are available elsewhere in our regulations and it is neither practical nor necessary to use the CGMP requirements of part 117 as a means to communicate some or all of these other requirements. For example, the manufacturer of a food product must also comply with food labeling regulations ranging from declaration of ingredients (§ 101.4) to health claims (part 101, subpart E).

2. Proposed § 117.35(b)(2)—Identification and Storage of Toxic Materials

We proposed that toxic cleaning compounds, sanitizing agents, and pesticide chemicals must be identified, held, and stored in a manner that protects against contamination of food, food-contact surfaces, or food-packaging materials. We also proposed to remove a recommendation for following all relevant regulations promulgated by other Federal, State, and local government agencies for the application, use, or holding of toxic cleaning compounds, sanitizing agents, and pesticides.

(Comment 262) Some comments ask us to specify that we require that the compounds, agents, and pesticides be used according to the manufacturer's instructions.

(Response 262) We decline this request. Such a recommendation is more properly addressed by the applicable Federal, State, and local government agencies. See the discussion at 78 FR 3646 at 3721.

C. Proposed § 117.35(c)—Pest Control

We proposed that pests must not be allowed in any area of a food plant. Guard or guide dogs may be allowed in some areas of a plant if the presence of the dogs is unlikely to result in contamination of food, food-contact surfaces, or food-packaging materials. Effective measures must be taken to exclude pests from the manufacturing, processing, packing, and holding areas and to protect against the contamination of food on the premises by pests. The use of insecticides or rodenticides is permitted only under precautions and restrictions that will protect against the contamination of food, food-contact surfaces, and food-packaging materials.

(Comment 263) Some comments ask us to specify “pest-detection” dogs in addition to guard and guide dogs because the use of animals to detect pests is widespread in the professional pest management industry for concealed and difficult to find pests. Comments assert that like guard and guide dogs, detection dogs are well trained and should be permissible in areas of the plant where the presence of the dog is unlikely to result in contamination of the food, food-contact surfaces or food-packaging materials.

Other comments ask us to specify that pests must not be allowed in any area of a food plant “where appropriate” or “where the potential for contamination exists.” Other comments assert that animals should be excluded from all areas that are used by production or packaging employees or that communicate with food processing, packing, or storage areas. Some comments ask us to clarify whether this provision includes administrative offices, cafeterias, and other rooms that are not directly involved in the processing, packing, or holding of food because the provision applies to “any area of a food plant.”

(Response 263) We have revised the regulatory text to account for “pest-detection dogs.” However, we have not otherwise modified the regulatory text of this long-standing provision as a result of these comments. Areas of the food plant (such as a cafeteria) that are not directly involved with production may nonetheless be a source of contamination (e.g., if there are pests in that area). We have long provided that specified types of dogs may be allowed in some areas of a plant provided that the presence of the dogs is unlikely to result in contamination, and the comments provide no basis for why this qualified exception is no longer appropriate.

(Comment 264) Some comments ask us to specify that insecticides and rodenticides are types of pesticides and that the use of these substances is permitted in accordance with the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) label precautions and restrictions.

(Response 264) We have revised the regulatory text to specify the “use of pesticides” rather than the “use of insecticides and rodenticides “to use the broader term “pesticides.” We also modified the regulatory text to clarify that the restrictions on use of pesticides is when the pesticides are used “to control pests.” We made this modification because we are aware that some food processing processes (such as fumigating almonds) involve treating food with substances that are classified as “pesticides.” Without this modification, the provision could mistakenly appear to prevent establishments from conducting such processes.

We decline to modify the text to account for FIFRA label precautions and restrictions. See (Response 262).

(Comment 265) Some comments express concern that the phrases “must not be allowed” and “exclude” suggest that it is always possible to prevent all types of pests. Some comments assert that it is not always possible to prevent all types of pests, especially on farms and in areas where pests are prevalent because of the presence of conditions over which the food manufacturer has no control. Some comments assert that a food establishment should be required to take all reasonable measures to exclude pests, but an outright “exclude” is unrealistic.

(Response 265) The requirements apply to activities conducted in a plant and do not apply to activities that are within the “farm” definition, such as harvesting RACs and on-farm packing of RACs. We disagree that effective measures cannot be taken to exclude pests from a plant that is fully enclosed. When a plant is only partially enclosed (e.g., a partially enclosed area that processes seafood taken off a fishing vessel, or a partially enclosed building on an off-farm establishment that packs RACs), we would interpret the provision in a manner consistent with the provisions of previous guidance, such as our 2005 “Guide to Produce Farm Investigations” and the final provisions of the produce safety rule. We are not modifying the requirement to incorporate this interpretation because pest control in buildings that are only partially enclosed will be a concern for only a small percentage of establishments subject to subpart B.

D. Proposed § 117.35(d)—Sanitation of Food-Contact Surfaces

We proposed that all food-contact surfaces, including utensils and food-contact surfaces of equipment, must be cleaned as frequently as necessary to protect against cross-contact and contamination of food.

(Comment 266) Some comments ask us to specify that all food-contact surfaces must also be sanitized.

(Response 266) We decline this request. These long-standing requirements identify specific circumstances when food-contact surfaces must be sanitized (see § 117.35(d)(2), which specifies circumstances when food-contact surfaces must be sanitized when used in wet processing operations). The comment provided no basis for why food-contact surfaces must be sanitized when they will be used in manufacturing/processing or holding low-moisture food or why food-contact surfaces must be sanitized when used in wet processing operations other than the circumstances specified in § 117.35(d)(2). There are some situations in which food-contact surfaces do not need to be sanitized. For example, raw materials and other ingredients for processing may be held in clean containers prior to processing with steps lethal to microorganisms; sanitizing such containers is not necessary for the production of safe food.

(Comment 267) Some comments ask us to clarify that we are not requiring an absolutely allergen-free environment, but rather that the expectation is that the manufacturer will take steps to identify potential sources of allergen cross-contact and implement preventive measures. Some comments ask us to also clarify that dedicated lines or equipment are not required for effective preventive control of food allergens. Some comments discuss practical difficulties that arise when balancing the need to control microorganisms such as Salmonella in chocolate and low-moisture confectionary products (through procedures such as dry cleaning) with the control of allergens (which may be controlled better when wet cleaning procedures are used).

(Response 267) See also the discussion of food allergen controls in Response 429. This rule does not establish a particular standard for preventing allergen cross-contact. In general, when we do establish a standard we avoid “absolute” standards such as the “absolutely allergen-free” standard mentioned by the comment. Likewise, the rule does not require the use of dedicated lines or equipment for effective prevention of allergen cross-contact. As the comments suggest, the intent of the requirement is for the manufacturer to take steps to identify potential sources of allergen cross-contact and implement preventive measures.

(Comment 268) Some comments ask us to clarify that the use of advisory label statements is appropriate when allergen cross-contact has been reduced to the greatest extent possible, but cannot be eliminated with certainty.

(Response 268) See Response 434 for a discussion about the use of advisory label statements.

E. Proposed § 117.35(d)(1)—Food-Contact Surfaces Used for Manufacturing/Processing or Holding

We proposed that food-contact surfaces used for manufacturing/processing or holding low-moisture food must be in a clean, dry, sanitary condition at the time of use. When the surfaces are wet-cleaned, they must, when necessary, be sanitized and thoroughly dried before subsequent use.

(Comment 269) Some comments ask us to specify “packing” for clarity and completeness.

(Response 269) We have revised the provision to specify that it applies to food-contact surfaces used for manufacturing, processing, packing, or holding low-moisture food. Doing so makes the terms in this provision consistent with terms used throughout the CGMPs (78 FR 3646 at 3692).

(Comment 270) Some comments ask us to clarify that the proposed requirement to maintain food-contact surfaces in a sanitary condition is not a requirement to sanitize all product contact surfaces. These comments also ask us to specifically allow the continued use of cleaning methods based on a risk assessment, including dry cleaning with no sanitizing step. Some comments ask us to clarify that “sanitary condition” is not synonymous with “sanitized” from an antimicrobial standpoint.

(Response 270) See Response 266. This provision does not require that all product contact surfaces be sanitized and, thus, it is not necessary to specify that dry cleaning methods with no sanitizing step are acceptable in certain circumstances. We do not consider “sanitary condition” to be synonymous with “sanitized.” We consider “sanitary condition” to be a state of cleanliness. Terms such as “sanitize” and “sanitizing” are associated with the reduction of microorganisms.

(Comment 271) Some comments ask us to specify different requirements for food-contact surfaces used during different stages of manufacturing/processing or holding. These comments explain that the provision does not accommodate initial processing steps prior to moisture removal where food-contact surfaces will be exposed to moist (non-dry) conditions. These comments also explain that the provision also does not recognize that food-contact surfaces may not appear to be “sanitary” when raw materials handled at initial processing steps have not yet undergone subsequent processes designed to eliminate microorganisms of public health concern. Some comments ask us to specify that food-contact surfaces only need to be clean and sanitary “before use and after any interruption during which the food-contact surfaces may have become contaminated.” Comments also ask us to specify that “finished product low-moisture food-contact surfaces must be maintained in a clean, dry, and sanitary condition.”

(Response 271) We decline these requests. This long-standing provision has been used in this context for decades. The full requirements for sanitation of food-contact surfaces (§ 117.35(d), (d)(1), and (d)(2)) address both processing of low-moisture foods and wet processing. It is not practical to describe all variations of complex manufacturing scenarios that may involve both wet processing and low-moisture foods. Instead, we expect both industry and regulators to appropriately apply the specific requirements associated with the sanitary condition of food-contact surfaces during such complex manufacturing scenarios. The comments do not provide any examples of how we have interpreted this provision in the past in a way that does not accommodate manufacturing processes such as those it describes.

(Comment 272) Some comments ask us to specify that food-contact surfaces used for manufacturing/processing or holding low-moisture food be in a clean, dry, sanitary condition “prior to use or the start of production” instead of “at time of use” to more accurately reflect the reality of food processing. Some comments express concern that properly cleaned and sanitized food-contact surfaces begin to accumulate small dust particles on the surface of conveyors, sizing screens, and other equipment surfaces as soon as operations commence. These comments assert that it is unrealistic to keep the equipment in a clean, dry, sanitary condition during the entire operation.

(Response 272) We have revised the regulatory text to specify that the requirement applies “before use.” We agree that “before use” more accurately describes the intent of the requirement.

F. Proposed § 117.35(d)(2)—Wet Cleaning

We proposed that in wet processing, when cleaning is necessary to protect against cross-contact and the introduction of microorganisms into food, all food-contact surfaces must be cleaned and sanitized before use and after any interruption during which the food-contact surfaces may have become contaminated. Where equipment and utensils are used in a continuous production operation, the utensils and food-contact surfaces of the equipment must be cleaned and sanitized as necessary.

(Comment 273) Some comments ask us to specify that this requirement applies when cleaning is necessary to protect against allergen cross-contact or the introduction of microorganisms into food, not only when both conditions are satisfied.

(Response 273) We have revised the regulatory text to specify “necessary to protect against allergen cross-contact or the introduction of microorganisms into food.”

G. Proposed § 117.35(d)(3)—Single-Service Articles

We proposed that single-service articles (such as utensils intended for one-time use, paper cups, and paper towels) should be stored in appropriate containers and must be handled, dispensed, used, and disposed of in a manner that protects against cross-contact and contamination of food, food-contact surfaces, or food-packaging materials. We also requested comment on whether to require, rather than recommend, that single-service articles be stored in appropriate containers (78 FR 3646 at 3721).

(Comment 274) Comments are mixed regarding whether to require, rather than recommend, that single-service articles be stored in appropriate containers. Some comments ask us to keep this provision as a recommendation, whereas other comments ask us to change this recommendation to a requirement. One comment asking us to retain the provision as a recommendation asserts that these practices have never resulted in a food safety risk.

Other comments ask us to specify that “single-service articles must be handled in a manner that protects against allergen cross-contact and contamination of food.” These comments assert that the proposed use of “must” and “appropriate” in the same sentence will lead to inconsistency in determining what is “appropriate” for each individual situation. In addition, the comments assert that the common definition of “handling” encompasses “appropriate storage, dispensing, usage, and disposal.”

(Response 274) We have decided to establish this provision as a requirement rather than as a recommendation. Articles used in the manufacturing, processing, packing, or holding of food must not cause allergen cross-contact or contamination of food, food-contact surfaces, or food-packaging materials, regardless of whether the articles are single-service or would be used multiple times.

We have revised the regulatory text to accept some, but not all, of the suggestions in these comments. We deleted “in appropriate containers” so as not to prescribe a specific mechanism for complying with the requirement. We also deleted “dispensed” and “used” because we agree that these terms are captured by the term “handled.” We have not deleted “stored” because other provisions of these long-standing CGMPs refer to both storage and handling (see § 117.35(f)) and, thus, we have not previously considered that the term “handling” includes “storage” in this context. See the regulatory text for the final provision containing all of these modifications.

H. Proposed § 117.35(e)—Sanitation of Non-Food-Contact Surfaces

We proposed that non-food-contact surfaces of equipment used in the operation of a food plant should be cleaned in a manner and as frequently as necessary to protect against cross-contact and contamination of food, food-contact surfaces, and food-packaging materials. We also requested comment on whether to establish these recommendations as requirements (78 FR 3646 at 3722).

(Comment 275) Some comments ask us to change this recommendation to a requirement to prevent the creation of insanitary conditions and the adulteration of product.

(Response 275) We have revised the regulatory text to establish this recommendation as a requirement.

(Comment 276) Some comments assert that it is impractical to sanitize all non-food-contact surfaces in a farm mixed-type facility and that this provision should only apply to those areas where a RAC is being transformed into a processed food.

(Response 276) These comments appear to misinterpret the proposed provision, which does not require sanitizing any non-food-contact surfaces, but rather requires cleaning the non-food-contact surfaces of equipment. (See also Response 278.)

(Comment 277) Some comments ask us to specify that this provision applies to non-food-contact surfaces of equipment used “where food is exposed or in the food production sections.”

(Response 277) We decline these requests. The provision clearly addresses equipment used in the operation of a food plant, which includes food storage in addition to food production. Non-food-contact surfaces can become harborages for environmental pathogens (Ref. 55). Specifying that non-food-contact surfaces be cleaned as frequently as necessary to protect against allergen cross-contact and against contamination provides flexibility for industry and regulators to interpret this long-standing provision as appropriate to the establishment and the food being processed.

(Comment 278) Some comments ask us to specify that non-food-contact surfaces be sanitized or “sanitized where appropriate.” Other comments assert that sanitizing of high touch areas in the non-processing areas of a food facility will help prevent transmission of public health pathogens into food processing areas. Some comments assert that sanitizing non-food-contact surfaces could also assist with minimizing risks from possible pathogen transfer to food-contact surfaces.

(Response 278) We decline these requests. We acknowledge that there could be some benefit to sanitizing non-food-contact surfaces with substances that would reduce pathogens but disagree that treating non-food-contact surfaces with substances that would reduce pathogens is necessary if the surfaces are kept clean. The provision does not preclude an establishment from sanitizing non-food-contact surfaces in addition to cleaning them, if the establishment determines that doing so is necessary or prudent for its operations. See also Response 125.

(Comment 279) Some comments ask us not to designate the frequency for cleaning of non-food-contact surfaces because doing so would create an unnecessary burden for smaller facilities.

(Response 279) The provision does not specify the frequency for cleaning of non-food-contact surfaces. Instead, it specifies that the surfaces be cleaned “as frequently as necessary.”

I. Proposed § 117.35(f)—Storage and Handling of Cleaned Portable Equipment and Utensils

We proposed that cleaned and sanitized portable equipment with food-contact surfaces and utensils should be stored in a location and manner that protects food-contact surfaces from cross-contact and contamination. We also requested comment on whether to establish this provision as a requirement rather than a recommendation (78 FR 3646 at 3722).

(Comment 280) Comments are mixed regarding whether to require, rather than recommend, provisions for cleaned and sanitized portable equipment with food-contact surfaces and utensils. Some comments ask us to keep this provision a recommendation, whereas other comments ask us to change this recommendation to a requirement. Some comments agree that it is important that these food-contact surfaces are clean and sanitary when used, but because storage of equipment and utensils could be for an extended period of time, the comments ask us to specify that this requirement applies before the subsequent use of the equipment and utensils.

(Response 280) The intent of the provision is to emphasize that equipment that is cleaned and sanitized at one location has the potential to become contaminated or be subject to allergen cross-contact before or during movement to a location in which the equipment is used. Examples of such equipment are portable mixing kettles, tables, and slicers. We are establishing the provision as a requirement because of the importance of ensuring that food-contact surfaces are clean and sanitary at time of use.

(Comment 281) Some comments assert that the manner in which this equipment is stored includes the location and therefore such wording is redundant. These comments ask us to modify the language to remove “location.”

(Response 281) We acknowledge that “manner” in which the equipment is stored could be interpreted to include “location” but disagree that this interpretation would be universal. The storage location can affect the potential for the equipment to become contaminated or subject to allergen cross-contact, and we are retaining it in the rule.

(Comment 282) Some comments state that they support the proposed revision for “all new equipment installations being away from the wall,” but request a waiver for equipment installed before this rule is issued. These comments ask for a clear definition of “portable equipment” because some large, stationary pieces of equipment may have wheels.

(Response 282) The provision is directed to the storage of equipment that does not remain stationary in a given establishment, regardless of whether the equipment is designed in such a way so that it could readily be moved in that establishment or another establishment. These comments appear to misinterpret the proposed provision, which does not specify that equipment be installed away from a wall. (See also Response 296.)

(Comment 283) Some comments ask us to clarify this provision to adapt industry practices for transport of watermelons because it is unrealistic and impractical to clean the carpet or replace the cardboard lining the harvest buses that transport watermelons on a regular basis. Other comments ask that the use of wooden totes to transport nuts from the field to the wash and dryer operators remains an option for this industry.

(Response 283) These comments appear to have misinterpreted this provision, which relates to the storage and handling of cleaned portable equipment and utensils used within an establishment rather than to vehicles or equipment used to transport food to a location other than the establishment.

XVI. Subpart B: Comments on Proposed § 117.37—Sanitary Facilities and Controls

We proposed to re-establish the provisions of § 110.37 in new § 117.37 with some revisions to modernize them. Some comments agree with one or more of these proposed provisions without change. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 285 and Comment 286). Other comments that support the proposed provisions ask us to revise or clarify current provisions that we proposed to re-establish in part 117 without change (see, e.g., Comment 290).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we proposed to re-establish in § 117.37 with no changes. After considering these comments, we have revised the proposed provisions as shown in table 21, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.37(a)—Water Supply

We proposed that the water supply must be sufficient for the operations intended and must be derived from an adequate source. Any water that contacts food, food-contact surfaces, or food-packaging materials must be safe and of adequate sanitary quality. Running water at a suitable temperature, and under pressure as needed, must be provided in all areas where required for the processing of food, for the cleaning of equipment, utensils, and food-packaging materials, or for employee sanitary facilities.

(Comment 284) Some comments express concern that because the provision does not define specific microbial limits, it is possible that a packer or processor that is subject to the CGMPs for human food could have more flexibility in interpreting and following water quality expectations than a farm that will be subject to the produce safety rule.

(Response 284) We expect that most facilities subject to this rule will have access to a public water supply that would not, under the provisions of the proposed produce safety rule, require testing to demonstrate that it complies with defined microbial standards. When facilities that pack or process produce subject to the produce safety rule use untreated ground water or surface water to wash produce, the measures described in the proposed produce safety rule are appropriate measures to demonstrate that water used in packing and processing of produce is safe and of adequate sanitary quality when the produce does not undergo any processing to reduce pathogens.

(Comment 285) Some comments ask us to modify the requirement that water must be safe and of adequate sanitary quality by specifying that the standard for water quality is “as defined in 40 CFR part 141.” These comments also ask us to specify that compliance with this requirement may be verified by any effective means, such as examination of the supplier's specifications or test reports; purchase of the water under a supplier's guarantee or certification; or analyzing the water.

(Response 285) We decline these requests. The CGMP provisions apply to diverse establishments, including some establishments that do not have access to water that satisfies the drinking water requirements of 40 CFR part 141. For example, seafood processing vessels may need to use seawater to clean areas of the ship used for food processing. This long-standing provision has been in place since the umbrella CGMPs were first established and the comments do not provide any examples of food safety problems that would have been addressed by the proposed change. Moreover, the CGMP Working Group report (Ref. 3) did not identify the water quality standard as something that needed to be changed.

(Comment 286) Some comments ask us to specify that running water be provided only “at appropriate locations.”

(Response 286) We decline this request. We agree that running water must be provided only “at appropriate locations.” However, in the context of this provision “appropriate locations” means “in all areas where required for the processing of food, for the cleaning of equipment, utensils, and food-packaging materials, or for employee sanitary facilities” as has been specified for decades.

B. Proposed § 117.37(b)—Plumbing

We proposed that plumbing must be of adequate size and design and adequately installed and maintained to: (1) Carry sufficient quantities of water to required locations throughout the plant; (2) properly convey sewage and liquid disposable waste from the plant; (3) avoid constituting a source of contamination to food, water supplies, equipment, or utensils or creating an unsanitary condition; (4) provide adequate floor drainage in all areas where floors are subject to flooding-type cleaning or where normal operations release or discharge water or other liquid waste on the floor; and (5) provide that there is not backflow from, or cross-connection between, piping systems that discharge waste water or sewage and piping systems that carry water for food or food manufacturing.

(Comment 287) Some comments assert that requirements for adequate floor drainage are overly prescriptive and do not allow for any standing water subsequent to washing and sanitizing activities.

(Response 287) This provision does not prohibit standing water—e.g., during vegetable or other wet processing operations. However, floors should provide for drainage, e.g., be sloped towards drains, and standing water should be minimized to the extent possible to reduce the potential for contamination of food and food-contact surfaces. This is a long-standing provision and the comment does not provide any information as to how this has been interpreted in the past to not allow for standing water during processing or subsequent to washing and sanitizing activities.

C. Proposed § 117.37(c)—Sewage Disposal

We proposed that sewage disposal must be made into an adequate sewerage system or disposed of through other adequate means.

(Comment 288) Some comments ask us to specify that sewage “must be disposed.”

(Response 288) We have revised the regulatory text to consistently use the verb “dispose” rather than to use a noun (i.e., “disposal”) in the first clause.

D. Proposed § 117.37(d)—Toilet Facilities

We proposed to replace the existing CGMP requirements for toilets (i.e., that each plant provide its employees with adequate, readily accessible toilet facilities, along with recommendations for how to comply with these requirements) with a requirement that each plant must provide its employees with adequate, readily accessible toilet facilities. We proposed that toilet facilities must be kept clean and must not be a potential source of contamination of food, food-contact, or food-packaging materials. We also proposed to delete the guidance on how to comply with the requirements.

(Comment 289) Some comments ask us to retain the guidance we proposed to delete. Some comments ask us to retain some of the guidance and make some of it optional to allow for flexibility based on the design of the facility. Some comments provide specific editorial suggestions to include the guidance in this provision.

(Response 289) We decline these requests. As noted in the final rule establishing CGMPs for dietary supplements (72 FR 34752 at 34817), it is unnecessary to require specific features because an establishment may be able to achieve compliance through other means better suited to its operations.

E. Proposed § 117.37(e)—Hand-Washing Facilities

We proposed to replace the existing CGMP requirements for hand-washing facilities (i.e., that hand-washing facilities must be adequate and convenient and be furnished with running water at a suitable temperature, along with recommendations for how to comply with these requirements) with a requirement that each plant must provide hand-washing facilities designed to ensure that an employee's hands are not a source of contamination of food, food-contact surfaces, or food-packaging materials, by providing facilities that are adequate, convenient, and furnish running water at a suitable temperature. We also proposed to delete the guidance on how to comply with the requirements.

(Comment 290) Some comments ask us to clarify the meaning of “suitable temperature” in this provision.

(Response 290) By “suitable temperature,” we mean a temperature that does not discourage employees from adequately washing hands, or from washing hands at all, because the water is either too cold or too hot.

(Comment 291) Some comments ask that we specify that hot water should be provided so that this provision is more consistent with similar rules for most State and local jurisdictions that interpret “suitable temperature” as “hot.” Some comments ask whether we are deleting a current requirement for hot water to be provided at a hand-wash station.

(Response 291) We are not deleting a current requirement for hot water to be provided at a hand-wash station. The comments may be mistaking our CGMP requirements with the provisions of our Food Code, which specify that a hand-washing sink shall be equipped to provide water at a temperature of at least 38 degrees C (110 degrees F) through a mixing valve or combination faucet (See section 5-202.12 of the Food Code) (Ref. 51).

We decline the request to modify the regulatory text so that it requires that “hot water” be provided. This long-standing requirement for a “suitable temperature,” without specifying a requirement for “hot water,” means that the water should be neither too hot nor too cold to discourage personnel from washing their hands. We continue to believe that it is not necessary to specify a particular temperature or to use the subjective term “hot.”

XVII. Subpart B: Comments on Proposed § 117.40—Equipment and Utensils

We proposed to re-establish the provisions of § 110.40 in new § 117.40 with some revisions to modernize them. Some comments agree with one or more of these proposed provisions without change. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 301, Comment 305, and Comment 307) or ask us to clarify how we will interpret the provision (see, e.g., Comment 308). Other comments that support the proposed provisions ask us to revise or clarify current provisions that we proposed to re-establish in part 117 without change (see, e.g., Comment 292, Comment 300, and Comment 310).

We also proposed to reorganize provisions found in current § 110.40(a) by creating paragraph designations (a)(1) through (a)(6) with associated editorial changes. We received no comments that disagreed with this proposed redesignation and are finalizing it as proposed.

In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we proposed to re-establish in § 117.40 with no changes. After considering these comments, we have revised the proposed provisions as shown in table 22, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.40(a)—Design, Construction, Use, Installation, and Maintenance of Equipment and Utensils

1. Proposed § 117.40(a)(1)—Design of Plant Equipment and Utensils

We proposed no revisions to the requirement that all plant equipment and utensils must be so designed and of such material and workmanship as to be adequately cleanable, and must be properly maintained.

(Comment 292) Some comments ask us to specify that this provision only applies to equipment and utensils used for, or in connection with, food manufacturing, processing, packing, or holding and appropriate to the stage of production it is used in. These comments assert that “all plant equipment and utensils” is too broad and that the requirements for cleanliness of the equipment and utensils differ at various stages of production. Other comments ask us to specify “as needed to protect against allergen cross-contact and contamination.”

(Response 292) We agree that it is not necessary to apply the provision to all plant equipment and utensils, regardless of what the equipment is and whether it has any role in the production of food. For example, we agree that it is not necessary to apply the requirement to equipment such as welding equipment used in an establishment's machine shop. Accordingly, we have made the following modifications to the provision: (1) Specify that the provision applies to all plant equipment and utensils “used in manufacturing, processing, packing, or holding food”; (2) specify that equipment and utensils must be “adequately” maintained, rather than “properly” maintained, to emphasize the public health goal of the requirement; and (3) specify that the purpose of the requirement is to protect against allergen cross-contact and contamination.

2. Proposed § 117.40(a)(2)—Design, Construction, and Use of Equipment and Utensils

We proposed no revisions to the requirement that the design, construction, and use of equipment and utensils must preclude the adulteration of food with lubricants, fuel, metal fragments, contaminated water, or any other contaminants.

(Comment 293) Some comments suggest editorial changes to the provision to improve clarity.

(Response 293) We agree that the suggested changes improve the clarity of the provision and have incorporated them into the regulatory text.

3. Proposed § 117.40(a)(3)—Installation and Maintenance of Equipment

We requested comment on whether to establish the current recommendation that all equipment be so installed and maintained as to facilitate the cleaning of the equipment and of all adjacent spaces as a requirement (78 FR 3646 at 3723).

(Comment 294) Some comments assert that we should establish this recommendation as a requirement in light of recent findings of the pathogen L. monocytogenes in environmental swab samples taken from food processing plants.

(Response 294) We agree with these comments that an additional reason to establish this recommendation as a requirement, in addition to the reasons we provided in the 2013 proposed preventive controls rule (78 FR 3646 at 3728), is that it could facilitate cleaning for environmental pathogens. We have revised the regulatory text to change “should” to “must.”

(Comment 295) Some comments suggest that we make editorial changes, for clarity and completeness, to read “so as to facilitate the cleaning and maintenance” rather than “so installed and maintained as to facilitate the cleaning.”

(Response 295) We agree that the suggested changes improve the clarity of the provision and have incorporated them into the regulatory text.

(Comment 296) Some comments support the proposed revision for “all new equipment installations being away from the wall,” but ask that we provide a waiver for equipment that has been installed prior to the issuance of this rulemaking.

(Response 296) These comments appear to misinterpret the proposed provision, which does not specify that equipment be installed away from a wall. The requirement is to install equipment so as to facilitate both cleaning and maintenance. This provision has been a long-standing recommendation. Moreover, if the existing equipment is installed in a way that it cannot be cleaned, it would not have been in compliance with existing CGMP requirements for the design and construction of the plant (§ 110.20). For example, the current CGMPs have long required that the design and construction of the plant must provide sufficient space for such placement of equipment and storage of materials as is necessary for the maintenance of sanitary operations and the production of safe food (§ 110.20(a)(1)).

4. Proposed § 117.40(a)(4)—Corrosion-Resistant Food-Contact Surfaces

We proposed no revisions to the requirement that food-contact surfaces must be corrosion-resistant when in contact with food.

(Comment 297) Some comments ask us to specify that the requirement only applies where appropriate for food safety. Other comments ask us to specify that the food-contact surfaces be corrosion-resistant as appropriate to the type of food and other substances with which they come in contact.

(Response 297) We decline these requests. We disagree with the implication that the condition of some food-contact surfaces would not be relevant to food safety. We also disagree that it would be acceptable for some food products to be in contact with surfaces susceptible to corrosion, regardless of the nature of the food product.

5. Proposed § 117.40(a)(5)—Food-Contact Surfaces and Nontoxic Materials

We proposed no revisions to the requirement that food-contact surfaces must be made of nontoxic materials and designed to withstand the environment of their intended use and the action of food, and, if applicable, cleaning compounds and sanitizing agents.

(Comment 298) Some comments assert that food-contact surfaces or utensils could be dedicated to allergens only or non-allergens only.

(Response 298) We agree that dedicating food-contact surfaces and utensils is one way to comply with various requirements of this rule to prevent allergen cross-contact, but disagree that we should require this particular mechanism to prevent allergen cross-contact. Other mechanisms can prevent allergen cross-contact, such as adequately cleaning equipment and surfaces between uses.

(Comment 299) Some comments ask us to specify that food-contact surfaces must be made of food-grade materials and suitably durable.

(Response 299) We decline these requests. Food-grade materials must be non-toxic. The comment provides no examples of circumstances in which the long-standing criterion of “nontoxic” is inadequate. We agree that “suitably durable” could be interpreted to capture the general intent of the current text that specifies “designed to withstand the environment of their intended use and the action of food, and, if applicable, cleaning compounds and sanitizing agents,” but disagree that this interpretation would be universal and are retaining the long-standing regulatory text.

(Comment 300) Some comments ask us to specify that food-contact surfaces must be designed to withstand cleaning procedures.

(Response 300) We have revised the regulatory text to include cleaning procedures. For example, food-contact surfaces must be designed to withstand the actions of scrubbing utensils that could scratch or pit the equipment, creating cracks and crevices that could be difficult to clean and lead to a niche where environmental pathogens could lodge and potentially contaminate food produced using the equipment.

6. Proposed § 117.40(a)(6))—Maintenance of Food-Contact Surfaces

We proposed that food-contact surfaces must be maintained to protect food from cross-contact and from being contaminated by any source, including unlawful indirect food additives. As an inadvertent error, we specified that this requirement would be designated as § 117.40(a)(5); we intended to specify that it be designated § 117.40(a)(6).

(Comment 301) Some comments ask us to specify that this requirement also applies to equipment and utensils but does not apply to single-use items.

(Response 301) We decline these requests. As proposed, the requirement applies to all food-contact surfaces, including those on equipment and utensils; it is not necessary to separately specify that the requirement applies to equipment and utensils. We are not specifying that single-use food-contact surfaces do not need to be maintained. Using equipment or utensils that have single-use food-contact surfaces may be one way to satisfy the requirements of the provision, although single use items may still need to be protected from allergen cross-contact and from contamination, e.g., by protective packaging.

(Comment 302) Some comments ask us to require that the surfaces also be appropriately cleaned and sanitized.

(Response 302) We decline this request. Cleaning and sanitizing of food-contact surfaces is covered by § 117.35(d) and does not need to be repeated here.

(Comment 303) Some comments ask us to strike the phrase “including unlawful indirect food additives.” These comments assert that the wording would be equally effective without the phrase and that striking it would result in a stronger and more absolute requirement.

(Response 303) We decline this request. Although some persons might realize that the provision requires them to protect against unlawful indirect food additives, such an interpretation may not be universal.

B. Proposed § 117.40(b)—Seams on Food-Contact Surfaces

We proposed that seams on food-contact surfaces must be smoothly bonded or maintained so as to minimize accumulation of food particles, dirt, and organic matter, and thus minimize the opportunity for growth of microorganisms and cross-contact.

(Comment 304) Some comments assert that this provision should not apply to all establishments—e.g., that it seems directed towards bakeries but inapplicable to establishments that pack produce.

(Response 304) The provision requires an establishment to minimize accumulation of food particles, dirt, and organic matter in seams on food-contact surfaces to minimize the opportunity for growth of microorganisms and allergen cross-contact and provides flexibility for how to comply with the requirement (i.e., through smoothly bonded seams or through maintenance). Minimizing the accumulation of food particles, dirt, and organic matter in seams on food-contact surfaces is appropriate for all establishments that produce food.

C. Proposed § 117.40(c)—Construction of Equipment

We proposed that equipment that is in the manufacturing or food-handling area and that does not come into contact with food must be so constructed that it can be kept in a clean condition.

(Comment 305) Some comments ask us to specify “areas where food is manufactured, processed, or packed” and clarify that the equipment must be constructed so that it can be kept “appropriately clean and sanitary.”

(Response 305) We have revised the provision to specify that it applies to areas in the plant where food is manufactured, processed, packed, or held. Doing so makes the terms in this provision consistent with terms used throughout the CGMPs (78 FR 3646 at 3692). Consistent with (Response 258, we also have modified the provision to specify that the equipment must be constructed so that it can be kept “clean and sanitary.”

(Comment 306) Some comments ask us to consider inserting technical language to address systems used for sanitizing in food processing environments to ensure they meet generally accepted design principles for food grade equipment. Some comments ask us to specify that the equipment must be constructed of materials that will not get corroded by cleaning chemicals and that welded joints must be of non-corrosive materials and “dressed” to eliminate porous surfaces and occlusions.

(Response 306) We decline these requests. It is not necessary to specify every type of equipment that could be used in a food processing environment or every situation that must be addressed to satisfy the specific requirements of this provision and the more general requirements of § 117.40(a).

D. Proposed § 117.40(d)—Holding, Conveying, and Manufacturing Systems

We proposed no revisions to the requirement that holding, conveying, and manufacturing systems, including gravimetric, pneumatic, closed, and automated systems, must be of a design and construction that enables them to be maintained in an appropriate sanitary condition.

(Comment 307) Some comments ask us to specify that these systems also need to be maintained in an appropriately clean condition in addition to a sanitary condition.

(Response 307) Consistent with Response 258, we have revised the provision to specify that the equipment must be constructed so that it can be kept “clean and sanitary.”

E. Proposed § 117.40(e)—Freezer and Cold Storage Compartments

We proposed that each freezer and cold storage compartment used to store and hold food capable of supporting growth of microorganisms must be fitted with an indicating thermometer, temperature measuring device, or temperature-recording device so installed as to show the temperature accurately within the compartment. We also proposed to delete the recommendation that each freezer and cold storage compartment used to store and hold food capable of supporting growth of microorganisms be fitted with an automatic control for regulating temperature or with an automatic alarm system to indicate a significant temperature change in a manual operation.

(Comment 308) Some comments ask us to clarify that this requirement is only for foods that require temperature control for food safety, and does not apply to any intact fruits or vegetables that are only held at specific temperatures for quality and shelf-life purposes. Some comments ask us to change this requirement to a recommendation for the same reason. Some comments assert that temperature control for intact fruits and vegetables is likely not always necessary or even desirable (e.g., to avoid chill damage).

(Response 308) We decline this request. The requirement applies to refrigerated storage when the establishment has placed food in a refrigerated storage compartment, whether for food safety or for food quality (e.g., to prevent the growth of spoilage microorganisms). The provision, which is an existing requirement in § 110.40, does not specify which foods must be refrigerated or what the refrigeration temperature must be. However, once the establishment has determined that refrigerated storage is appropriate, either for food safety or food quality, it is appropriate to require that the establishment have evidence that it is refrigerating the food as it has decided to do.

F. Proposed § 117.40(f)—Accurate and Precise Instruments and Controls

We proposed that instruments and controls used for measuring, regulating, or recording temperatures, pH, acidity, water activity, or other conditions that control or prevent the growth of undesirable microorganisms in food must be accurate and precise and adequately maintained, and adequate in number for their designated uses.

(Comment 309) Some comments ask us to specify “calibrated” for clarity, accuracy, and completeness. Some comments assert that proper calibration of such equipment is essential to ensure food safety, and does not entail so large a cost as to preclude even small companies from compliance.

(Response 309) We decline this request. The request of this comment is already addressed by our proposal to revise this long-standing provision to require that these types of instruments be accurate, as well as precise. As discussed in Comment 519 and Response 519, some types of instruments generally are subject to accuracy checks rather than to calibration.

G. Proposed § 117.40(g)—Compressed Air or Other Gases

We proposed no revisions to the requirement that compressed air or other gases mechanically introduced into food or used to clean food-contact surfaces or equipment must be treated in such a way that food is not contaminated with unlawful indirect food additives.

(Comment 310) Some comments ask us to specify that compressed air or other gases must be “filtered or otherwise treated” for clarity.

(Response 310) We decline this request. We agree that filtration is a common treatment to prevent contamination, but disagree that it is necessary to modify this long-standing requirement to add this particular example of a treatment to prevent contamination with unlawful indirect food additives. As written, the provision provides flexibility for an establishment to determine the appropriate treatment for compressed air or other gases in a manner that works best for its plant.

(Comment 311) Some comments ask us to strike the phrase “with unlawful indirect food additives.” These comments assert that the wording would be equally effective without the phrase and that striking it would result in a stronger and more absolute requirement.

(Response 311) We decline this request. Although some persons might realize that the provision requires them to protect against unlawful indirect food additives, such an interpretation may not be universal.

XVIII. Subpart B: Comments on Proposed § 117.80(a)—General Processes and Controls

We proposed to re-establish the provisions of § 110.80 in new § 117.80(a) with some revisions to modernize them and with some redesignations. Some comments support one or more of these proposed provisions without change. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 316) or ask us to clarify how we will interpret the provision (see, e.g., Comment 317). Other comments that support the proposed provisions ask us to revise or clarify current provisions that we proposed to re-establish in part 117 without change (see, e.g., Comment 312 and Comment 320).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we did not propose to revise. After considering these comments, we have revised the proposed provisions as shown in table 23, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.80(a)(1)—Adequate Sanitation Principles

We proposed no revisions to the requirements of current § 110.80 (proposed § 117.80(a)(1)) that all operations in the manufacturing, processing, packing, and holding of food (including operations directed to receiving, inspecting, transporting, and segregating) be conducted in accordance with adequate sanitation principles.

(Comment 312) Some comments ask us to clarity “adequate sanitation principles.” Some of these comments express concern that facilities receiving raw produce that will be further cleaned or processed will be unable to meet this requirement and assert that this requirement will not provide additional public health benefits.

(Response 312) These comments fail to explain how we have interpreted the provision in a way that has been problematic such that clarification is necessary. The term “adequate” is a long-standing term that we defined in its current form when we first established the umbrella CGMPs in 1969 (34 FR 6977 at 6978). Furthermore, during a previous rulemaking to revise the umbrella CGMPs and establish current § 110.80 we explained that the phrase “adequate sanitation principles” must be broad so that industry can easily adapt sanitation principles to its existing procedures (51 FR 22458 at 22461).

(Comment 313) Some comments ask us to specify that operations be conducted in accordance with adequate sanitation principles “specific to the operation” to provide for extended time intervals between sanitation procedures. These comments explain that in the case of low-moisture almonds, sanitation intervals may be extended in order to minimize addition of water into the facility.

(Response 313) We decline this request. By specifying that sanitation principles must be “adequate,” the provision already provides flexibility such as that requested by these comments. In addition, the rule does not specify any time intervals for conducting sanitation operations and, thus, the provision needs no qualification to provide flexibility for an establishment to adopt a frequency of sanitation procedures consistent with its operations.

B. Proposed § 117.80(a)(2)—Quality Control Operations

We proposed no revisions to the requirements of current § 110.80 (proposed § 117.80(a)(2)) that appropriate quality control operations be employed to ensure that food is suitable for human consumption and that food-packaging materials are safe and suitable.

(Comment 314) Some comments assert that specifying that food-packaging materials must be “safe and suitable” is confusing because the definition for “safe and suitable” at § 130.3(d) defines the phrase with respect to ingredients.

(Response 314) The requirement is a long-standing provision that has been used in this context for decades. When we first proposed this provision during a previous rulemaking to revise the umbrella CGMPs, we included this exact phrase and did not receive any comments regarding its use (44 FR 33238 at 33246). Furthermore, as evidence that industry commonly understands the use of the term “suitable” in the context of CGMP requirements in addition to requirements applicable to ingredients used in standardized foods, we note that we substituted the term “suitable” for “fit” in another provision (§ 110.80(a)(1)) in response to comments from industry stating that “suitable” was a more familiar term than “fit” (51 FR 22458 at 22470).

C. Proposed § 117.80(a)(3)—Supervision of Overall Sanitation

We proposed no revisions to the requirements of current § 110.80 (proposed § 117.80(a)(3)) that overall sanitation of the plant be under the supervision of one or more competent individuals assigned responsibility for this function.

(Comment 315) Some comments ask us to revise this provision to specify that it applies to overall cleaning of the plant, as well as overall sanitation of the plant.

(Response 315) We decline this request. Sanitation is a general term that already encompasses cleaning (and, as appropriate, sanitizing).

D. Proposed § 117.80(a)(4)—Production Procedures

We proposed that all reasonable precautions must be taken to ensure that production procedures do not contribute to cross-contact and contamination from any source.

(Comment 316) Some comments assert that the phrase “all reasonable precautions” is too extreme and prescriptive and suggest that “adequate” would be more appropriate than “all” to describe the intended measures and precautions.

(Response 316) We agree that “adequate” is more appropriate than “all” and have substituted the word “adequate” for “all reasonable” in the final rule.

E. Proposed § 117.80(a)(5)—Chemical, Microbial, or Extraneous-Material Testing Procedures

We proposed that chemical, microbial, or extraneous-material testing procedures must be used where necessary to identify sanitation failures or possible cross-contact and food contamination.

(Comment 317) Some comments ask whether the word “must” in the provision means that testing will always be required, including for food allergens. Other comments assert that testing should only be used when there is reason to suspect a specific problem has occurred and when methods are available.

(Response 317) Testing is not always required. The provision provides flexibility for an establishment to test when appropriate, such as when a facility determines that it is necessary to use rapid ATP (adenosine triphosphate) swabs as an indicator of microbial or food residue contamination to verify cleaning of a line prior to running a different product (Ref. 56). Facilities commonly conduct tests on food for microorganisms that indicate sanitation failures, such as testing for total plate count, generic E. coli, total coliforms, etc. (Ref. 57). When the number of such organisms exceeds expectation, sanitation or other failures are suspected and the facility can take actions to determine the source of the problem.

(Comment 318) Some comments oppose any implication that food manufacturers are required to develop test methods or analytical standards, or search out methods that are not readily available, for this or any other purpose.

(Response 318) The provision does not require food manufacturers to develop test methods or analytical standards, or search out methods that are not readily available.

(Comment 319) Some comments suggest that testing as part of an environmental monitoring program should be risk-based and include allergens, but should not be required for finished product.

(Response 319) The provision does not use the term “environmental monitoring,” which is a term that has come to be associated with monitoring for environmental pathogens rather than for other substances that may contaminate the food processing environment. Likewise, the provision does not establish requirements for environmental monitoring for finished product. As discussed in Response 317, the provision provides flexibility for an establishment to test when testing is appropriate, such as when the facility determines testing would be useful to verify adherence to CGMPs or when there is a problem such as allergen cross-contact.

F. Proposed § 117.80(a)(6)—Contaminated Food

We proposed no revisions to the requirements of current § 110.80 (proposed § 117.80(a)(6)) that all food that has become contaminated to the extent that it is adulterated be rejected, or if permissible, treated or processed to eliminate the contamination.

(Comment 320) Some comments assert that the use of the phrase “if permissible” is vague and confusing and should be replaced by a statement of precisely what is impermissible.

(Response 320) We acknowledge that the phrase “if permissible” does not communicate the circumstances under which it is permissible to treat or process a food to eliminate contamination. Rather than add such circumstances to the rule, we have replaced the phrase “if permissible” with “if appropriate.” In the following paragraphs, we discuss examples of when treatment or processing to eliminate contamination would or would not be appropriate.

Some RACs, such as cocoa beans, can become adulterated with insects or filth but may be fumigated or cleaned in accordance with an application for reconditioning submitted to FDA to bring the product into compliance. Acid or acidified canned goods with microbial contamination due to a container defect may be reconditioned by sorting out the defective containers to ensure that containers released into commerce are intact and the product is not contaminated. Tree nuts with signs of mold growth can be reconditioned using methods that separate the moldy nuts from those that are not contaminated. Tree nuts found to be contaminated with Salmonella may be treated by processes such as steam or propylene oxide when such treatments have been validated to provide an adequate reduction of Salmonella. A heat-treated food contaminated from the environment, such as a heat-treated, dried protein product, can sometimes be rehydrated, and a food establishment could repeat the processing to reduce pathogens. Other products, such as many types of produce, are not normally processed to reduce pathogens, and product quality may be impacted by such treatments. Even though processing techniques such as irradiation have the potential to reduce pathogens, irradiation is a food additive that requires approval. For example, as of January 15, 2015, irradiation had been approved for control of foodborne pathogens and extension of shelf-life in fresh iceberg lettuce and fresh spinach, but not in other fresh leafy greens. Using irradiation for a purpose that has not been approved (such as for the irradiation of fresh leafy greens other than fresh iceberg lettuce and fresh spinach) would render the food adulterated under section 402(a)(2)(C)(i) of the FD&C Act and, thus, it would not be appropriate to treat or process fresh leafy greens other than fresh iceberg lettuce and fresh spinach using irradiation.

XIX. Subpart B: Comments on Proposed § 117.80(b)—Processes and Controls for Raw Materials and Other Ingredients

We proposed to re-establish the provisions of § 110.80(a) in new § 117.80(b) with some revisions to modernize them. Some comments support one or more of these proposed provisions without change. For example, some comments support a new provision that would require raw materials and ingredients that are food allergens, and rework that contains food allergens, to be identified and held in a manner that prevents allergen cross-contact. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 324, Comment 325, Comment 328, and Comment 329) or ask us to clarify how we will interpret the provision (see, e.g., Comment 323 and Comment 327).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we did not propose to revise. After considering these comments, we have revised the proposed provisions as shown in table 24, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.80(b)(1)—Inspection, Segregation and Handling of Raw Materials and Other Ingredients

We proposed that raw materials and ingredients must be inspected and segregated or otherwise handled as necessary to ascertain that they are clean and suitable for processing into food and must be stored under conditions that will protect against cross-contact and contamination and minimize deterioration. Raw materials must be washed or cleaned as necessary to remove soil or other contamination. Water used for washing, rinsing, or conveying food must be safe and of adequate sanitary quality. Water may be reused for washing, rinsing, or conveying food if it does not increase the level of contamination of the food or cause cross-contact.

We also proposed to continue to recommend that containers and carriers of raw materials be inspected on receipt to ensure that their condition has not contributed to cross-contact, contamination, or deterioration. However, we also requested comment on whether to establish this recommendation as a requirement (78 FR 3646 at 3724).

(Comment 321) Some comments express concern about revising current § 110.80(a)(1) to require, rather than recommend, that containers and carriers of raw materials be inspected on receipt. Some comments focus on practical problems associated with inspecting bins containing RACs such as produce. These comments explain that produce bins received by a packing establishment are too large to be handled directly and instead are delivered by a fork lift followed by automated travel through the establishment.

(Response 321) We agree that circumstances such as those described in these comments make it appropriate to continue to recommend, but not require, that containers and carriers of raw materials be inspected on receipt to ensure that their condition has not contributed to allergen cross-contact, contamination, or deterioration. Therefore, we are not re-establishing this nonbinding recommendation as a requirement. Instead, as discussed in Response 67, we have deleted this non-binding provision from the rule.

B. Proposed § 117.80(b)(2)—Levels of Microorganisms in Raw Materials and Other Ingredients

We proposed that raw materials and ingredients must either not contain levels of microorganisms that may render the food injurious to health of humans, or they must be pasteurized or otherwise treated during manufacturing operations so that they no longer contain levels that would cause the product to be adulterated. We also proposed to delete guidance regarding how to comply with this requirement.

(Comment 322) Some comments ask us to supply the list of microorganisms that may render the food injurious to the health of humans. Some comments assert that we would have to establish acceptable pathogen concentration limits in order for industry to comply with this provision.

(Response 322) We are not providing a list of microorganisms that may render the food injurious to the health of humans. CGMPs establish procedural requirements, not declarations of foods that are adulterated. It is not necessary for us to establish acceptable pathogen concentration limits in order for industry to comply with this provision. Moreover, several Compliance Policy Guides (CPGs) provide guidance to our investigators about agency policies that apply when food is contaminated with microorganisms, and these CPGs are available to industry (Ref. 58) (Ref. 59) (Ref. 60) (Ref. 61) (Ref. 62).

(Comment 323) Some comments express concern about the requirement for pasteurization, explaining that fresh produce cannot be pasteurized.

(Response 323) The proposed provision would not require pasteurization of products such as produce. The proposed provision clearly states that pasteurization or other treatment is only required when raw materials and other ingredients contain levels of microorganisms that may render the food injurious to health of humans. However, when products such as produce contain levels of microorganisms that may render the food injurious to health of humans, and the products cannot be pasteurized or otherwise treated so that they no longer contain levels that would cause the product to be adulterated, other provisions require that the product be rejected and disposed of in a manner that protects against the contamination of other food (see, e.g., §§ 117.80(a)(6) and 117.80(c)(9)).

(Comment 324) Some comments assert that this requirement is overly broad and should only apply to RTE food. These comments express the view that we should not focus on the issue of microbiological contamination in foods that are early in the supply chain (other than produce that will be consumed without adequate processing or cooking). Some comments suggest adding a statement to be provided in commercial documentation accompanying the sale of produce not covered by the proposed produce safety rule to alert potential purchasers to the hazard that may exist and allow them to determine whether the food offered for sale is suitable for their particular needs or whether the food requires commercial formulation, processing, or both to adequately reduce microorganisms.

(Response 324) It is not necessary to narrow this requirement to RTE food to provide for use of raw materials and other ingredients that are early in the supply chain. The requirement already clearly provides for pasteurization or other treatment during manufacturing operations so that the processed product would no longer contain levels that would cause the product to be adulterated. See also our previous discussion of the importance of this provision during a previous rulemaking to revise the umbrella CGMPs (51 FR 22458 at 22470).

We decline the request to require a statement in commercial documentation when produce is not covered by the produce safety rule. As discussed in section XXVII, we are providing for a narrow use of commercial documentation, when a manufacturer/processor that has identified a hazard requiring a preventive control does not establish a preventive control because it: (1) Relies on its customer to ensure that an identified hazard will be controlled and (2) discloses, in documents accompanying the food, in accordance with the practice of the trade, that the food is “not processed to control [identified hazard]” (See § 117.136(a)(2), (3), and (4)). That use of commercial documentation reflects the outcome of a hazard analysis—in particular, an outcome in which the manufacturer/processor determines that a hazard requires a preventive control. The vast majority of the produce that we proposed would not be subject to the requirements of the forthcoming produce safety rule would either be produce that is going to commercial processing that adequately reduces the presence of microorganisms of public health significance or produce that is rarely consumed raw. Thus, there would be no benefit to alert potential purchasers to a hazard because such produce has been determined to be low-risk, based on the findings of a qualitative assessment of risk (e.g., for produce rarely consumed raw) or because it will not go directly to the consumer but to commercial processing to adequately reduce pathogens. We see no reason to also establish a broad CGMP requirement that would apply regardless of the outcome of a hazard analysis.

C. Proposed § 117.80(b)(3)—Natural Toxins in Raw Materials and Other Ingredients

We proposed that raw materials and ingredients susceptible to contamination with aflatoxin or other natural toxins comply with current FDA regulations for poisonous or deleterious substances before these materials or ingredients are incorporated into finished food. We also proposed to delete guidance regarding how to comply with this requirement and to delete a requirement for compliance with action levels, which are not binding.

(Comment 325) Some comments ask us to delete “aflatoxin” from the provision because it is redundant with “other natural toxin.”

(Response 325) We decline this request. Aflatoxin is an important natural toxin that is an example illustrating what we mean when we refer to “natural toxins.” An illustrative example does not create a redundancy.

D. Proposed § 117.80(b)(4)—Pests, Undesirable Microorganisms and Extraneous Materials in Raw Materials and Other Ingredients

We proposed that raw materials, ingredients, and rework susceptible to contamination with pests, undesirable microorganisms, or extraneous material must comply with applicable FDA regulations for natural or unavoidable defects if a manufacturer wishes to use the materials in manufacturing food. We also proposed to delete guidance regarding how to comply with this requirement and to delete the requirement for compliance with action levels, which are not binding.

(Comment 326) Some comments ask us to qualify that the requirement does not apply if the manufacturing process includes steps that serve to decontaminate the food.

(Response 326) We decline this request. We have defined “defect action level” to mean a level of a non-hazardous, naturally occurring, unavoidable defect at which FDA may regard a food product “adulterated” and subject to enforcement action under section 402(a)(3) of the FD&C Act (see § 117.3). It is not uncommon for an establishment to receive raw materials (such as RACs) that contain extraneous material that is removed before production. For example, some methods of harvesting vegetable RACs (e.g., pulling up most of the plant material in the field) result in inclusion of extraneous material that is removed during initial cleaning steps at processing facilities. It is not necessary to revise this long-standing requirement to provide for such common procedures. Moreover, in general we use the term “decontaminate” to refer to an action taken when the substance is a hazardous substance (such as a pathogen) rather than to a non-hazardous substance.

E. Proposed § 117.80(b)(5)—Holding Raw Materials, Other Ingredients, and Rework in Bulk

We proposed that raw materials, ingredients, and rework must be held in bulk, or in containers designed and constructed so as to protect against cross-contact and contamination and must be held at such temperature and relative humidity and in such a manner as to prevent the food from becoming adulterated. Material scheduled for rework must be identified as such.

(Comment 327) Some comments express concern that this requirement would make the use of wooden bins in the produce industry problematic and ask us to clarify whether it is our intent to prohibit use of wooden bins. Some comments ask us to clarify whether the provision would preclude using or storing containers (such as trailers and gondolas used in the produce industry) outdoors because such containers cannot be covered.

(Response 327) We do not intend to interpret this provision in such a way that would prohibit the use of wooden bins in the produce industry or preclude using and storing containers such as trailers and gondolas outside. Importantly, these CGMP requirements are long-standing provisions that we have not interpreted as prohibiting wooden containers in the produce industry. See also our “Guide to Produce Farm Investigations” (Ref. 63), which applies during investigations when an outbreak and traceback investigation implicates a farm and related operations, or as a follow-up to a produce sample that tests positive for contamination with a pathogen.

(Comment 328) Some comments ask us to add “in-process” materials to the provision.

(Response 328) We decline this request, which is already covered by § 117.80(c)(7). We note that the requirements directed to raw materials and other ingredients are established in § 117.80(b), whereas the requirements directed to in-process materials are established in § 117.80(c).

F. Proposed § 117.80(b)(7)—Liquid or Dry Raw Materials and Other Ingredients

We proposed that liquid or dry raw materials and ingredients received and stored in bulk form must be held in a manner that protects against cross-contact and contamination.

(Comment 329) Some comments ask us to revise the proposed provision to clarify that liquid or dry raw materials and ingredients received and stored in bulk form must be held in a manner that protects against deterioration, as well as in a manner that protects against allergen cross-contact and contamination.

(Response 329) We decline this request. The rule already requires that raw materials and ingredients be stored under conditions that will minimize deterioration (see § 117.80(b)(1)).

G. Proposed § 117.80(b)(8)—Raw Materials and Other Ingredients That Are Food Allergens

We proposed to establish a new requirement that raw materials and ingredients that are food allergens, and rework that contains food allergens, be identified and held in a manner that prevents cross-contact.

(Comment 330) Some comments ask us to exempt finished, packaged product that is later reworked from the proposed requirement.

(Response 330) We decline this request. A product that is in finished, packaged form, including label information that identifies any food allergen, would be in compliance with the requirement and need not be exempted. However, when a product is packaged, but not yet labeled, it is necessary to identify the product in a way (other than a product label) that would prevent allergen cross-contact while the packaged product is being held. For example, shelves holding the product before labeling operations could have a sign such as “Contains peanuts.”

(Comment 331) Some comments ask us to modify the proposed requirement to specify that it applies to raw materials and ingredients that “are or contain” food allergens and that it applies to in-process material, as well as to raw materials and ingredients and to rework. These comments explain that such modifications would provide clarity and completeness.

(Response 331) We decline these requests. The rule defines “food allergen” to mean a major food allergen as defined in section 201(qq) of the FD&C Act, and section 201(qq) of the FD&C Act already specifies that a major food allergen is a food that is one of several specified foods and food groups, or contains protein derived from one of these foods or food groups (78 FR 3646 at 3697). Thus, the request that the provisions be directed to raw materials and other ingredients that “are or contain” food allergens is already addressed in the definition of food allergen. Requirements applicable to in-process material are addressed in § 117.80(c)(5).

XX. Subpart B: Comments on Proposed § 117.80(c)—Manufacturing Operations

We proposed that current § 110.80(b) would become proposed § 117.80(c). We also proposed revisions to all provisions that would be established in § 117.80(c) except for the provisions that would be established in § 117.80(c)(1) and (c)(16).

Some comments support one or more of these proposed provisions without change. For example, some comments support provisions directed to control of, or preventing contamination with, undesirable microorganisms during manufacturing, storage, and handling. Other comments that support the proposed provisions suggest alternative regulatory text (see, e.g., Comment 334) or ask us to clarify how we will interpret the provision (see, e.g., Comment 345 and Comment 346). Other comments that support the proposed provisions ask us to revise or clarify provisions that we proposed to re-establish in part 117 without change (see, e.g., Comment 333).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we did not propose to revise. After considering these comments, we have revised the proposed provisions as shown in table 25, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.80(c)(1)—Condition of Equipment, Utensils, and Finished Food Containers

We proposed no revisions to the requirements of current § 110.80(b)(1) (proposed § 117.80(c)(1)) that equipment and utensils and finished food containers be maintained in an acceptable condition through appropriate cleaning and sanitizing, as necessary. Insofar as necessary, equipment must be taken apart for thorough cleaning.

(Comment 332) Some comments assert that this provision precludes the use of wooden bins, because wooden bins cannot be sanitized.

(Response 332) This requirement is a long-standing provision that provides flexibility for an establishment to sanitize when appropriate by specifying that equipment, utensils, and food containers be sanitized “as necessary.” For example, equipment food-contact surfaces are usually sanitized after cleaning to minimize the potential for contaminating food with undesirable microorganisms that accumulate during processing and grow in food residues on the equipment. When containers such as wooden bins cannot be sanitized, the establishment is responsible for taking appropriate steps to adequately clean and maintain the containers to minimize the potential for contaminating food with undesirable microorganisms. To clarify that the standard governing the condition of the equipment, utensils, and finished food containers is the same public health standard that applies to other provisions in § 117.80, we have revised the provision to specify that containers be kept in “adequate” condition rather than “acceptable” condition.

(Comment 333) Some comments ask us to delete the term “finished” from “finished food containers” so that the requirements applicable to the condition of equipment, utensils, and food containers will be more complete.

(Response 333) We agree that the requirements should apply to all food containers used during manufacturing operations, not just to “finished food containers.” We note that we received comments about the most appropriate adjective to describe the food containers subject to this requirement during the rulemaking to establish this provision in part 110. (See the discussion at 51 FR 22458 at 22471, in which we responded to comments asking us to change “finished product container to “bulk product container” by explaining that finished product containers includes bulk product containers.) Rather than perpetuate questions as to how we are interpreting “finished,” we have deleted this adjective.

B. Proposed § 117.80(c)(2)—Conditions and Controls for Food Manufacturing, Processing, Packing, and Holding

We proposed that all food manufacturing, processing, packing, and holding must be conducted under such conditions and controls as are necessary to minimize the potential for the growth of microorganisms or for the contamination of food. We also proposed to delete guidance regarding how to comply with this requirement.

(Comment 334) Some comments ask us to add “in-process materials and rework,” “cross-contact,” and “or deterioration” for clarity and completeness.

(Response 334) We agree that adding “allergen cross-contact” is necessary for completeness and have revised the proposed provision to include it. We also agree that the provision needs to address deterioration; doing so is consistent with the requirements applicable to raw materials and other ingredients (see § 117.80(b)(1)). We decline the request to add “in-process materials and rework” to this provision because in-process materials and rework are already covered by the phrase “all food.”

C. Proposed § 117.80(c)(3)—Food That Can Support the Rapid Growth of Undesirable Microorganisms

We proposed that all food that can support the rapid growth of undesirable microorganisms must be held at temperatures that will prevent the food from becoming adulterated during manufacturing, processing, packing, and holding. We also proposed to delete recommendations for how to comply with this requirement.

(Comment 335) Some comments ask us to keep requirements for specific temperatures for holding hot food and cold food because there is a direct correlation between temperature abuse and growth of pathogenic bacteria.

(Response 335) We agree that temperature abuse can lead to growth of pathogenic bacteria. Importantly, the temperatures that have been in current § 110.80(b)(3) were recommendations rather than requirements. As discussed in Response 67, we have deleted non-binding provisions from the rule and intend to issue guidance that will include much of the guidance that we have deleted from the umbrella CGMPs. As noted in the 2013 proposed human preventive controls rule (see table 8, 78 FR 3646 at 3715), the temperatures needed for safe holding may vary and the diversity of food to which the provision applies makes it inappropriate to specify these temperatures in regulation. There is information available currently on appropriate temperatures for a variety of foods (e.g., in the Food Code (Ref. 51) and the PMO (Ref. 64)). Moreover, a continued approach to specific temperatures for holding hot food and cold food through non-binding guidance is particularly appropriate because we can reasonably expect ongoing scientific advances that would alter our thinking on appropriate temperatures to hold hot food and cold food.

(Comment 336) Some comments ask us to require that food that can support the rapid growth of undesirable microorganisms be held at temperatures or “in another manner” that will prevent the food from becoming adulterated. These comments assert that current or future technology may provide other means of preventing microbial growth besides temperature controls—e.g., through use of pressure or in another as‐yet‐unforeseen manner.

(Response 336) We agree that current or future technology may provide other means of preventing microbial growth besides temperature controls. However, we disagree that it is necessary to modify the requirement to provide for preventing microbial growth by means other than temperature control, because the provision does not identify specific temperatures that must be used to prevent the food from becoming adulterated. If, for example, a food that currently requires refrigeration to prevent adulteration becomes shelf-stable as a result of new technology, the provision as written would allow the food to be held at room temperature rather than under refrigeration.

D. Proposed § 117.80(c)(4))—Measures To Destroy or Prevent the Growth of Undesirable Microorganisms

We proposed that measures such as sterilizing, irradiating, pasteurizing, cooking, freezing, refrigerating, controlling pH, or controlling water activity that are taken to destroy or prevent the growth of undesirable microorganisms must be adequate under the conditions of manufacture, handling, and distribution to prevent food from being adulterated.

(Comment 337) Some comments express concern that the measures listed could be interpreted as an exhaustive list of processing methods and, thus, hinder the development of new technologies. These comments suggest adding “or other measures” at the end of the list.

(Response 337) The phrase “such as” indicates that these are examples of processing methods and that the list is not all inclusive. We believe that the list of examples and wording of the provision adequately express the intent behind this provision and allow the use of other measures without the suggested addition.

E. Proposed § 117.80(c)(5)—Work-in-Process and Rework

We proposed that work-in-process and rework must be handled in a manner that protects against cross-contact, contamination, and growth of undesirable microorganisms.

(Comment 338) Comments that address this proposed requirement ask us to use the term “in-process materials” rather than “work-in-process.”

(Response 338) As discussed in Response 71, we decline this request.

F. Proposed § 117.80(c)(6)—Finished Food

We proposed that effective measures must be taken to protect finished food from cross-contact and contamination by raw materials, ingredients, or refuse. When raw materials, ingredients, or refuse are unprotected, they must not be handled simultaneously in a receiving, loading, or shipping area if that handling could result in cross-contact or contaminated food. Food transported by conveyor must be protected against cross-contact and contamination as necessary.

(Comment 339) Some comments ask us to specify that raw materials, ingredients, or refuse that are unprotected not be handled simultaneously in “the same area” rather than in “a receiving, loading, or shipping area.” The comments assert that this would be clearer.

(Response 339) We decline this request. We narrowly directed the provision to address the potential for allergen cross-contact and for contamination by unprotected raw materials, ingredients, and refuse when finished food is in a receiving, loading, or shipping area. Broadening the provision to prohibit handling raw materials, ingredients, or refuse in the same area as finished food would imply that raw materials, ingredients, or refuse will never be handled in the production area where they may be needed or generated during production.

(Comment 340) Some comments ask us to revise the provision to add “in-process” food and “cleaning and sanitizing agents, and other chemicals” for clarity and completeness.

(Response 340) We decline this request. Work-in-process foods are covered separately in § 117.80(c)(5), and cleaning and sanitizing agents are addressed in the requirements for sanitary operations (see § 117.35(b)(2)).

G. Proposed § 117.80(c)(7)—Equipment, Containers, and Utensils

We proposed that equipment, containers, and utensils used to convey, hold, or store raw materials, work-in-process, rework, or food must be constructed, handled, and maintained during manufacturing, processing, packing, and holding in a manner that protects against cross-contact and contamination.

(Comment 341) Some comments ask us to specify that the equipment, containers, and utensils also must be cleaned and sanitized during manufacturing, processing, packing, and holding in a manner that protects against cross‐contact and against contamination.

(Response 341) We decline this request. Cleaning and sanitizing are addressed in the requirements for sanitary operations (see § 117.35(a)) and do not need to be addressed again in the requirements for manufacturing operations.

(Comment 342) Some comments ask us to add the phrase “where appropriate for food safety” at the beginning of the provision because food gases are manufactured, held, and distributed in a closed pressurized system and are therefore not exposed to personnel or environmental conditions where there is an impact on food safety.

(Response 342) We decline this request. The closed pressurized system described by the comment appears to satisfy the requirements of the provision, as would other systems commonly used in the food industry. The purpose of the provision is to set the standard; it is not necessary to add that no specific actions are necessary for those systems that inherently comply with the requirement.

H. Proposed § 117.80(c)(8)—Metal or Other Extraneous Material

We proposed that effective measures must be taken to protect against the inclusion of metal or other extraneous material in food and to delete guidance regarding how to comply with this requirement.

(Comment 343) Some comments assert that it could be more effective from the perspective of food safety to use a risk-based approach to implementing protective measures against the inclusion of metal or other extraneous material in food. These comments assert that the risk of inclusion of metal is higher in cut fruits or vegetables than in fresh whole fruits or vegetables and, thus, the measures used to protect against the inclusion of metal should be different in cut fruits or vegetables than in fresh whole fruits or vegetables.

(Response 343) We agree that the measures used to protect against the inclusion of metal likely will be different for cut fruits or vegetables than for fresh whole fruits or vegetables and that a risk-based approach can be helpful in determining how to comply with the requirement. To emphasize the utility of a risk-based approach, we have revised the provision to require “adequate” measures rather than “effective” measures; as defined in the rule (see § 117.3), the term “adequate” means that which is needed to accomplish the intended purpose in keeping with good public health practice.

I. Proposed § 117.80(c)(9)—Disposal of Adulterated Food, Raw Materials, and Other Ingredients

We proposed that food, raw materials, and ingredients that are adulterated must be disposed of in a manner that protects against the contamination of other food or, if the adulterated food is capable of being reconditioned, it must be reconditioned using a method that has been proven to be effective. We also proposed an editorial change to make clear that reconditioning, rather than disposal, is an option and to delete a provision that could be viewed as providing an option to simply reexamine adulterated food and subsequently find it not to be adulterated.

(Comment 344) Some comments ask us to retain the provision to reexamine adulterated food and subsequently find it not to be adulterated. These comments explain that there are processes that can remove contaminants such as pesticides and heavy metals from foods such as botanical extracts. Although laboratory studies or small‐scale pilot batches may give an indication that the reconditioning is likely to be effective, they cannot always guarantee the treatment will be equally effective when scaled up to commercial‐scale production batches. Because these methods have not been “proven to be effective,” the appropriate approach to determining whether the reconditioned food is no longer adulterated is reexamination after the reconditioning is complete.

(Response 344) We agree with these comments and have revised the provision to make clearer that reexamination can only be used to subsequently find that the food is not adulterated after the food has been reconditioned. See the regulatory text of § 117.80(c)(9).

(Comment 345) Some comments ask us to clarify that the provision only applies if the food has actually been found to be adulterated. The comments assert that the provision should not apply where product has been placed “on hold” due to an equipment failure (e.g., if product is put on hold due to an inoperative metal detector until the establishment can retest for potential metal contaminants).

(Response 345) The provision only applies if the food is adulterated. In the example described in these comments, if the food is not adulterated, the establishment would not need to dispose of, or recondition, the product.

(Comment 346) Some comments ask us to clarify that the provision does not apply to grains subject to the review inspection provisions provided for by 7 CFR 800.125 and 800.135.

(Response 346) In many cases, grains subject to the review inspection provisions provided for by 7 CFR 800.125 and 800.135 are RACs that are being held or transported by an establishment solely engaged in holding or transporting RACs and subpart B (including § 117.80(c)(8)) would not apply to the grains (see § 117.5(k)). In addition, as noted in Response 345, this provision only applies to food that is adulterated.

J. Proposed § 117.80(c)(10)—Performing Manufacturing Steps

We proposed that steps such as washing, peeling, trimming, cutting, sorting and inspecting, mashing, dewatering, cooling, shredding, extruding, drying, whipping, defatting, and forming must be performed so as to protect food against cross-contact and contamination. We proposed that food should be protected from contaminants that may drip, drain, or be drawn into food and requested comment on whether to establish the recommendation regarding physical protection of food from contaminants that may drip, drain, or be drawn into the food as a requirement (78 FR 3646 at 3726). We also proposed to delete two recommendations regarding adequate cleaning and sanitizing of food-contact surfaces and regarding the use of time and temperature controls.

(Comment 347) Some comments agree that we should require, rather than recommend, that food be protected from contaminants that may drip, drain, or be drawn into food. Other comments express concern that turning the current recommendation into a requirement could lead to a de facto requirement for closed systems to be used in food production. Some comments ask us to specify that the requirements only apply where food is exposed.

(Response 347) We agree that we should require, rather than recommend, that food be protected from contaminants that may drip, drain, or be drawn into food. We have not revised the regulatory text to specify that the requirements only apply where food is exposed, because such protections would only be needed if foods are exposed to such conditions. Such a requirement would not lead to a de facto requirement for a closed system, because this is not the only way to protect food from such contaminants. For example, covers can be used on kettles and tanks, and shields can be placed over conveyor lines.

K. Proposed § 117.80(c)(11)—Heat Blanching and Growth and Contamination by Thermophilic Microorganisms During Manufacturing Operations

We proposed that heat blanching, when required in the preparation of food, should be effected by heating the food to the required temperature, holding it at this temperature for the required time, and then either rapidly cooling the food or passing it to subsequent manufacturing without delay. We proposed that thermophilic growth and contamination in blanchers should be minimized by the use of adequate operating temperature and by periodic cleaning and requested comment on whether to establish these two recommendations as requirements (78 FR 3646 at 3726).

(Comment 348) Some comments support establishing the recommendations in this provision as requirements. Other comments oppose doing so and assert that these detailed steps may not be important to protect the public health.

(Response 348) We disagree that the use of adequate operating temperature and periodic cleaning are not important to protect public health. Improper cooling can lead to growth of pathogenic sporeforming bacteria if product remains too long at temperatures that support their multiplication. In addition, growth of thermophiles, while not a public health issue, can lead to product spoilage, and, thus, adulteration. We are establishing these two recommendations as requirements in the regulatory text, along with associated editorial changes.

L. Proposed § 117.80(c)(12)—Batters, Breading, Sauces, Gravies, Dressings, and Other Similar Preparations

We proposed that batters, breading, sauces, gravies, dressings, and other similar preparations must be treated or maintained in such a manner that they are protected against cross-contact and contamination. We also proposed to clarify that these steps require protection against cross-contact and to delete the recommendations for how to comply with this requirement.

(Comment 349) Some comments agree that we should delete the provided examples of mechanisms to achieve compliance.

(Response 349) We have deleted the examples as proposed.

(Comment 350) Some comments ask us to modify the provision to clarify that it applies to preparations that are held and used repeatedly over time and to add “dipping solutions” as another example of such a preparation.

(Response 350) We agree that the provision applies to preparations that are held and used repeatedly over time and that “dipping solutions” is a useful example to add. We have revised the regulatory text as requested by these comments.

(Comment 351) Some comments ask us to add that another purpose of the requirement is to minimize the potential for the growth of undesirable microorganisms.

(Response 351) This request would promote consistency in the requirements throughout § 117.80 and we have revised the regulatory text accordingly.

M. Proposed § 117.80(c)(13)—Filling, Assembling, Packaging and Other Operations

We proposed that filling, assembling, packaging, and other operations must be performed in such a way that the food is protected against cross-contact, contamination, and growth of undesirable microorganisms. We also proposed to delete the recommendations for achieving compliance with this requirement.

(Comment 352) Some comments ask us to specify that the requirement applies only to finished food to differentiate it from other provisions in § 117.80 and assert that without the modification the provision would be redundant.

(Response 352) The specific requirements of § 117.80(c)(13) are not redundant with other provisions in § 117.80. The long-standing provisions of § 117.80 first address general requirements (§ 117.80(a)) and then address more specific requirements applicable to raw materials and other ingredients (§ 117.80(b)) and manufacturing operations (§ 117.80(c)). Although the comment does not define “finished food,” we consider that term to apply to a packaged and labeled food product; filling, assembling, and packaging operations would be conducted on in-process food to create a finished product. Regardless of whether the appropriate term would be “finished” or “in-process food,” the comment provides no reason for why this long-standing provision is not clear without specifying the production stage of a food product that is subject to filling, assembling, and packaging operations.

N. Proposed § 117.80(c)(14)—Food That Relies on the Control of Water Activity for Preventing the Growth of Undesirable Microorganisms

We proposed that food, including dry mixes, nuts, intermediate moisture food, and dehydrated food, that relies on the control of water activity for preventing the growth of undesirable microorganisms must be processed to, and maintained at, a safe moisture level. We also proposed to delete the recommendations for achieving compliance with this requirement.

(Comment 353) Some comments assert that moisture level is not an adequate food safety control measure. The comments ask us to revise the requirement to reflect that it is the proper maintenance of water activity, rather than moisture level, that will prevent growth of undesirable microorganisms.

(Response 353) The rule defines safe moisture level as a level of moisture low enough to prevent the growth of undesirable microorganisms in the finished product and notes that the safe moisture level is related to water activity (§ 117.3). Although in most cases water activity is the most suitable measurement to predict food safety, moisture content is frequently used to assess the stability of grains and nuts with respect to prevention of growth and mycotoxin production by molds. We are retaining the term “safe moisture level” as a broader term that takes into account the fact that measuring moisture level and measuring water activity are both common industry practice and, depending on the food, can be measures that are appropriate to assess safety. The comments provide no basis for the assertion that this long-standing provision is not an adequate food safety measure.

(Comment 354) Some comments assert that water activity may not be the only factor responsible for preventing the growth of undesirable microorganisms in dry products and ask us to modify the regulatory text to take into account other synergistic barriers for microbial growth and toxin formation.

(Response 354) We agree with these comments and have revised the regulatory text to clarify that such products rely “principally” on the control of water activity.

(Comment 355) Some comments assert that nuts should be “maintained” at an appropriate moisture level rather than “processed to” an appropriate moisture level.

(Response 355) We acknowledge that some products need only be “maintained” at a safe moisture level and may not need to be processed to achieve that level. However, we disagree that it is necessary to modify this long-standing requirement to specify this distinction. The comments do not provide examples of how we have been interpreting this provision in a way that does not accommodate the differences in products.

(Comment 356) Some comments ask us to more closely adhere to the current regulatory text (i.e., food, such as dry mixes . . .) rather than the proposed regulatory text (i.e., food, including dry mixes . . .).

(Response 356) The final rule retains the long-standing language “such as” as requested by the comments. (See also the discussion in Response 68.)

O. Proposed § 117.80(c)(15)—Food That Relies on the Control of pH for Preventing the Growth of Undesirable Microorganisms

We proposed that food, including acid and acidified food, that relies principally on the control of pH for preventing the growth of undesirable microorganisms must be monitored and maintained at a pH of 4.6 or below. We also proposed to delete the recommendations for how to comply with this requirement.

(Comment 357) Some comments ask us to use the term “equilibrated pH” or “finished equilibrium pH” for consistency with part 114. Some comments ask us to add a definition for “equilibrated pH” in § 117.3.

(Response 357) We decline these requests. It is not necessary for this long-standing provision in the umbrella food CGMPs to use specialty terms used in the more specific CGMPs that apply to acidified foods in order to make clear that the operative pH for the safety of such foods is 4.6 or below.

(Comment 358) Some comments ask us to more closely adhere to the current language (i.e., food such as acid and acidified food . . .) rather than the proposed language (i.e., food, including acid food and acidified food . . .) to make it clear that the list is not intended to be complete.

(Response 358) The final rule retains the long-standing language “such as” as requested by the comments. (See also the discussion in Response 68.)

P. Proposed § 117.80(c)(16)—Requirements for Ice Used in Contact With Food

We proposed no revisions to the requirements of current § 110.80(b)(16) (proposed § 117.80(c)(16)) that when ice is used in contact with food, it must be made from water that is safe and of adequate sanitary quality, and must be used only if it has been manufactured in accordance with current good manufacturing practice.

(Comment 359) Some comments ask us to replace the requirement that water must be safe and of adequate sanitary quality with a cross-reference to the water quality requirements of § 117.37(a).

(Response 359) We acknowledge that cross-referencing the water quality requirements established in § 117.37(a), without describing those requirements, would accurately convey the requirements for ice used in contact with food. However, we believe there is value added by continuing to emphasize the water quality standard within the requirements for ice used in contact with food. We have added a cross-reference to § 117.37(a) but have not deleted “safe and of adequate sanitary quality.”

Q. Proposed Deletion of Current § 110.80(b)(17)—Food-Manufacturing Areas and Equipment

We proposed to delete the current recommendation that food-manufacturing areas and equipment used for manufacturing human food not be used to manufacture nonhuman food-grade animal feed or inedible products, unless there is no reasonable possibility for the contamination of the human food. We tentatively concluded that this recommendation would be more appropriate in guidance, which could include examples of situations where there is no reasonable possibility for the contamination of the human food.

(Comment 360) Some comments ask us to retain this provision for clarity and as a means to educate small, foreign, and new food processors.

(Response 360) We decline this request. The focus of the provision is to emphasize the importance of manufacturing food in a way that prevents contamination. Other provisions (such as §§ 117.10(b), 117.20(a), 117.35(a), 117.40(a)(1), 117.80(a), and 117.93) already require that an establishment prevent contamination from any source. (See also the discussion in Response 67 about our decision to delete those non-binding provisions of part 110 that we are not establishing as requirements.)

XXI. Subpart B: Comments on Proposed § 117.93—Warehousing and Distribution

Current § 110.93 requires that storage and transportation of finished food be under conditions that will protect food against physical, chemical, and microbial contamination, as well as against deterioration of the food and the container. We proposed a series of revisions to these current requirements—i.e., to apply the requirements to “food” rather than to “finished food”; clarify that storage and transportation of food must be under conditions that will protect against allergen cross-contact in addition to protecting against contamination of food; add radiological hazards as an additional category of contaminants; and require protection against “biological,” rather than “microbial” contamination. With all of these revisions, we proposed that storage and transportation of food must be under conditions that will protect against cross-contact and biological, chemical, physical, and radiological contamination of food, as well as against deterioration of the food and the container.

Some comments support one or more of these proposed revisions without change. For example, some comments support adding radiological hazards as an additional category of contaminants to the list of contaminants which may be encountered in warehousing and distribution because food may be subject to contamination with radiological hazards. Other comments that support the proposed provisions suggest alternative regulatory text (see, e.g., Comment 361) or ask us to clarify how we will interpret the provision (see, e.g., Comment 363).

In the following sections, we discuss comments that ask us to clarify the proposed provision or that disagree with, or suggest one or more changes to, the proposed provision. After considering these comments, we are finalizing the provision as proposed (see table 26), with editorial and conforming changes as shown in table 52.

(Comment 361) Some comments express concern that produce will spoil and deteriorate even under the best conditions. These comments ask us to modify the proposed requirements to address these concerns, such as by specifying that the conditions will “reasonably protect” or by revising “will protect” to “will minimize to acceptable levels.”

(Response 361) We decline this request. In some cases, this provision will not apply to produce (i.e., when the produce is a RAC subject to the exemption for an establishment solely engaged in the holding or transportation of one or more RACs; see § 117.5(k)). When the produce is not subject to the RAC exemption (e.g., when the produce is being handled in a fresh-cut processing facility), requiring storage and transportation of produce under the conditions specified in the provision is appropriate. The comments provide no basis that we have been enforcing this long-standing provision in a manner that does not acknowledge practical issues associated with the short shelf life of produce in such facilities and, thus, that modifications such as those suggested by the comments are necessary.

(Comment 362) Some comments assert that regulations directed to radiological hazards will act as a double regulation to hinder amicable trade activities and will increase economic burden to manufacturers. As discussed in Comment 410, these same comments ask us to provide that a facility subject to the requirements for hazard analysis and risk-based preventive controls may rely on existing systems in place to manage radiological risks, such as steps taken by government officials to inspect ingredients obtained from a geographic region that has been the subject of a nuclear accident.

(Response 362) See Response 410 for a discussion of how a facility may consider existing systems in place to manage radiological risks, but still has responsibilities to establish and implement preventive controls to address a radiological hazard when circumstances warrant. The comment provides no basis for its assertion that regulations directed to radiological hazards will act as a double regulation to hinder amicable trade activities and will increase economic burden to manufacturers.

(Comment 363) Some comments support our proposal to specify that the requirements apply to “food” rather than to “finished food,” provided that doing so does not affect common and safe practices for the transportation of RACs, such as transporting raw produce from the field, or from packinghouses, in open top containers such as field boxes, totes and gondola trucks.

(Response 363) As discussed in the 2013 proposed human preventive controls rule, we proposed to apply the CGMP requirements for storage and transportation to “food” rather than “finished food” to ensure food safety throughout the food chain, regardless of whether a food product is a raw material or ingredient or in its finished state (78 FR 3646 at 3727). We intend this revision to clarify that the CGMP provisions for warehousing and distribution apply to raw materials and ingredients, including RACs. When a food establishment that stores and transports RACs is subject to the CGMP provisions, common and safe storage and transportation practices such as those described in our 1998 guidance entitled “Guide to Minimize Microbial Food Safety Hazards for Fresh Fruits and Vegetables (Ref. 13) would be appropriate.

(Comment 364) As noted in Response 324, under the proposed produce safety rule a farm that produces covered produce that is distributed for commercial processing would be required to maintain documentation of the identity of the recipient of the commercial processor. Some comments appear to assume that a farm might distribute such products with information disclosing that such produce was not grown in compliance with part 112, should not be consumed raw, and/or requires commercial processing. These comments ask us to add a provision that no food whose labels, labeling, or commercial documentation accompanying the sale contain any of the following notices may be sold or otherwise distributed to any user except a commercial processor: Not grown in compliance with part 112; Not for fresh or raw consumption; May require commercial formulation, processing, or both to adequately reduce microorganisms.

(Response 364) We decline to add such a provision to the CGMP requirements for distribution of food. As noted in Response 324, we do not see a benefit to labeling produce as indicated because we believe that the vast majority of such produce is low risk. However, as also noted in Response 324, we are providing for a narrow use of commercial documentation, which would include produce, when a manufacturer/processor that has identified a hazard requiring a preventive control does not establish a preventive control because it: (1) Relies on its customer to ensure that an identified hazard will be controlled and (2) discloses, in documents accompanying the food, in accordance with the practice of the trade, that the food is “not processed to control [identified hazard]” (See § 117.136(a)(2), (3), and (4)).

XXII. Subpart B: Comments on Proposed § 117.110 (Natural or Unavoidable Defects in Food for Human Use That Present No Health Hazards)

We proposed to revise the current provisions directed to natural or unavoidable defects in food for human use that present no health hazard. Some comments support one or more of these proposed provisions without change. Other comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 365, Comment 367, and Comment 368).

In the following sections, we discuss comments that ask us to clarify the proposed provisions or that disagree with, or suggest one or more changes to, the proposed provisions, including comments on provisions that we did not propose to revise. After considering these comments, we have revised the proposed provisions as shown in table 27, with editorial and conforming changes as shown in table 52.

We proposed that some foods, even when produced under current good manufacturing practice, contain natural or unavoidable defects that at low levels are not hazardous to health. The proposed provisions specify that FDA establishes maximum levels for these defects in foods produced under current good manufacturing practice and uses these levels in deciding whether to recommend regulatory action. The proposed provisions also specify that defect action levels are established for foods when it is necessary and feasible to do so, and that these levels are subject to change upon the development of new technology or the availability of new information (proposed § 117.110(a) and (b)).

We also proposed that compliance with defect action levels does not excuse violation of the requirement in section 402(a)(4) of the FD&C Act that food not be prepared, packed, or held under unsanitary conditions whereby it may have become contaminated with filth, or whereby it may have been rendered injurious to health, or the requirements in part 117 that food manufacturers, processers, packers, and holders must observe current good manufacturing practice. Evidence indicating that such a violation exists causes the food to be adulterated, even though the amounts of natural or unavoidable defects are lower than the currently established defect action levels. The manufacturer, processor, packer and holder of food must at all times utilize quality control operations that reduce natural or unavoidable defects to the lowest level currently feasible (proposed § 117.110(c)).

We also proposed that the mixing of a food containing defects at levels that render that food adulterated with another lot of food is not permitted and renders the final food adulterated, regardless of the defect level of the final food. (Proposed § 117.110(d)).

We proposed to delete current § 110.110(e), which specifies that a Defect Levels Handbook (a compilation of the current defect action levels for natural or unavoidable defects in food for human use that present no health hazard) may be obtained upon request from the Center for Food Safety and Applied Nutrition.

(Comment 365) Some comments assert that the word “defects” may cause confusion in industry, because the term “defects” is commonly used to describe quality or physical type attributes that do not pose a risk to public health. These comments ask us to consider using another term, such as “contaminant,” in place of the term “defect.”

(Response 365) We decline this request. The specific term requested by the comments (i.e., contaminant) often carries the connotation of hazardous to health. However, we have added a definition of the term “defect action level” to the rule (see Response 165 and § 117.3). The defined term makes clear that the term does not refer to quality or physical type attributes such as those described in the comments. We also have deleted the first two full paragraphs of the proposed provision (proposed § 117.110(a) and (b)), which are no longer necessary to provide context about the regulatory impact of the term “defect action level,” because the new definition of “defect action level” explains that a defect action level is a level of a non-hazardous, naturally occurring, unavoidable defect at which FDA may regard a food product “adulterated” and subject to enforcement action under section 402(a)(3) of the FD&C Act.

(Comment 366) Some comments assert that a facility subject to this provision will implement both CGMPs and a food safety plan as guiding “quality control operations” appropriate for this purpose. These comments also assert that reducing natural or unavoidable defects to “the lowest level currently feasible” does not require a facility to exceed CGMPs or go beyond preventive controls identified through a hazard analysis. In the view of these comments, doing so would run contrary to the risk-based principles that underlie FSMA and leading food safety programs by requiring that all hazards be managed equally without considering the outcomes of the hazard analysis. These comments assert that successful, responsible food safety programs allocate resources to hazards commensurate with their potential impact to the public health.

(Response 366) We agree that reducing natural or unavoidable defects to “the lowest level currently feasible” does not require a facility to exceed CGMPs or go beyond preventive controls identified through a hazard analysis.

(Comment 367) Some comments assert that the word “reduce” in § 117.110 (c) may not be appropriate for all facilities. As an example, the comments explain that a brownskin almond facility that solely sizes and sorts product before packaging may not have processes to reduce microbial contaminants. Instead, that facility may rely upon custom processors to reduce the level of microbial contamination. In such a case, these comments note that it would be more accurate for the provision to specify using quality control operations that ensure the lowest level currently feasible for natural or unavoidable defects.

(Response 367) We have not revised the provision to account for circumstances such as those described in these comments. We acknowledge that the production of some food products requires that food pass through multiple facilities before the finished food is distributed into commerce, and that a specific pathogen reduction step may occur at only one of the applicable facilities. The comments do not provide any examples of how we have interpreted this long-standing provision in the past in a way that creates practical problems when applying the provision to facilities such as those described in the comments.

(Comment 368) Some comments ask us to retain the provision, in § 110.110(e), specifying that the Defect Levels Handbook may be obtained upon request from the Center for Food Safety and Applied Nutrition. These comments also ask us to add an FDA Web site where the handbook may be obtained.

(Response 368) We have added a reference to the Defect Levels Handbook (Ref. 36) to the provisions as examples of defect action levels that may render food adulterated, including an address on the FDA Web site where this handbook may be obtained.

XXIII. Subpart C: Comments on Overall Framework for Hazard Analysis and Risk-Based Preventive Controls

In the 2014 supplemental human preventive controls notice, we proposed a series of changes to proposed subpart C and reopened the comment period specifically with respect to these changes. The proposed changes included: (1) Eliminating the term “hazard reasonably likely to occur” throughout proposed subpart C (and, thus, deleting the definition we had proposed for this term); (2) adding a new defined term, “significant hazard,” and, in general, using this new term instead of “hazard reasonably likely to occur” throughout the re-proposed regulations; (3) defining “known or reasonably foreseeable hazard” in place of “reasonably foreseeable hazard” and clarifying that the new term means a hazard “that has the potential to be associated with the facility or the food” rather than “a potential . . . hazard that may be associated with the facility or the food”; and (4) providing additional flexibility to address concerns about re-writing existing plans or programs to conform with the requirement of the human preventive controls rule.

We received many comments on the overall framework for hazard analysis and risk-based preventive controls. We discuss each of these comments in the discussion of the specific regulatory text applicable to each comment. We show highlights of the changes we made after considering these comments in table 28.

XXIV. Subpart C: Comments on Proposed § 117.126—Food Safety Plan

We proposed requirements for a food safety plan. Some comments support the proposed requirements without change. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 377 and Comment 381) or ask us to clarify how we will interpret the provision (see, e.g., Comment 370).

In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we are finalizing the provisions as proposed, with editorial and conforming changes as shown in table 52.

We proposed that the food safety plan be under the oversight of one or more “qualified individuals.” As discussed in section IX.C.25, we have changed the proposed term “qualified individual” to “preventive controls qualified individual” because we are establishing a new definition for “qualified individual,” with a meaning distinct from “preventive controls qualified individual.” To minimize the potential for confusion for when the term “qualified individual” refers to the proposed meaning of the term and when the term “qualified individual” refers to the meaning of that term as finalized in this rule, in the remainder of this document we substitute the new term “preventive controls qualified individual” for the proposed term “qualified individual,” even though the proposed rule used the term “qualified individual.” Likewise, we substitute the new term “preventive controls qualified individual” for the proposed term “qualified individual” when describing the comments to the proposed rule, even though those comments use the term “qualified individual.”

We proposed that several other provisions of subpart C be under the oversight of a “qualified individual” (now “preventive controls qualified individual”), and also proposed requirements that would apply to the “qualified individual” (now “preventive controls qualified individual”). See, e.g., §§ 117.160, 117.165, 117.170, 117.180, 117.190, and 117.206). As discussed in the preceding paragraph, in the remainder of this document, we substitute the new term “preventive controls qualified individual” for the proposed term “qualified individual,” when describing these proposed provisions and the comments to these proposed provisions.

A. Proposed § 117.126(a)(1)—Requirement for a Food Safety Plan

We proposed that you must prepare, or have prepared, and implement a written food safety plan.

(Comment 369) Some comments ask us to emphasize that “written” means “any type of recordable and reproducible format” (e.g., as paper or electronic documents). Some comments ask us to specify that the components of the food safety plan need not be in a single document or stored in one place.

(Response 369) A “written” food safety plan can be either a paper document or an electronic document, as provided by § 117.305(a). The final rule specifies that required information (which would include the food safety plan) does not need to be kept in one set of records (see § 117.330 (b)), and a food safety plan may be prepared as a set of documents kept in different locations within the facility (e.g., based on where they will be used), provided that each set of documents is onsite. As provided in the recordkeeping provisions, electronic records are considered to be onsite if they are accessible from an onsite location.

(Comment 370) Some comments agree with our previous statements that facilities should be able to group food types or production method types if hazards, control measures, parameters, and required procedures, such as monitoring, are identical (78 FR 3646 at 3730). These comments note that exceptions should be carefully delineated and followed as appropriate. Some comments ask us to clarify that we will allow food safety plans to share common provisions where there are uniform systems in place. Some comments ask us to clarify whether one plan is required for the facility or for each crop/food item individually.

(Response 370) We are requiring that a facility have a written food safety plan that covers all the foods that it manufactures, processes, packs, or holds. We recognize that, to the extent that the controls are the same, there may be common controls that broadly apply to some or all of a facility's food products. However, any product- or process-specific differences must be carefully delineated and observed in practice.

In some facilities with limited types of products, the written food safety plan may contain a single set of procedures that addresses all of the products produced. For example, a facility making fruit-flavored beverages may be able to address all of its beverages in the same set of procedures. For other facilities, there may not be a practical way to group the products and the written food safety plan may need to contain more than one set of procedures to address all of its products. For example, a facility that makes both RTE entrees and entrees that are not RTE may choose to group the RTE entrees in one set of procedures, but have a separate set of procedures for the entrees that are not RTE. However, to the extent that some of the written procedures in the food safety plan are the same for both RTE entrees and entrees that are not RTE, the facility need not duplicate those procedures in its written food safety plan. For example, a facility that uses an electronic food safety plan could store written procedures in multiple folders in the electronic system, and the food safety plan for individual products (or groups of products) could simply hyperlink to the written procedures applicable to each product. Likewise, a facility that uses a paper-based food safety plan could store written procedures in a binder or file cabinet, with written cross-references to procedures that apply to more than one product.

(Comment 371) Some comments ask us to provide that the food safety plan be handled at the corporate level rather than the facility level if a corporation owns many facilities.

(Response 371) A corporation may designate an individual at the corporate level as the owner, operator, or agent in charge of a particular facility. In addition, an employee of the corporation, whether at headquarters or at another facility owned by the corporation, may provide input into a particular facility's food safety plan. As previously discussed, the food safety plan needs to be facility specific (see the discussion of the facility-based nature of the food safety plan in the 2013 proposed human preventive controls rule, 78 FR 3646 at 3732). For example, even if a corporation makes similar products at two separate facilities, it is unlikely that the two facilities have exactly the same equipment and layout. Procedural instructions must be tailored to the equipment being used, and the layout of a facility may affect its approach to preventive controls such as food allergen controls.

(Comment 372) Some comments ask us to provide for facilities that have HACCP plans to build off their existing HACCP programs. As an example, these comments state that we could allow facilities to use terms like “critical limits” for process controls rather than require these foundational documents to be rewritten simply to change terminology.

(Response 372) A facility that has a HACCP plan (or other food safety plan) in place before this rule becomes effective can build off its existing program and can rely on existing records, supplemented as necessary to include all of the required information and satisfy the requirements of this rule (see § 117.330). The rule does not preclude the use of terms like “critical limits” that are associated with HACCP systems.

(Comment 373) Some comments ask us to provide templates that facilities can use as models to develop their food safety plans. Some comments ask us to accept Good Agricultural Practices (GAPs) food safety plan formats and/or HACCP plans. Some comments provide specific templates for us to consider.

(Response 373) We decline the request to provide templates for facilities to use to develop their food safety plans. The rule does not specify the format of a food safety plan, and a facility has flexibility to format its food safety plan in a way that works best for the facility, provided that the plan includes all required information. In general, internationally recognized food safety plan formats would be acceptable, although modification and supplementation may be necessary to comply with all requirements of the rule (see § 117.330 on the use and adaptation of existing records). Training materials being developed by the FSPCA may be useful in developing food safety plans (see Response 2).

We note that activities of farm mixed-type facilities that are within the “farm” definition (e.g., packing and holding RACs) are not subject to the human preventive controls rule. However, to the extent that some components of GAPs-based food safety plans are relevant to a facility (e.g., for an off-farm packinghouse), the facility has flexibility to format its plan in a way that is consistent with GAPs-based food safety plans.

(Comment 374) Some comments ask us to clarify that a food safety plan is not required when a facility is exempt as a qualified facility (§ 117.5(a)) or as a facility solely engaged in the storage of packaged food that is not exposed to the environment (§ 117.7).

(Response 374) A qualified facility is exempt from the requirements of subparts C and G, including the requirement to prepare and implement a food safety plan, and is instead subject to the modified requirements in § 117.201. Likewise, a facility solely engaged in the storage of packaged food that is not exposed to the environment is exempt from the requirements of subparts C and G, including the requirement to prepare and implement a food safety plan, and is instead subject to the modified requirements in § 117.206.

(Comment 375) Some comments ask us to clarify that a food safety plan is not required for facilities that store unexposed, refrigerated, packaged TCS foods.

(Response 375) We agree that a facility “solely engaged” in the storage of unexposed, refrigerated, packaged TCS food is exempt from the requirements of subparts C and G, including the requirement to prepare and implement a food safety plan, and is instead is subject to the modified requirements in § 117.206 (see § 117.7). However, if a facility engages in other activities in addition to the storage of unexposed, refrigerated, packaged TCS foods, the exemption does not apply. In such a case, the facility must prepare and implement a food safety plan. However, the modified requirements of § 117.206 can be informative with respect to what the food safety plan could include regarding the storage of unexposed, refrigerated, packaged TCS food.

(Comment 376) Some comments ask us to explain why a written food safety plan is necessary, because adoption of a HACCP system is only voluntary under the Codex General Principles of Food Hygiene.

(Response 376) The requirement to prepare and implement a written food safety plan is required by U.S. law (i.e., by section 418(h) of the FD&C Act). In contrast, Codex standards are recommendations for voluntary application by members and, thus, Codex provisions are only mandatory if the standard is adopted by a country in its national legislation.

B. Proposed § 117.126(a)(2)—Preparation of the Food Safety Plan by a Preventive Controls Qualified Individual

We proposed that the food safety plan must be prepared, or its preparation overseen, by one or more preventive controls qualified individuals.

(Comment 377) Some comments ask us to provide for a group of preventive controls qualified individuals to prepare, or oversee the preparation of, a food safety plan.

(Response 377) The proposed regulatory text included in the 2014 supplemental human preventive controls notice provides for the food safety plan to be prepared, or its preparation overseen, by one or more preventive controls qualified individuals, and we are finalizing that provision as proposed.

(Comment 378) Some comments ask us to specify that oversight of the food safety plan is voluntary rather than required.

(Response 378) We decline this request. The food safety plan is the foundation for a preventive approach to producing safe food. As previously discussed, the food safety plan must be designed to identify, and to significantly minimize or prevent, hazards for the purpose of preventing illness or injury (78 FR 3646 at 3731). The comments fail to explain how a facility could ensure the proper design of an effective food safety plan without oversight by an individual who satisfies the minimum requirements for a preventive controls qualified individual (see the discussion of the requirements for a preventive controls qualified individual in section XXXVI).

(Comment 379) Some comments assert that oversight of the food safety plan by a preventive controls qualified individual should not be required for products subject to the PMO because the production of such products is subject to the NCIMS process.

(Response 379) As discussed in Response 214, we agree we should make use of the existing system of oversight provided for by NCIMS, which has been part of a cooperative program among the U.S. Public Health Service/FDA, the States, and the dairy industry since 1950, and we have provided an extended compliance date in order that the PMO be revised for consistency with this rule. Under a revised PMO, Grade “A” facilities would need a preventive controls qualified individual to make decisions about hazards and verification procedures such as environmental monitoring specific to a facility and to review food safety records.

(Comment 380) Some comments express concern about the cost associated with oversight of the food safety plan by a preventive controls qualified individual, regardless of whether the preventive controls qualified individual is employed by the facility or is a third party. These comments focus on the burden that this oversight would place on farms and small businesses, and note that the food industry is a “low margin” industry. Some comments ask us to provide for an officer or employee of a State agricultural agency to provide oversight of the food safety plan, because such persons have the most specialized knowledge concerning that State, it is more efficient for State officials to travel to nearby farms, and farmers feel more comfortable working with State employees.

(Response 380) A farm is not subject to this rule for activities within the “farm” definition. A farm mixed-type facility that is a small or very small business and only conducts the low-risk activity/food combinations specified in § 117.5(g) and (h) is exempt from the requirements of subparts C and G, including the requirement for oversight of the food safety plan by a preventive controls qualified individual. Furthermore, a farm mixed-type facility that is a very small business, but does not satisfy the criteria for the exemptions specified in § 117.5(g) and (h), is a qualified facility that is exempt from the requirements of subparts C and G, and is instead subject to modified requirements that do not require oversight of a food safety plan by a preventive controls qualified individual. Moreover, we expect that some training materials and courses will be available online, thereby helping to mitigate costs, both associated with training of a preventive controls qualified individual and loss of production manpower during training.

We disagree that it would be appropriate for an officer or employee of a State agricultural agency to provide oversight of the food safety plan. The food safety plan and its oversight are the responsibility of the facility, not State government officials. The role of an officer or employee of a State agricultural agency would be in determining whether the applicable facility is in compliance with the rule, such as during inspection. State extension agents may be available to assist small businesses, even if those agents are not the designated preventive controls qualified individual for the facility, provided that such agents do not also have any role in determining whether the applicable facility is in compliance with the rule.

We acknowledge that oversight of a food safety plan by a preventive controls qualified individual is a cost associated with the rule, and we have accounted for that cost in the FRIA for this rule (Ref. 38). To minimize the burden on the smallest businesses, the definition of “very small business” establishes a $1,000,000 threshold, adjusted for inflation, during the 3-year period preceding the applicable calendar year. As already noted, a facility that satisfies the definition of very small business is exempt from the requirements of subparts C and G and instead is subject to modified requirements (see § 117.201), which do not require a food safety plan that is prepared or overseen by a preventive controls qualified individual.

C. Proposed § 117.126(b)—Contents of a Food Safety Plan

We proposed that the written food safety plan must include the written hazard analysis, preventive controls (including the supplier program and the recall plan), procedures for monitoring the implementation of the preventive controls, corrective action procedures, and verification procedures. As discussed in more detail in section XLII, we have revised the phrase “supplier program” to “supply-chain program” throughout the regulatory text. In the remainder of this document, we use the phrase “supply-chain program” in section headings and when referring to the provisions of the final rule. We continue to use the term “supplier program” when describing the proposed provisions and the comments regarding the proposed provisions.

(Comment 381) Some comments ask us to specify that sanitation controls must be in the food safety plan. Some comments ask us to require equipment standards in the food safety plan, noting that it is not possible to clean and sanitize equipment that is not designed and constructed to be cleanable by meeting specific standards.

(Response 381) Sanitation controls are one type of preventive control. As appropriate to the facility and the food (e.g., to control hazards such as environmental pathogens), sanitation controls for cleanliness of food-contact surfaces and prevention of allergen cross-contact and cross contamination would be required to be in the food safety plan (§ 117.135(c)(3)).

We are not adding a requirement to include equipment standards in the food safety plan. The CGMPs established in subpart B already require that all plant equipment and utensils be so designed and of such material and workmanship so to be adequately cleanable (§ 117.40(a)(1)). It is not practical to specify equipment standards in the CGMPs due to the wide range of equipment used by the food industry, including equipment subject to ongoing development and improvement.

(Comment 382) Some comments ask us to recognize that existing HACCP plans, such as those developed in accordance with the EU 2004 Food Hygiene law and GFSI-compliant food safety plans, can satisfy the requirements for what must be in a food safety plan.

(Response 382) To the extent that an existing HACCP plan or GFSI-compliant food safety plan includes all required information, a facility can use such plans to meet the requirements of this rule. We expect that many existing plans will need only minor supplementation to fully comply with these requirements. Relying on existing records, with supplementation as necessary to demonstrate compliance with the requirements of the human preventive controls rule, is acceptable (see § 117.330).

(Comment 383) Some comments ask us to explain the differences between the food safety plan being established to implement FSMA and HACCP plans established under current requirements or guidelines for HACCP systems. These comments ask us to provide exporters with background information and specific examples of differences, including how firms are directed to set their critical control points and critical limits.

(Response 383) Table 29 compares the provisions of the food safety plan required by this rule to the provisions of HACCP plans in some current requirements or guidelines for HACCP systems. See also the discussion in the 2013 proposed human preventive controls rule (78 FR 3646 at 3730-3732) and our memorandum comparing the provisions of this rule to various existing domestic and international HACCP-based standards (Ref. 65). This rule does not specify how a facility would identify any applicable CCPs or critical limits. Importantly, this rule explicitly provides that preventive controls include controls other than those at CCPs that are also appropriate for food safety (§ 117.135(a)(2)(ii)). See also Response 2, in which we discuss both future guidance and a preventive controls training curriculum being developed by the FSPCA. We expect that both of these resources will help facilities, including foreign facilities, understand the requirements for a food safety plan.

D. Proposed § 117.126(c)—Records

We proposed that the food safety plan is a record that is subject to the recordkeeping requirements of subpart F. We received no comments that disagreed with this proposed requirement and are finalizing it as proposed.

E. Comments on Potential Requirements for Submission of a Facility Profile to FDA

We requested comment on whether to require submission to FDA of a subset of the information that would be in a food safety plan (78 FR 3646 at 3768). This information, which could be referred to as a “facility profile,” could be submitted through an electronic form using a menu selection approach at the same time as facility registration, and could be updated biennially simultaneously with the required biennial update of the food facility registration. We described potential benefits to having a facility's food safety plan in advance of an inspection, such as aiding in the efficient oversight of preventive controls by allowing us to better target inspectional activities to facilities that produce foods that have an increased potential for contamination (particularly contamination with biological hazards). We noted that facilities could benefit from our advance preparation through interaction with better-informed investigators and potentially reduced inspection time. We requested comment on the utility and necessity of such an approach and on the specific types of information that would be useful in developing a facility profile. We also requested comment on any additional benefits that might be obtained from using such an approach and any potential concerns with this approach.

We noted that we had previously announced an opportunity for public comment on the proposed collection of additional food facility profile information on a voluntary basis from firms that complete the FDA food facility registration process (Federal Register of May 11, 2012, 77 FR 27779). In contrast to the voluntary submission of food facility profile information described in that notice, in the 2013 proposed human preventive controls rule we requested comment on whether the submission of such information should be required.

(Comment 384) Some comments state that submission of a facility profile would be useful and support requiring such a submission. However, most of the comments that addressed our request for comments on such a submission express concern. Some comments assert that requiring submission of a facility profile is outside of FDA's statutory authority under FSMA. Other comments assert that submitting a facility profile would not advance food safety goals or have a commensurate benefit to food safety. Some comments express concern about protection of confidential information. Other comments express concern that we would misinterpret the submitted information in the absence of discussion with the facility. Some comments assert that receiving and evaluating the submitted information would be too time-consuming for FDA, whereas other comments assert that submitting the information would be too time-consuming for the facility. Some comments state that a subset of the information that would be submitted could be found in the Establishment Inspection Reports. Some comments assert that we could use information already available through the Reportable Food Registry to identify facilities that have needed to address a serious food safety violation and target our inspectional resources to those facilities. Some comments state that a facility profile is a not a static document and would be very difficult to keep up-to-date.

(Response 384) We have decided that we will not establish a requirement for submission of a facility profile. We will explore other mechanisms to achieve the goals we described in the 2013 proposed human preventive controls rule.

XXV. Subpart C: Comments on Proposed § 117.130—Hazard Analysis

We proposed requirements for hazard analysis, including hazard identification and hazard evaluation. Some comments support the proposed requirements without change. For example, some comments support our proposal for the hazard analysis to address “known or reasonably foreseeable hazards” because this is consistent with Codex. Other comments agree that the hazard analysis should address both the severity of the potential hazard and the probability that the hazard will be present in a food product. Other comments state that testing for environmental pathogens may be impractical in certain situations for facilities in chemical plants that also produce food additives and that the proposed requirements for hazard evaluation make it clear that in such facilities environmental monitoring would not be required. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 385, Comment 395, Comment 406, and Comment 407) or ask us to clarify how we will interpret the provision (see, e.g., Comment 418).

In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 30, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.130(a)—Requirement for a Written Hazard Analysis

We proposed that you must identify and evaluate, based on experience, illness data, scientific reports, and other information, known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at your facility to determine whether there are significant hazards. We also proposed that the hazard analysis must be written. As discussed in Response 126, we have revised the term “significant hazard” to “hazard requiring a preventive control.”

(Comment 385) Some comments ask us to specify that the rule requires a written hazard analysis even if the hazard analysis concludes that no hazards exist.

(Response 385) As proposed, the regulatory text would require a written hazard analysis even if the hazard analysis concludes that no hazards exist. To make this clearer, we have made two revisions to the regulatory text. First, we have revised the regulatory text to specify that a facility must “conduct a hazard analysis” to identify and evaluate known or reasonably foreseeable hazards, rather than merely specify that a facility must “identify and evaluate” known or reasonably foreseeable hazards. Second, we have revised the regulatory text to specify that the hazard analysis must be written regardless of its outcome.

(Comment 386) Some comments assert that a facility should not be able to conclude that no hazard exists in its production process and that any such conclusion reached should be a “red flag” to FDA investigators.

(Response 386) The purpose of a hazard analysis is to identify and evaluate known or reasonably foreseeable hazards to determine whether there are any hazards requiring a preventive control. If a facility appropriately determines, under the oversight of a preventive controls qualified individual, that no such hazards exist, then that is the outcome of its hazard analysis, and the facility must document that outcome in its written hazard analysis. (See also Response 222, Response 226, Response 229, Response 232, Response 397, Response 721, and Response 726.)

However, we agree that our investigators should take appropriate steps to evaluate a facility's hazard analysis when the outcome is that there are no hazards requiring a preventive control. We expect that our investigators would both review the facility's written hazard analysis and discuss the outcome with the facility. During the initial stages of implementation, we also expect that our investigators will ask subject matter experts in our Center for Food Safety and Applied Nutrition (CFSAN) to review such a hazard analysis. Over time, as our investigators gain experience with appropriate determinations that there are no hazards requiring a preventive control, we expect that there will be fewer circumstances in which our investigators would consult CFSAN about such an outcome.

(Comment 387) Some comments ask us to require facilities to provide supporting documentation in the hazard analysis and assert that such a requirement would be consistent with the requirements of the FSIS HACCP regulation for meat and poultry.

(Response 387) We made no changes to the regulatory text to specifically require that a facility “provide supporting documentation” in its hazard analysis. A facility has flexibility to determine the appropriate content of its written hazard analysis, provided that the written hazard analysis complies with the requirements for hazard identification and hazard evaluation (see § 117.130(b) and (c)). A facility must be able to justify its hazard analysis decisions, even if the supporting documentation is not specifically included with the hazard analysis. For example, a facility that relies on one or more scientific publications to support its hazard analysis might include a bibliography listing the relevant publications, but not include a copy of the listed publications. Differences in the regulatory text of this rule compared to the FSIS HACCP regulation for meat and poultry reflect the flexible framework provided by FSMA but do not create a conflict.

(Comment 388) Some comments ask us to modify the provision to specify that the hazard analysis identify and evaluate known or reasonably foreseeable hazards for each type of food manufactured, processed, packed, or held at the facility, including hazards in the raw materials and ingredients used in the food (emphasis added).

(Response 388) We decline this request. Other provisions in the requirements for hazard analysis specify that the hazard evaluation must consider raw materials and ingredients (see § 117.130(c)(2)(iii)). It is not necessary to repeat the specific requirements associated with the hazard evaluation in the provision that directs each facility to conduct a hazard analysis.

(Comment 389) Some comments ask us to modify the provision to use “or” instead of “and” in the clause “based on experience, illness data, scientific reports, and other information” because it is not necessary to evaluate all of the specified criteria in all cases.

(Response 389) We decline this request. We agree that in some cases some of the specified types of information may not be available. For example, if a food product has not been associated with foodborne illness, there would be no illness data. However, modifying the provision as suggested by the comments would establish a regulatory requirement in which a facility could pick and choose which information to evaluate, irrespective of whether the information is available.

(Comment 390) Some comments point out that the Codex HACCP Annex includes “mileposts” for the identification of hazards, recommending that the HACCP Annex apply to “all of the hazards that may be reasonably expected to occur at each step from primary production, processing, manufacture, and distribution until the point of consumption.” These comments ask us to include such “mileposts” in the requirements to conduct a hazard analysis to put the regulations in better alignment with the Codex HACCP Annex and underscore the fact that food producers cannot anticipate or be responsible for customer behavior that is contrary to general principles of food safety.

(Response 390) By “mileposts” for hazard identification, we assume that the comments are referring to the steps included in the Codex HACCP Annex regarding the recommendation to list all potential hazards associated with each step, conduct a hazard analysis, and consider any measures to control identified hazards. These steps include consideration of: (1) The likely occurrence of hazards and severity of their adverse health effects; (2) the qualitative and/or quantitative evaluation of the presence of hazards; (3) survival or multiplication of microorganisms of concern; (4) production or persistence in foods of toxins, chemicals or physical agents; and (5) conditions leading to these factors (Ref. 34).

We agree that a hazard analysis should address known or reasonably foreseeable hazards at each step from primary production, processing, manufacture, and distribution until the point of consumption. For example, a facility that produces cut or shredded RTE carrots might consider pathogens such as Salmonella that can occur at primary production; metal from the slicers or shredders, and L. monocytogenes as an environmental pathogen, during manufacturing/processing; and refrigeration until the end of the shelf life to prevent the growth of pathogenic sporeforming bacteria.

However, to the extent that these comments are asserting that a facility can ignore consumer behavior that the facility considers contrary to principles of food safety, we disagree. For example, a facility could not conclude that it need not identify and evaluate known or reasonably foreseeable hazards because the facility intends to provide cooking instructions on the label of a packaged food. Consumer research indicates that consumer cooking practices are not uniform and that many consumers do not follow some cooking instructions, such as those on frozen foods or directions specifying that a product should be cooked until it reaches a certain temperature (Ref. 66) (Ref. 67).

(Comment 391) Some comments ask us to require that the hazard analysis be re-evaluated every three years and updated as needed.

(Response 391) The written hazard analysis is one component of the food safety plan, and the food safety plan is subject to reanalysis at least every three years (see § 117.170).

(Comment 392) Some comments state that the standard for hazard analysis in the human preventive controls rule should both align with the re-proposed requirements for hazard analysis set forth in the supplemental FSVP notice and be consistent with the statutory standard for hazard analysis in section 418(b)(1) of the FD&C Act.

(Response 392) We have aligned the requirements of the human preventive controls rule and the proposed FSVP rule to the extent practicable, consistent with the applicable statutory requirements.

(Comment 393) Some comments ask us to endorse a template, format, or style to be used for a hazard analysis to ensure these analyses are conducted consistently across the food industry and that auditors are consistent in their evaluation.

(Response 393) We decline this request. See Response 373.

B. Proposed § 117.130(b)—Hazard Identification

We proposed that the hazard identification must consider hazards that include biological, chemical, and physical hazards. We proposed to list examples of biological hazards (i.e., microbiological hazards such as parasites, environmental pathogens, and other pathogens) and chemical hazards (i.e., radiological hazards and substances such as pesticide and drug residues, natural toxins, decomposition, unapproved food or color additives, and food allergens). In the preamble (78 FR 3646 at 3734)], we provided examples of physical hazards (i.e., stones, glass, or metal fragments that could inadvertently be introduced into food) but did not propose to include these examples in the regulatory text.

We also proposed that the hazard identification must consider hazards that may be present in the food if they occur naturally, may be unintentionally introduced, or may be intentionally introduced for purposes of economic gain.

(Comment 394) As discussed in Comment 126, some comments express concern that the rule would refer to multiple levels of hazards (i.e., “hazards,” “known or reasonably foreseeable hazards,” and “significant hazards” (which we now refer to as “hazards requiring a preventive control”) and ask us to provide sufficient clarity to be able to distinguish between these types of hazards.

(Response 394) As discussed in Response 126, we have revised the requirements for hazard identification to emphasize that the hazard identification focuses on known or reasonably foreseeable hazards (rather than on all hazards).

(Comment 395) Some comments ask us to include examples of physical hazards in the regulatory text.

(Response 395) We have added stones, glass, and metal fragments as examples of physical hazards in the regulatory text. This is consistent with the regulatory text for biological and chemical hazards, even though the hazards listed in section 418(b)(1) of the FD&C Act include examples of chemical and biological hazards but do not include examples of physical hazards.

(Comment 396) Some comments ask us to separately list some hazards (such as parasites and drug residues) rather than include them as examples of biological hazards and chemical hazards.

(Response 396) We decline this request. Although section 418(b)(1)(A) of the FD&C Act lists such items separately, we believe it is clearer to acknowledge that some of the hazards listed in the statute are in fact a subset of the broader categories of biological and chemical hazards.

(Comment 397) Some comments ask us to rephrase the requirement for hazard identification to specify “The hazard analysis must identify hazards” rather than “The hazard identification must consider hazards.”

(Response 397) We decline this request. The provision is directed to the first step of a hazard analysis—i.e., hazard identification—rather than to the overall hazard analysis (which is addressed in § 117.130(a)). The purpose of the hazard identification is to consider the types of hazards listed in the provision as a step in determining whether there are any hazards requiring a preventive control; the suggestion of the comments implies that such hazards will always be identified. As discussed in Response 386, the outcome of a hazard analysis for a food product could be that there are no hazards requiring a preventive control.

(Comment 398) Some comments ask us to broaden the examples listed for chemical hazards to include “allergens and ingredients associated with food sensitivities.”

(Response 398) We decline this request. Although the presence of an undeclared ingredient associated with a food sensitivity (such as the color additive Yellow #5) can be considered a chemical hazard for the sensitive population, it is neither practical nor necessary for the list of examples of chemical hazards in the regulatory text to be exhaustive.

(Comment 399) Some comments assert that we should not require all food safety plans to specifically address the likelihood of radiological hazards.

(Response 399) The rule only requires that a facility consider whether radiological hazards are known or reasonably foreseeable, and we have described situations where radiological hazards could be considered to be known or reasonably foreseeable (78 FR 3646 at 3667). A facility that appropriately determines that no radiological hazards are known or reasonably foreseeable would document that determination in its written hazard analysis but would not need to establish preventive controls and associated preventive control management components to address radiological hazards.

(Comment 400) Some comments addressing radiological hazards ask us to clarify that radiological hazards are an example of chemical hazards; clarify the requirements by identifying specific radiological hazards and including them in the regulatory text; develop a baseline for acceptable levels and specific monitoring recommendations for each product; defer compliance on the control of radiological hazards until more comprehensive information is available to industry and regulators on how best to control for and assess compliance in controlling the hazard; clarify whether irradiation of produce for phytosanitary purposes must be considered as a potential radiological hazard; confirm that a facility is required to assess only two types of radiological hazards (production water and accidental contamination from accidental release from a nuclear facility); and clarify whether we will require consideration of radiological hazards by processors subject to our HACCP regulations for seafood and juice.

(Response 400) The regulatory text specifies that radiological hazards are an example of chemical hazards. We decline the requests to identify specific radiological hazards, include them in the regulatory text, and develop a baseline for acceptable levels, with specific monitoring recommendations for each product type. As discussed in the 2013 proposed human preventive controls rule (78 FR 3646 at 3667), radiological contamination of foods is a rare event. The most relevant information that would lead a food facility to consider and evaluate a specific radiological hazard to determine whether it is a hazard requiring a preventive control would be publicly disseminated information following a particular event, such as contamination arising from accidental release from a nuclear facility or from damage to a nuclear facility from a natural disaster. We already have issued guidance on levels of concern for radionuclides that could be a known or reasonably foreseeably hazard in certain circumstances, such as after an accident at a nuclear facility (Ref. 68). In light of this current guidance, we see no reason to provide additional guidance to address hypothetical circumstances or to defer compliance until more information is available.

A facility does not need to consider sources of radiation used in accordance with a food additive regulation in its hazard analysis. Such sources are safe for their intended use. As with any other equipment and substances used in the manufacture of food, a facility must comply with all applicable safety requirements established either under the terms of a food additive regulation or by an authority such as the Occupational Safety and Health Administration. Although production water and accidental contamination from accidental release from a nuclear facility would be the two most likely sources of radiological hazards that a facility would need to address, we are not limiting the facility's responsibilities to these two sources. We cannot anticipate the future.

We have not taken action to revise either our HACCP regulations for seafood and juice or our current guidance on hazards and controls for seafood and juice (Ref. 42) (Ref. 43) to require or recommend that processors of those products address radiological hazards in their food safety plans. However, in the event of a situation such as an accident at a nearby nuclear facility, it would be prudent for such processors to consider whether the potential for contamination with radiological hazards would warrant modification of their food safety plans.

(Comment 401) Some comments assert that predictable intentional hazards should be in the food safety plan but unexpected intentional hazards should be part of a food defense plan.

(Response 401) This rule only requires a facility to consider intentionally introduced hazards when such hazards are introduced for purposes of economic gain. Hazards that may be intentionally introduced by acts of terrorism are the subject of the 2013 proposed intentional adulteration rule (78 FR 78014, December 24, 2013).

(Comment 402) Some comments disagree that the human preventive controls rule should address hazards that are intentionally introduced for purposes of economic gain (economically motivated adulteration). Some of these comments assert that economically motivated adulteration is not a good fit for the hazard analysis and preventive controls framework because it is, in all but the rarest of circumstances, an issue of product integrity and quality, whereas food safety systems are designed and built to prevent or mitigate food safety hazards. Some comments state that traditional food safety hazards are primarily both identified and addressed at the facility level, but economically motivated adulteration is typically handled by the corporate parent company, where supply chain management programs are typically located. These comments also assert that food safety-related economically motivated adulteration is extremely rare and that predicting economically motivated adulteration to prevent it is extremely difficult. Some comments assert there will be no measurable benefit to food safety by imposing requirements to consider economically motivated adulteration as part of a food safety plan and that doing so will consume limited resources without a corresponding increase in consumer protection. Other comments assert that there is no need to require a facility to identify hazards intentionally introduced for purposes of economic gain because the misbranding and adulteration provisions of the FD&C Act already sufficiently provide safeguards against economic gain.

(Response 402) We agree with the comments stating that the requirement to consider hazards intentionally introduced for purposes of economic gain is narrow. Such hazards will be identified in rare circumstances, usually in cases where there has been a pattern of economically motivated adulteration in the past. In addition, we define hazards to only include those agents that have the potential to cause illness or injury. Economically motivated adulteration that affects product integrity or quality, for example, but not food safety, is out of the scope of this rule. We continue to believe that there is benefit in taking this preventive approach to economically motivated adulteration, and not solely on enforcing the preexisting misbranding and adulteration provisions of the FD&C Act after a violation occurs.

As discussed in sections XLII through XLIX, we are finalizing supply-chain program provisions. It is consistent with the framework of this rule for a facility to address hazards requiring a preventive control that may be intentionally introduced for purposes of economic gain through the facility's supply-chain program.

(Comment 403) Some comments express concern about identifying hazards that may be intentionally introduced for purposes of economic gain because there are potentially an unlimited number of unknown or yet-to-be-identified hazards that could be intentionally introduced for purposes of economic gain by an unscrupulous supplier. These comments disagree with our attempt to narrow the field of potential scenarios for economically motivated adulteration to circumstances where there has been a pattern of such adulteration in the past.

Some comments assert that our attempt to narrow the field of potential scenarios for economically motivated adulteration is both too broad and too narrow at the same time. These comments assert that our attempt is too broad, because we expect facilities to consider patterns of adulteration from the past “even though the past occurrences may not be associated with the specific supplier or the specific food product” and a requirement to consider every potential product and potential supplier makes the task open ended. These comments further assert that our attempt is too narrow, because a focus on patterns of adulteration in the past is unlikely to reveal potential future instances of economically motivated adulteration and because those intending to defraud purchasers for economic gain are trying to avoid detection. According to these comments, once a food safety-related instance of economically motivated adulteration is uncovered, perpetrators quickly move to carry out their fraudulent activities in a different way. Some comments assert that there are alternative ways to control hazards that may be intentionally introduced for purposes of economic gain without specific regulatory requirements, such as by having an effective supplier approval program with appropriate qualification and verification activities; through business-to-business relations, expectations, and contracts; and through a vulnerability assessment and control plan tailored specifically to economically motivated adulteration.

(Response 403) We disagree that the requirement is too broad. A facility must conduct a hazard analysis for each type of food manufactured, processed, packed, or held at the facility. There is no requirement to consider every potential product or potential supplier. We also disagree that the requirement is too narrow. Some individuals intending to defraud purchasers for economic gain will develop entirely novel ways of adulterating food to suit their purposes. We agree that these circumstances may not lend themselves to the preventive approach required here. We encourage, but do not mandate, that facilities adopt other measures they deem appropriate to mitigate the risks of economically motivated adulteration that this rulemaking does not address. Still, the repeated economically motivated adulteration of spices with toxic colorants demonstrates that patterns of economically motivated adulteration can emerge and should be considered as part of a food safety plan (see the examples in the 2014 supplemental human preventive controls notice, 79 FR 58524 at 58550-58551).

(Comment 404) Some comments ask us to limit the requirement to identify hazards that may be introduced for purposes of economic gain to only those hazards that pose a risk to public health for which there has been a pattern in the past. Some comments assert that in those few instances where a hazard was intentionally introduced the underlying intention was to defraud rather than to cause harm, and the food safety hazard was an unintended consequence. Some comments ask us to focus the hazard identification solely on inbound products, because it is obvious that hazards introduced by the facility itself will not be prevented through a hazard analysis. Some comments ask us to narrow the scope of the requirement by specifying that facilities focus on three situations: (1) Situations in which there has been a pattern of similar adulteration in the past; (2) foods or ingredients for which quality assurance methods may not sufficiently characterize the food or ingredient to assure its identity, and; (3) foods or ingredients for which there are substitutes that are likely to be harmful that would be considered obvious to one skilled in food science.

(Response 404) We decline to make the changes suggested in these comments, because they are unnecessary. Because of our definition of hazard, the requirement is already limited to economically motivated adulteration that has the potential to cause illness or injury. Under the final rule, a facility does not need to identify a hazard related to economically motivated adulteration when there is no risk to public health or when the economically motivated adulteration is not known or reasonably foreseeable.

We agree that the three circumstances suggested by the comments are an appropriate focus for facilities who seek guidance on how to approach the requirements, but decline the request to specify these limitations of the scope in the regulatory text. As already noted, some comments assert that our attempt to narrow the field of potential scenarios for economically motivated adulteration is both too broad and too narrow at the same time (see Comment 403). Although we continue to believe that the instances in which a facility will identify a hazard intentionally introduced for economic gain will be rare, we also consider that limiting the scope of the requirement in the regulatory text would be both pre-judging the future and inconsistent with the public health objectives of this rule.

(Comment 405) Some comments ask us to allow implementation of the major provisions in FSMA before establishing requirements to address economically motivated adulteration. These comments assert that economically motivated adulteration requires a completely different paradigm than unintentional adulteration. In addition, because economically motivated adulteration is typically addressed through product specifications, supplier relationships, and good business practices, implementation of these other provisions of the human preventive controls rule are likely to have a positive effect on preventing economically motivated adulteration.

(Response 405) We disagree that economically motivated adulteration requires a completely different paradigm than unintentional adulteration. Hazards intentionally introduced for economic gain are addressed here with the same preventive framework as every other hazard. As such, we do not see a compelling reason to delay implementation of the requirements to address economically motivated adulteration.

C. Proposed § 117.130(c)—Evaluation of Whether a Hazard Requires a Preventive Control

We proposed that the hazard analysis must include an evaluation of the identified hazards to assess the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls; and environmental pathogens whenever an RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment that would significantly minimize the pathogen (proposed § 117.130(c)(1)). We also proposed that the hazard evaluation must consider the effect of the following on the safety of the finished food for the intended consumer: (1) The formulation of the food; (2) the condition, function, and design of the facility and equipment; (3) raw materials and ingredients; (4) transportation practices; (5) manufacturing/processing procedures; (6) packaging activities and labeling activities; (7) storage and distribution; (8) intended or reasonably foreseeable use; (9) sanitation, including employee hygiene; and (10) any other relevant factors (proposed § 117.130(c)(2)).

(Comment 406) Some comments ask us to revise the requirement to include an evaluation of environmental pathogens to avoid the implication that an intervention is needed when there may be other controls (such as pH or formulation) that would significantly minimize or prevent the pathogen. These comments suggest that we revise the provision to require that a hazard evaluation include an evaluation of environmental pathogens whenever an RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment “or otherwise include a control measure” that would significantly minimize the pathogen.

(Response 406) We have revised the provision on the hazard evaluation for environmental pathogens to specify that the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen. We agree that controls such as formulation can function as a “kill step” and that the provision should make clear that such controls can be used in lieu of “treatment.”

(Comment 407) Some comments ask us to clarify what we meant by “other relevant factors” and note that natural disasters (which we previously discussed) (78 FR 3646 at 3738) are “usually exceptional events” that are best managed in a facility crisis management plan. Other comments ask us to specify that the hazard evaluation must consider any relevant geographic, temporal, agricultural, or other factors that may affect the severity or probability of the hazard.

(Response 407) We included “other relevant factors” to emphasize that the list of factors in the provision is not an exhaustive list and that a facility is responsible to consider those factors that play a role in its determination of whether a potential hazard is a hazard requiring a preventive control, regardless of whether those factors are listed in the provision. A facility that already addresses circumstances such as natural disasters in other plans may consider the applicable part of those plans to be part of its food safety plan (see § 117.330).

We agree that geographic, temporal, and agricultural factors are examples of “other relevant factors.” For example, hazards such as aflatoxin are subject to a weather-dependent effect in that aflatoxin levels in some RACs are more of a problem in some years than in others. We have added the temporal nature of some hazards associated with some RACs as an example of “other relevant factors” to consider (see § 117.130(c)(2)(x)).

(Comment 408) Some comments assert that it is unnecessary to establish a specific provision that identifies environmental pathogens as a hazard that is required to be evaluated.

(Response 408) We are retaining the provision, which we proposed to highlight the importance of environmental pathogens in some facilities and to make clear that sanitation controls, with appropriate verification, may be necessary in addition to sanitation measures that the facility establishes as a matter of CGMP.

(Comment 409) Some comments assert that it can be difficult to determine “the severity of the illness or injury if the hazard were to occur” for a food that is not RTE food, especially for raw materials and ingredients.

(Response 409) We acknowledge that determining the severity of the illness or injury if the hazard were to occur can be more difficult for some foods than for other foods. However, recent outbreaks and large-scale recalls demonstrate the potential for some raw materials and other ingredients to cause serious illness or injury (78 FR 3646 at 3656 and 3737). For reasons such as these, the rule requires that a facility identify and evaluate multiple sources of information (i.e., experience, illness data, scientific reports, and other information) and also requires that the food safety plan (which includes the written hazard analysis) be prepared, or its preparation overseen, by one or more preventive controls qualified individuals (see § 117.126(a)(2)).

(Comment 410) Some comments ask us to provide that a facility may rely on existing systems in place to manage radiological risks, such as steps taken by government officials to inspect ingredients obtained from a geographic region that has been the subject of a nuclear accident.

(Response 410) A facility may consider all available resources in appropriately determining whether a known or reasonably foreseeable radiological hazard is a hazard requiring a preventive control and in appropriately determining what preventive controls, and associated preventive control management components, to establish and implement in light of a radiological hazard that is a hazard requiring a preventive control. However, existing systems in place to manage radiological risks, such as after a nuclear accident, do not absolve a facility of its responsibilities to establish and implement preventive controls to address a radiological hazard when circumstances warrant.

(Comment 411) Some comments assert that there would be no need to evaluate an environmental pathogen if the finished food is inherently incapable of supporting pathogen survival (e.g., in acid or acidified foods). These comments ask us to modify the requirement to narrow the circumstances when it would apply to whenever an RTE food is “capable of supporting pathogen growth to, or survival at, infectious levels.”

(Response 411) The suggestion of the comments pre-judges the outcome of the hazard analysis for a wide variety of food products. A facility can consider factors such as whether the formulation of a food would not support the growth of the pathogen to increased numbers, or would cause pathogens to die off over time, in determining whether an environmental pathogen is a hazard requiring a preventive control. Importantly, for many pathogens the mere presence of the pathogen presents a risk of illness, and the time necessary for pathogens in the food to die off due to the formulation of the food varies. Thus, a facility that appropriately determines that an environmental pathogen is not a hazard requiring a preventive control due to factors such as formulation of a food would need to document the basis for its determination in its written hazard analysis.

(Comment 412) Some comments ask us to include a definition for “exposed to the environment” to avoid confusion. These comments state their understanding that this phrase means that the product is in a form that is exposed and/or subject to direct human contact.

(Response 412) We decline this request. It is not necessary to define every term and phrase included in the rule. See the Appendix to the 2013 proposed preventive controls rule for examples of food products that are, or are not, exposed to the environment (78 FR 3646 at 3819). In the context of doing a hazard analysis, the facility must appropriately determine whether contamination of RTE foods with pathogenic organisms from the production environment can occur; to make such an appropriate determination does not require a definition of “exposed to the environment.”

(Comment 413) Some comments assert that the proposed requirement to consider the effect of “intended or reasonably foreseeable use” on the safety of the finished food for the intended consumer is too open-ended and vague to provide clear direction to industry and regulators pertaining to compliance obligations. These comments ask us to substitute “expected use” for “intended or reasonably foreseeable use.”

(Response 413) We decline this request. We agree that the term “expected use” has potential to communicate both intended use and reasonably foreseeable use but disagree that this interpretation would be universal. We are retaining “intended or reasonably foreseeable use” to be explicit that a facility must consider what is reasonably foreseeable in addition to what is intended. (See also Response 121.)

(Comment 414) Some comments express concern about the potential for a hazard evaluation to overlook food allergens and assert that food allergens must be designated as significant hazards whenever they occur. Other comments assert that a determination of whether a food allergen is a significant hazard should consider protein levels in ingredients. Other comments assert that food allergens are not a problem in produce, except for tree nuts.

(Response 414) The hazard identification must consider chemical hazards, including food allergens (§ 117.130(b)(1)(ii)). Thus, food allergens cannot be overlooked. Whether the protein level of a food allergen in ingredients is a factor that must be considered in the hazard evaluation would be determined by the preventive controls qualified individual who must conduct or oversee the hazard analysis. We agree that most produce does not satisfy the definition of food allergen, but the evaluation of whether a food allergen hazard exists in any particular food still must be considered by the preventive controls qualified individual who must conduct or oversee the hazard analysis.

(Comment 415) Some comments ask us to specify that the hazard evaluation be more specific about issues relevant to raw materials and ingredients, including how raw materials are selected and shipped, how suppliers are evaluated, and how shipments are inspected on receipt.

(Response 415) We decline this request. When a hazard requiring a preventive control in a raw material or other ingredient is controlled before receipt, the receiving facility would address such specifics in the supply-chain program that would be required as a preventive control (see subpart G). In addition, the rule already specifies that the hazard evaluation must consider the effect of raw materials and other ingredients on the finished food (§ 117.130(c)(2)(iii)).

(Comment 416) Some comments ask us to specify that a hazard evaluation consider the history of the class of product causing outbreaks from a particular pathogen.

(Response 416) We decline this request. The rule already specifies that the hazard analysis must be based on experience, illness data, scientific reports, and other information (see § 117.130(a)).

(Comment 417) Some comments assert that a facility that exports fresh fruit to the United States should not be required to consider storage and distribution of the food because storage and distribution are parts of the supply chain that are not known or controlled by the supplier. These comments also assert that records showing where the facility sent the food should suffice when a facility exports fresh fruit to the United States. Likewise, some comments assert that a facility that exports fresh fruit to the United States should not be required to consider intended or foreseeable use because the facility could not necessarily ascertain the intended or foreseeable use.

(Response 417) Each facility is part of a complex food supply chain and a supplier must consider how its food products are likely to be stored, distributed, and used. For example, entities that transport a food product generally rely on the shipper (in this case, the facility exporting the fruit) to provide information relevant to the safe handling of the food during transport. As another example, a facility exporting fruit could simply assume that its food product will be consumed without any processing to reduce any pathogens that may be on the fruit, unless it knows that its food product is destined for a commercial processing facility that makes processed fruit products using processes to adequately control pathogens.

(Comment 418) Some comments note our previous discussion about conducting a hazard evaluation for pathogens, including addressing whether a specific product has been documented to be contaminated with such pathogens (78 FR 3646 at 3737). These comments ask us to clarify what we mean by “documented,” particularly in the context of a single incident.

(Response 418) We expect a facility to take appropriate steps to remain aware of current reports of food contamination. For example, such reports are often disseminated through press releases that we post on our Web site when firms send them to us, and a facility can subscribe to our service that alerts interested persons to recalls, market withdrawals, and other safety alerts (Ref. 69). In appropriately determining whether a pathogen is a hazard requiring a preventive control, the facility would consider factors such as the severity of the hazard and the probability that the hazard would occur in the absence of preventive controls. Whether a single incident warrants consideration of a pathogen as a hazard requiring a preventive control may depend on the incident.

(Comment 419) Some comments ask us to specify that the hazard analysis consider the impact of a pathogen on high-risk populations.

(Response 419) We decline this request. The rule requires that a hazard evaluation consider the severity of the illness or injury if the hazard were to occur. This evaluation would consider the expected population of consumers and the severity of consequences when the expected population is exposed to a pathogen that is a known or reasonably foreseeable hazard in the food.

(Comment 420) Some comments assert that the proposed requirements for hazard evaluation could be interpreted in many ways. For example, a facility could conclude that the presence of a hand sink or boot dip prior to entering the processing area will reduce the likelihood of environmental pathogens and that environmental pathogens are not a significant hazard, whereas a regulator could interpret this provision to mean that a facility must always consider an environmental pathogen to be a significant hazard when the criteria in the provision are met, unless the facility can provide evidence to the contrary.

(Response 420) We agree that the requirements for hazard evaluation are subject to alternative interpretations. This is often the case, particularly when a regulation is new. The provision specifies that a facility must evaluate whether an environmental pathogen is a hazard requiring a preventive control in particular circumstances—i.e., whenever an RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen. The written hazard analysis must be prepared (or its preparation overseen by) a preventive controls qualified individual (see § 117.126(a)(2) and (b)(1)). The preventive controls qualified individual for a facility that determines that an environmental pathogen is not a hazard requiring a preventive control in such circumstances must document that determination, and a regulator would consider the adequacy of the facility's documented determination before reaching a conclusion as to whether the facility had failed to satisfy the requirements. However, the use of a hand sink or boot dip prior to entering the processing area to reduce the likelihood of environmental pathogens may also be considered to be part of the sanitation controls for the environmental pathogen.

(Comment 421) Some comments assert that the hazard assessment must document that the benefits of using a particular chemical outweigh the potential risks, such as the risks of the chemical causing antibiotic resistance. Other comments ask us to consider the factors listed in the provision for potential benefits, as well as risks.

(Response 421) A hazard is an agent that is reasonably likely to cause illness or injury in the absence of its control (§ 117.3). As previously discussed, the focus of the requirement on risk (i.e., the severity of the hazard and the likelihood that it will occur) is consistent with the NACMCF HACCP guidelines, the Codex HACCP Annex, and Federal HACCP regulations for seafood, juice, and meat and poultry (78 FR 3646 at 3735). None of these national or international guidelines or regulations suggest that a risk-benefit analysis is part of a hazard analysis.

Moreover, these comments appear to be directed to a determination by a facility of which raw materials or other ingredients to intentionally add to a food product rather than to biological, chemical, or physical hazards that, for example, occur naturally in the raw materials or other ingredients or may be unintentionally introduced. Any raw material or other ingredient that a facility adds to a food product must be lawful. This rule does not address the criteria for determining whether a particular raw material or other ingredient is lawful under the applicable statutory provisions (e.g., under section 409 of the FD&C Act regarding food additives).

(Comment 422) Some comments object to the use of sucrose fatty acid esters as an example (in our previous discussion, 78 FR 3646 at 3737) for distinguishing between raw materials and ingredients because sucrose fatty acid esters are an obscure product and the example does not clearly distinguish between the two terms.

(Response 422) As discussed in Response 65, we have decided to return to the phrase “raw materials and other ingredients” (rather than the proposed phrase “raw materials and ingredients”) throughout the rule to make it clear that raw materials are ingredients. As a result, it is not necessary to provide a more broadly applicable example to distinguish between the terms.

(Comment 423) Some comments ask us to clarify how the requirements of this rule apply to transportation practices and assert that a facility receiving product should not be responsible for hazards in foods that are not being transported under its custody. Other comments assert that we should require all entities across the supply chain to identify food transportation as a critical control point under the facility's hazard analysis.

(Response 423) We address specifics about the responsibilities of shipping facilities and receiving facilities in the 2014 proposed sanitary transportation rule (79 FR 7006). We will address comments regarding the responsibilities of shippers and receivers in the final sanitary transportation rule. For the purpose of the hazard analysis, whether a particular facility would identify food transportation as a critical control point through its hazard analysis would depend on the circumstances, such as whether the food is a TCS food. We expect a facility that identifies temperature control, including during transportation, as a preventive control (whether or not as a CCP), to communicate the need for appropriate temperature control to the person transporting the food.

(Comment 424) Some comments ask us to clarify our previous statements (78 FR 3646 at 3737) regarding whether and how label information, such as cooking instructions, may be a factor to consider in a hazard evaluation.

(Response 424) See Response 390 regarding consumer research about consumer cooking practices.

XXVI. Subpart C: Comments on Proposed § 117.135—Preventive Controls

We proposed requirements to identify and implement preventive controls to provide assurances that significant hazards will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. Some comments support the proposed requirements without change. For example, some comments agree that preventive controls must be written and include process controls, food allergen controls, sanitation controls, a recall plan, and other controls as appropriate and necessary. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 428, Comment 431, Comment 432, and Comment 439) or ask us to clarify how we will interpret the provision (see, e.g., Comment 425, Comment 437, and Comment 440).

In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 31, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.135(a)—Requirement To Identify and Implement Preventive Controls

We proposed that you must identify and implement preventive controls, including at critical control points, if any, to provide assurances that significant hazards will be significantly minimized or prevented and the food manufactured, processed, packed, or held by your facility will not be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. We also proposed that these preventive controls include controls at CCPs, if there are any CCPs, and controls, other than those at CCPs, that are also appropriate for food safety.

Some comments support the flexibility provided to facilities to implement preventive controls that are appropriate to the facility and the food. Other comments support the clarification, in the 2014 supplemental human preventive controls rule, that not all preventive controls are established at CCPs and that some food safety plans will have not CCPs. We are finalizing the provision as proposed with the editorial and conforming changes in table 52.

B. Proposed § 117.135(b)—Requirement for Written Preventive Controls

We proposed that preventive controls must be written.

(Comment 425) Some comments from the almond industry explain that USDA's regulations for a mandatory program for reduction of Salmonella on almonds require almond handlers (facilities) to subject almonds to a process that delivers a minimum 4-log destruction of Salmonella. The process can be applied by the almond handler (facility) or off-site at a “custom processor.” These comments agree that preventive controls should be written, but ask us to clarify whether documentation of treatment by its “custom processor” would be accepted as a “written preventive control” when the “custom processor” controls the hazard.

(Response 425) The question posed by these comments highlights the difference between the records required in the food safety plan and the records documenting the implementation of the food safety plan. The “written preventive controls” are part of the food safety plan, whereas the records documenting treatment are implementation records. Implementation records documenting treatment, whether by a facility or its “custom processor,” would not satisfy the requirements for written preventive controls. However, specifying that the preventive control for a specific hazard is a particular treatment by a “custom processor,” along with information that describes the treatment, would satisfy the requirement for written preventive controls.

C. Proposed § 117.135(c)(1)—Process Controls

We proposed that preventive controls include process controls as appropriate to the facility and the food. Process controls include procedures, practices, and processes to ensure the control of parameters during operations such as heat processing, acidifying, irradiating, and refrigerating foods. Process controls must include, as appropriate to the applicable control, parameters associated with the control of the hazard, and the maximum or minimum value, or combination of values, to which any biological, chemical, or physical parameter must be controlled to significantly minimize or prevent a significant hazard.

(Comment 426) Some comments state that assigning a parameter and associated minimum and maximum values for some process controls (such as refrigeration (including freezing), baking, or water activity) may be possible, but not be necessary for food safety. These comments ask us to require minimum and maximum values to be assessed against the applicable food safety need, or otherwise make clear that the implications of not controlling minimum and maximum values must be assessed in light of the circumstances. Other comments express concern that “as appropriate to the applicable control” could be interpreted as suggesting that if it is merely feasible to establish parameters for a process control, they must be established. Other comments express concern that the proposed requirement suggests that if a parameter is not “controlled,” a regulator could conclude that the facility is not in compliance with the rule because it necessarily has not significantly minimized or prevented a significant hazard.

One comment provides two examples of refrigeration controls to explain its view that the management components for refrigeration controls will vary depending on the role of refrigeration within the facility's overall food safety system. (See Comment 455.) This comment also provides an example to make a point that water activity may not be necessary for food safety even when maximum or minimum values are assigned. In this example, a parameter for water activity could be set at less than 0.85 based on the control of Staphylococcus aureus, but such a parameter would not be necessary for food safety for a product such as a dry seasoning blend that has a water activity of 0.2-0.3. This comment also notes that when there are many different controls working together to minimize or prevent one hazard simultaneously (such as a formulation that uses a combination of moisture, pH, titratable acidity, and salt level), noncompliance with any one parameter will not necessarily result in an unsafe product.

(Response 426) See Response 455. We have revised the regulatory text to specify that process controls must include parameters and minimum or maximum values as appropriate to both the nature of the applicable control and its role in the facility's food safety system.

(Comment 427) Some comments ask us to delete the phrase “to significantly minimize or prevent a significant hazard.”

(Response 427) We decline this request. “Significantly minimize or prevent a significant hazard” (which we have revised to “significantly minimize or prevent a hazard requiring a preventive control”) is the standard for controlling the hazards. Although the phrase could be viewed as redundant with the standard in the requirement to identify and implement preventive controls (§ 117.135(a)(1)), repeating that standard in the requirements for parameters and the minimum or maximum values associated with control of the hazard emphasizes the standard, which is appropriate for process controls.

D. Proposed § 117.135(c)(2)—Food Allergen Controls

We proposed that preventive controls include, as appropriate to the facility and the food, food allergen controls that include those procedures, practices, and processes employed for ensuring protection of food from allergen cross-contact, including during storage and use, and for labeling the finished food, including ensuring that the finished food is not misbranded under section 403(w) of the FD&C Act.

(Comment 428) Some comments ask us to specify that food be protected from allergen cross-contact during handling, as well as during storage.

(Response 428) We have revised the provision as requested by the comments.

(Comment 429) Some comments assert that food allergen controls should be based on hazard analysis and risk. Other comments provide examples of existing industry guidance that addresses food allergen controls. Some comments note that food allergen controls are addressed in the PMO (e.g., Appendix K, the voluntary HACCP program).

Other comments assert that establishing food allergen controls at this time is premature or that food allergen controls need to be balanced with pathogen controls. Some comments ask us to clarify whether the standard that would be established for food allergen controls is “absolutely allergen free.”

(Response 429) We have acknowledged that it is premature to require validation of food allergen controls (see 78 FR 3646 at 3755 and Response 515). However, we disagree that requiring a facility to establish food allergen controls as a preventive control is premature at this time, as evidenced by the existing industry guidance, and requirements of programs such as Appendix K of the PMO, submitted by comments. We agree that whether a facility appropriately determines that food allergen controls are necessary will be based on the outcome of the hazard analysis (see the requirements for hazard analysis in § 117.130(a) and (c)). A facility that already has established food allergen controls based on recommendations in industry guidelines or requirements of programs such as the voluntary HACCP program of the PMO can incorporate those established food allergen controls into its own, facility-specific food safety plan, and rely on its existing records for those food allergen controls to demonstrate compliance with the requirements of this rule (see § 117.330). Whether a facility needs to establish food allergen controls in addition to pathogen controls depends on the outcome of the facility's hazard analysis; a facility that determines that both allergens and pathogens are hazards requiring a preventive control in the manufacturing, processing, packing, or holding of a food product must address both hazards.

The requirements for food allergen controls do not establish a particular standard. In general, when we do establish a standard we avoid “absolute” standards such as the “absolutely allergen free” standard mentioned by the comment.

We appreciate receiving examples of food allergen control guides.

(Comment 430) Some comments ask us to revise the proposed requirement from “food allergen controls must include” to “food allergen controls include.”

(Response 430) In the 2014 supplemental human preventive controls notice, we proposed a series of revisions to the overall framework of the requirements for hazard analysis and risk-based preventive controls, including revisions to the requirements for preventive controls to emphasize that the preventive controls that a facility must establish and implement are those appropriate to the facility and the food (79 FR 58524 at 58541-58543). With respect to food allergen controls, we proposed to first specify what food allergen controls “include” (i.e., procedures, practices, and processes to control food allergens), as requested by these comments. However, we also proposed to continue to specify minimum requirements for what food allergen controls must include when a facility determines that a food allergen is a hazard requiring a preventive control—i.e., those procedures, practices, and processes employed for ensuring protection of food from allergen cross-contact and for labeling the finished food.

To the extent that these comments are asking us to clarify the distinction between a description of what constitutes a food allergen control and the minimum requirements for what food allergen controls must include when a facility determines that a food allergen is a hazard requiring a preventive control, the regulatory text we proposed in the 2014 supplemental human preventive controls notice modified the regulatory text as requested. However, to the extent that these comments are asking us to modify the provision so that it no longer establishes the minimum requirements for what food allergen controls must include when a facility determines that a food allergen is a hazard requiring a preventive control, we disagree. The listed minimum requirements are consistent with long-standing approaches to the control of food allergens and provide flexibility for a facility to identify and implement those procedures, practices, and processes most suited to the control of food allergen hazards in light of the facility and its food products (Ref. 70) (Ref. 71); see also the discussion at 78 FR 3646 at 3741.

(Comment 431) Some comments ask us to revise the requirement that food allergen controls must include labeling controls by adding the phrase “to ensure that major food allergens are properly disclosed.”

(Response 431) We decline this request. The provision requires that the procedures, practices, and processes employed for labeling the finished food include those for ensuring that the finished food is not misbranded under section 403(w) of the FD&C Act. Requiring that labeling procedures, practices, and processes ensure that major food allergens are properly disclosed would be redundant with the proposed requirement that they ensure that the finished food is not misbranded under section 403(w).

(Comment 432) Some comments ask us to revise the requirement that food allergen controls must include labeling controls by adding the phrase “as appropriate” because section 201(qq)(2)(A) of the FD&C Act excludes highly refined oils from the definition of “major food allergen.”

(Response 432) We decline this request because qualifying that the requirement applies “as appropriate” is not necessary to achieve the outcome requested by the rule comments. If a food ingredient, such as a highly refined oil, is not a major food allergen, it is not subject to the requirements for food allergen controls.

(Comment 433) Some comments assert that quantification or measurement of specific parameters is not appropriate for some food allergen controls.

(Response 433) We agree with these comments. In the 2014 supplemental human preventive controls notice, we clarified that the requirements for parameters and maximum and minimum values apply to process controls.

(Comment 434) Some comments ask us to establish thresholds for food allergens. Other comments assert that we should not have a “zero-tolerance” approach to food allergens. Some comments ask us to require advisory labeling (such as a label statement that a food that does not contain an allergen ingredient was processed in a facility that also processes foods that do have specific allergen ingredients) if we do not establish a “zero-tolerance” policy for food allergen controls. Other comments assert we should allow advisory labeling in light of difficulties in developing food allergen controls.

(Response 434) In 2008, we announced a public hearing on the use of advisory labeling of allergens in foods as part of a long-term strategy to help manufacturers use allergen advisory labeling that is truthful and not misleading, conveys a clear and uniform message, and adequately informs food-allergic consumers and their caregivers (73 FR 46302, October 8, 2008). In that document, we explained our concerns with food allergens, including food allergens inadvertently incorporated into manufactured foods, due to the number of reports concerning consumers who have experienced adverse reactions following exposure to an allergenic substance in a food. We also described our previous actions targeting food manufacturers, including: (1) A notice to manufacturers entitled “Label Declaration of Allergenic Substances in Foods” in 1996 (Ref. 72); (2) an FDA/state partnership to increase industry's understanding of food allergens and to identify effective manufacturing controls (Ref. 73); and (3) a statement of policy, to our staff, regarding food allergens (Ref. 74).

In 2012, we requested comments relevant to conducting a risk assessment to establish regulatory thresholds for major food allergens as defined in FALCPA (77 FR 74485, December 14, 2012). We noted that regulatory thresholds would help industry to conduct allergen hazard analyses and develop standards for evaluating the effectiveness of allergen preventive controls.

However, establishing regulatory policy or requirements, such as a long-term strategy regarding use of allergen advisory labeling, or a specific threshold for a food allergen or a “zero-tolerance” policy, is outside the scope of this rule. The provisions of this rule, whether the CGMPs in subpart B or the requirements for hazard analysis and risk-based preventive controls in subparts C and G, are directed to procedures, practices, and processes for the safe manufacturing, processing, packing, and holding of food rather than to special labeling policies or specific levels of substances (such as food allergens) that would render food adulterated or misbranded.

(Comment 435) Some comments assert that food allergen controls need not be required in specific situations, such as during the storage and transport of coffee and the storage of packaged foods not exposed to the environment.

(Response 435) Whether food allergen controls are necessary in any particular circumstance depends on the outcome of the facility's hazard analysis. Although coffee is not a food allergen, whether coffee requires food allergen controls during storage and transport depends on factors such as how the coffee is stored and transported and whether there is potential for allergen cross-contact. Although we agree that the potential for allergen cross-contact during the storage of packaged foods not exposed to the environment is low, it is the responsibility of the preventive controls qualified individual who conducts or oversees the hazard analysis to make an appropriate determination for an individual facility.

(Comment 436) Some comments assert that implementation of food allergen controls poses particular challenges in the context of milling operations. As an example, these comments explain that most milling operations do not handle soy. However, allergen cross-contact between grains and soy can occur at various points in the chain of production and transport, such that grains arriving at a milling facility might already contain low levels of soy. These comments also assert that the presence in a desired grain of low levels of soy or of other grains is consistent with U.S. Grain Standards. For example, the Grain Inspection, Packers and Stockyards Administration (GIPSA) definition of corn allows for the presence of between 2 percent and 7 percent foreign material, depending on the grade of corn, and the presence of up to 10 percent of other grains for which standards have been set. Although millers use equipment that helps to separate the desired grain from soy or other grains, these comments assert that complete elimination of soy and other grains is not practicable even under CGMP. These comments ask us to acknowledge that complete elimination of allergen cross-contact is not feasible in certain operations even under CGMP and that the intermittent presence of undeclared allergens is possible in certain foods, notwithstanding the observance of CGMP.

(Response 436) We acknowledge that GIPSA standards may allow for the presence of foreign material, and that foreign material could be a food allergen such as soy. However, such standards are not determinative as to whether hazards requiring a preventive control will be significantly minimized or prevented and the food manufactured, processed, packed, or held by a facility will not be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. Thus, as the comments point out, grains that arrive at a facility for milling may contain levels of a food allergen that a milling operation would not be able to eliminate. In circumstances such as these, supply-chain controls directed to the supplier's cleaning procedures, in addition to separation techniques applied at milling, may be necessary to enable the milling operation to satisfy its responsibilities under this rule. For example, a supplier that uses storage bins to hold soybeans at some times and corn at other times could agree to additional “cleaning” of bins previously used to store soybeans by “scouring” the bin with corn before using the bin to hold corn intended for human consumption. The corn used for scouring would be handled appropriately—e.g., by diverting to use in animal food, because food allergens are not hazards requiring a preventive control in food for animals. Doing so would reduce the potential for residual soybeans to be present in the next lot of corn, sold for human consumption.

(Comment 437) Some comments ask us to clarify when a facility would be expected to establish food allergen controls rather than rely on the CGMP requirements (in subpart B) to prevent allergen cross-contact, particularly for oilseed processors who only need to address soy allergens.

(Response 437) Food allergen controls are applicable to facilities that handle any of the foods that are food allergens. Any facility that handles a single food allergen, such as a processor only handling soybeans to make soybean oil, may simply need to ensure that the products it ships into commerce are labeled with the food allergen. (If the oils are highly refined and do not contain soy proteins, the facility may need to prevent cross-contact with less highly refined oils that may contain soy proteins.) If the facility only produces foods that contain the single food allergen, there would not be any foods for which cross-contact could occur. For facilities that handle more than one allergen-containing food or both foods that contain a specific food allergen along with foods that do not contain that food allergen (such as a facility that roasts almonds, macadamia nuts, and cashews), the facility could establish preventive controls to ensure that common equipment is cleaned between each type of nut. The facility could use CGMPs to ensure that the different nuts are stored separately before and after roasting to prevent cross-contact.

(Comment 438) Some comments ask us to confirm that FSMA does not change prior agency guidance on the reasonable steps that should be taken to prevent allergens from being unintentionally incorporated into the food and the limited use of allergen advisory statements where the risk of allergen cross-contact cannot be eliminated through CGMPs.

(Response 438) Prior agency guidance on the reasonable steps that should be taken to prevent allergens from being unintentionally incorporated into the food and the limited use of allergen advisory statements is still applicable. (See also the discussion in Response 434.)

E. Proposed § 117.135(c)(3)—Sanitation Controls

We proposed that preventive controls include, as appropriate to the facility and the food, sanitation controls that include procedures, practices, and processes to ensure that the facility is maintained in a sanitary condition adequate to significantly minimize or prevent hazards such as environmental pathogens, biological hazards due to employee handling, and food allergen hazards. We also proposed that sanitation controls must include procedures, practices, and processes for the cleanliness of food-contact surfaces, including food-contact surfaces of utensils and equipment, and procedures for the prevention of allergen cross-contact and cross-contamination from insanitary objects and from personnel to food, food packaging material, and other food-contact surfaces and from raw product to processed product.

(Comment 439) Some comments ask us to use the term “primary packaging material” rather than “food packaging material.”

(Response 439) We decline this request. See Response 166, in which we discuss what we mean by “food packaging material” (e.g., we do not intend the term “food-packaging materials” to include shipping containers such as cartons and crates that pose no risk of introducing contaminants or food allergens into food).

(Comment 440) Some comments ask us to clarify whether the requirements for sanitation controls apply to all food facilities or only to those that make RTE products.

(Response 440) The requirements for sanitation controls apply to all food facilities, not just those that make RTE products. The facility must determine through its hazard analysis when sanitation controls are necessary to address a hazard requiring a preventive control. It is reasonable to assume that sanitation controls will be more common in facilities that make RTE products than in facilities that make non-RTE products.

(Comment 441) Some comments assert that sanitation controls are not necessary to prevent any hazards in distribution facilities where food-contact surfaces are not present. Other comments assert that sanitation controls should be required in all cases (rather than “as appropriate”) given their central importance.

(Response 441) Under the framework established by FSMA—and implemented in this rule—each facility determines through its hazard analysis when sanitation controls are necessary to control a hazard requiring a preventive control. The rule neither establishes circumstances (such as in distribution centers) where sanitation controls are not necessary nor pre-judges whether sanitation controls are necessary in specific circumstances. Although we do not expect that facilities such as distribution centers would determine through their hazard analysis that sanitation controls are required, we do expect all food establishments that are subject to the CGMP requirements established in subpart B to fully comply with applicable requirements for sanitation.

F. Proposed § 117.135(c)(4)—Supply-Chain Controls

We proposed that supplier controls include the supplier program. See the discussion of comments on the supplier program, now in subpart G, in sections XLII through XLIX. As discussed in more detail in section XLII, we have revised the phrase “supplier program” to “supply-chain program” throughout the regulatory text. As a companion change, we have revised § 117.135(c)(4) to refer to “supply-chain controls” rather than “supplier controls.”

G. Proposed § 117.135(c)(5)—Recall Plan

We proposed that preventive controls include, as appropriate, a recall plan as would be required by proposed § 117.137. See the discussion of comments on the recall plan (final § 117.139) in section XXVIII.

H. Proposed § 117.135(c)(6)—Other Controls

We proposed that preventive controls include any other procedures, practices, and processes necessary to satisfy the requirements of § 117.135(a). Examples of other controls include hygiene training and other current good manufacturing practices.

(Comment 442) Some comments ask us to specify that preventive controls include controls on raw materials and other ingredients.

(Response 442) The final rule specifies that preventive controls include supply-chain controls as appropriate to the facility and the food. The request of these comments is addressed by the requirements for the supply-chain program (see § 117.135(c)(4) and subpart G).

(Comment 443) Some comments refer to our discussion that an example of an “other” preventive control could include temperature control for a TCS refrigerated food, and our discussion that although many refrigerated foods only require refrigeration for food quality, some refrigerated foods do require refrigeration for food safety (78 FR 3646 at 3744). These comments ask us to be clearer about foods that require refrigeration for food quality rather than for food safety.

(Response 443) Additional information about foods that do not require refrigeration for food safety is available in the Food Code (Ref. 51) (see, e.g., the definition of TCS food and the examples of foods that are not TCS foods in section 1-2 of the Food Code).

XXVII. Subpart C: Circumstances in Which the Owner, Operator, or Agent in Charge of a Manufacturing/Processing Facility Is Not Required To Implement a Preventive Control (Final §§ 117.136 and 117.137)

In the 2014 supplemental human preventive controls notice, we provided an opportunity for public comment on potential requirements for a supplier program as a preventive control, including comments on when a supplier program would not be required. As discussed in more detail in section XLII, we have revised the phrase “supplier program” to “supply-chain program” throughout the regulatory text. As summarized in table 32 and discussed more fully in the following paragraphs, after considering comments on when a supplier program would not be required, we are establishing two new provisions. Although both provisions have an effect on the required supply-chain program, they would be implemented outside the framework of a supply-chain program.

The first provision allows a manufacturer/processor to not implement a preventive control if the manufacturer/processor determines and documents that the type of food (e.g., RACs such as cocoa beans, coffee beans, and grains) could not be consumed without application of the appropriate control (see § 117.136(a)(1)). We describe comments leading to this provision, and our response to those comments, in Comment 444 and Response 444, respectively. Although we are establishing these provisions outside the framework of the supply-chain program, these provisions continue to play a role in the requirements for a supply-chain program, because they also provide an exception to the requirements for a manufacturer/processor to establish and implement a supply-chain program.

The second provision relates to comments we received on a proposed exception to the requirement for a manufacturer/processor to establish and implement a supplier program (proposed § 117.136(a)(1)(ii)(C)). (See Comment 445.) Under proposed § 117.136(a)(1)(ii)(C), a receiving facility would not have been required to have a supplier program if it relied on its customer to control the hazard and annually obtained from its customer written assurance that the customer has established and is following procedures (identified in the written assurance) that will significantly minimize or prevent the hazard. As discussed in Response 445, we are replacing this provision with several provisions that apply when a manufacturer/processor identifies a hazard requiring a preventive control (“identified hazard”), does not control the identified hazard, but can demonstrate and document that the identified hazard will be controlled by an entity in its distribution chain. A manufacturer/processor that satisfies the criteria in these provisions will not be required to implement a preventive control for the identified hazard. Under these provisions, the combination of three requirements will provide adequate assurance that the food will be processed to control the identified hazard before it reaches consumers. These requirements are: (1) Documentation provided by the manufacturer/processor to its direct customer that the food is “not processed to control [identified hazard]”; (2) written assurance from customers regarding appropriate procedures to ensure that the food will receive further processing to control the identified hazards; and (3) provisions relating to accountability for written assurances. (In these provisions, “customer” means a commercial customer, not a consumer.)

(Comment 444) Some comments express concern about the ability for distributors/cooperatives to identify the individual farms that harvested the produce when such farms are more than one step back in the food chain from the distributor/cooperative. Some comments assert that receiving facilities should not be required to verify suppliers with which they do not have a direct commercial relationship. These comments note that, in the case of the cocoa bean supply chain, the processing facility likely has no direct relationship with the thousands of farms involved in the growing and harvesting of the beans. Some comments ask for an exemption from supplier verification activities for foods such as cocoa beans because, although cocoa processors do not currently rely on farms to control hazards, and would therefore not need to verify farms, it is problematic to have a requirement that potentially could necessitate traceback to farms.

(Response 444) We are establishing a provision, applicable to both the supply chain and the distribution chain of a manufacturer/processor, for a circumstance when a manufacturer/processor does not need to implement a preventive control. The specific food product identified by some of the comments (i.e., cocoa beans) is part of a class of food products (principally RACs) that could simply not be eaten without processing that would control the hazards requiring a preventive control. Other RACs in this class of food products are coffee beans, grains, and some RACs that are rarely consumed raw. Therefore, we are providing that a manufacturer/processor does not need to implement a preventive control if it determines and documents that the type of food (e.g., RACs such as cocoa beans, coffee beans, and grains) could not be consumed without application of the appropriate control (see § 117.136(a)(1)). The regulatory text does not specify RACs “rarely consumed raw” because “rarely consumed raw” is not the same as “could not be consumed without application of the appropriate control.” However, depending on the facility, the RAC, and the food produced by the manufacturer/processor, there may be some circumstances where a manufacturer/processor could determine that a particular RAC that passes through its facility satisfies the criterion “could not be consumed without application of the appropriate control.”

In other cases, a facility that conducts a manufacturing/processing activity on produce rarely consumed raw may satisfy the criteria in other new provisions (§ 117.136(a)(2), (3), and (4)) in which it relies on its customer to provide assurance that the food will be processed to control the identified hazard. In still other cases, such a facility may have determined through its hazard analysis that there are no hazards requiring a preventive control, and will not consider whether one of the circumstances in new § 117.136 apply.

As a consequential addition, new § 117.136(b) specifies the records that a manufacturer/processor would need to satisfy the documentation requirements established in new § 117.136(a)(1), and we have added new § 117.136(b) to the list of implementation records (§ 117.190) that are subject to the recordkeeping requirements of subpart F.

See also Comment 657, in which we discuss comments asking us to add flexibility to the requirements for a supply-chain program such that any entity other than the receiving facility can perform supplier verification activities. As discussed in Response 657, the rule provides additional flexibility in the supply-chain program with regard to who can perform certain activities (see § 117.415).

(Comment 445) Some comments ask us to delete the criterion for control of the hazard by the receiving facility's customer, with annual written assurance that the customer had established and was following procedures (identified in the written assurance) that would significantly minimize or prevent the hazard. The stated reasons varied. For example, some comments state that a receiving facility may have so many customers that it is not possible to obtain written assurance annually from all customers. Other comments express concern that a customer may be unwilling to describe confidential trade secrets in order to identify in writing the procedures the customer has established and is following to control the hazard. Other comments express concern about “legal issues” when a receiving facility needs to assess the adequacy of the customers' procedures for controlling a hazard because under current business practices a vendor can provide assurance to a buyer (its customer), but buyers do not typically provide such assurance to vendors. Some comments express concern that written assurance does not guarantee that the customer is actually doing anything to significantly minimize or prevent the hazard.

Some comments ask us to provide an alternative that would allow the receiving facility to provide documentation to its customer about a hazard that needs a preventive control at a processing facility later in the distribution chain rather than obtain written assurance that its customer will control a hazard. If written assurance must be required, these comments ask us to allow the written assurance provided by the customer to state that the customer would evaluate the hazard and if necessary establish and follow procedures to significantly minimize or prevent the hazard.

Some comments state the receiving facility may not know the identity of all its ultimate customers, particularly if the receiving facility sells its products to a distributor who then sells to other entities. Some comments ask us to provide flexibility for facilities to determine whether annual updates of written assurance are necessary. Other comments ask us to specify that a receiving facility need not establish and implement a supplier program for raw materials and ingredients that are RACs intended for further processing.

Some comments assert that the presence of low levels of pathogens on a raw product that will be subject to a lethal process further downstream does not pose a risk to the consumer, and should not be considered a significant hazard (i.e., a hazard requiring a preventive control). These comments also assert that if we maintain that Salmonella contamination is a significant hazard for each member of the supply chain, then we should allow the preventive control to be applied in a subsequent step at another facility. Other comments ask us to clarify that a facility would not need to develop preventive controls where it produces raw materials or ingredients that are subject to subsequent processing that will address known or reasonably foreseeable hazards.

(Response 445) We are establishing several provisions, specifically applicable to the distribution chain of a manufacturer/processor, for circumstances when a manufacturer/processor does not need to implement a preventive control (§§ 117.136(a)(2), (a)(3), (a)(4) and (a)(5), (b)(2), (b)(3), (b)(4), and (b)(5), 117.137, and 117.335). See Response 444 for another new provision that applies to the supply chain in addition to the distribution chain (§ 117.136(a)(1)).

Under the first of these provisions (§ 117.136(a)(2)), a manufacturer/processor is not required to implement a preventive control if it relies on its customer (who is subject to the requirements for hazard analysis and risk-based preventive controls in subpart C) to ensure that the identified hazard will be significantly minimized or prevented and: (1) Discloses in documents accompanying the food, in accordance with the practice of the trade, that the food is “not processed to control [identified hazard]”; and (2) annually obtains from its customer written assurance, subject to the requirements of § 117.137, that the customer has established and is following procedures (identified in the written assurance) that will significantly minimize or prevent the hazard. The manufacturer/processor would include the specific hazard requiring a preventive control (e.g., Salmonella) where the statement says “[identified hazard].” A facility that provides the written assurance must act consistently with the assurance and document its actions taken to satisfy the written assurance (see new § 117.137). The documents could be bills of lading or other papers that accompany the food, or labels on the containers of the food.

Under the second of these provisions, (§ 117.136(a)(3)), a manufacturer/processor is not required to implement a preventive control if it relies on its customer (who is not subject to the requirements for hazard analysis and risk-based preventive controls in subpart C) to provide assurance it is manufacturing, processing, or preparing the food in accordance with applicable food safety requirements and it: (1) Discloses in documents accompanying the food, in accordance with the practice of the trade, that the food is “not processed to control [identified hazard]”; and (2) annually obtains from its customer written assurance that it is manufacturing, processing, or preparing the food in accordance with applicable food safety requirements. By “customer who is not required to implement preventive controls under part 117” we mean entities such as qualified facilities and retail food establishments.

Under the third of these provisions (§ 117.136(a)(4)), a manufacturer/processor is not required to implement a preventive control if it relies on its customer to provide assurance that the food will be processed to control the identified hazard by an entity in the distribution chain subsequent to the customer and: (1) Discloses in documents accompanying the food, in accordance with the practice of the trade, that the food is “not processed to control [identified hazard]”; and (2) annually obtains from its customer written assurance, subject to the requirements of § 117.137, that the customer will disclose in documents accompanying the food, in accordance with the practice of the trade, that the food is “not processed to control [identified hazard]”. The manufacturer/processor also must obtain written assurance that its customer will only sell to another entity that agrees, in writing, it will: (1) Follow procedures (identified in a written assurance) that will significantly minimize or prevent the hazard (if the entity is subject to the requirements for hazard analysis and risk-based preventive controls in subpart C), or manufacture, process, or prepare the food in accordance with applicable food safety requirements (if the entity is not subject to the requirements for hazard analysis and risk-based preventive controls in subpart C); or (2) obtain a similar written assurance from the entity's customer.

Under the fourth of these provisions (§ 117.136(a)(5)), a manufacturer/processor is not required to implement a preventive control if it has established, documented, and implemented a system that ensures control, at a subsequent distribution step, of the hazards in the food product it distributes and documents the implementation of that system. Comments did not provide examples of such a system, but we do not want to preclude the development of such systems.

We have added several other requirements related to these new provisions that we are specifically establishing as circumstances in which a manufacturer/processor need not implement a preventive control. As already noted in this response, new § 117.137 requires that a facility that provides a written assurance must act consistently with the assurance and document its actions taken to satisfy the written assurance. In addition, new § 117.136(b)(2), (3), (4), and (5) specify the records that a manufacturer/processor would need to satisfy the documentation requirements established in new § 117.136(a)(2), (3), (4), and (5), and new § 117.335 establishes requirements applicable to the written assurance between a manufacturer/processor and its customer. Taken together, the provisions of §§ 117.137 and 117.335 establish legal responsibilities for a facility that provides a written assurance under § 117.136(a)(2), (3), or (4), even if that facility is not a manufacturer/processor.

The point of these provisions is to ensure that hazards that a manufacturer/processor has determined, through its hazard analysis, require a preventive control, but are not controlled in the supply chain before the manufacturer/processor or by the manufacturer/processor, are in fact controlled by a subsequent entity in the distribution chain. With the assurance from the first manufacturer/processor's customer that the hazards will be controlled after the food product leaves the manufacturer/processor, it is not necessary for the first manufacturer/processor to implement the applicable preventive control. We continue to believe that annual written assurance from a manufacturer/processor's direct customer is an appropriate mechanism to ensure that its customer is aware of the identified hazard and is taking steps to ensure that the food is processed to control the identified hazard. We do not believe that a manufacturers/processor will need all of the details of its customer's process to satisfy the requirement to state in writing the procedures the customer has established and is following to control the hazard. For example, the customer could merely state that its manufacturing processes include a lethality step for microbial pathogens of concern.

We agree that it is appropriate to require that the manufacturer/processor provide documentation to its customer indicating that the food must be processed to control an identified hazard. Such documentation will be a means of clear communication from the manufacturer/processor to its customer. When the hazard will not be controlled by the customer, the customer will still have documentation that can be passed on to the entity that is expected to process the food to control the identified hazard, so that it will be very clear to that entity that the identified hazard still needs to be controlled.

(Comment 446) Some comments ask us to delete the proposed requirement to maintain the written assurance as a record.

(Response 446) We decline this request. As already discussed in this section, it is the combination of requirements (i.e., for documentation that the food is “not processed to control [identified hazard]”; assurance from customers regarding appropriate procedures to ensure that the food will receive further processing to control the identified hazards; and provisions relating to accountability for written assurances) that will provide adequate assurance that the food will be processed to control the identified hazard before it reaches consumers. Records documenting the written assurances are a key component of the provisions.

XXVIII. Subpart C: Comments on Proposed Requirements for a Recall Plan (Final § 117.139)

We proposed that you must establish a written recall plan for food with a significant hazard and that the recall plan must include certain procedures. Some comments support the proposed requirements without change. For example, some comments express the view that a written recall plan is critical in the event of a system breakdown where adulterated foods have been distributed. Some comments that support the proposed requirements note that many model plans are available to industry. Other comments state that the proposed requirements for a recall plan mirror guidelines in many fresh produce commodity-specific food safety guidelines and seem appropriate for all types of facilities handling fresh produce. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 447, Comment 452, Comment 453, and Comment 454).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we are finalizing the requirements as proposed with the conforming revision to use the term “hazard requiring a preventive control” rather than “significant hazard.” See Response 126 and table 52. We also are redesignating the requirements as § 117.139. As discussed in section XXVII, we are establishing a provision applying to certain assurances in § 117.137.

A. Proposed § 117.137(a)—Requirement for a Written Recall Plan (Final § 117.139(a))

We proposed that you must establish a written recall plan for food with a significant hazard.

(Comment 447) Some comments ask us to require a written recall plan for all food (rather than just for food with a significant hazard) and to establish the requirements for a written recall plan as CGMP requirements in subpart B rather than as part of the requirements for hazard analysis and risk-based preventive controls in subpart C. These comments assert that all products can be subject to a recall. These comments contrast recall plans with other preventive controls in that recall plans are often specific to a firm or facility, but rarely are specific to particular foods. In addition, these comments note that a recall may be administered and managed at the corporate office rather than at the specific manufacturing facility that produced the food.

Some comments note the requirements for a written recall plan are sufficiently different from other provisions in subpart C that we proposed to specify that the recall plan would not be subject to the preventive control management requirements for monitoring, corrective actions, and verification (see § 117.140(c)). Some comments note that facilities that are exempt from the requirements of subpart C, but remain subject to the CGMP requirements, would not be required to have a recall plan unless we establish the requirements in subpart B.

Some comments note that our authority to require recall plans is not limited to section 418 of the FD&C Act and that we can use other legal authority to impose a requirement for recall plans in subpart B. Some comments note that FSMA specifically amended the FD&C Act to provide us with the authority to mandate a food recall (section 423 of the FD&C Act). These comments assert that it would be reasonable for us to conclude that in order to efficiently carry out section 423 of the FD&C Act we should issue requirements governing the conduct of recalls, because section 423 of the FD&C Act requires that we provide a firm with an opportunity to voluntarily recall a product before issuing an order to the firm to cease distribution and recall a product.

(Response 447) We decline the request to establish requirements for a written recall plan as a CGMP requirement in subpart B and are establishing the requirements as a preventive control in subpart C as proposed. We acknowledge that a recall plan would be useful to all food establishments, and we encourage all food establishments to have a recall plan. However, the report issued by the CGMP Modernization Working Group did not identify the lack of a written recall plan as something that needed to be changed (Ref. 3). (See 78 FR 3646 at 3651 for a discussion of the CGMP Modernization Working Group and the process leading to its report.) However, going forward we intend to monitor whether the lack of a broader requirement for a recall plan leads to problems when food establishments that are not subject to the requirements of subpart C are faced with recall situations. As we gain experience with the impact of the new requirement for a recall plan on those facilities subject to subpart C, we can reassess at a later date whether to conduct rulemaking to broaden the requirement to apply to all food establishments subject to the CGMP requirements in subpart B. For now, food establishments that are not subject to subpart C can continue to follow our long-standing recall policy in part 7.

Consistent with the overall framework of FSMA, a recall plan (like other preventive controls) is only required when the facility has identified a hazard requiring a preventive control. A facility could establish a recall plan that applies to other foods it manufactures. We recognize that recalls may be managed by the corporate office of a firm rather than at the specific manufacturing facility that produced the food. Nothing in the rule precludes this approach. In such cases the corporate recall policy would be reflected in a facility's recall plan. (See also (Response 371.) In addition, a facility that identifies one or more hazards requiring a preventive control in multiple food products could use the same recall plan for all applicable food products.

The rule specifies that the requirements for preventive control management components (i.e., monitoring, corrective actions and corrections, and verification) apply as appropriate to ensure the effectiveness of the preventive control, taking into account the nature of the preventive control (§ 117.140(a)). As previously discussed, the preventive control management components are directed at food that remains at the facility, whereas the recall plan addresses food that has left the facility (78 FR 3646 at 3745). Our determination that the nature of the recall plan does not require these preventive control management components demonstrates the flexibility provided by FSMA and this rule, not that the recall plan must be considered a CGMP rather than a preventive control.

We have not yet made a determination of whether we should issue requirements governing the conduct of recalls, rather than rely on the guidelines in part 7, in order to fully implement section 423 of the FD&C Act. However, we have issued draft guidance entitled “Draft Guidance for Industry: Questions and Answers Regarding Mandatory Food Recalls” which, when finalized, would address topics such as the criteria for a mandatory recall and the process that FDA must follow for a mandatory recall (Ref. 75).

(Comment 448) Some comments assert that the requirements for a recall plan should only apply to RTE food.

(Response 448) These comments are suggesting that the rule predetermine the outcome of the hazard analysis at all facilities. The framework provided by FSMA and established in this rule makes it the responsibility of each facility to appropriately determine the hazards requiring a preventive control, and establish preventive controls as appropriate to the facility and the food.

(Comment 449) Some comments ask us to cross-reference the provisions of part 7 (21 CFR part 7) rather than establish requirements that these comments assert would be duplicative with the provisions of part 7. These comments ask us to address any more substantive requirements than are already in part 7 as part of a review of part 7. These comments assert that part 117 should require a written recall plan, but not require a “written recall plan for the food,” to be consistent with the approach of part 7.

(Response 449) We decline these requests. Part 7 addresses enforcement policy, and the provisions for recalls in subpart C of part 7 are “Guidance on Policy, Procedures, and Industry Responsibilities.” These recall provisions do not establish requirements and are not binding on industry. They also are broadly directed to recalls for all FDA-regulated products, not just food. As already discussed (see Response 447), nothing in this rule would prevent a facility that establishes a recall plan for a particular food from using that recall plan for any food product that the facility decides to recall.

B. Proposed § 117.137(b)—Procedures That Describe the Steps To Be Taken, and Assign Responsibility for Taking Those Steps (117.139(b))

We proposed that the recall plan must include procedures that describe the steps to be taken, and assign responsibility for taking those steps, to perform the following actions as appropriate to the facility: (1) Directly notify the direct consignees of the food being recalled, including how to return or dispose of the affected food; (2) notify the public about any hazard presented by the food when appropriate to protect the public health; (3) conduct effectiveness checks to verify that the recall is carried out; and (4) appropriately dispose of recalled food (e.g., through reprocessing, reworking, diverting to a use that does not present a safety concern, or destroying the food). We requested comment on whether: (1) The proposed procedures are appropriate for all types of facilities; (2) we should require a recall plan to include procedures and assignment of responsibility for notifying FDA of recalls subject to the plan; and (3) we should include a requirement for a mock recall as a verification activity.

(Comment 450) Some comments ask us to modify the proposed requirements for a recall plan to clearly differentiate between manufacturers and distributors. These comments note that distributors are often not the initial recalling firm and ask us to clarify that the manufacturer, rather than the distributor, is the responsible party for notifying the public. Other comments ask us to modify and simplify the details of the recall plan for smaller businesses based on product, distribution, and other factors.

(Response 450) In the 2014 supplemental human preventive controls notice, we revised the proposed requirements for a recall plan by specifying that the procedures in the recall plan are “as appropriate to the facility.” As a result, the rule explicitly provides flexibility for a recall plan to be different based on characteristics such as size of the facility or the role of the facility in the food supply chain. For example, the rule provides flexibility for a small business to simply specify that it will telephone its customers. Although we decline the request to specify that the manufacturer, rather than the distributor, is the responsible party for notifying the public, the rule provides flexibility for a distributor to establish, through its business relationships with manufacturers, that this would be the procedure established in the distributor's recall plan.

(Comment 451) Some comments ask us to delete the proposed requirement that the recall plan include procedures for a facility to notify the public about any hazard presented by the food when appropriate to protect public health. These comments assert that such a requirement would be highly subjective and create a nebulous regulatory burden that could subject facilities to unnecessary regulatory oversight and enforcement actions.

(Response 451) We decline this request. Our guidance for a recall strategy has long recommended issuing a public warning to alert the public that a product being recalled presents a serious hazard to health in urgent situations where other means for preventing use of the recalled product appear inadequate (§ 7.42(b)(2)). Operationally, such notification to the public is so common that our current home page on our Internet site (Ref. 76) gives prominence to recall information, and we have established a free email subscription service for updates on recalls (Ref. 77). Consistent with the long-standing recall policy in part 7, subpart C, the proposed requirement qualifies that the notification to the public is “when appropriate to protect public health.”

(Comment 452) Some comments ask us to specify that food recall plans include a minimum data requirement about the food product in question. These comments assert that information such as lot, batch, product size, and production date are critical in sorting defective products from non‐defective ones.

(Response 452) The procedures that must be established in a recall plan are those that describe the steps that will be taken to notify entities that a product must be removed from commerce, to verify that product is removed, and to appropriately dispose of the product. Information (such as lot, batch, product size, and production date) is necessary to be able to carry out the steps that must be included in the procedures and can be a useful component of the procedures that a facility includes in its recall plan, because a facility would need to obtain such information about the specific product being recalled when conducting a recall. However, we decline the request to specify what a facility must include in its procedures because facilities may use different approaches in how they carry out recalls and the information they need to do so. For example, not all facilities use that same data for identifying the product that may be impacted by a recall.

(Comment 453) Some comments ask us to specify that the procedures require facilities to notify us about a recall to ensure that all suppliers, retailers, and consumers will have adequate notification of the recall action. Other comments agree that it is important for facilities to involve us in a recall situation as soon as possible, but assert that the best way to address such a notification is through the existing RFR system. These comments assert that additional procedures or means to notify us would involve unnecessary additional steps and be duplicative, with no improvement to the public health. Some comments ask us to specify that the appropriate State regulatory agency with inspection jurisdiction be notified in the event of a recall.

(Response 453) We agree with comments that it is important to notify us about a recall and that doing so can help to ensure that suppliers, retailers, and consumers will have adequate notification of the recall action. We also agree that the existing procedures to notify us through the RFR system can accomplish this goal when a food presents a risk of serious adverse health consequences or death and that it therefore is not necessary to duplicate the notification procedures already established in the RFR system in part 117. However, we encourage facilities to include in their recall plan any procedures they have to comply with the RFR or to include a cross-reference to those procedures. Doing so may save time, which is critical during a recall. When the recalled food does not present a risk of serious adverse health consequences or death (and, thus, there is no report to the RFR), our guidance entitled “Guidance for Industry: Product Recalls, Including Removals and Corrections” recommends that recalling firms notify the local FDA District Recall Coordinator as soon as a decision is made that a recall is appropriate and prior to the issuance of press or written notification to customers (Ref. 78). Including this guidance with the facility's recall procedures may also save time.

Likewise, we agree with comments that it is important to notify appropriate State regulatory agencies about a recall. However, procedures are available for State regulatory agencies to rapidly receive information from us about food recalls. For example, State regulatory agencies can receive automatic notification about food recalls that we post on our Web site (Ref. 79). We note that whatever methods are used to dispose of adulterated food should comply with State and local requirements.

(Comment 454) Some comments ask us to add a requirement for mock recalls on a regular basis, such as annually. Some of these comments state that mock recalls would familiarize the staff and communications network(s) with the recall process and would improve the facility's capacity to conduct effective and efficient recalls in the event of a contamination event. Other comments assert that mock recalls would be the only way to determine the effectiveness of a recall program. Some comments note that mock recalls would be particularly critical for manufacturers that have limited experience in actual recalls. Other comments note that information from mock recalls could support development of guidance on best practices for recalls. Some comments recommend that any requirement for a mock recall as a verification measure include sufficient flexibility to accommodate diverse procedures and mechanisms.

Some comments acknowledge that a mock recall could be an important element of a recall plan but recommend that mock recalls remain voluntary, such as by including mock recalls as an example of how verification may be accomplished. Other comments note that the current recall procedures in part 7 do not recommend mock recalls. Some comments assert that a requirement to include a mock recall as a verification activity would be an excessive and inappropriate burden. Some comments note that retail facilities execute multiple recalls each week and that adding the requirement to perform a mock recall would be an unnecessary burden on the retail industry. Likewise, some comments note that foodservice distributors are experts in conducting recall activities, because they are routinely affected by manufacturer recalls.

Some comments ask us to clarify the “metrics” for a mock recall, particularly with respect to the consequences of failing to meet an appropriate metric if a mock recall is conducted as a verification activity.

(Response 454) We agree that a mock recall would familiarize the facility with the recall process, could improve the facility's capacity to conduct effective and efficient recalls during a contamination event, may be particularly helpful for manufacturers that have limited experience in actual recalls, and could support the development of guidance on best practices for recalls, and we encourage facilities to conduct one or more mock recalls to accomplish these goals. However, as previously discussed, a recall plan would address food that had left the facility, whereas the proposed requirements for monitoring, corrective actions, and verification would all be directed at food while it remains at the facility. Comments are mixed regarding whether the rule should require a mock recall as a verification activity for the recall plan, and we have decided to not require a facility to conduct a mock recall as a verification activity for its recall plan so that the focus of the monitoring, corrective actions, and verification in the rule remains focused on food being produced rather than on food that is distributed in commerce. A facility that voluntarily conducts a mock recall would establish metrics appropriate to its plan and take action (such as modifications to its procedures, or additional training for its employees) if it is not satisfied with the results of the mock recall.

We note that retail companies are not subject to this rule and, thus, are not subject to the requirement to have a written recall plan.

XXIX. Comments on Proposed § 117.140—Preventive Control Management Components

We proposed preventive control management components as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control. Most of the comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 455).

In the following sections, we discuss comments that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 33, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.140(a)—Flexible Requirements for Monitoring, Corrective Actions and Corrections, and Verification

We proposed that, with some exceptions, the preventive controls would be subject to three preventive control management components as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control: monitoring, corrective actions and corrections, and verification.

(Comment 455) Some comments support our proposal to provide flexibility in the oversight and management of preventive controls, including the explicit provision that preventive control management components take into account the nature of the preventive control. Some of these comments state that the provisions for the preventive control management components will allow facilities to tailor their food safety plans to their specific facility, product, and process and ensure that the regulatory requirements are risk-based. Other comments state that the proposed approach acknowledges the safety benefits derived from the use of prerequisite programs, such as CGMPs, and provides for a framework whereby appropriate decisions may be reached regarding hazards that require management controls that may include monitoring, corrections or corrective actions, verification, and records. Other comments state that the provisions will allow businesses to allocate resources to spend the most time and resources controlling and monitoring those hazards that pose the greatest risk to public health.

However, many of these comments also ask us to convey not only that the application of a particular management component be appropriate (i.e., capable of being applied), but also that it be necessary for food safety (i.e., to meet the overall FSMA food safety goals or to ensure a particular control is effective) by specifying that the preventive control management components take into account both the nature of the preventive control and its role within the facility's overall food safety system. Some of these comments ask us to make companion changes reflecting that the preventive control management components take into account both the nature of the preventive control and its role within the facility's overall food safety system throughout applicable provisions of the rule, such as the definition of “significant hazard” (which we now refer to as “hazard requiring a preventive control”) and in the requirements for preventive controls, monitoring, corrective actions and corrections, and verification. Some comments ask us to consistently refer to “the nature of the preventive control” (rather than simply to “the preventive control”) when communicating the flexibility that a facility has in identifying preventive controls and associated preventive control management components.

One comment provides two examples of refrigeration controls to explain its view that the management components for refrigeration controls will vary depending on the role of refrigeration within the facility's overall food safety system. In the first example, a facility that manages the process of cooling a cream cheese as a CCP would validate its refrigeration control, establish time and temperature parameters that must be met, monitor those parameters and confirm their use through verification, and, if the parameters were not met, then follow a specific corrective action procedure to address the situation. In contrast, after the initial cooling process for the hot-filled product, the facility would manage refrigerated storage differently. The facility would not keep validation data to support the specific temperature chosen because the temperatures needed to keep food safe are widely known and accepted. Although the facility may choose to establish temperature parameters, the facility typically would not apply such values as hard and fast limits in the same way as it would for a CCP (e.g., because a 5 degree increase over the upper end of the temperature range for a short time would not be meaningful to food safety). The facility may choose not to monitor temperature continuously and, even if the facility does monitor temperature continuously it would only generate “exception records” when the temperature exceeds a specific value. The facility also would find it unnecessary to verify its ongoing monitoring.

(Response 455) We agree that preventive control management components should take into account both the nature of the preventive control and its role in the facility's food safety system and have modified the regulatory text of § 117.140 to incorporate this suggestion. We reviewed the full regulatory text of proposed subpart C and made similar modifications to the regulatory text for the definition of “hazard requiring a preventive control” (§ 117.3); process controls (§ 117.135(c)(1)); monitoring (§ 117.145); verification (§ 117.155); validation (§ 117.160); and verification of implementation and effectiveness (§ 117.165).

(Comment 456) Some comments assert that the flexibility explicitly provided in the regulatory text could result in some facilities taking a broad approach to significant hazards and other facilities taking a more detailed approach. These comments express concern that inspectors will view the detailed approach (e.g., with more preventive controls) as the standard to judge compliance with the rule. Other comments express concern that identifying a large number of preventive controls could also undermine the value of HACCP programs because treating too many controls as CCPs will pull resources from those controls that are truly critical.

(Response 456) We agree that facilities are likely to take different approaches to complying with the rule. A facility-specific approach is consistent with FSMA, which places responsibility for hazard analysis and risk-based preventive controls on the owner, operator, or agent in charge of the facility (section 418(a) of the FD&C Act). We agree that having too many CCPs could dilute their significance, but not every hazard will require a CCP to be controlled. See table 6 in the 2014 supplemental preventive controls rule for two examples of preventive controls that would not be CCPs (79 FR 58524 at 58542).

During the initial stages of implementation, we expect that our investigators will ask subject matter experts in CFSAN to review the outcome of the facility's hazard analysis, the preventive controls established by the facility, and the associated preventive control management components that the facility has established and implemented. Over time, as our investigators gain experience, we expect that there will be fewer circumstances in which our investigators would consult CFSAN about such an outcome. See also Response 5.

(Comment 457) Some comments express concern with the number of provisions that will impact certain types of operations. As an example, these comments assert that a fresh-cut produce facility potentially could be required to implement supplier verification, environmental monitoring, and product testing, whereas a peanut butter producer may not be required to implement any of those three provisions. According to these comments, supplier verification most likely would not be required if the manufacturing operation of the peanut butter manufacturer includes a kill step to significantly minimize Salmonella, because the “significant hazard” would be addressed at the receiving facility. These comments interpret our previous discussions about product testing, in the 2013 proposed preventive controls rule, as evidence that such a peanut butter manufacturer also would likely not conduct product testing. If the peanut butter product is hot-filled into jars, there would be no RTE food exposed to the environment and, thus, the facility's hazard analysis would not be required to consider the potential for contamination with environmental pathogens.

(Response 457) We acknowledge that some facilities will need to do more than others, because the rule is flexible and risk-based. Importantly, the rule does not require every fresh-cut produce operation to conduct environmental monitoring, even though it does require each fresh-cut produce operation to consider whether it is necessary.

We disagree that the flexibility provided in the regulatory text would lead a peanut butter manufacturer to conclude that there would be no RTE food exposed to the environment when peanut butter is hot-filled into jars. In the production of peanut butter, the kill step (i.e., roasting) happens before the rest of the manufacturing process, and the roasted peanuts are exposed to the environment before the filling step. At the filling step, the temperature is hot enough to fill the jars but is not hot enough to act as a kill step to significantly minimize any pathogens that contaminated the peanuts after they were roasted. As a result, in contrast to the interpretation of the comments, the peanut butter production described by the comments does involve RTE food exposed to the environment, and the facility's hazard analysis must consider the potential for contamination with environmental pathogens. However, when a peanut butter manufacturer concludes that it requires sanitation controls for environmental pathogens, it is more likely that the peanut butter manufacturer would conduct environmental monitoring (rather than product testing) as a verification of its sanitation controls. (The peanut butter manufacturer may also conclude that product testing is a useful tool to verify its overall food safety system.) Likewise, a facility that buys peanut butter for use in an RTE food would need to consider whether it needs supply-chain controls for the manufacturer that performed the kill step for Salmonella and whether it needs sanitation controls for environmental pathogens and environmental monitoring as verification of its sanitation controls.

(Comment 458) Some comments state that USDA's regulations (in 7 CFR 205.201(a)(3)) for the NOP include regulatory text to “ensure the effectiveness” of measures in that program and that this regulatory text is similar to regulatory text in the requirements for preventive control management components. These comments assert that this type of regulatory text has created compliance challenges and ask us to consult with USDA about its experience with implementing effectiveness language associated with monitoring practices and procedures and ensure that the final rule uses regulatory text that will be clearly understood and readily implementable by those subject to its provisions.

(Response 458) Under the USDA regulation cited by these comments, an organic production or handling system plan must include a description of the monitoring practices and procedures to be performed and maintained, including the frequency with which they will be performed, to “verify that the plan is effectively implemented.” We have not consulted with USDA regarding its experience in evaluating compliance with this requirement because we addressed the issue likely to cause these compliance challenges for monitoring practices and procedures in an organic production or handling system plan when we established our requirements for monitoring preventive controls. Specifically, we require that a facility monitor the preventive controls with adequate frequency to “provide assurance that they are consistently performed,” not to “verify that the plan is effectively implemented.” Our requirements more clearly distinguish the purpose of monitoring and verification activities. See our previous discussion of the relationship between monitoring and verification, and our tentative conclusion to require monitoring of the performance of the preventive controls (78 FR 3646 at 3747). We are affirming that conclusion in this rule (see Response 461).

(Comment 459) Some comments assert that regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) would prevent a facility from monitoring employee health if it establishes a Good Worker Hygiene Program as a preventive control.

(Response 459) The basis of these comments is unclear. We do not expect that activities associated with monitoring of employee health would include activities that would be contrary to provisions of the Health Insurance Portability and Accountability Act of 1996. Employee health could be addressed through long-standing CGMP provisions (see § 117.10(a) and (b)). Specifically, with respect to disease control there could be supervisory observation of illness or conditions such as an open lesion, with appropriate action to exclude the worker from operations in which there is a reasonable possibility of food, food-contact surfaces, or food-packaging materials becoming contaminated (§ 117.10(a)). Generally, the regulations described in this comment (commonly referred to as “the Privacy Rule”) apply to disclosures made by a health care provider, not to the questions of an employer (Ref. 80). See 45 CFR 160.103, which defines a “covered entity” as a health plan; a health care clearinghouse; and a health care provider who transmits any health information in electronic form in connection with a transaction covered by the Privacy Rule. The Privacy Rule does not prevent a supervisor, human resources worker or others from asking an employee for a doctor's note or other information about health if the employer needs the information to administer sick leave, workers' compensation, wellness programs, or health insurance (45 CFR 164.512(b)(1)(v)).

B. Proposed § 117.140(b)—Applicability of Preventive Control Management Components to the Supply-Chain Program

We proposed that the supplier program (which we now refer to as “supply-chain program”) is subject to the following preventive control management components as appropriate to ensure the effectiveness of the supplier program, taking into account the nature of the hazard controlled before receipt of the raw material or ingredient: (1) Corrective actions and corrections, taking into account the nature of any supplier non-conformance; (2) review of records; and (3) reanalysis. We address comments on the supply-chain program in sections XLII through XLIX. We are finalizing the applicability of preventive control management components to the supply-chain program as proposed.

C. Proposed § 117.140(c)—Recall Plan Is Not Subject to Preventive Control Management Components

We proposed that the recall plan would not be subject to the preventive control management components.

(Comment 460) As discussed in Comment 447, some comments ask us to establish requirements for a written recall plan as a CGMP requirement in subpart B rather than as a preventive control in subpart C. As a companion change, some of these comments ask us to delete our proposed provision that the recall plan would not be subject to the preventive control management components.

(Response 460) As discussed in Response 447, we are establishing the requirements as a preventive control in subpart C as proposed. Therefore, we are finalizing the provision that the recall plan not be subject to the preventive control management components.

XXX. Subpart C: Comments on Proposed § 117.145—Monitoring

We proposed to establish requirements for monitoring the preventive controls. We also discussed our tentative conclusion that the language of section 418 of the FD&C Act regarding monitoring is ambiguous and that it would be appropriate to require monitoring of the “performance” of preventive controls.

Some comments agree with our tentative conclusion regarding the ambiguous nature of section 418. For example, some comments state that our interpretation seems appropriate because requiring monitoring of the “effectiveness” of the preventive controls would be redundant with required verification activities. In addition, requiring monitoring of the performance of preventive controls is consistent with applicable domestic and internationally recognized standards.

Some comments support the proposed provisions without change. For example, some comments note that the proposed requirement for written procedures for monitoring is similar to globally recognized food safety standards and current industry practices and is a proactive measure to help facilities prevent problems. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 466 and Comment 467) or ask us to clarify how we will interpret the provision (see, e.g., Comment 465 and Comment 468).

In the following paragraphs, we discuss comments that disagree with our tentative conclusion or with the proposed requirements, or ask us to clarify the proposed requirements or suggest one or more changes to the proposed requirements. After considering these comments, we are affirming our tentative conclusion that the language of section 418 of the FD&C Act regarding monitoring is ambiguous and that it would be appropriate to require monitoring of the “performance” of preventive controls. We also have revised the proposed requirements as shown in table 34, with editorial and conforming changes as shown in table 52.

A. Our Tentative Conclusion To Require Monitoring of the Performance of Preventive Controls

(Comment 461) Some comments disagree with our tentative conclusion that it would be appropriate to require monitoring of the “performance” of preventive controls and assert that the concept of “performance evaluation” is too complex to be included in the rule.

(Response 461) These comments may have misinterpreted what we meant by “monitoring performance of preventive controls.” We used the term “performance” to mean “the execution or accomplishment of an action, operation, or process undertaken or ordered” (78 FR 3646 at 3747). We acknowledge that the definition of “monitoring” that we are establishing in this rule includes that the purpose of observations or measurements conducted as part of monitoring is to “assess” whether control measures are operating as intended. However, we provided examples showing that this assessment is a straightforward determination of whether a process is operating as intended and is not a complex evaluation as asserted by the comments. (See, e.g., the discussion of monitoring the temperature of a process for roasting nuts, 78 FR 3646 at 3746-3747.)

(Comment 462) Some comments that support monitoring the performance of preventive controls assert that our proposed definition of “monitoring” (proposed § 117.3), and our preamble discussions of “monitoring,” have the potential to confuse “monitoring the performance of preventive controls” with verification activities that address ongoing implementation of control measures.

(Response 462) See Response 106, in which we discuss comments on the definition of monitoring and describe the changes we have made to that definition to address concerns about the potential to confuse “monitoring the performance of preventive controls” with verification activities that address ongoing implementation of control measures.

(Comment 463) Some comments assert that authority should be explicitly granted to the States to conduct food safety monitoring and that we should maintain our responsibilities for product tracing.

(Response 463) These comments misinterpret the provisions of section 418 of the FD&C Act and this rule. Section 418 places the responsibility for establishing and implementing a food safety system (including hazard analysis, risk-based preventive controls, preventive control management components (including monitoring, corrective action procedures, and verification), and recordkeeping) on the owner, operator, or agent in charge of a facility, not on FDA or any other regulatory authority. This requirement for monitoring within the framework of hazard analysis and risk-based preventive controls is distinct from regulatory oversight of food safety, such as during inspections and investigations of outbreaks of foodborne illness, which generally involve product tracing. We agree that it is important to coordinate regulatory oversight of food safety with the States and other food safety partners. As discussed in Response 5, we are working through the PFP to develop and implement a national Integrated Food Safety System consistent with FSMA's emphasis on establishing partnerships for achieving compliance (see section 209(b) of FSMA).

(Comment 464) Some comments express concern about monitoring for radiological hazards. Some comments claim hardships for fruit packinghouses required to analyze and monitor radiological hazards. Some comments object to comprehensive monitoring for radiological hazards and note that the Codex Principles of Food Hygiene (Ref. 81) do not address radiological hazards. Some comments from foreign entities request an exemption from the requirements to monitor radiological hazards because their government already monitors the food supply for radiological safety at a national level.

(Response 464) These comments misinterpret the proposed requirements for monitoring. In this rule, “monitoring” means to conduct a planned sequence of observations or measurements to assess whether control measures are operating as intended, such as measuring temperature during a process in which temperature is critical to controlling a hazard. The comments seem to be referring to a situation in which a receiving facility would find it appropriate to test incoming raw materials or other ingredients to ensure that they are not contaminated with a radiological hazard. In such a circumstance, testing the incoming materials would not be monitoring, but rather would be a preventive control (different from its usual role in verification). Regardless, whether a facility would need to conduct such testing (e.g., after an accident at a nuclear facility near one of the facility's suppliers) would be determined based on the outcome of its hazard analysis. As part of its hazard analysis, a facility that identifies a radiological hazard as a hazard requiring a preventive control, and determines that testing raw materials and other ingredients is an appropriate preventive control, could consider the extent to which any testing conducted by its government on raw materials and other ingredients reduces the need for, or extent of, its own testing.

B. Proposed § 117.145(a)—Flexibility in Requirements for Monitoring

We proposed that, as appropriate to the preventive control, you must establish and implement written procedures, including the frequency with which they are to be performed, for monitoring the preventive controls, and monitor the preventive controls with adequate frequency to provide assurance that they are consistently performed.

(Comment 465) Some comments assert that some food allergen controls are not “monitored” in the sense that HACCP controls are monitored. Some comments support a “visibly clean” standard for monitoring for food allergens.

(Response 465) To the extent that these comments are asserting that the types of monitoring activities that a facility would establish likely would be different for food allergen controls than for a control at a CCP for a product subject to a HACCP plan, we agree. Under the rule, a facility has flexibility to establish preventive control management components, including monitoring, as appropriate to the preventive control, and the nature of any monitoring activity will depend on the nature of the preventive control and its role in the facility's food safety system. In addition, a facility could determine, for example, that it will visually observe food allergen controls as a verification activity and not establish a separate “monitoring” activity within the meaning of § 117.145. For example, a facility that uses several food allergens as ingredients could store each of the food allergens in a separate area of the facility, and then “visually observe” that the various food allergens are in their assigned storage areas. We agree that “visibly clean” can be a minimum standard that a facility could apply during verification of food allergen controls by visual observation.

(Comment 466) Some comments ask us to require continuous monitoring of preventive controls because the NACMCF HACCP guidelines recommend continuous monitoring of controls where possible.

(Response 466) We decline this request. The NACMCF HACCP guidelines characterize continuous monitoring as the ideal situation and specifically note that continuous monitoring is always preferred “when feasible.” The NACMCF HACCP guidelines also note that continuous monitoring is possible with many types of physical and chemical methods. However, as we previously discussed, both the NACMCF HACCP guidelines and the Codex HACCP Annex acknowledge that continuous monitoring may not be possible, or even necessary, in all cases (78 FR 3646 at 3748).

(Comment 467) Some comments agree that frequency and areas to be tested and monitored need to be determined based on each product and facility and ask us to allow each individual facility to determine the frequency and areas to be monitored based on a completed risk assessment. Some comments ask us to specify that the frequency of monitoring preventive controls must have a scientific basis.

(Response 467) It is unclear whether the comment agreeing that monitoring frequency and areas to be tested need to be determined based on each product and facility was directed to the monitoring provision or to environmental monitoring. Regardless, by requiring written procedures for monitoring, and specifying that the procedures include the frequency with which the procedures are to be performed, the rule provides that each facility must determine the frequency of monitoring, as well as details such as the areas to be monitored. However, we decline the request to specify that these procedures be based on a completed “risk assessment.” The rule requires the facility to conduct a hazard analysis, which determines whether there are any hazards requiring a preventive control, and the facility would establish preventive controls for such hazards as appropriate to the facility and the food. The facility must consider factors associated with risk (i.e., the severity of the illness or injury if the hazard were to occur and the probability that the hazard will occur in the absence of preventive controls) in evaluating whether any potential hazard is a hazard requiring a preventive control (§ 117.130(c)). Risk could be relevant to a facility's identification of appropriate preventive controls for a particular hazard requiring a preventive control. However, it is the nature of the preventive control, rather than the risk associated with the hazard, that is more relevant to the frequency of monitoring and the areas to be monitored. Accordingly, the rule specifies that the facility establish written procedures and conducts monitoring as appropriate to the preventive control, rather than based on risk associated with the hazard. (See, e.g., the discussion of monitoring the temperature of a process for roasting nuts, 78 FR 3646 at 3746-3747.)

We decline the request to specify that the frequency of monitoring preventive controls must have a scientific basis. Monitoring should take place with sufficient frequency to detect a problem in the performance of a preventive control. The importance of the preventive control to the safety of the food can be one factor in setting a frequency. We acknowledge that scientific information may be appropriate in determining the frequency of monitoring in some cases. For example, the frequency may be statistically based, such as with statistical process control. However, in some cases factors other than scientific information may be appropriate in determining the frequency of monitoring. For example, historical information on the consistency of the control measure can be a factor in determining frequency. When variability of the process is low, the frequency may be less than with a process that has more variability. As another example, a process that is operated at a point close to a food safety parameter limit may be monitored more frequently than one where there is a large safety margin built into the process.

C. Proposed § 117.145(b)—Records

We proposed that all monitoring of preventive controls must be documented in records that are subject to verification and records review.

(Comment 468) Some comments point out that table 6 in the 2014 supplemental human preventive controls notice includes an example of a monitoring activity that generally would not require monitoring records (i.e., monitoring for foreign material with x-rays) (see 79 FR 58524 at 58542). These comments assert that this example is in conflict with the proposed regulatory text and ask us to modify the regulatory text to provide the flexibility we acknowledged in the 2014 supplemental human preventive controls notice. Other comments ask us to specify that monitoring must be documented as appropriate to the nature of the preventive control.

Some comments ask us to recognize the acceptability of monitoring systems that exclusively provide exception reports. These comments describe exception reporting as a structure where automated systems are designed to alert operators and management on an exception basis—i.e., only when a deviation from food safety parameter limits are observed by the system. These comments assert that, in many cases, monitoring of preventive controls can be done by automated systems that provide exception reporting in a much more efficient manner than if performed by operators and that automated monitoring allows for increased sampling frequency (often continuous) and reduction of human error. The comments provide an example of a refrigeration temperature control that notifies on exception (e.g., high temperature alarm) and may only record temperatures that exceed the specified temperature (without recording temperatures that meet control requirements). These comments acknowledge that such systems must be validated and periodically verified to ensure they are working properly. These comments ask us to clarify in the preamble to the final rule that monitoring systems can work affirmatively or by exception and that both types of systems and their related documentation are acceptable.

(Response 468) We have made several revisions to the regulatory text, with associated editorial changes, to clarify that monitoring records may not always be necessary. We agree that the exception reporting described in these comments, including validation and periodic verification to ensure that the system is working properly, would be an acceptable monitoring system in the circumstances provided in the comments—i.e., for monitoring refrigeration temperature. Therefore, we have revised the regulatory text to provide that records of refrigeration temperature during storage of food that requires time/temperature control to significantly minimize or prevent the growth of, or toxin production by, pathogens may be affirmative records demonstrating temperature is controlled or exception records demonstrating loss of temperature control. Although the comments specifically requested that we clarify our view on exception records in the preamble, we believe that clarifying the regulatory text will be more useful, both to facilities and to regulatory agencies that conduct inspections for compliance with the rule. If a facility uses “exception records,” the facility must have evidence that the system is working as intended, such as a record that the system has been challenged by increasing the temperature to a point at which an “exception record” is generated. (See also Response 602 and Response 610.)

We also have revised the regulatory text to provide that exception records may be adequate in circumstances other than monitoring of refrigeration temperature. For example, in table 6 of the 2014 supplemental human preventive controls notice the example we provided of a monitoring activity that generally would not require monitoring records is monitoring for foreign material with x-rays. We believe that an x-ray system that monitors for foreign material with x-rays would result in a record only when the system detects foreign material.

XXXI. Subpart C: Comments on Proposed § 117.150—Corrective Actions and Corrections

We proposed to establish requirements for corrective actions and corrections. Some comments support the proposed requirements without change. For example, some comments assert that there is virtually no reason to have a food safety plan unless there are proper corrective actions in place so the product can be properly disposed of. Some comments agree that there should be written procedures for corrective actions and note the importance of identifying and evaluating the problem, correcting it, and documenting the corrective action. Some comments express the view that the proposed requirement for clear corrective action in the event of an unanticipated problem, and documenting all corrective actions, contributes to a comprehensive safety plan. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 469, Comment 470, Comment 479, Comment 480, and Comment 485).

In the following paragraphs, we discuss comments that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 35, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.150(a)(1)—Requirement To Establish and Implement Corrective Action Procedures

We proposed that, with some exceptions, as appropriate to the preventive control you must establish and implement written corrective action procedures that must be taken if preventive controls are not properly implemented. The corrective action procedures must include procedures to address, as appropriate, the presence of a pathogen or appropriate indicator organism in an RTE product detected as a result of product testing, as well as the presence of an environmental pathogen or appropriate indicator organism detected through environmental monitoring.

(Comment 469) Some comments note that we proposed to list two circumstances that require written corrective active procedures (i.e., product testing and environmental monitoring) and that it is not clear whether this list is intended to be exhaustive or not (i.e., whether written corrective action procedures are required in only these two circumstances, or whether there may be other circumstances that require written corrective action procedures). These comments ask us to insert “but are not limited to” after “must include” if we intend that the list is not exhaustive. Likewise, other comments state our proposal to specifically require corrective action procedures may result in a misunderstanding by some facilities about the need to take corrective actions in circumstances other than in response to testing results, other non-conformances, or other types of verification activities. These comments assert that it would be better for food safety if the regulatory requirements took a more principled approach and generally required corrective action procedures, with the importance of corrective action procedures for testing programs addressed through guidance. If, however, we conclude that specific requirements for corrective action procedures for testing programs are necessary, these comments ask us to clarify that the nature and extent of any corrective actions should be proportional to the nature of the test findings.

(Response 469) We have revised the regulatory text, with associated editorial revisions and redesignations, to clarify that the specified list of corrective action procedures is not intended to be exhaustive (i.e., not limited to the two corrective action procedures that we specified in the proposed human preventive controls rule). The approach we used in the modified regulatory text (i.e., “You must establish and implement written corrective action procedures . . ., including procedures to address, as appropriate . . .” is similar to the approach used in several other provisions of the rule. (See, e.g., requirements for allergen controls (§ 117.135(c)(2)); sanitation controls (§ 117.135(c)(3)(i)); and monitoring (§ 117.145(a).) We decline the suggestion to modify the regulatory text by adding “but is not limited to” after “includes.” The word “includes” does not need to be followed by “but is not limited to” to clearly communicate that a following list is not complete. (See Response 68.) We agree that the nature and extent of any corrective actions in response to the findings of testing programs should be proportional to nature of the test findings. (See Response 470.)

(Comment 470) Some comments state that the nature and extent of the corrective actions should be proportional to the nature of the testing results. These comments ask us to require that a facility establish and implement corrective action procedures that must be taken if preventive controls are not properly implemented as appropriate to the nature of the hazard, the nature of the control measure, and the extent of the deviation.

(Response 470) We have revised the regulatory text to specify that the corrective action procedures are established and implemented based on the nature of the hazard in addition to the nature of the preventive control. We agree that the nature of the hazard plays a key role in the corrective actions that a facility would take. Although a facility's corrective action procedures likely would specify actions to take based on the extent of the deviation, we consider this a detail that does not need to be specified in the rule.

(Comment 471) Some comments ask us to revise the provisions to clarify that corrective action procedures are not always necessary when testing detects the presence of a pathogen or indicator organism. These comments assert that the extent of the corrective actions should be proportional to the nature of the testing results themselves because the level of contamination matters for those microorganisms with thresholds that need to be taken into account and because the location of contamination in the food processing environment matters (e.g., the zone in the facility where the contamination is detected). (For information about zones associated with environmental monitoring, see 78 FR 3646 at 3816.)

(Response 471) We decline this request. These comments appear to be confusing the requirement to establish and implement corrective action procedures with the content of the corrective action procedures. These comments also appear to assume that a requirement to have corrective action procedures (which describe the steps to be taken to ensure that appropriate action is taken to identify and correct a problem and, when necessary, to reduce the likelihood that the problem will recur; that all affected food is evaluated for safety; and that all affected food is prevented from entering into commerce when appropriate) pre-determines the outcome of following the corrective action procedures. This is not the case. If, as the comments assert, a facility concludes, for example, that the nature of some test results do not warrant steps to reduce the likelihood that the problem will recur and that affected food is safe and lawful (or, in the case of finding a pathogen in some zones in the facility, that no food is affected), then that is what its corrective action procedures would say. The reason to have corrective action procedures is to consider the likely scenarios in advance, with appropriate input from the facility's food safety team and preventive controls qualified individual, rather than react to these scenarios on an ad hoc basis.

(Comment 472) Some comments ask us to require that corrective actions include an analysis to determine the root cause of a problem, not only identify it. These comments also ask us to require follow-up actions to ensure the corrective action was effective and assert that although the requirements address the need to reanalyze the food safety plan they do not appear to specifically address a review of the corrective action.

(Response 472) The requests of these comments do not require any revisions to the regulatory text. The rule does not use the term “root cause” but it does require the facility to take appropriate action, when necessary, to reduce the likelihood that the problem will recur (see § 117.150(a)(2)(ii)). Root cause analysis is simply part of a common approach to complying with this requirement. (Knowing the root cause is key to reducing the likelihood that a problem will happen again.) The rule also requires a review of records of corrective actions, but does so as a verification activity rather than as part of the corrective action procedures (see § 117.165(a)(4)).

(Comment 473) Some comments ask us to revise the proposed rule to address corrective actions in a more general way and then outline areas where specific corrective action procedures would be helpful, such as for testing programs, in guidance.

(Response 473) The proposed provisions do not prescribe the outcome of the corrective action procedures, but merely direct the facility to the types of actions that the procedures must address. In essence, the proposed provisions already do, as the comments request, address corrective actions in a general way.

(Comment 474) Some comments ask us to specify that the requirements also apply when a preventive control is found to be ineffective.

(Response 474) We have not revised the regulatory text as requested by these comments. The appropriate action when a preventive control is found to be ineffective is to reanalyze the food safety plan and to establish and implement a preventive control that is effective, not follow a corrective action procedure. A corrective action procedure is intended to address a problem that happens when following the procedures in a food safety plan that previously was verified to be valid, not to fix problems on an ongoing basis when a preventive control is ineffective (and, thus, the food safety plan is not valid). We agree that some of the steps that apply to corrective actions may need to be taken, such as evaluating affected food for safety and ensuring that adulterated food does not enter commerce. This is addressed by the provisions for corrective actions in the event of an unanticipated problem (§ 117.150(b)(1)(ii)), which require specific corrective actions to be taken (§ 117.150(b)(2)).

B. Proposed § 117.150(a)(2)—Content of Corrective Action Procedures

We proposed that corrective action procedures must describe the steps to be taken to ensure that: (1) Appropriate action is taken to identify and correct a problem that has occurred with implementation of a preventive control; (2) appropriate action is taken to reduce the likelihood that the problem will recur; (3) all affected food is evaluated for safety; and (4) all affected food is prevented from entering into commerce, if you cannot ensure that the affected food is not adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act.

(Comment 475) Some comments assert that the corrective action procedures should not consider food to be “affected” if it is immediately subjected to an additional (or repeat) preventive control after determining that the initial preventive control was not properly implemented. These comments discuss an example in which there is a temperature deviation below accepted parameter limits for a given process, and the incorrectly processed product is re-processed correctly, and assert that it would be illogical to consider the food to be “affected” in this circumstance. Other comments ask us to modify the requirements to specify that they apply to all affected food “if any.”

(Response 475) We decline the request to modify the regulatory text to specify that the requirements apply to all affected food “if any.” Food is “affected” if a preventive control is not properly implemented during its production. However, the rule does not pre-determine the consequences when food is “affected.” Instead, the rule requires the facility to evaluate the affected food for safety. If, as in the example described by the comments, the facility re-applies the preventive control such that the food is safe and is not adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act, there would be no need to take steps to prevent that food from entering commerce.

(Comment 476) Some comments assert that the proposed regulatory text could be misunderstood as a requirement to establish a new preventive control after implementing a corrective action procedure. These comments also assert that it would be inappropriate to assume that corrective action procedures always correct a problem with the implementation of a new or additional preventive control.

(Response 476) We received these comments before we issued the 2014 supplemental human preventive controls notice. The proposed regulatory text in the 2014 supplemental human preventive controls notice addresses the issues identified in these comments by clearly separating the requirement to take appropriate action to identify and correct a problem that has occurred from the requirement to take appropriate action, when necessary, to reduce the likelihood that the problem will recur.

(Comment 477) Some comments ask us to provide that requirements for corrective actions be principle-based (e.g., containment of affected product, control restored to operation before commencing production) rather than prescriptive.

(Response 477) The requirements for corrective actions established by this rule are principle-based in that they require the facility to describe the steps that it will take rather than prescribe the steps that it will take.

(Comment 478) Some comments ask us to revise the provision to make re-sampling and/or re-testing one of the first steps in a corrective action procedure to take into account human error. These comments assert that mishandling during sampling, transport, and testing can contribute to a false positive result and that if the results of a follow-up test are negative, then the previous test could be considered an anomaly that could be ignored.

(Response 478) We decline this request. We disagree that an appropriate approach to positive findings of a test for contamination is to re-sample and re-test and to consider positive findings to be an anomaly if subsequent test results are negative. Many food products are not homogeneous and contamination is localized. Even for homogeneous food products (such as fluids), the problem could be the sensitivity of the method if the level of contamination is low. See our guidance entitled “Guidance for Industry: Testing for Salmonella Species in Human Foods and Direct-Human-Contact Animal Foods” (Ref. 82).

C. Proposed § 117.150(b)—Corrective Action in the Event of an Unanticipated Problem

With some exceptions, we proposed that you must take corrective action to identify and correct a problem, reduce the likelihood that the problem will recur, evaluate all affected food for safety, and, as necessary, prevent affected food from entering commerce as would be done following a corrective action procedure if any of the following circumstances apply: (1) A preventive control is not properly implemented and a specific corrective action has not been established; (2) a preventive control is found to be ineffective; or (3) a review of records finds that the records are not complete, the activities conducted did not occur in accordance with the food safety plan, or appropriate decisions were not made about corrective actions. We also proposed that if any of these circumstances apply, when appropriate you must reanalyze the food safety plan to determine whether modification of the food safety plan is required.

(Comment 479) Some comments ask us to delete the proposed requirement that a facility must reanalyze the food safety plan in the event of an unanticipated problem. These comments argue that FSMA does not specify reanalysis in the event of an unanticipated problem. In addition, these comments assert that the proposed requirement for reanalysis in the event of an unanticipated problem would be redundant with the proposed requirements for reanalysis as a verification activity (proposed § 117.170) and would not add value for food safety. These comments also assert that the term “problem” is ambiguous and ask us to replace “problem” with “food safety issue” if we retain the provision in the final rule.

(Response 479) We acknowledge that section 418 of the FD&C Act does not explicitly specify that a facility must reanalyze its food safety plan in the event of an unanticipated problem. However, as previously discussed, requiring reanalysis of the food safety plan after an unanticipated problem is consistent with the NACMCF HACCP guidelines, the Codex HACCP Annex, and Federal HACCP regulations for seafood, juice, and meat and poultry (78 FR 3646 at 3752). In the 2014 supplemental human preventive controls notice, we clarified that reanalysis would be conducted “when appropriate.” For example, if a problem occurs because personnel did not understand the procedures or carry out the procedures correctly, additional training for applicable personnel may be warranted, but there likely would be no need to reanalyze the food safety plan.

We disagree that the term “problem” is ambiguous. The term “problem” signifies that something is wrong, whereas the term suggested by the comments (i.e., “issue”) may or may not signify that something is wrong. The analogous provisions in the NACMCF HACCP guidelines (Ref. 34), the Codex HACCP Annex (Ref. 35), and Federal HACCP regulations for seafood, juice, and meat and poultry is “deviation.” We avoided the term “deviation” because “deviation” has the potential to signify that the requirements of this rule for corrective actions only apply when a preventive control is at a CCP, which is not the case. We agree that the requirements are directed to problems related to food safety, and in the 2014 supplemental human preventive controls notice we modified the title of the requirement to be “Corrective action in the event of an unanticipated food safety problem.” However, we continue to use the simpler term “problem” in the remainder of the regulatory text. Specifying that the nature of the problem is “food safety” in the title is sufficient to focus the requirement on food safety.

We agree that there is a relationship between the requirements for corrective actions in the event of an unanticipated food safety problem and the requirements for reanalysis. To reduce redundant regulatory text, in the 2014 supplemental human preventive controls notice we proposed to modify the regulatory text of the requirements for reanalysis to specify that reanalysis is required when appropriate after an unanticipated food safety problem, and we are establishing that modified provision in this final rule. Importantly, the provisions for reanalysis continue to require reanalysis when a preventive control is found to be ineffective. We are not aware of any circumstances in which it would not be appropriate to reanalyze the food safety plan if a preventive control is found to be ineffective.

(Comment 480) Some comments assert that the word “specific” is not appropriate as a modifier for “corrective action procedure” because many preventive controls will have corrective action procedures that allow flexibility based on the nature of the hazard and control. These comments also state that the term “specific” in this context is more appropriate for a CCP control in a HACCP system.

(Response 480) We have revised the regulatory text to delete the word “specific.”

(Comment 481) Some comments ask us to emphasize that reanalysis is required only when a combination of two events occurs (i.e., a preventive control is not properly implemented, and the facility has not established a corrective action procedure).

(Response 481) In the 2014 supplemental human preventive controls notice, we proposed revisions to the regulatory text to clearly specify the circumstances requiring reanalysis. One such circumstance is when a preventive control is not properly implemented and a corrective action procedure has not been established (§ 117.150(b)(1)(i)). The final provision includes the revisions included in the 2014 supplemental human preventive controls notice and is consistent with the request of these comments.

(Comment 482) Some comments ask us to add that corrective actions in the event of an unanticipated problem also apply when a preventive control is “missing.”

(Response 482) We have revised the regulatory text to require corrective actions whenever a preventive control, combination of preventive controls, or the food safety plan as a whole, is ineffective. (See § 117.150(b)(1)(ii).) In assessing what the comment might mean by a preventive control that is “missing,” we concluded that an unanticipated problem could, in some cases, mean that a combination of preventive controls, or the facility's food safety plan as a whole (rather than a single preventive control), simply was not effective. If this is the case, reanalysis would be appropriate, and we also have modified the requirements for reanalysis to specify that a facility must reanalyze its food safety plan whenever it finds that a preventive control, combination of preventive controls, or the food safety plan as a whole is ineffective. (See also Response 556.)

(Comment 483) Some comments assert that fresh and fresh-cut produce operations are unlikely to prevent recurrence of occasional detections of human pathogens (particularly L. monocytogenes, which is a soil microorganism whose normal habitat is in the field) because there is no “kill step” for pathogens and because the source of contamination may not be identified. These comments point out that we recognize that preventive controls may only be able to “significantly minimize” significant hazards and assert that our acknowledgement that preventive controls may not always be able to prevent significant hazards is inconsistent with an expectation to prevent recurrence.

(Response 483) We disagree that our acknowledgement that preventive controls may not always be able to prevent significant hazards is inconsistent with an expectation to prevent recurrence. Even when a preventive control is not always able to prevent a hazard requiring a preventive control, it can reduce the likelihood that the hazard will adulterate the food within the meaning of section 402 of the FD&C Act or misbrand the food within the meaning of section 403(w) of the FD&C Act. For example, a facility processing fresh-cut produce can reduce the likelihood of contamination of incoming fresh produce with L. monocytogenes through enhanced supply-chain controls for incoming fresh produce, along with appropriate sanitation controls. As discussed in Response 470, we have revised the regulatory text to specify that the corrective action procedures are established and implemented based on the nature of the hazard in addition to the nature of the preventive control, because the nature of the hazard plays a key role in the corrective actions that a facility would take. When a preventive control is not able to prevent a hazard, the facility must focus on minimizing the hazard.

(Comment 484) Some comments ask us to replace the term “reanalyze” with the term “reassess.”

(Response 484) We decline this request. See Response 551.

D. Proposed § 117.150(c)—Corrections

We proposed that you do not need to comply with the requirements for corrective actions and corrections for conditions and practices that are not consistent with specified food allergen controls or sanitation controls if you take action, in a timely manner, to correct such conditions and practices.

(Comment 485) Some comments support our proposal to provide for corrections, rather than corrective actions, for sanitation controls and some food allergen controls in some circumstances. Other comments assert that situations in which “corrections” can be applied are not limited to sanitation and food allergen controls and could include actions to address other preventive controls such as preventive maintenance controls or CGMPs. As discussed in Comment 164, some comments emphasize the importance of distinguishing between the terms “correction” and “corrective action.”

(Response 485) We have revised the regulatory text, with associated editorial revisions and redesignations, to provide for corrections, rather than corrective actions and corrective action procedures, for minor and isolated problems that do not directly impact product safety. As discussed in Response 164, we also have defined the term “correction” to mean an action to identify and correct a problem that occurred during the production of food, without other actions associated with a corrective action procedure (such as actions to reduce the likelihood that the problem will recur, evaluate all affected food for safety, and prevent affected food from entering commerce).

E. Proposed § 117.150(d)—Records

We proposed that all corrective actions (and, when appropriate, corrections) must be documented in records and that these records are subject to the verification requirements in §§ 117.155(a)(3) and 117.165(a)(4)(i). We received no comments that disagreed with this proposed requirement and are finalizing it as proposed.

XXXII. Subpart C: Comments on Proposed § 117.155—Verification

In the 2013 proposed human preventive controls rule, we proposed verification activities that would include validation, verification of monitoring, verification of corrective actions, verification of implementation and effectiveness, written procedures, reanalysis, and documentation of all verification activities. We also requested comment on whether we should specify the verification activities that must be conducted for verification of monitoring (78 FR 3646 at 3756) and for verification of corrective actions (78 FR 3646 at 3756), and if so, what verification activities should be required.

To improve clarity and readability, in the 2014 supplemental human preventive controls notice we proposed to move the more extensive verification requirements for validation, implementation and effectiveness, and reanalysis from the single proposed section (proposed § 117.150) to separate sections (proposed §§ 117.160, 117,165, and 117.170, respectively). In addition, to address comments that asked us to provide more flexibility to facilities, including flexibility in determining whether and how to conduct verification activities, in the 2014 supplemental human preventive controls notice we proposed that the verification activities be performed “as appropriate to the preventive control.”

In this section, we discuss the proposed requirements for verification of monitoring, verification of corrective actions, and documentation of verification activities. See sections XXXIII through XXXV for comments on the proposed requirements for validation, verification of implementation and effectiveness, written procedures, and reanalysis. See table 37, table 38, and table 39 for a summary of the revisions to those proposed requirements.

Some comments support the proposed requirements for verification of monitoring, verification of corrective actions, and documentation of verification activities without change. For example, comments support the documentation of verification activities (see section XXXII.C). In the following paragraphs, we discuss comments on the flexibility provided for a facility to conduct verification activities as appropriate to the nature of the preventive control. We also discuss comments that address our request for comment on whether we should revise the regulatory text to specify the verification activities that must be conducted for verification of monitoring and for verification of corrective actions, or express concern that the requirements as proposed are too prescriptive. After considering these comments, we have revised the verification requirements described in § 117.155 as shown in table 36.

A. Flexibility in Requirements for Verification

(Comment 486) Some comments support the flexibility provided by use of the phrase “as appropriate to the preventive control” in the requirement that verification activities must include, as appropriate to the preventive control, specified verification activities (i.e., validation, verification that monitoring is being conducted, verification that appropriate decisions about corrective actions are being made, verification of implementation and effectiveness, and reanalysis). These comments emphasize that verification activities must be tailored to the preventive control and assert that the use of the word “must” is potentially confusing in light of this flexibility—e.g., because not all preventive controls must be validated for food safety, and those preventive controls that do not need monitoring would not need verification of monitoring. Other comments ask us to allow facilities flexibility to verify that preventive controls are effective in the manner prescribed by FSMA—i.e., such controls should be deemed to be effective by an appropriate means as determined and supported by the facility within its food safety plan.

(Response 486) The provisions for preventive control management components make clear that all preventive control management components, including verification, are required as appropriate to ensure the effectiveness of the preventive control, taking into account the nature of the preventive control and its role in the facility's food safety system (see § 117.140). Likewise, the provisions for each of the preventive control management components (i.e., monitoring, corrective actions and corrections, and verification) individually provide flexibility, either by specifying that the provisions apply as appropriate to the nature of the preventive control and its role in the facility's food safety system (i.e., for monitoring and verification) or both the nature of the preventive control and the nature of the hazard (i.e., for corrective actions and corrections). The word “must” specifies the type of activities that a facility can use to satisfy the requirements for a particular preventive control management component.

We are retaining the term “must.” However, we agree that the rule should provide flexibility for additional verification of implementation and effectiveness. To provide that additional flexibility, we have revised the specific requirements for verification of implementation and effectiveness to provide for other activities appropriate for verification of implementation and effectiveness (see § 117.165(a)(5)). As a conforming revision, we have revised the requirement for review of records to include a review of records of “other verification activities” within a reasonable time after the records are created (see § 117.165(a)(4)(ii)).

B. Proposed § 117.155(a)—Verification Activities

1. Proposed § 117.155(a)(1)—Validation

We proposed that verification activities must include, as appropriate to the preventive control, validation in accordance with § 117.160. See section XXXIII for comments on validation as a verification activity.

2. Proposed § 117.155(a)(2)—Verification of Monitoring

We proposed that verification activities must include, as appropriate to the preventive control, verification that monitoring is being conducted in accordance with § 117.145. We requested comment on whether we should specify the verification activities that must be conducted for monitoring, and, if so, what verification activities should be required.

(Comment 487) Comments that address our request for comment on whether we should specify the verification activities that must be conducted for monitoring ask us to not do so because this prescriptive approach would be too limiting. These comments ask us to instead provide flexibility for the facility to determine the appropriate verification activities.

(Response 487) We agree that we should provide flexibility for the facility to determine these verification activities, and are not specifying the verification activities that must be conducted for monitoring.

(Comment 488) Some comments express concern that the proposed requirements for verification of monitoring would bring food CGMPs to the same level as pharmaceutical CGMPs. These comments assert that our example of how verification of monitoring could be conducted when a metal detector is a preventive control is impractical (FR 3646 at 3756). These comments explain that a quality control officer is not likely to go out onto the plant floor every shift to verify the operator's metal detector readings but would instead document the metal detector readings, which would be captured as part of the batch record review. These comments suggest that a more appropriate description of what a facility would do when a metal detector is a preventive control would be to “check” whether the metal detector is rejecting test pieces of metal.

(Response 488) We are establishing the requirements for verification of monitoring as part of a system for hazard analysis and risk-based preventive controls, not as a matter of CGMP. As previously discussed (78 FR 3646 at 3756), verification of monitoring is consistent with the FSIS HACCP regulation for meat and poultry, which requires direct observations of monitoring activities as an ongoing verification activity (9 CFR 417.4(a)(2)(ii)). We disagree that our example of how verification of monitoring could be conducted when a metal detector is a preventive control is impractical; observation of the operator conducting the check with test pieces by a supervisor, or having a quality assurance person run a test, is not uncommon. However, in the 2014 supplemental human preventive controls notice, we clarified that verification that monitoring is being conducted is required as appropriate to the preventive control. With this added flexibility, a facility could, for example, determine that it would satisfy the requirement for verification of monitoring by reviewing records under § 117.165(a)(4). Doing so would be consistent with the NACMCF HACCP guidelines (Ref. 35), the Codex HACCP guidelines (Ref. 34), and FDA's HACCP regulations for seafood and juice, which all address verification of monitoring through the review of records (78 FR 3646 at 3756).

3. Proposed § 117.155(a)(3)—Verification of Corrective Actions

We proposed that verification activities must include, as appropriate to the preventive control, verification that appropriate decisions about corrective actions are being made in accordance with § 117.150. We requested comment on whether this section should specify the verification activities that must be conducted for corrective actions, and if so, what verification activities should be required.

(Comment 489) Some comments ask us not to specify the verification activities that must be conducted for corrective actions because this approach would be too limiting. These comments ask us to instead provide flexibility for the facility to determine the appropriate verification activities.

(Response 489) We agree that we should provide flexibility for the facility to determine the appropriate verification activities for corrective actions, and are not specifying the verification activities that must be conducted for corrective actions.

4. Proposed § 117.155(a)(4)—Verification of Implementation and Effectiveness

We proposed that verification activities must include, as appropriate to the preventive control, verification of implementation and effectiveness in accordance with § 117.165. See section XXXIV for comments on verification of implementation and effectiveness.

5. Proposed § 117.155(a)(5)—Reanalysis

We proposed that verification activities must include, as appropriate to the preventive control, reanalysis in accordance with § 117.170. See section XXXV for comments on reanalysis as a verification activity.

C. Proposed § 117.155(b)—Documentation of Verification Activities

We proposed that all verification activities must be documented in records. We received no comments that disagreed with this proposed requirement and are finalizing it as proposed.

D. Comments on Potential Requirements Regarding Complaints

We requested comment on whether and how a facility's review of complaints, including complaints from consumers, customers, or other parties, should be required as a component of its activities to verify that its preventive controls are effectively minimizing the occurrence of hazards (78 FR 3646 at 3768).

(Comment 490) Some comments ask us to require review of consumer complaints as a verification activity and note that our HACCP regulations for seafood and juice require that verification activities include a review of consumer complaints to determine whether they relate to the performance of the HACCP plan or reveal the existence of unidentified CCPs. Some comments note circumstances in which consumer complaints have identified food safety problems that resulted in a company report to the RFR.

Some comments state that the frequency and type of complaints a facility receives is a very good indicator of the underlying issues associated with food production, reviewing these records would provide valuable insight into the type of issues that should be investigated, and this type of verification activity could be therefore be extremely effective with little to no cost because the facility would already be performing this type of activity. Some comments state that many foodborne outbreaks have been identified through complaints and a review of complaints is a critical component of a food safety system.

Other comments state that a food safety review of complaints is a prudent part of a food safety program but that the value of such a review is in providing information and feedback for continuous improvement of the food safety management system rather than as a verification of preventive controls. These comments caution against use of consumer complaints as a regulatory requirement for verification of the food safety plan because most complaints relate to product quality. If such a requirement is nonetheless established in the final rule, these comments recommend that the rule only require follow-up and documentation for the rare occurrences where consumer complaints relate to food safety issues.

Other comments ask us not to require review of complaints as a verification activity. Some of these comments assert that complaints rarely relate to food safety or yield information that leads to discovery of a food safety issue. Some comments assert that requiring review of consumer complaints could result in unnecessary time and effort being spent on an activity with a limited correlation to food safety. Other comments assert that complaints would be acted upon immediately for business reasons, and that waiting to react to complaints until conducting a review of records as a verification activity would be too late. Other comments assert that complaints are sensitive business information. Other comments assert that some consumer complaints are false or emotional (rather than factual) and have no place in development of preventive controls. Some comments assert that FSMA does not expressly direct us to require review of complaints. Some comments assert that review of complaints is not a precise scientific process, and that consumer comments are often open to different interpretations.

(Response 490) We are not establishing a requirement for a review of complaints as a verification activity. We agree that review of complaints is more likely to be useful in providing information and feedback for continuous improvement of the food safety system rather than as a verification of preventive controls. However, we encourage facilities to do such a review, as they occasionally do uncover food safety issues such as an undeclared allergen.

XXXIII. Subpart C: Comments on Proposed § 117.160—Validation

We proposed to establish requirements for validation of preventive controls. Some comments support the proposed requirements without change. For example, some comments agree that validation must be performed by (or overseen by) a preventive controls qualified individual and that some preventive controls (e.g., food allergen controls, sanitation controls, and recall plans) do not require validation. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 491, Comment 500, Comment 501, Comment 503, and Comment 513) or ask us to clarify how we will interpret the provision (see, e.g., Comment 499, Comment 502, and Comment 508).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 37, with editorial and conforming changes as shown in table 52.

A. Flexibility in the Requirements To Validate Preventive Controls

With some exceptions (see discussion of proposed § 117.160(b)(3) in section XXXIII.D), we proposed that you must validate that the preventive controls identified and implemented in accordance with proposed § 117.135 to control the significant hazards are adequate to do so (proposed § 117.160(a)).

(Comment 491) Some comments assert that the regulatory text is in conflict with the preamble discussion in the 2014 supplemental human preventive controls notice because the regulatory text (i.e., “[e]xcept as provided by . . .”) narrowly provides exceptions only for validation of food allergen controls, sanitation controls, supplier controls, and the recall plan, whereas the preamble discussion provides other examples of preventive controls that would not require validation (i.e., zoning, training, preventive maintenance, and refrigerated storage). These comments also assert that although the regulatory text specifies that validation requirements apply “as appropriate to the nature of the preventive control,” that phrase could be interpreted to mean that only the validation act itself can be tailored and that the facility does not have the flexibility to conclude that validation isn't necessary.

Some comments assert that the proposed regulatory text would prevent us from requiring validation of specific allergen or sanitation controls where it may be prudent to do so, either now or in the future as a result of a newly identified hazard, establishment of regulatory allergen threshold(s), or the development of a tool, such as a test method, that would enable validation of the control for the specific hazard.

(Response 491) We have deleted “except as provided by paragraph (b)(3) of this section” from proposed § 117.160(a) to remove the limitation seen by the comments on the exceptions to the requirement for validation of preventive controls. We also have revised the regulatory text of § 117.160(c) to provide that a facility does not need to validate other preventive controls, if the preventive controls qualified individual prepares (or oversees the preparation of) a written justification that validation is not applicable based on factors such as the nature of the hazard, and the nature of the preventive control and its role in the facility's food safety system. We specified that the determination that validation is not required must be made by the preventive controls qualified individual to emphasize that specialized experience is necessary to evaluate whether validation is required. We made a conforming revision to the list of responsibilities of the preventive controls qualified individual (see § 117.180(a)).

(Comment 492) Some comments ask us to separate requirements for validation from requirements for verification because verification and validation are two different concepts and combining them is confusing. Some comments point out that while section 418(f)(1) of the FD&C Act explicitly requires verification, it does not require validation. Some of these comments assert that our proposed requirements for validation exceed the mandate of FSMA while others argue that the lack of explicit language in section 418 of the FD&C Act gives us legal flexibility in determining whether and how to require validation.

(Response 492) Our approach is consistent with section 418 of the FD&C Act. Section 418(f)(1) of the FD&C Act requires verification of the preventive controls, and validation is an element of verification (see both the NACMCF HACCP guidelines (Ref. 35) and our HACCP regulation for juice (§ 120.3(p)). We agree that the purpose of validation is different from the purpose of other verification activities, and we have revised the definitions of both terms to make this clearer. Although we are establishing a separate regulatory section for the validation requirements, we did so to improve clarity and readability rather than as a substantive change relevant to the issues discussed in these comments (See Response 150).

(Comment 493) Some comments assert that validation is more appropriate for a HACCP regulation and that requiring the validation of all preventive controls does not reflect the flexibility mandated by section 418(n)(3)(A) of FSMA. Other comments assert that effective preventive measures may be identified in the future that are not amenable to validation and it would be counterproductive for them not to be employed in food safety plans because they cannot meet the validation requirements. These comments explain that certain control measures are not suitable for validation activities due to the nature of the activity or previous validation by another entity (e.g., a supplier).

(Response 493) The 2013 proposed human preventive controls rule would not have required the validation of all preventive controls. For example, we specifically proposed that the validation of preventive controls need not address food allergen controls, sanitation controls, and the recall plan. To emphasize that a facility has flexibility in appropriately determining which other preventive controls require validation, in the 2014 supplemental human preventive controls notice we revised the proposed regulatory text to require validation “as appropriate to the nature of the preventive control.” See (Response 491 for additional revisions we have made to the regulatory text to provide flexibility for a facility to determine that validation is not necessary.

(Comment 494) Some comments ask us to allow validation of the whole system instead of individual controls.

(Response 494) See the discussion of the definition of validation in Response 150. Under the definition, validation can be directed to a control measure, combination of control measures, or the food safety plan as a whole.

(Comment 495) Some comments ask us to align validation requirements with the relative risk of operations.

(Response 495) Validation requirements apply only to preventive controls that are established and implemented based on the outcome of a hazard analysis, which requires consideration of risk. We also require validation as appropriate to the nature of the preventive control and its role in the facility's food safety system. This provides flexibility with respect to validation and allows consideration of risk.

(Comment 496) Some comments ask whether we will endorse certification under GFSI as satisfying the requirements for validation.

(Response 496) GFSI was established to support improvements in food safety management systems to ensure confidence in the delivery of safe food to consumers worldwide (Ref. 83). GFSI has developed a guidance document that specifies a process by which food safety schemes may gain recognition by GFSI, the requirements to be put in place for a food safety scheme seeking recognition by GFSI, and the key elements for production of safe food or feed, or for service provision (e.g., contract sanitation services or food transportation), in relation to food safety (Ref. 83). We have no plans to endorse certification under GFSI (or any other standard setting organization) as satisfying the requirements for validation. However, to the extent that scientific and technical information available from GFSI or another standard setting organization provides evidence that a control measure, combination of control measures, or the food safety plan as a whole is capable of effectively controlling the identified hazards, a facility may use such information to satisfy the validation requirements of the rule.

(Comment 497) Some comments ask us to provide guidance and clarification on topics relevant to validation, such as commodity-specific guidance to help facilities understand what preventive controls are capable of being validated and to design testing to ensure validation conditions always exceed conditions during production. Some comments ask us to clarify our expectations for a validated process and on conducting studies for validation purposes, particularly for preventive controls applied to fresh and fresh-cut produce (such as reduction of pathogens in wash water for fresh-cut leafy greens with the use of sanitizers, which the comments characterize as scientifically difficult and time consuming). Some comments ask us to provide resources for validation, noting that some preventive controls will be difficult to validate and that no scientific research or data are available for certain controls. Some comments ask us to delay enforcement for the validation requirements until a readily accessible repository of validated processes, and scientific and technical information, can be created to assist stakeholders in complying with the validation requirements.

(Response 497) We intend that the guidance we are developing will address topics such as those recommended in the comments. (See Response 2.) In addition, there is a “wash water validation group” with members from government (including FDA, USDA and CDC) and industry (including producers, chemical suppliers, and equipment suppliers) developing information on how to validate the efficacy of antimicrobial chemicals in wash water for fresh-cut produce processes to demonstrate that the antimicrobials in the washing process are effective for minimizing the risk of cross-contamination. The FSPCA and the Produce Safety Alliance (PSA) are developing information for training, which may be useful to facilities, including facilities that process produce. We are not requiring facilities to comply with the rule, including the validation requirements, for 1, 2, or 3 years depending on the size of the facility. We expect that segments of the food industry will work together and with the FSPCA and the PSA to develop scientific and technical information that can be used as evidence to validate a variety of preventive controls, and that this information will be helpful to facilities.

(Comment 498) Some comments ask us to develop a mechanism for industry to make sure their approach and studies meet the requirements of the rule, such as certification of process authorities or the establishment of a liaison between FDA and industry to ensure validation protocols are in compliance.

(Response 498) As discussed in Response 2, we are developing several guidance documents within FDA, including guidance on validation. In addition, as part of a collaborative effort with the FSPCA we are obtaining technical information useful for developing commodity/industry sector-specific guidelines for preventive controls and outreach to industry, and we intend that effort to include guidance on approaches to satisfy the validation requirements of the rule. We do not intend to develop a mechanism for certification of process authorities or establish a liaison between FDA and industry to ensure validation protocols are in compliance. The guidance we are developing on validation should help industry determine whether their validation approaches are likely to be acceptable to us.

B. Proposed § 117.160(b)(1)—When Validation Must Be Performed and Role of the Preventive Controls Qualified Individual in Validation

We proposed that validation of the preventive controls must be performed by (or overseen by) a preventive controls qualified individual prior to implementation of the food safety plan (or, when necessary, during the first 6 weeks of production) and whenever a reanalysis of the food safety plan reveals the need to do so.

(Comment 499) Some comments ask us to clarify whether an individual attending food safety training by an entity such as a cooperative extension or a State department of agriculture could be a “preventive controls qualified individual” for the purpose of performing or overseeing the validation of preventive controls.

(Response 499) See the discussion in section XXXVI.B.1 for additional information about training applicable to a preventive controls qualified individual. We have not specified additional requirements for a preventive controls qualified individual with respect to validation. A person may be a preventive controls qualified individual through job experience, as well as training. Food safety training provided by an entity such as a cooperative extension specialist or a State department of agriculture could be appropriate training for many of the functions of the preventive controls qualified individual if the training is consistent with the standardized curriculum being developed by the FSPCA.

(Comment 500) Some comments that discuss the distinction between validation and verification ask us to align with the distinction made in FSIS' Compliance Guidelines on HACCP Systems Validation (FSIS Validation Guidelines) (Ref. 84). As discussed in those guidelines, there are two distinct elements to validation: design and execution. The design element addresses the scientific or technical support for the system design, and the execution element addresses the initial, practical, in-plant demonstration that the system can perform as expected.

(Response 500) As discussed in Response 150, the definition of validation focuses on whether a control measure, combination of control measures, or the food safety plan as a whole is capable of controlling the identified hazards and, thus, captures the design element of validation. We have revised the validation requirements to clarify that it may be necessary to perform validation during production to demonstrate the control measures can be implemented as designed.

(Comment 501) Some comments question whether 6 weeks is enough time to perform all applicable validation studies that would address the execution element of validation. Some comments ask us to explain the basis for the proposed 6-week timeframe. Some comments ask us to align with the 90-day timeframe in the FSIS Validation Guidelines (Ref. 84). Some comments note that food additives may only be produced a few times per year at plants that also produce industrial, cosmetic, and excipient grade products, and that this production schedule may make it impractical to meet the proposed 6-week timeframe. Some comments note that the seasonal nature of production of some food products may make it impractical to perform all required validations within 6 weeks. Some comments suggest that validation be performed within a specified number of production batches, such as 10 production batches. Some comments emphasize the need for flexibility and ask us to both adopt a 90-day timeframe and provide for a longer timeframe with a written justification, or provide for ongoing evidence of process validation. Some comments ask us to specify that validation be performed within a reasonable time as justified by the preventive controls qualified individual. Some comments ask for more time for small businesses to perform validation studies.

(Response 501) We note that the 90-day timeframe for validation is established in FSIS' regulations at 9 CFR 304.3(b) and (c) and 9 CFR 381.22(b) and (c) (Conditions for receiving inspection for meat and meat products and poultry and poultry products, respectively). The FSIS Validation Guidelines are a companion to those regulations. We have revised the regulatory text, with associated editorial changes, to make two changes to the proposed 6-week timeframe for validation of preventive controls. First, we have adopted the 90-day timeframe already established in FSIS' regulations by specifying that when necessary to demonstrate the control measures can be implemented as designed, validation may be performed within 90 days after production of the applicable food first begins. Although we had proposed a 6-week timeframe based on the 3 to 6-week timeframe suggested in the Codex Guidelines for the Validation of Food Safety Control Measures (Ref. 39) (Codex Validation Guidelines), we agree that practical limitations associated with the production of some food products may make it difficult to perform validation within 6 weeks. The 90-day timeframe in FSIS' regulations, and incorporated into the FSIS Validation Guidelines, reflects more than 15 years of experience with validating HACCP systems for meat and poultry. Although we have provided for validation to be performed within 90 days after production of the applicable food first begins, we do not believe it would take a full 90 days of production to determine whether the facility can provide assurances that a control measure is working as intended to control the hazard.

Second, we have provided for validation within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a written justification for a timeframe that exceeds 90 days after production of the applicable food first begins. We acknowledge that practical limitations such as those described in the comments could prevent a facility from performing the validation within 90 days after production of the applicable food first begins. A timeframe that exceeds 90 days after production of the applicable food first begins will be the exception rather than the norm and we are requiring that the preventive controls qualified individual provide (or oversee the preparation of) a written justification for such a timeframe. We made a conforming revision to the list of responsibilities of the preventive controls qualified individual (see § 117.180(a)).

(Comment 502) Some comments ask us to clarify that the time period when validation is performed would be considered as production time rather than “down time.” These comments explain that many farms with on-farm processing activities conduct those activities sporadically for a brief period. For a processing activity that may be conducted for only 2 or 3 days within a six week period, the facility may not have enough production run time to validate controls.

(Response 502) As discussed in Response 501, we have provided for validation within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a written justification for a timeframe that exceeds 90 days after production of the applicable food first begins. A facility would design a preventive control that is valid based on scientific and technical information and then determine that the control can be applied in the facility. It is unlikely that this will require a full 90 days of production, and we see no reason for a facility to significantly extend the validation time—e.g., to a year or more—because it only produces for 2-3 days every 6 weeks.

(Comment 503) Some comments ask us to add another circumstance when validation would be required—i.e., whenever a change is made to the control being applied.

(Response 503) We have revised the regulatory text to require validation whenever a change to a control measure or combination of control measures could impact whether the control measure or combination of control measures, when properly implemented, will effectively control the hazards requiring a preventive control. Under this provision, a facility would re-validate a preventive control if, for example, a different type of equipment is used to deliver a heat process, because it would be necessary to determine that the new equipment can consistently achieve the required temperature and time of the process. However, a facility would not need to re-validate a preventive control if, for example, a thermal process is changed by increasing the time or temperature, because a less stringent thermal process would already have been validated.

(Comment 504) Some comments ask us to require validation both before production and 6 weeks after production begins.

(Response 504) We decline this request. A facility has flexibility to perform validation as appropriate to the nature of the preventive controls, whether before production (e.g., by obtaining and evaluating generally available scientific and technical information or by conducting studies), after production begins (to demonstrate the control measures can be implemented as designed during full-scale production), or both.

(Comment 505) Some comments assert that qualified third parties should conduct all process validations.

(Response 505) The critical factor is that the validation be performed (or overseen) by an individual who has the appropriate training and experience to validate the control measures. This preventive controls qualified individual could be a third party or an employee of the facility. Employees of the facility have a vested interest in ensuring that the controls are effective, including by appropriately validating the controls, just as a “disinterested” third party would have.

C. Proposed § 117.160(b)(2)—What Validation Must Include

We proposed that the validation of preventive controls must include collecting and evaluating scientific and technical information (or, when such information is not available or is inadequate, conducting studies) to determine whether the preventive controls, when properly implemented, will effectively control the significant hazards.

(Comment 506) As discussed in Comment 150, some comments ask us to revise the definition of “validation” to be consistent with the Codex definitions.

(Response 506) The Codex definition of validation is “Obtaining evidence that a control measure or combination of control measures, if properly implemented, is capable of controlling the hazard to a specified outcome.” The definition of “validation” we are establishing in this rule specifies that validation means obtaining and evaluating scientific evidence that a control measure, combination of control measures, or the food safety plan as a whole, when properly implemented, is capable of effectively controlling the identified hazards, which more closely aligns with the Codex definition. As a conforming change for consistency with the revisions we made to the definition, we have revised the proposed requirements for validation of preventive controls to specify that validation of preventive controls must include obtaining and evaluating scientific and technical evidence (or, when such evidence is not available or is inadequate, conducting studies) to determine whether the preventive controls, when properly implemented, will effectively control the hazards. (See also Response 150.)

(Comment 507) Some comments assert that our discussion of validation refers to “scientific proof” for the validation of a processing step and ask us to define what is and is not considered scientific proof for validation.

(Response 507) We used terms such as “scientific and technical information” and “scientific and technical basis” rather than “scientific proof” when discussing validation. For information about what we mean by “scientific and technical information,” see 78 FR 3646 at 3753-3754.

(Comment 508) Some comments ask us to clarify expectations of validations for basic sanitary processes.

(Response 508) The requirements for validation only apply to preventive controls. To the extent that the comment is referring to sanitary practices governed by CGMPs (such as in §§ 117.35 and 117.37), the validation requirements would not apply. To the extent that the comment is referring to sanitation controls established as a preventive control, those sanitation controls are excluded from the validation requirements (see § 117.160(a)(3)(ii)).

(Comment 509) Some comments ask that we not require further validation of well-accepted preventive controls, such as refrigeration temperature and roasting coffee.

(Response 509) A facility may rely on generally available scientific and technical information to demonstrate the adequacy of controls such as refrigeration and roasting processes for coffee, but must obtain that information and establish it as a record (see § 117.155(b)).

(Comment 510) Some comments express concern that specific methods are not available to enable validation. Some comments express concern that the requirement to “conduct studies” might be intended, or could be interpreted, to mean that firms are required to develop or validate analytical methods (either in general or for specific food matrices). These comments assert that any such requirement would incur extreme costs and burdens without delivering commensurate public health benefits.

(Response 510) We do not intend the requirement to “conduct studies” to mean that firms are required to develop or validate analytical methods.

(Comment 511) Some comments ask us to clarify that dry pasta facilities would not be required to validate that their extrusion or drying process provides a 5-log reduction for Salmonella. These comments assert that a “kill step” is not necessary for foods such as dry pasta because consumers cook the product before consumption and that validation would be costly, time-consuming, and impractical.

(Response 511) The rule does not require any specific performance standards, such as the 5-log reduction standard in our HACCP regulation for juice (see § 120.24). A dry pasta facility that evaluates Salmonella as a known or reasonably foreseeable hazard may determine that the nature of the dry pasta product (and, thus, its reasonably foreseeable use) makes it unlikely that it would be consumed without a “kill step” (i.e., cooking sufficient to adequately reduce Salmonella) by the consumer and the facility could conclude that its extrusion or drying process is not a preventive control. In contrast, when the nature of the product (such as refrigerated cookie dough) is such that its reasonably foreseeable use includes consumption without cooking (or without cooking sufficient to adequately reduce Salmonella) by the consumer, it would not be appropriate to rely on cooking by the consumer to control a known or reasonably foreseeable biological hazard.

(Comment 512) Some comments recommend validation via indirect methods such as scientific publications, government documents, predictive modeling, and other technical information from equipment manufacturers and other sources. These comments assert that the development of validation data is not appropriate for a number of preventive controls in fresh-cut operations (e.g., temperature control, employee hygiene practices, and product separation protocols). Other comments assert that there are a variety of circumstances in which the collection and evaluation of scientific and technical information is not necessary (e.g., the use of sieving or metal detectors to control physical hazards).

(Response 512) See Response 491 and Response 493. We agree that not all preventive controls require validation, and the facility has flexibility to take into account the nature of the preventive control when determining whether to perform validation. The regulatory text, which provides for scientific and technical evidence that a control measure is capable of effectively controlling the identified hazards, provides for the use of “indirect methods” as recommended by the comments. However, even when sources such as scientific publications are the basis for validation, studies may be needed to demonstrate that the process used can be implemented in the facility to control the hazard. For example, scientific publications may support use of a specific concentration of sanitizer in produce wash water to prevent cross-contamination. The facility would still need to demonstrate it can consistently maintain that concentration under operating conditions.

D. Proposed § 117.160(b)(3)—Preventive Controls for Which Validation Is Not Required

We proposed that validation need not address food allergen controls, sanitation controls, the recall plan and the supplier program (which we now refer to as the “supply-chain program”).

(Comment 513) Some comments ask us to eliminate the specific list of controls that are excluded from the validation requirement and instead revise the regulatory text to provide the facility with flexibility to determine when validation is appropriate. (See also Comment 491.)

(Response 513) As discussed in Response 491, we have deleted “except as provided by paragraph (b)(3) of this section” from proposed § 117.160(a) to remove the limitation seen by the comments on the exceptions to the requirement for validation of preventive controls. We also have revised the regulatory text of § 117.160(c) to provide that a facility does not need to validate other preventive controls, if the preventive controls qualified individual prepares (or oversees the preparation of) a written justification that validation is not applicable based on factors such as the nature of the hazard, and the nature of the preventive control and its role in the facility's food safety system. We see no reason to also eliminate the list of those controls for which we have already determined that validation is not necessary, and require each facility to develop its own rationale for concluding that validation is not necessary based on the nature of these preventive controls. The rule would not prevent a facility from validating one of these preventive controls, such as a food allergen control, if it chooses to do so. (See also Response 514.)

(Comment 514) Some comments assert that the proposed regulatory text would prevent us from requiring validation of specific allergen or sanitation controls where it may be prudent to do so, either now or in the future as a result of a newly identified hazard, establishment of regulatory allergen threshold(s), or the development of a tool, such as a test method, that would enable validation of the control for the specific hazard. Other comments assert that validation of food allergen controls for some food allergens is possible now and that we should not preclude future requirements as it becomes possible to validate food allergen controls for other allergens in the future. Other comments state that a preventive controls qualified individual should determine appropriate validation for food allergen controls. Other comments state that scientific studies are not needed to validate food allergen controls because monitoring is sufficient.

(Response 514) This rule establishes requirements that will apply when the rule becomes effective. It does not address the potential for additional requirements that we could establish, through additional rulemaking, in the future. The rule does not preclude a facility from validating any of its food allergen controls, and we encourage facilities to validate food allergen controls as appropriate to the facility, the food, and the specific food allergen control. However, if a facility decides to validate any of its food allergen controls, the rule does not require that such validation be conducted or overseen by a preventive controls qualified individual.

As previously discussed, we agree that food allergen controls generally are not evaluated through scientific studies and that monitoring (e.g., by visual observation) that these activities do not result in allergen cross-contact provides sufficient assurance that the controls are functioning as intended to prevent the hazard of undeclared food allergens in the food due to allergen cross-contact (78 FR 3646 at 3755).

(Comment 515) Some comments assert that validation of food allergen controls and sanitation controls is already possible through sample swabs and, thus, that reliance strictly on visual observation for potential allergen cross-contact and sanitation controls does not appear to be appropriate.

(Response 515) As discussed in Response 150, validation is directed to determining whether a control measure, when properly implemented, is capable of effectively controlling a hazard. Procedures such as sample swabs (e.g., of equipment used for food containing an allergen to determine if the allergen protein is present after cleaning, and of equipment following a dry cleaning procedure to determine microbial load) are generally directed to verifying that a control measure is functioning as intended rather than whether the control measure is capable of effectively controlling the hazard. However, they can also be part of a validation study to determine whether a sanitation procedure effectively removes a food allergen from equipment surfaces if a facility decides to validate such procedures.

XXXIV. Subpart C: Comments on Proposed § 117.165—Verification of Implementation and Effectiveness

We proposed that you must verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the significant hazards. We proposed that to do so you must conduct specified activities (i.e., calibration, product testing, environmental monitoring, and review of records) as appropriate to the facility, the food, and the nature of the preventive control. We also proposed that you must establish and implement written procedures for the frequency of calibrating process monitoring instruments and verification instruments, product testing, and environmental monitoring.

Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 516, Comment 519, Comment 539, Comment 540, Comment 544, and Comment 545) or ask us to clarify how we will interpret the provision (see, e.g., Comment 522, Comment 523, Comment 528, and Comment 536). In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 38.

A. Flexibility in the Requirement To Conduct Activities To Verify Implementation and Effectiveness

We proposed that you must verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the significant hazards by conducting specified activities as appropriate to the facility, the food, and the nature of the preventive control. We proposed to specify the following verification activities: (1) Calibration; (2) product testing; (3) environmental monitoring; and (4) review of records.

In the following paragraphs, we discuss comments generally directed to the need for a facility to have flexibility to apply these requirements (particularly the requirements for product testing and environmental monitoring) in a manner that works best for the facility in light of its food products and the nature of the preventive controls that would be verified. In sections XXXIV.B through XXXIV.F, we discuss the requirements for calibration, product testing, environmental monitoring, and review of records more specifically.

(Comment 516) Some comments express support for the flexibility provided by specifying that verification activities must be conducted “as appropriate to the facility, the food, and the nature of the preventive control.” Some comments state that the proposed provision means that, based on risk, a fresh fruit packing operation could decide whether or not to do product testing and, when applicable, the type of test and the testing frequency. Some comments agree with the proposed provisions because they address product testing through flexible written procedures that consider both testing and corrective action plans rather than through mandatory or prescribed requirements. Other comments agree with the proposed provisions because they require facilities to develop and use testing programs that are tailored to their facility, equipment, processes, products, and other specific circumstances and do not prescribe specific requirements for testing, such as finished product testing. Some comments state that product testing may not be effective in identifying the acceptability of a specific ingredient or finished product lot on any given day, but it can help assess and verify the effectiveness of a food safety plan as a whole and the facility's capability to consistently deliver against it.

Some comments assert that the preamble discussion in the 2014 supplemental human preventive controls notice is in conflict with the proposed regulatory text and ask us to modify the regulatory text to provide the flexibility we signaled in that supplemental notice. These comments express concern that the term “must” (i.e., “you must conduct activities that include the following”) could be interpreted to mean that activities listed in the regulatory text (in particular, product testing and environmental monitoring) are always required in some form. Some comments ask us to clarify whether product testing and environmental monitoring are required or optional. Other comments assert that facilities should have the flexibility to determine whether to conduct product testing and environmental monitoring based on a risk assessment. Some comments assert that there are circumstances (such as in warehouses and distribution centers; in the production of gases used in food; in operations that hull and shell nuts; and in the production of refined vegetable oils) where these tests would not be necessary. Some comments assert that a determination to conduct environmental monitoring should be on a case-by-case basis and that other verification activities may be used (such as process verifications or testing of intermediates) to verify implementation and effectiveness. Some comments assert that there would be no reason to conduct environmental monitoring in the shell egg processing plant, given the testing in henhouses required by part 118. Other comments ask us to exempt operations when their hazard analysis appropriately concludes that there is no foreseeable risk.

See also Comment 486.

(Response 516) The provisions for verification provide flexibility by specifying that they apply as appropriate to the nature of the preventive control and its role in the facility's food safety system. As noted by some comments, the provisions address testing through flexible written procedures that allow facilities to develop and use testing programs that are tailored to their facility, equipment, processes, products, and other specific circumstances. We agree that an appropriate outcome of the hazard analysis for some facilities will be that product testing and environmental monitoring are not required; it is not necessary to grant an “exemption” to allow a facility to achieve this outcome. For example, environmental monitoring would be required to verify effectiveness of sanitation controls when an RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen because such environmental monitoring is appropriate to the facility (one manufacturing RTE foods), the food (an RTE food exposed to the environment), and the nature of the preventive control (sanitation controls). Foods such as peanut butter, soft cheeses, dried dairy products for use in RTE foods, and roasted nuts are among the products for which manufacturing operations would need to have an environmental monitoring program when such foods are exposed to the environment. In an FDA memorandum on environmental monitoring, we discuss several outbreaks of foodborne illness attributed to contamination from the environment (Ref. 55). These examples illustrate the severe consequences that can occur when environmental pathogens contaminate a product as a result of inadequate preventive controls and how environmental monitoring can be used to verify the adequacy of the preventive controls.

We discuss product testing for microbial pathogens in another FDA memorandum, including the use of pathogens and indicator organisms and microbial testing of foods for process control and for problem solving (Ref. 85). The circumstances in which product testing would be required are dependent on a variety of factors, as described in that memorandum and in the Appendix to the 2013 proposed human preventive controls rule (78 FR 3646 at 3818-3820, with reference numbers corrected in 78 FR 17142 at 17149-17151). As with environmental monitoring, product testing must be conducted as appropriate to the facility, the food, and the nature of the preventive control. For example, a raw material or other ingredient added to an RTE food after a pathogen “kill step” must be tested before use when the raw material or other ingredient has been associated with a pathogen and has not been treated to significantly minimize or prevent that pathogen (e.g., spices added to snack chips, a food that has been previously involved in an outbreak of foodborne illness). Product testing would be required because it is appropriate to the facility (one making an RTE food), the food (spiced snack chips), and the nature of the preventive control (there is no control applied to the spices added to the snack chips).

When process control testing for an indicator organism, or environmental monitoring for an indicator organism, indicates an RTE food is reasonably likely to be contaminated with a pathogen, that food must be tested for the pathogen. For example, if environmental monitoring reveals food-contact surfaces that are used in the production of soft cheese are contaminated with Listeria spp. and additional environmental monitoring following corrective actions indicates food-contact surfaces are still contaminated with Listeria spp., product testing would be required because it is appropriate to the facility (one making an RTE food), the food (soft cheese, which supports the growth of L. monocytogenes), test results from environmental monitoring (which show the presence of an indicator organism for L. monocytogenes on food-contact surfaces in the food processing environment), and the nature of the preventive control (sanitation controls to prevent contamination by environmental pathogens, which appear to be inadequate).

The word “must” specifies the type of activities that a facility can use to satisfy the requirements for a particular preventive control management component, and we are retaining the term “must.” However, we agree that the rule should provide flexibility for additional verification of implementation and effectiveness. To provide that additional flexibility, we have revised the specific requirements for verification of implementation and effectiveness to provide for other activities appropriate for verification of implementation and effectiveness (see § 117.165(a)(5)). (See also Response 486.)

(Comment 517) Many comments ask us to issue guidance, rather than requirements, for product testing and environmental monitoring based on concerns such as the following: The value of environmental monitoring will be reduced if it becomes a minimum regulatory requirement; in many cases environmental pathogens can be eliminated by proper preparation by the consumer; there are well-known limitations to product testing and negative results from product testing can create a false sense of security; product testing is not preventive, would put industry into a reactive mode, and would pull valuable resources from activities focused on preventing contamination; there is limited technology available to test fresh produce, and limited time available due to the perishable nature of the commodity; any regulatory requirement will soon be outdated as products change and science improves; neither product testing nor environmental monitoring are required by HACCP systems; product testing would vastly increase the cost of the rule and will drive many businesses out of business without necessarily improving food safety; and requirements for product testing would require the States to direct resources to respond to non-compliant product testing results, and such resources would be better directed to environmental monitoring.

Some of these comments emphasize the need for flexibility so that product testing and environmental monitoring are options that are available to the facility rather than requirements for all facilities. Other comments assert that guidance provides greater opportunity for industry innovation and stakeholder participation to determine the appropriate use of verification measures, and avoids a “one-size-fits-all” approach to regulations. Some of these comments state that we should encourage environmental monitoring to be conducted “through facility specific food safety plans,” which would provide the flexibility necessary to monitor risks associated with exposures of RTE foods. Other comments state that operators should be given the necessary flexibility to implement any requirements in the most effective and efficient manner using a risk-based approach and taking into account the specific conditions of their facilities and operations. Some comments express concern that including a requirement makes it difficult for businesses to justify a conclusion that testing is not necessary.

Some comments ask us to solicit drafts of proposed guidance documents from the sustainable agriculture and local/regional food system community; publish a list of possible topics for future guidance each year; seek input in advance from the sustainable agriculture and local/regional food system community before preparing draft guidance (including public meetings, workshops, and formation of an advisory committee); hold public meetings on draft guidance after publication; and present draft guidance to an advisory committee including representatives from the sustainable agriculture and local/regional food system community.

(Response 517) We are retaining the requirements for product testing and environmental monitoring in the rule, with the revisions, already discussed, to provide that verification activities depend on the role of the preventive control in the facility's food safety system (see Response 455); corrective action procedures depend on the nature of the hazard (see Response 470); and written procedures for product testing and environmental monitoring are established and implemented as appropriate to the role of the preventive control in the facility's food safety system (see Response 455). These revisions clarify in the regulatory text the flexibility that we discussed in the 2014 supplemental human preventive controls notice (79 FR 58524 at 58543-58545). Some of the comments that ask us to issue guidance rather than requirements appear to believe that only guidance can provide sufficient flexibility for product testing and environmental monitoring. This is not the case. See Response 516.

We disagree that environmental monitoring will be become a minimum regulatory requirement in all cases; the decision to conduct environmental monitoring is made by the facility and some comments discuss specific examples of when environmental monitoring or product testing would not be warranted (see Comment 516). We acknowledge that in some cases environmental pathogens can be eliminated by proper preparation by the consumer, but this rule will not change consumer behavior (see, e.g., our discussion of a prepackaged, refrigerated cookie dough that was implicated in an E. coli O157:H7 outbreak that caused 76 confirmed cases of illness, including 35 hospitalizations (78 FR 3646 at 3665)). Also, as noted in Response 390, we note that many consumers do not follow some cooking instructions. Moreover, the fact that consumer preparation would be capable of eliminating an environmental pathogen is not a reason to not take reasonable measures to prevent contamination from the environment and to verify that such measures are effective through environmental monitoring.

We have acknowledged limitations of product testing (78 FR 3646 at 3819-3820) and agree that a facility should consider such limitations when determining whether to conduct product testing and keep such limitations in mind when obtaining negative results from product testing. We also agree that product testing is not preventive. However, the mere facts that there are limitations, and that product testing is itself not a preventive measure, do not eliminate all benefits of product testing; we agree with comments (described in Comment 516) that although product testing may not be effective in identifying the acceptability of a specific ingredient or finished product lot on any given day, it can help assess and verify the effectiveness of a food safety plan as a whole and the facility's capability to consistently deliver against it. We agree that there is limited technology available to test fresh produce and expect testing of fresh produce by a facility as a verification of its food safety plan as a whole would be the exception rather than the norm.

We disagree that regulatory requirements for product testing and environmental monitoring will soon be outdated as products change and science improves; the rule requires reanalysis of the food safety plan as a whole at least every 3 years, and requires reanalysis of the food safety plan as a whole, or the applicable preventive control, in light of new information (see § 117.170(a) and (b)(2)). We disagree that the lack of specific provisions for product testing and environmental monitoring in HACCP systems should preclude us from establishing requirements for product testing and environmental monitoring in this rule; as previously discussed, not every provision in section 418 of the FD&C Act is identical to HACCP as described in current literature (78 FR 3646 at 3660). Moreover, the HACCP systems have provisions for verification activities, as we consider these to be. We agree that there are some costs to product testing, but the rule provides flexibility for the facility to determine when product testing is appropriate. We acknowledge that the States will be required, in many cases, to follow up on positive findings obtained during product testing but disagree that this is a reason to eliminate the proposed requirements. The States would only be directing resources when the findings indicate contamination of food, and doing so will protect public health.

We will follow the procedures in § 10.115 for issuing guidance documents. Under § 10.115(f), members of the public can suggest areas for guidance document development and submit drafts of proposed guidance documents for FDA to consider. Under § 10.115(g), after we prepare a draft guidance we may hold public meetings or workshops, or present the draft guidance document to an advisory committee for review; doing so is not common and is determined on a case-by-case basis.

(Comment 518) Some comments ask us to consider the volume of product produced in establishing the verification testing requirements because volume-based testing is a way to address the burden that testing requirements may create for small facilities.

(Response 518) We decline this request. Although a facility would establish the frequency of testing if it determines, through its hazard analysis, that product testing or environmental monitoring is warranted, volume does not play a role in most statistical sampling plans. See the discussion of statistical sampling plans in the Appendix to the 2013 proposed human preventive controls rule (78 FR 3646 at 3819-3820).

B. Proposed § 117.165(a)(1)—Calibration

We proposed to require calibration of process monitoring instruments and verification instruments.

(Comment 519) Some comments distinguish “calibration” from an accuracy check, which the comments describe as a test to confirm that a particular equipment or measurement device is accurate. These comments assert that calibration may not be possible for certain equipment or measurement devices, and the appropriate corrective action may be replacement or application of corrective values. These comments ask us to specify that an accuracy check may be used as a verification activity in lieu of calibration.

(Response 519) We have revised the proposed requirements to require calibration of process monitoring instruments and verification instruments, or checking them for accuracy. However, if the outcome of an accuracy check is that a process monitoring instrument or verification instrument is not accurate, the facility must follow up by calibrating the device, rather than by applying corrective values, when it is practical to do so and replace the device when it is not practical to calibrate it.

C. Comments Directed to Proposed Requirements for Both Product Testing (Proposed § 117.165(a)(2) and (b)(2)) and Environmental Monitoring (Proposed § 117.165(a)(3) and (b)(3))

We proposed that to verify that the preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the significant hazards you must conduct activities that include product testing and environmental monitoring, as appropriate to the facility, the food, and the nature of the preventive control (§ 117.165(a)(2) and (a)(3)). We also proposed that you must establish and implement written procedures for product testing and for environmental monitoring.

(Comment 520) Some comments ask us to revise the regulatory text to be explicit that there are circumstances when product testing and environmental monitoring would not be necessary.

(Response 520) We decline this request. We discussed examples relevant to this request in memoranda that we placed in the docket for this rule as references to the 2014 supplemental human preventive controls notice (Ref. 55) (Ref. 85). However, the actual decision as to whether product testing and environmental monitoring are warranted depend on the actual facility and its food product, as well as the nature of the preventive control and its role in the facility's food safety system, and a slight variation on circumstances that would lead one facility to conclude that such testing programs were not required could lead a different facility to the opposite conclusion.

(Comment 521) Some comments discuss topics for us to include in guidance on procedures for product testing and environmental monitoring, such as which pathogens to test for; the range of products that should be tested; circumstances that warrant testing; what a facility would document and what factors the facility would consider before determining that product testing is not appropriate for its food product; frequency of sampling and number of samples to be collected; actions to take after a positive result; available test methods; reporting requirements for results; compliance strategies; and criteria for laboratories conducting the testing.

(Response 521) The memoranda that we placed in the docket for this rule as references to the 2014 supplemental human preventive controls notice (Ref. 55) (Ref. 85) address many of these topics.

(Comment 522) Some comments ask us to clarify that tests can be performed by third-party facilities or laboratories, as well as by the facility itself. Some comments ask us to clarify that we will accept test results in the same format as the format used for other purposes, such as third-party certification services.

(Response 522) The rule places no restrictions on who conducts testing. However, facilities have a responsibility to choose testing laboratories that will produce reliable and accurate test results. (See Response 524.) The rule does not specify the format of test results, provided that the record documenting testing satisfies the recordkeeping requirements of subpart F.

(Comment 523) Some comments express concern about requirements for product testing and environmental monitoring in light of section 202 of FSMA (section 422 of the FD&C Act). (Section 422 of the FD&C Act addresses laboratory accreditation for the analyses of foods, including use of accredited laboratories in certain circumstances and including requirements for accredited laboratories to report the results of laboratory testing to FDA in certain circumstances.) These comments express concern that requirements for facilities to submit results of environmental monitoring to us will create an additional disincentive to looking for pathogens established in the facility. These comments assert that the results of environmental monitoring tests should be available to us for inspection but not submitted to us if product has not been distributed and that submitting the results of routine tests would be burdensome without benefit. These comments ask us to clarify whether facilities or laboratories would be required to submit the results of environmental monitoring tests to us. Likewise, some comments ask us to clarify whether product testing (including testing of raw materials or other ingredients as part of supplier controls) is subject to the requirements of section 422 of the FD&C Act for using accredited laboratories and for reporting test results to us. Other comments ask us to establish standards and procedures for certifying laboratories that would perform the tests. These comments assert that these standards and procedures are needed to ensure the credibility of the testing and to provide direction for facilities that establish in-house testing facilities. Other comments urge us to establish regulations implementing section 422 of the FD&C Act because they would complement the requirements of the human preventive controls rule and because model laboratory standards that address quality controls, proficiency testing, training, and education of laboratory personnel offer the protections necessary for ensuring reliable, accurate test results. Other comments assert that if laboratories are not accredited or samples are not collected in a sanitary manner, there is no guarantee the results will be scientifically valid.

(Response 523) Section 422 of the FD&C Act would require, in relevant part, that food testing be conducted by an accredited laboratory (and the results of such testing be sent directly to FDA) whenever such testing is conducted in response to a specific testing requirement established under the FD&C Act or its implementing regulations, when applied to address an identified or suspected food safety problem, or to support admission of a food under an Import Alert that requires food testing. Although another rulemaking will address the requirements of section 422 of the FD&C Act, our current thinking is that routine product testing and environmental monitoring conducted as a verification activity is not being applied to address an identified or suspected food safety problem that requires food testing and would not be subject to requirements to use an accredited laboratory that would submit the results to FDA. We will review the results of environmental monitoring and product testing, if any, during inspections.

The primary concern expressed in these comments was with respect to laboratories reporting results to FDA and not with use of accredited laboratories. The rule requires a facility to establish and implement written procedures for product testing and environmental monitoring and that the procedures for such testing be scientifically valid. One way to comply with the requirement that testing procedures be scientifically valid is to use an accredited laboratory.

(Comment 524) Some comments ask us to expand the proposed requirement to identify the laboratory conducting the testing to also specify whether that laboratory is accredited and uses the appropriate standards (such as quality control, proficiency testing, and trained laboratory staff). These comments assert that such information would be useful to facilities.

(Response 524) We decline this request. These comments appear to be asking us to establish in the human preventive controls rule requirements related to section 422 of the FD&C Act. Doing so in advance of regulations implementing section 422 of the FD&C Act is premature. However, facilities have a responsibility to choose testing labs that will produce reliable and accurate test results even if the rule does not require the facility to specify whether the laboratory is accredited.

(Comment 525) Some comments express concern about how the requirements for product testing will apply to the produce industry. For example, some comments assert that product testing on intact RACs is not an effective way to ensure food safety and assume that product testing would apply only to foods we consider to pose a greater risk, like fresh fruits and vegetables consumed raw. Some comments assert that product testing would be an excessive and unnecessary cost on farms and in low-risk facilities that pack and hold RACs. Other comments strongly object to mandatory product testing for fresh and fresh-cut produce. These comments assert that the results of product testing are unlikely to provide useful information for RACs and support application of GAPs and CGMPs rather than product testing. Some comments express concern that the fresh-cut produce industry will be dramatically changed if every lot of product needs to be tested and that such testing would certainly add expense without making the food any safer. Other comments assert that produce contamination occurs at so low a frequency that product testing for produce (including tree nuts) is not economically feasible through any scientifically valid sampling protocol. These comments also assert that “test and hold” would require building additional cooling operations in all facilities and that, because of short shelf life, testing of produce would negatively impact quality and marketing. Other comments assert that industry data have shown a sporadic and limited finding of pathogens in product and statistical sampling profiles do not provide sufficient evidence that product testing is an effective use of time and money. Other comments assert that facilities handling produce RACs are a unique type of facility and repeat previous requests that we allow all produce operations handling RACs to be covered by the produce safety rule, rather than the human preventive controls rule, to ensure that such facilities will not be expending resources on testing that could be better directed to implementation of preventive controls.

Likewise, some comments express concern about how the requirements for environmental monitoring will apply to the produce industry. For example, some comments express concern that off-farm packinghouses would be subject to environmental monitoring because certain produce RACs are classified as RTE foods. Other comments reiterate requests that we not interpret produce held in vented crates to be “exposed to the environment,” so that facilities that only hold food could qualify for the exemption for facilities solely engaged in the storage of unexposed packaged food. These comments assert that holding produce in vented crates presents a low risk of contamination from environmental pathogens and that environmental pathogens do not qualify as a hazard requiring preventive controls. Some comments assert that neither product testing nor environmental monitoring would be warranted for facilities that hull and dry walnuts because at this stage walnuts are not a finished commercial commodity or an RTE food.

Some comments that express concern about the requirements for environmental monitoring focus on the environmental pathogen L. monocytogenes. Some of these comments assert that fresh produce poses a unique challenge in that L. monocytogenes is routinely found in the outdoor environment and its occasional transient detection on raw produce in low numbers does not necessarily indicate poor practices, that a contamination event has occurred due to insanitary conditions, or that such occasional transient detection presents an elevated public health risk. These comments assert that the occasional detection of transient L. monocytogenes in low numbers on food-contact surfaces where produce is handled is to be expected and must be considered and addressed in the drafting of environmental monitoring procedures for produce facilities. Other comments state that not all produce operations will be susceptible to harborage of L. monocytogenes. Other comments state that they will not support mandatory environmental monitoring for facilities that handle RACs until we amend our policies regarding the regulatory consequences of a single detection of potentially transient and low levels of L. monocytogenes on a food-contact surface.

(Response 525) We acknowledge the limitations of product testing for produce RACs and fresh-cut produce. As discussed in Response 517, the product testing that this rule requires as a verification activity is to help assess and verify the effectiveness of a food safety plan and the facility's capability to consistently deliver against it, not as a “hold and test” procedure to establish the acceptability of every lot or batch. We do not expect either product testing or environmental monitoring to be common in facilities that process, pack, or hold produce RACs. We agree that there would be little or no benefit to product testing or environmental monitoring in facilities that pack or hold produce RACs that are rarely consumed raw, such as potatoes. We expect that many facilities that process, pack, or hold produce RACs that are RTE foods may conclude, as a result of their hazard analysis, that neither product testing nor environmental monitoring is warranted. We also expect that many facilities that process, pack, or hold produce RACs that are RTE foods will conclude that the limitations of product testing when applied to produce reduce the value of product testing for their products and would direct their resources to food safety practices and verification measures other than product testing. In addition, we expect that some facilities will see benefits in conducting environmental monitoring as a verification measure and would direct resources to such activities.

We disagree that produce held in vented crates is not exposed to the environment (see Response 170), but agree that holding produce in vented crates presents a low risk of contamination from environmental pathogens. We do not expect that facilities that store produce in vented crates would conclude, as a result of their hazard analysis, that environmental pathogens are a hazard requiring preventive controls during storage activities. See Response 25 for a discussion of how this final rule broadens the number of packinghouses that will be governed by the provisions of the produce safety rule. See the discussions, in the 2014 supplemental human preventive controls notice (79 FR at 58535-536) and in Response 25, of the similarities and differences for off-farm packing and holding compared to on-farm packing and holding. We note that some of the comments express concern related to operations that, as a result of changes in the farm definition, may fall within that definition (e.g., some walnut hullers and dryers) and would not be subject to the requirements of this rule.

We agree that not all produce facilities are susceptible to harborage with L. monocytogenes. For example, harborage with L. monocytogenes is more likely to be a potential hazard in certain wet packing operations (e.g., wet packing operations for cantaloupes) (Ref. 86). Comments that we previously received about our draft guidance entitled “Guidance for Industry: Control of Listeria monocytogenes in Refrigerated or Frozen Ready-To-Eat Foods; Draft Guidance” (Ref. 87) have raised issues, similar to the issues described in these comments, regarding the detection of L. monocytogenes on food-contact surfaces, and we intend to re-issue that draft guidance for public comment in the near future.

The memoranda that we prepared on product testing and environmental monitoring for the 2014 supplemental human preventive controls notice (Ref. 55) (Ref. 85) include some examples relevant to facilities that process, pack, or hold produce. In light of the questions we have received regarding similarities and differences for off-farm packing and holding compared to on-farm packing and holding, we are considering developing a separate guidance on this topic.

(Comment 526) Some comments express concern about the cost of testing and suggest creation of a one-time grant program for very small businesses that would assist them in developing their initial food safety plans and testing programs.

(Response 526) Very small businesses are qualified facilities that are subject to modified requirements, which do not require testing or development of a food safety plan. We intend that the guidance we are developing will be helpful to all sizes of businesses that are subject to the requirements for product testing and environmental monitoring. (See Response 2.)

D. Proposed § 117.165(a)(2)—Product Testing

(Comment 527) Some comments ask us to require finished product testing for food products designated as high-risk, particularly when the product supports pathogen growth during its shelf life. Other comments suggest that finished product or ingredient testing should be implemented as appropriate in situations where a risk has been identified and an effective preventive control cannot be implemented. Other comments ask us to require product testing if an environmental pathogen is identified as a significant hazard.

(Response 527) We decline these requests. A facility's decision to conduct product testing, and to establish the frequency of such testing, will reflect a risk-based approach consistent with its hazard analysis. Consequently, we expect that facilities that produce foods that have frequently been associated with outbreaks of foodborne illness, or produce food for which an effective preventive control cannot be implemented, would establish product testing programs more often than facilities that do not produce such foods.

A facility that identifies an environmental pathogen as a hazard requiring a preventive control such as sanitation controls would conduct environmental monitoring. Such a facility would decide what, if any, role product testing would play as a verification activity, or as part of a corrective action as a result of positive findings from environmental monitoring, based on the facility, the food, the nature of the preventive control, and the role of the preventive control in the facility's food safety system.

(Comment 528) Some comments ask us to clarify (or specify) when product testing would be directed at raw materials and other ingredients and when product testing would be directed at finished product. Some comments favor testing raw materials and other ingredients as part of “product testing,” whereas other comments state that testing raw materials and other ingredients should be considered part of a supplier program rather than verification of implementation and effectiveness. Other comments state that it is unclear what preventive control step would be verified by product testing and what types of facilities would be required to perform product testing. One comment from a supplier of produce states that testing its product (i.e., produce testing) is not an adequate measure of its cleaning and sanitation program and asks us to clarify that product testing is not on final product and that final product testing is not required.

(Response 528) We use the term “product testing” to mean testing any food product, whether raw materials or other ingredients, in-process foods, or finished products (Ref. 85) and, thus, product testing can be directed to any of these food products. For example, testing raw materials and other ingredients could be verification of a supplier; testing in-process material after a kill step could be verification of process control; testing finished product could be verification of the food safety plan as a whole, and capture a problem introduced during manufacture, including from contaminated raw materials and other ingredients. Product testing generally is not the most effective means of measuring the adequacy of cleaning and sanitation programs, but such testing is common to track a facility's overall hygienic production measures.

(Comment 529) Some comments assert that a facility that implements supplier verification and environmental monitoring (or other measures) should not be required to perform product testing in addition to the other controls and verification measures.

(Response 529) The facility determines whether product testing is necessary as appropriate to the facility, the food, and the nature of the preventive control and its role in the facility's food safety system. The factors mentioned by the comment are examples of factors that a facility would consider in making its determination.

(Comment 530) Some comments ask us to revise the requirement for product testing to clarify that product testing applies to significant hazards.

(Response 530) We decline this request. Product testing is a verification activity for a preventive control, and a preventive control is established for a “significant hazard” (which we now refer to as “hazard requiring a preventive control”). It is not necessary to repeat, for each type of verification activity, that the activity applies to hazards requiring a preventive control.

(Comment 531) Some comments assert that the real point of product testing is to test all lots or batches. These comments explain that they would be required to retest every lot of product in order to pass an analysis of the product on to its customers, even if testing had already been performed by their vendors (i.e., suppliers), because each of their customers receives a proprietary blend. These comments further explain that it is not economically or physically possible to retest small lots of product already tested by their vendors, and that the risk has already been mitigated by its vendors.

(Response 531) The situation described by these comments appears to be a supplier-customer relationship in that the customer—not this rule—has established a requirement for a certificate of analysis for every lot of received product. As discussed in Response 517, the product testing that this rule requires as a verification activity is to help assess and verify the effectiveness of a food safety plan and the facility's capability to consistently deliver against it, not to establish the acceptability of every lot or batch.

(Comment 532) Some comments assert that we should set out a consultation process by which identification of hazards, situations, or product types that may require finished product testing is undertaken (noting that there may be significant international differences) before establishing requirements for product testing in the rule. These comments also assert that before product testing is mandated as a potential control step, as opposed to as part of a general verification program, Competent Authorities are obligated to demonstrate that it will directly deliver demonstrable food safety benefits. According to these comments, other than for specific pathogens, random, intermittent finished product testing should primarily be used as a measure of process control, not for acceptance testing; product testing should normally be viewed as a monitoring and review tool, not as a product conformance verification tool. Testing programs for product conformance verification should be the exception rather than the rule. Other comments suggest seeking advice from either the National Advisory Committee on Microbiological Criteria for Foods or the FDA Food Advisory Committee on establishing statistically based product testing programs for process control.

(Response 532) These comments appear to have misunderstood the proposed requirements for product testing. Consistent with the views expressed by these comments, we proposed requirements for product testing as a verification measure of the food safety plan as a whole, not for product conformance or lot acceptance. We do not intend to initiate the consultation process described by these comments; however, we may consider requesting the assistance of advisory committees on process control testing in the future.

E. Proposed § 117.165(a)(3)—Environmental Monitoring

We proposed to require environmental monitoring, for an environmental pathogen or for an appropriate indicator organism, if contamination of a ready-to-eat food with an environmental pathogen is a significant hazard, by collecting and testing environmental samples.

(Comment 533) Some comments assert that requirements for environmental monitoring as a verification activity would be unnecessary in light of proposed revisions to some CGMP requirements, such as: (1) A requirement to use chemical, microbial, or extraneous-material testing procedures where necessary to identify sanitation failures or possible allergen cross-contact and food contamination (§ 117.80(a)(5)); (2) a requirement for raw materials and ingredients to either not contain levels of microorganisms that may render the food injurious to the health of humans, or to be pasteurized or otherwise treated during manufacturing operations so that they no longer contain levels that would cause the product to be adulterated (§ 117.80(b)(2)); and (3) a requirement for all food manufacturing, processing, packing, and holding to be conducted under such conditions and controls as are necessary to minimize the potential for the growth of microorganisms or for the contamination of food (§ 117.80(c)(2)).

(Response 533) Environmental monitoring would be a verification activity to ensure that sanitation controls are being implemented and are effective. The CGMP testing requirement cited by the comments neither explicitly requires environmental monitoring, nor describes the circumstances in which environmental monitoring would be needed. The cited CGMP requirement for raw materials and ingredients would not negate the need for environmental monitoring to verify that sanitation controls are preventing environmental pathogens from becoming established in a “niche” or harborage site (78 FR 3646 at 3814). The cited CGMP requirement to minimize the potential for the growth of microorganisms or for the contamination of food does not specify that a food establishment verify that it is meeting this requirement through environmental monitoring.

(Comment 534) Some comments ask us to specify that environmental monitoring of pathogens be executed according to a risk analysis.

(Response 534) We decline this request. See the discussion in Response 467, which explains how risk applies to the facility's hazard analysis and the determination by the facility to establish preventive controls for hazards requiring a preventive control as appropriate to the facility and the food. In contrast, the requirements for environmental monitoring are a verification activity that a facility would conduct to verify that one or more preventive controls are consistently implemented and are effectively and significantly minimizing or preventing the hazards requiring a preventive control and would be established as appropriate to the facility, the food, and the nature of the preventive control rather than according to a risk analysis.

(Comment 535) Some comments ask us to expand the requirements for environmental monitoring. For example, comments ask us to broadly require environmental monitoring in the following circumstances: as a component of every food safety program; in any facility in which there is a risk of contamination by an environmental pathogen, not just facilities that make RTE food; whenever there is a risk of environmental contamination if a likelihood exists that a person may consume the food raw; for spores of pathogenic sporeforming bacteria if there is a possibility the spores could germinate and multiply in a packaged food or under storage or preparation conditions in the home; and for unintended food allergens.

(Response 535) We decline these requests. We are requiring a facility to evaluate environmental pathogens whenever an RTE food is exposed to the environment prior to packaging and the packaged food does not receive a treatment or otherwise include a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen (§ 117.130(c)(1)(ii)). This risk-based requirement is a minimum requirement; a facility can do more if its preventive controls qualified individual determines that doing so would be appropriate.

The definition of RTE food does include food for which it is reasonably foreseeable that the food will be eaten without further processing that would significantly minimize biological hazards (§ 117.3)). The definition of environmental pathogen (§ 117.3) excludes the spores of pathogenic sporeforming bacteria, and we decline the request to require environmental monitoring (by revising the definition of environmental pathogen) for such spores if there is a possibility the spores could germinate and multiply in a packaged food or under storage or preparation conditions in the home. As previously discussed, pathogenic sporeforming bacteria are normally present in foods and unless the foods are subjected to conditions that allow multiplication, they present minimal risk of causing illness. Because pathogenic sporeforming bacteria are so commonly present in food, a more appropriate approach to the risks presented by pathogenic sporeforming bacteria would be to focus on their potential presence in raw materials and other ingredients and implement appropriate measures to prevent their growth (e.g., formulation, refrigeration) rather than to monitor for them in the food processing environment.

We decline the request to expand the requirement to all foods, not just RTE foods. Although facilities are required to apply CGMPs to prevent contamination of foods that are not RTE, these foods will receive a treatment that will significantly minimize or prevent environmental pathogens at a later stage.

Environmental monitoring is directed at microbiological hazards, not chemical hazards such as food allergens. The rule requires a facility to evaluate known or reasonably foreseeable food allergen hazards and to establish food allergen controls when the outcome of the hazard analysis is that a food allergen hazard is a hazard requiring a preventive control (§ 117.130(b)(1)(ii) and (c)). A facility that determines that a food allergen hazard requires preventive controls could, for example, establish sanitation controls for food allergens and a swabbing program to verify those sanitation controls. Even though the facility would take swabs from the food processing environment, such swabs would not be considered “environmental monitoring” as that term is used in this rule.

(Comment 536) Some comments ask us to clarify whether the requirement for environmental monitoring “if contamination of an RTE food with an environmental pathogen is a significant hazard” refers to all RTE foods.

(Response 536) The requirements for environmental monitoring are addressed to RTE foods (including RACs, as well as processed foods) that are exposed to the environment unless the packaged RTE food receives a treatment or otherwise includes a control measure (such as a formulation lethal to the pathogen) that would significantly minimize the pathogen. See § 117.130(c)(1)(ii) and the discussion in Response 406. See also Comment 525 and Response 525 for a discussion of environmental monitoring as it could apply to the produce industry.

(Comment 537) Some comments suggest that a mechanism to reduce costs could be to clarify that environmental testing should only be done on food-contact surfaces.

(Response 537) We disagree that it would be appropriate to focus environmental monitoring only on food-contact surfaces. It is well-established that successful environmental monitoring programs look to eliminate environmental pathogens from non-food-contact surfaces as a means to keep the pathogens from contaminating food-contact surfaces and thereby contaminating food.

F. Proposed § 117.165(a)(4)—Review of Records

We proposed to require review of specified records by (or under the oversight of) a preventive controls qualified individual, to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food safety plan, the preventive controls are effective, and appropriate decisions were made about corrective actions. We proposed to require review of records of monitoring and corrective action records within a week after the records are made, and review of records of calibration, product testing, environmental monitoring, and supplier verification activities within a reasonable time after the records are made.

(Comment 538) Some comments assert that it is not necessary for a preventive controls qualified individual to conduct or oversee review of records as a verification activity, noting that review of records in another food safety regulation (i.e., the LACF requirements in part 113) can be done by persons adequately trained in recordkeeping and review of records.

(Response 538) The rule does not preclude review of records by persons other than the preventive controls qualified individual, provided that the preventive controls qualified individual provides oversight for that review. Oversight by a preventive controls qualified individual is necessary because the review of records is critical to assessing the facility's application of the preventive controls system and, thus, is fundamental to ensuring its successful operation (78 FR 3646 at 3757-58). Oversight by a preventive controls qualified individual is consistent with requirements of Federal HACCP regulations for seafood, juice, and meat and poultry, and with NACMCF HACCP guidelines (Ref. 35) (78 FR 3646 at 3757-58).

(Comment 539) Some comments ask us to provide for a timeframe longer than one week (such as 7 working days) for review of records of monitoring and corrective actions. Some comments ask us to provide the same flexibility for review of records of monitoring and corrective actions as we proposed for review of records of calibration, product testing, environmental monitoring, and supplier verification activities (“within a reasonable time” after the records are made)—e.g., because some preventive controls may be monitored less frequently than is typical in a traditional HACCP plan dominated with CCPs. Some comments note that corrective actions may not be fully implemented within 7 days and ask us to provide for review of these records within a week or other timeframe determined to be appropriate to ensure that potentially hazardous goods do not enter commerce. Some comments ask us to retain the one week timeframe for review of records associated with perishable foods, but to extend the timeframe to one month for nonperishable foods.

Some comments state that some food processors that operate on a batch production basis (rather than a continuous production basis) review all records related to a particular batch all at once just before release of the batch for distribution. These comments assert that it would be inefficient, unnecessary, and needlessly complicated to require management to review a few production records in advance of the normal complete records review, particularly when laboratory testing conducted on the batch by an outside laboratory takes several weeks to complete.

(Response 539) We have revised the proposed requirement to require review of records of monitoring and corrective actions within 7 working days after the records are made or within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a written justification for a timeframe that exceeds 7 working days. A timeframe that exceeds 7 working days will be the exception rather than the norm. For example, reviewing records before release of product may be considered adequate by a facility, although this may be later than one week after the records were created. A facility may determine that all records for a lot of product will be reviewed after product testing or environmental monitoring records relevant to that lot of product are available, which may be more than a week after monitoring records were created. We made a conforming change to the list of responsibilities of the preventive controls qualified individual to address the requirement for the preventive controls qualified individual to provide (or oversee the preparation of) a written justification for such a timeframe (see § 117.180(a)).

We are not requiring that a facility review records of monitoring and corrective actions before release of product or that the timeframe for the review depend on the shelf life of the food. The purpose of reviewing records is not to determine whether to release product. Instead, the purpose of reviewing records is to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food safety plan, the preventive controls are effective, and appropriate decisions were made about corrective actions. However, a facility will have flexibility to review records of monitoring and corrective actions within a timeframe that exceeds 7 working days, such as before product release, provided that the facility provides a written justification for doing so. As discussed in Response 542, depending on the nature of the record, a facility that reviews these types of records in a timeframe that exceeds 7 working days, and finds a problem, may be faced with recall decisions for a relatively large number of affected lots of product.

(Comment 540) Some comments ask us to revise the provisions for review of records by more generally referring to records of “verification testing (e.g., product testing and/or environmental monitoring as applicable).”

(Response 540) We have revised the regulatory text to refer to records of “testing (e.g., product testing, environmental monitoring).”

(Comment 541) Some comments refer to our request for comment on whether the regulatory text should specify the verification activities that must be conducted for corrective actions (see the discussion in Comment 489 and Response 489). These comments assert that if we do not further specify verification activities for corrective actions then we should eliminate the proposed requirement to review records of corrective actions.

(Response 541) Records are necessary to document all verification activities (see § 117.155(b)). The fact that the rule provides flexibility for the facility to appropriately determine the verification activities for corrective actions, rather than prescribes these verification activities, has no bearing on the requirement to document the verification activities.

(Comment 542) Some comments state that records of calibration activities are reviewed at the time the calibration is performed. These comments assert that in most cases a formal scheduled review of calibration records is not required to ensure the effectiveness of the control and that records review of calibrations should be based upon the nature of the control being calibrated.

(Response 542) The purpose of reviewing records as a verification activity is to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food safety plan, the preventive controls are effective, and appropriate decisions were made about corrective actions. Although records may be reviewed at the time they are made, the review of records as a verification activity includes oversight by a preventive controls qualified individual (see Response 538). Because the timeframe for review of calibration records is “within a reasonable time after the records are created,” the facility has flexibility over the frequency of conducting this review. However, depending on the nature of the control for which the instrument is being calibrated, a facility that reviews calibration records infrequently, and finds a problem with calibration of process monitoring instruments and verification instruments, may be faced with recall decisions for a relatively large number of affected lots of product.

(Comment 543) Some comments emphasize the importance of calibrating those instruments and monitoring devices that are critical to the preventive control, and reviewing the associated records, before validation of a lethality step and as frequently as necessary thereafter. These comments question whether requiring review of calibration records “within a reasonable time” will be adequate.

(Response 543) We agree that instruments and monitoring devices that are critical to a preventive control should be calibrated, and calibration records should be reviewed, before conducting studies to validate a lethality step. However, the provision is directed at verification of implementation and effectiveness of preventive controls on an ongoing basis. This rule does not prescribe specific steps that a facility must take before conducting validation studies.

A facility has flexibility to appropriately determine the frequency of reviewing calibration records based on the facility, the food, and the nature of the preventive control. We agree that it would be prudent to review calibration records of those instruments and monitoring devices that are critical to the preventive control more frequently than of those instruments and monitoring devices that are not critical to the preventive control. As discussed in Response 542, depending on the nature of the control for which the instrument is being calibrated, a facility that reviews calibration records infrequently, and finds a problem with calibration of process monitoring instruments and verification instruments, may be faced with recall decisions for a relatively large number of affected lots of product.

G. Proposed § 117.165(b)—Written Procedures

1. Proposed § 117.165(b)(1)—Frequency of Calibration

We proposed that you must establish and implement written procedures for the frequency of calibrating process monitoring instruments and verification instruments.

(Comment 544) As discussed in Comment 519, some comments ask us to specify that an accuracy check may be used as a verification activity in lieu of calibration. These comments also ask us to specify that written procedures address the frequency of accuracy checks, as well as calibration.

(Response 544) Consistent with Response 519, we have revised the proposed requirement to specify that written procedures address the frequency of accuracy checks, as well as calibration.

2. Proposed § 117.165(b)(2) and (b)(3)—Product Testing and Environmental Monitoring

We proposed that you must establish and implement written procedures for product testing. We proposed that procedures for product testing must: (1) Be scientifically valid; (2) identify the test microorganism(s); (3) specify the procedures for identifying samples, including their relationship to specific lots of product; (4) include the procedures for sampling, including the number of samples and the sampling frequency; (5) identify the test(s) conducted, including the analytical method(s) used; (6) identify the laboratory conducting the testing; and (7) include the corrective action procedures required by § 117.150(a)(1).

Likewise, we proposed that you must establish and implement written procedures for environmental monitoring. Procedures for environmental monitoring must: (1) Be scientifically valid; (2) identify the test microorganism(s); (3) identify the locations from which the samples will be collected and the number of sites to be tested during routine environmental monitoring; (4) identify the timing and frequency for collecting and testing samples; (5) identify the test(s) conducted, including the analytical method(s) used; (6) identify the laboratory conducting the testing; and (7) include the corrective action procedures required by § 117.150(a)(1).

(Comment 545) Some comments express concern that the word “valid” in the phrase “scientifically valid” could be construed to mean “validated” because not all testing protocols can be validated within the traditional meaning of the term. These comments state their belief that what we intend is for these testing programs to be “technically sound.” Other comments express concern that “scientifically valid” may be interpreted to mean that firms are required to develop or validate analytical methods (either in general or for specific food matrices).

(Response 545) We are retaining the term “scientifically valid” in these provisions. We disagree that we would interpret “scientifically valid” to mean that facilities are required to develop or validate analytical methods. We discussed our interpretation of the term “scientifically valid” in the Appendix to the 2013 proposed preventive controls rule (78 FR 3646 at 3812 to 3813), and noted that this interpretation was consistent with our previous discussion of the term “scientifically valid” (in place of “validated”) in the rulemaking to establish CGMP requirements for dietary supplements (68 FR 12158 at 12198, March 13, 2003). While validated methods are considered “scientifically valid,” methods that have not gone through formal validation processes but have been published in scientific journals, for example, may also be “scientifically valid.” We do expect methods used for testing to be adequate for their intended use.

We have had several years interpreting the term “scientifically valid” in the context of the requirement, in the dietary supplement CGMPs, that the manufacturer must ensure that the tests and examinations that it uses to determine whether the specifications are met are appropriate, scientifically valid methods (§ 111.75(h)(1)). Although we agree that methods that are “scientifically valid” would also be “technically sound,” we disagree that the hypothetical concern that we would construe “scientifically valid” to mean “validated” warrants changing “scientifically valid” to a new term (such as “technically sound”) in light of our previous statements regarding this term and experience in the context of CGMP requirements. See the final rule establishing the dietary supplement CGMPs for additional discussion on the terms “validated” and “scientifically valid” (72 FR 34752 at 34853).

(Comment 546) Some comments support the proposed requirements for written procedures for environmental monitoring, including providing flexibility to use indicator organisms and to design the timing, location, and frequency of environmental monitoring programs in a risk-based manner, and in not prescribing specific locations (e.g., food-contact surfaces or “zone 1”) or sample quantities for testing. Other comments ask us to add details to the written procedures for product testing and environmental monitoring regarding when and where sampling is required and the number of samples to take. Some comments ask us to make sure the most current “sampling planning science” is used for environmental monitoring by specifying that procedures for environmental monitoring must employ “sample quality criteria objectives.” Other comments assert that the product testing procedure requirements are inadequate and ask us to require that procedures for product testing specify the procedures for identifying samples (including their relationship to specific lots of product); describe how sampling was conducted (to establish that the sample obtained adequately represents the lot of product the sample is intended to represent); and include the procedures for sample quality control from field to lab. Other comments assert that the frequency of environmental monitoring and product testing is unclear and express concern that frequent swabbing and frequent testing could cause cheeses to be held past their optimum ripeness if they are fresh or soft ripened.

(Response 546) We decline the request to prescribe additional details, such as those described in these comments, in the requirements for written procedures for product testing and environmental monitoring. As with other procedures required by the rule, those relating to environmental monitoring and product testing must be adequate for their intended purpose. Further, procedures will not be identical in all circumstances. For example, a facility that produces products with a short shelf life may choose a different frequency of swabbing and testing than a facility that produces products with a long shelf life.

(Comment 547) Some comments ask us to provide more flexibility in product testing by not requiring establishments to provide written procedures for product testing and corrective action procedures.

(Response 547) These comments are unclear. By requiring that a facility establish its own procedures, the rule provides facilities with flexibility to develop a product testing program that works best for its facility and its products. We are retaining the requirements for written procedures for product testing, as well as for corrective action procedures.

(Comment 548) Some comments ask us to add a provision requiring that all positive results must result in corrective action being taken.

(Response 548) We decline this request. The rule requires that a facility must establish and implement written corrective action procedures that must be taken if preventive controls are not properly implemented, including procedures to address, as appropriate, the presence of a pathogen or appropriate indicator organism in an RTE product detected as a result of product testing and the presence of an environmental pathogen or appropriate indicator organism detected through environmental monitoring (see § 117.150(a)(1)). However, the rule does not pre-determine what corrective actions a facility must take when presented with positive results from product testing or environmental monitoring. The corrective action procedures that a facility would develop, and the actual corrective actions that the facility would take, will depend on the nature of the hazard and the nature of the preventive control, as well as information relevant to the positive result (e.g., pathogen or indicator organism, product or environment, food-contact surface or non-food-contact surface).

XXXV. Subpart C: Comments on Proposed § 117.170—Reanalysis

We proposed to establish requirements for reanalysis of the food safety plan. Some comments support the proposed requirements without change. For example, comments agree that a preventive controls qualified individual must perform (or oversee) the reanalysis (see section XXXV.D). Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 549, Comment 550, Comment 552, Comment 553, Comment 557, and Comment 558).

In the following paragraphs, we discuss comments that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 39, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.170(a)—Circumstances Requiring Reanalysis

We proposed that you must conduct a reanalysis of the food safety plan: (1) At least once every 3 years; (2) whenever a significant change in the activities conducted at your facility creates a reasonable potential for a new hazard or creates a significant increase in a previously identified hazard; (3) whenever you become aware of new information about potential hazards associated with the food; (4) whenever appropriate after an unanticipated food safety problem; and (5) whenever you find that a preventive control is ineffective.

(Comment 549) Some comments assert that the need to reanalyze the food safety plan will depend on the nature of the preventive control and its role in the food safety system. These comments also assert that if a specific preventive control is found to be ineffective, only the applicable portion of the food safety plan would need to be reanalyzed.

(Response 549) We agree and have revised the regulatory text, with associated editorial changes and redesignation, to separate the requirement to reanalyze the food safety plan as a whole every 3 years from all other circumstances when reanalysis is required “for cause.” When reanalysis is “for cause,” the regulatory text provides that reanalysis is of the food safety plan as a whole, or the applicable portion of the food safety plan.

(Comment 550) Some comments ask us to recognize other terminologies already used by some facilities (e.g., “reassess”).

(Response 550) We have acknowledged that the terminology used in relation to the concept of “reanalysis” varies in current regulations and guidelines for systems such as HACCP (78 FR 3646 at 3759). A facility may choose to use a term such as “reassessment” in its records—e.g., if it relies on existing records that use the term “reassessment” to satisfy some or all of the requirements of this rule for reanalysis. However, the human preventive controls rule will use a single term (i.e., reanalyze) to minimize the potential for confusion about whether different terms have a different meaning for the purposes of the rule.

(Comment 551) Some comments ask us to define “reanalysis” to mean “a reassessment of the validity of a preventive control or food safety plan to control a hazard. Reanalysis may include a system review and, where necessary, activities to revalidate a control measure or combination of control measures.”

(Response 551) We decline this request. Reanalysis goes beyond assessing the validity of a preventive control or food safety plan to control a hazard. Reanalysis can also include assessing whether all hazards have been identified, whether established procedures are practical and effective, and other factors.

(Comment 552) Some comments ask us to require reanalysis on an annual basis, noting that annual reanalysis is required by Federal HACCP regulations for seafood, juice, and meat and poultry.

(Response 552) We decline this request. We proposed to require reanalysis at least once every 3 years as a minimum requirement in the event that there is no other circumstance warranting reanalysis (see proposed § 117.170(a)(1)). That 3-year minimum is consistent with the statute (see section 418(i) of the FD&C Act). As a practical matter, we expect that reanalysis will occur more frequently as a result of changes in the activities conducted at a facility (see final § 117.170(b)(1) through (4)).

(Comment 553) Some comments suggest editorial changes to improve the readability of the requirement to conduct reanalysis when there is a change in a preventive control.

(Response 553) We are including these editorial changes in the regulatory text, which now reads whenever “a significant change in the activities conducted at your facility creates a reasonable potential . . .”

(Comment 554) Some comments assert that the proposed requirement to conduct reanalysis whenever you become aware of new information about potential hazards associated with the food does not align with FSMA statutory language, is ambiguous, and would establish vague compliance obligations.

(Response 554) We disagree. See our previous discussion regarding the emergence of the pathogen L. monocytogenes in the mid-1980's and the first outbreak of foodborne illness in the United States, in 2006-2007, caused by consumption of peanut butter contaminated with Salmonella (78 FR 3646 at 3759). Although we acknowledge that the proposed requirement is not explicit in section 418(i) of the FD&C Act, we disagree it is not in alignment with FSMA as a whole. FSMA directs the owner, operator, or agent in charge of a facility to evaluate the hazards that could affect food manufactured, processed, packed, or held by such facility and identify and implement preventive controls to significantly minimize or prevent the occurrence of those hazards (see section 418(a) of the FD&C Act). In other words, FSMA focuses on a system to prevent food safety problems rather than a system to react to problems after they occur. Requiring that a facility reanalyze its food safety plan, or the applicable portion of the food safety plan, in response to information such as the emergence of a new foodborne pathogen, or an outbreak of foodborne illness from consumption of a food product not previously associated with foodborne illness from a well-known pathogen, aligns very well with the statutory direction in FSMA.

(Comment 555) Some comments ask us to specify that reanalysis is required when a preventive control “fails to be” properly implemented rather than when a preventive control “is not” properly implemented.

(Response 555) We decline this request. We see no meaningful difference between “fails to be” and “is not” in this context, except that “fails to be” could lead to questions about the meaning of the term “fails” in this context.

(Comment 556) Some comments ask us to add a requirement to conduct reanalysis whenever a preventive control is found to be “missing” in addition to whenever a preventive control is found to be “ineffective.”

(Response 556) We have revised the regulatory text to require reanalysis whenever a preventive control, a combination of preventive controls, or the food safety plan as a whole, is ineffective. (See § 117.170(b)(4).) A “missing” preventive control could be discovered during verification to establish the validity of the food safety plan as a whole or as a result of an unanticipated problem. (See Response 482.) If circumstances lead a facility to conclude that an additional (or different) preventive control is necessary, the facility would include that preventive control in its food safety plan along with associated preventive control management components, including verification to establish the validity of the food safety plan.

B. Proposed § 117.170(b)—Timeframe To Complete Reanalysis

We proposed that you must complete the reanalysis and implement any additional preventive controls needed to address the hazard identified, if any, before the change in activities at the facility is operative or, when necessary, during the first 6 weeks of production. We have clarified that the requirement is to complete the reanalysis and validate (rather than implement) any additional preventive controls as appropriate to the nature of the preventive control and its role in the facility's food safety system.

(Comment 557) As discussed in Comment 501, some comments question whether 6 weeks is enough time to perform all applicable validation studies that would address the execution element of validation. Likewise, some comments question whether 6 weeks is enough time to complete reanalysis.

(Response 557) Consistent with revisions we have made to the timeframe to complete validation (see Response 501), we have revised the timeframe to complete the reanalysis and validate, as appropriate to the nature of the preventive control and its role in the facility's food safety system, any additional preventive controls to be within 90 days after production of the applicable food first begins or within a reasonable timeframe, provided that the preventive controls qualified individual provides (or oversees the preparation of) a written justification for a timeframe that exceeds 90 days after production of the applicable food first begins. We made a conforming change to the list of responsibilities of the preventive controls qualified individual (see § 117.180(a)).

(Comment 558) Some comments state that the phrase “before the change in activities at the facility is operative” is ambiguous in that it is unclear if the phrase is referencing the initial change in activities that triggered the reanalysis or a change in activities subsequent to the reanalysis. These comments ask us to clarify the requirement by substituting the phrase “before the relevant process is operative.”

(Response 558) We agree that there was ambiguity in this phrase, because changes in activities could result in the need for reanalysis and reanalysis could result in the need for changes in activities, both of which can result in a new preventive control. We have made several revisions to the regulatory text, with associated editorial changes, to clarify the requirements for reanalysis. First, we have clarified that reanalysis can be routine (at least every 3 years) or “for cause” (i.e., a significant change that creates the potential for a new hazard or an increase in a previously identified hazard; when you become aware of new information about potential hazards associated with the food; when there is an unanticipated food safety problem; or whenever a preventive control, combination of preventive controls or the food safety plan as a whole is ineffective). Second, we have specified that the reanalysis “for cause” may be for the entire food safety plan or only for an applicable portion.

In addition, as discussed in Response 557, we have clarified that the reanalysis and the validation, as appropriate to the nature of the preventive control and its role in the facility's food safety system, of any additional preventive controls needed to address an identified hazard would need to be completed before any change in activities (including any change in preventive controls) is operative. When additional time is necessary, we have provided for a timeframe within 90 days after production of the applicable food first begins or within a reasonable timeframe, provided that the preventive controls qualified individual provides (or oversees the preparation of) a written justification for a timeframe that exceeds 90 days after production of the applicable food first begins. In other words, if you decide to make a change, you should conduct a reanalysis before you make that change if there is potential for that change to create or increase a hazard; a reanalysis that results in changes to preventive controls should be completed and the preventive controls validated, as appropriate to the nature of the preventive control and its role in the facility's food safety system, before changes in activities to produce food using a new preventive control are put into operation. However, we acknowledge that it may be necessary to produce product to demonstrate a revised preventive control can be implemented appropriately, and provide for an extended timeframe to make this assessment.

C. Proposed § 117.170(c)—Requirement To Revise the Written Food Safety Plan or Document Why Revisions Are Not Needed

We proposed that you must revise the written food safety plan if a significant change is made or document the basis for the conclusion that no revisions are needed. We received no comments that disagreed with this proposed requirement and are finalizing it as proposed.

D. Proposed § 117.170(d) —Requirement for Oversight of Reanalysis by a Preventive Controls Qualified Individual

We proposed that a preventive controls qualified individual must perform (or oversee) the reanalysis. We received no comments that disagreed with this proposed requirement and are finalizing it as proposed. See section XXXVI.B.1 for comments on the qualifications for a preventive controls qualified individual who would perform or oversee the reanalysis.

E. Proposed § 117.170(e)—Reanalysis on the Initiative of FDA

We proposed that you must conduct a reanalysis of the food safety plan when FDA determines it is necessary to respond to new hazards and developments in scientific understanding.

(Comment 559) Some comments ask us to issue formal, written communications about new hazards and developments in scientific understanding. These comments express concern that communications of this type could be inconsistent if they are communicated by individual investigators. Other comments ask us to specify in the regulatory text that it is the Commissioner of Food and Drugs who makes the determination that it is necessary to conduct a reanalysis of the food safety plan.

(Response 559) We agree that a communication from FDA about the need to reanalyze the food safety plan should be issued in a formal written manner but disagree that it is necessary to specify that it is the Commissioner of Food and Drugs who makes the determination that it is necessary to conduct a reanalysis of the food safety plan. The comment provides no basis for precluding such a determination by an organizational component (such as CFSAN or a component of FDA's Office of Regulatory Affairs) that has operational responsibility for food safety and subject matter experts to advise the managers in those organizational components.

XXXVI. Subpart C: Comments on Proposed § 117.180—Requirements Applicable to a Preventive Controls Qualified Individual and a Qualified Auditor

We proposed to establish requirements for the qualifications of a preventive controls qualified individual and a qualified auditor. Some comments support the proposed requirements without change. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 563 and Comment 568) or ask us to clarify how we will interpret the provisions (see, e.g., Comment 560, Comment 564, and Comment 571).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we are finalizing the provisions as proposed with conforming changes as shown in table 52.

A. Proposed § 117.180(a) and (b)—What a Preventive Controls Qualified Individual or Qualified Auditor Must Do or Oversee

We proposed to list the functions that must be performed by one or more preventive controls qualified individuals (i.e., preparation of the food safety plan; validation of the preventive controls; review of records for implementation and effectiveness of preventive controls and appropriateness of corrective actions; and reanalysis of the food safety plan) or by a qualified auditor (i.e., conduct an onsite audit). We proposed to list these functions for simplicity (i.e., to make it easy to see all of the requirements in a single place). We specified that this list of functions already proposed to be established in applicable sections of the rule did not in itself impose any additional requirements.

(Comment 560) Some comments ask us to clarify whether the preventive controls qualified individual must be on the premises during operating hours. Other comments ask us to clarify that the preventive controls qualified individual is not responsible for performing laboratory testing, because the preventive controls qualified individual may not be appropriately educated and trained for laboratory testing.

(Response 560) The rule does not require that the preventive controls qualified individual be onsite during operating hours. The rule also does not require that the preventive controls qualified individual be responsible for performing laboratory testing, although review of testing records (e.g., records of product testing or environmental testing) must be conducted or overseen by a preventive controls qualified individual.

(Comment 561) Some comments ask us to consider the implication of having the preventive controls qualified individual serve as the process authority, serve as the auditor, and offer final sign off on a validation and corrective actions, and suggest that a third party may be necessary to ensure that uniform standards are applied.

(Response 561) To the extent that the comment suggests that the functions of the preventive controls qualified individual create a conflict of interest, we disagree. The rule focuses on the need for applicable training and experience to perform certain functions. The preventive controls qualified individual must develop (or oversee the development of) the food safety plan that controls the identified hazards and then ensure through review of records that the plan is being implemented as designed. The rule does not require that a facility engage a third party to provide oversight of any individual, including a preventive controls qualified individual, but does not preclude a facility from doing so if it chooses.

B. Proposed § 117.180(c)—Qualification Requirements

1. Proposed § 180(c)(1)—Preventive Controls Qualified Individual

We proposed that to be a preventive controls qualified individual, the individual must have successfully completed training in the development and application of risk-based preventive controls at least equivalent to that received under a standardized curriculum recognized as adequate by FDA or be otherwise qualified through job experience to develop and apply a food safety system. We also proposed that this individual may be, but is not required to be, an employee of the facility.

(Comment 562) Some comments ask us to work with industry to establish a national training curriculum and standards for knowledge requirements before the final rule is issued. Comments recommend that curriculum and training requirements be consistent with already existing standards, including Better Process Control School, International HACCP, GFSI, Seafood HACCP, and those trainings offered by Cooperative Extension or State Agriculture departments. Some comments ask us to allow flexibility for industry to continue current training programs without receiving express approval from the FSPCA. Other comments ask that a standardized curriculum for training a preventive controls qualified individual be harmonized with the GFSI requirement.

(Response 562) As discussed in Response 2, the FSPCA is establishing a standardized curriculum. The curriculum will focus on the specific requirements of the human preventive controls rule. Training providers do not need approval from the FSPCA to use the curriculum.

(Comment 563) Some comments ask who will assess the qualifications of a particular preventive controls qualified individual or determine whether particular individuals are in fact “qualified.” Some comments ask us to use an outcome-based demonstration of competency. Some comments ask us to specify that all work experience must be comparable or that a preventive controls qualified individual must pass a proficiency test. Some comments ask us to establish minimum standards for competency. Some comments ask us to clarify what job experiences would be sufficient. Some comments ask how we will verify that reported training and experience are true.

(Response 563) We are not establishing minimum standards for competency and do not intend routinely to directly assess the qualifications of persons who function as the preventive controls qualified individual, whether by their training or by their job experience. Instead, we intend to focus our inspections on the adequacy of the food safety plan. As necessary and appropriate, we will consider whether deficiencies we identify in the food safety plan suggest that the preventive controls qualified individual may not have adequate training or experience to carry out the assigned functions, including whether reported training and experience is accurately represented.

(Comment 564) Some comments ask us to provide for competency requirements to be met through on-the-job experience in lieu of traditional classroom training. Some comments ask us to clarify what we mean by training that is “at least equivalent” to that received under a standardized curriculum recognized as adequate by FDA. Some comments ask us to clarify whether individuals who have successfully completed training in the development and application of risk-based preventive controls through programs delivered and recognized under the International HACCP Alliance would be considered to have completed training “equivalent” to that recognized by FDA for the development and application of risk-based preventive controls.

(Response 564) The requirements do provide for qualification through appropriate job experience, such as experience with successfully implementing HACCP systems or other preventive-based food safety systems. It is the responsibility of the owner, operator, or agent in charge of the facility to determine whether any individual who prepares (or oversees the preparation of) the food safety plan has appropriate qualifications to do so, whether by on-the-job experience or by training.

There are some differences in the requirements of the human preventive controls rule compared to the requirements of HACCP regulations for seafood, juice, and meat and poultry such that training provided by the International HACCP Alliance may not be equivalent. Such an individual may need to obtain supplemental training specific to the rule. Alternatively, a person who has received the International HACCP Alliance training and has implemented a HACCP plan may be qualified through job experience.

(Comment 565) Some comments ask us to emphasize that a standardized curriculum in the development and application of risk-based preventive controls may not provide a preventive controls qualified individual with sufficient expertise to design and conduct robust, scientific validation studies to support the adequacy of control measures.

(Response 565) We acknowledge that a single training course may not provide adequate training for every function of the preventive controls qualified individual for the foods produced by a facility. In some cases an individual may gain the full complement of knowledge and experience through multiple, specific training courses; in other cases an individual may gain the full complement of knowledge and experience through job experience or through a combination of training and job experience.

(Comment 566) Some comments ask us not to establish requirements that are overly strict because there is a finite supply of food safety experts in the country and many facilities will need multiple preventive controls qualified individuals.

(Response 566) We disagree that the requirements applicable to the preventive controls qualified individual should be designed to match any current limitations in the number of individuals who have the knowledge and skill to prepare (or oversee the preparation of) a food safety plan. We expect that market forces will act to increase the number of preventive controls qualified individuals to match the demand generated by this rule. In addition, as discussed in section LVI.A, we are staggering the compliance dates for the rule, so that only those businesses that are not small or very small businesses will need to comply with the rule within one year, and very small businesses are not required to develop a food safety plan or conduct other activities that require oversight by a preventive controls qualified individual.

(Comment 567) Some comments ask us to develop training that emphasizes the need for appropriate equipment standards.

(Response 567) The training will focus on the specific requirements of the human preventive controls rule, which does not establish requirements for equipment standards.

(Comment 568) Some comments ask us to provide that the standardized curriculum can be recognized as adequate by the competent authority for food safety in each country rather than by FDA. One comment cited a requirement in one country for training that is consistent with Codex HACCP.

(Response 568) We decline this request. The standardized curriculum will be available to training providers, and we expect market forces will result in the development in foreign countries of training consistent with the standardized training curriculum. As noted previously (see Response 564), HACCP-based training may not be equivalent to the standardized curriculum because of the specific requirements of this rule. However, we believe that the flexibility provided by the alternative that a preventive controls qualified individual may be otherwise qualified through job experience to develop and apply a food safety system provides an approach to address the circumstances in a foreign country with respect to preventive controls qualified individuals until the training is available. In addition we will work with partners around the world—including the Alliances, regulatory counterparts, and multinational organizations—to promote training to the global community of food suppliers. We intend to meet both the letter and the spirit of our obligation to the World Trade Organization to facilitate training on the new regulations, particularly in developing nations.

2. Proposed § 117.180(c)(2)—Qualified Auditor

We proposed that to be a qualified auditor, a preventive controls qualified individual must have technical expertise obtained by a combination of training and experience appropriate to perform the auditing function.

(Comment 569) Some comments object to the proposed requirement that a qualified auditor must be a preventive controls qualified individual with certain technical auditing expertise. One comment asserts that a qualified auditor should not be required to have the broader skills of a preventive controls qualified individual.

(Response 569) We have revised the definition of “qualified auditor,” and the requirements applicable to a “qualified auditor,” such that a “qualified auditor” means a person who is a “qualified individual” as that term is defined in this final rule, rather than a “preventive controls qualified individual,” because some auditors may be auditing businesses (such as produce farms) that are not subject to the requirements for hazard analysis and risk-based preventive controls, and it would not be necessary for such an auditor to be a “preventive controls qualified individual.”

(Comment 570) Some comments ask us to consider specifying training for qualified auditors. These comments also ask us to consider certain industry documents in any guidance we may issue regarding qualified auditors.

(Response 570) At this time, we are not planning to specify a training curriculum for qualified auditors. If we develop guidance related to qualified auditors, we will consider industry documents that are already available.

C. Proposed § 117.180(d)—Records

We proposed that all applicable training must be documented in records, including the date of the training, the type of training, and the person(s) trained. For clarity, we have revised the requirement to specify the type of training that must be documented—i.e., applicable training in the development and application of risk-based preventive controls (see 78 FR 3646 at 3762).

(Comment 571) Some comments ask us to explain how job experience should be documented in records to prove qualifications.

(Response 571) The rule does not require documentation of job experience. A facility has flexibility to determine whether and how to document the job experience of a preventive controls qualified individual. For example, a facility could ask a preventive controls qualified individual to provide a resume documenting applicable experience. As discussed in Response 563, we intend to focus our inspections on the adequacy of the food safety plan. As necessary and appropriate, we will consider whether deficiencies we identify in the food safety plan suggest that the preventive controls qualified individual may not have adequate experience to carry out the assigned functions.

XXXVII. Subpart C: Comments on Proposed § 117.190—Implementation Records

We proposed to list all records documenting implementation of the food safety plan in § 117.190(a). We noted that proposed § 117.190(a) would not establish any new requirements but merely make it obvious at a glance what implementation records are required under proposed part 117, subpart C. We received no comments that disagreed with this proposed provision and are finalizing it as proposed.

We proposed that the records that you must establish and maintain are subject to the requirements of proposed subpart F (Requirements Applying to Records that Must be Established and Maintained). (Proposed subpart F would establish requirements that would apply to all records that would be required by the various proposed provisions of proposed part 117.) We received no comments that disagreed with this proposed provision and are finalizing it as proposed.

XXXVIII. Subpart D: Comments on Proposed § 117.201—Modified Requirements That Apply to a Qualified Facility

As previously discussed (78 FR 3646 at 3769), sections 418(l)(2)(A) and (B) of the FD&C Act provide that a qualified facility must submit two types of documentation to us. The first type of required documentation relates to food safety practices at the facility, with two options for satisfying this documentation requirement. Under the first option, the qualified facility may choose to submit documentation that demonstrates that it has identified potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the preventive controls to ensure that such controls are effective. Alternatively, under the second option, the qualified facility may choose to submit documentation (which may include licenses, inspection reports, certificates, permits, credentials, certification by an appropriate agency (such as a State department of agriculture), or other evidence of oversight), that the facility is in compliance with State, local, county, or other applicable non-Federal food safety law. The second type of required documentation relates to whether the facility satisfies the definition of a qualified facility.

If a qualified facility does not prepare documentation demonstrating that it has identified potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the preventive controls to ensure that such controls are effective, it must provide notification to consumers of certain facility information by one of two procedures, depending on whether a food packaging label is required on the food.

Consistent with the statutory direction of section 418(l) of the FD&C Act, we proposed the following modified requirements for qualified facilities: (1) Submission of certain documentation (proposed § 117.201(a)); (2) procedures for submission of the documentation (proposed § 117.201(b)); (3) the frequency of the submissions (proposed § 117.201(c)); (4) notification to consumers in certain circumstances (proposed § 117.201(d)); and (5) applicable records that a qualified facility must maintain.

In the 2013 proposed human preventive controls rule, we tentatively concluded that a certified statement would be acceptable for the purposes of satisfying the submission requirements of proposed § 117.201(a). We also requested comment on the efficiency and practicality of submitting the required documentation using the existing mechanism for registration of food facilities, with added features to enable a facility to identify whether or not the facility is a qualified facility.

Some comments support one or more of the proposed requirements without change. For example, some comments state that our proposed interpretation of the statutory term “business address” is consistent with our use of the term “business address” in our regulations regarding information that must be included in a prior notice for imported food (21 CFR 1.281). Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 587 through Comment 589, Comment 591 through Comment 593, and Comment 596 through Comment 598) or ask us to clarify how we will interpret the provision (see, e.g., Comment 572 and Comment 579 through Comment 585).

In this section, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. We also address comments discussing our tentative conclusion regarding the submission of certified statements to FDA, including submitting certified statements using the existing mechanism for registration of food facilities. After considering these comments, we have revised the proposed requirements as shown in table 40, with editorial and conforming changes as shown in table 52.

As discussed in Response 155, we have revised the definition of very small business to specify that it is based on an average (of sales plus market value of human food held without sale) during the 3-year period preceding the applicable calendar year and, as a companion change, we are explicitly requiring that a facility determine and document its status as a qualified facility on an annual basis (see § 117.201(c)(1)).

A. Comments on Submission of a Certification Statement

(Comment 572) Some comments ask us to clarify the distinction between the documentation that would be submitted to FDA and the records that a qualified facility relies on to support the submitted documentation.

Some comments agree with our tentative conclusion to use certified statements to satisfy the proposed submission requirements, noting that it would save time and money and reduce the paperwork burden on qualified facilities. Some comments ask us to revise the proposed requirements to make this use of certified statements explicit in the regulatory text.

Other comments disagree with our tentative conclusion to use certified statements to satisfy the submission requirements. These comments focus on the importance of actual copies of documents in determining compliance with the documentation requirements and assert that proof of qualification requires more than a checked box in an on-line registration database. Some comments ask us to require that a qualified facility affirm that it has the original documents on file and available for FDA inspection. Other comments assert that requiring qualified facilities to submit copies of the actual documentation would enable us to easily review food safety plans or inspection reports and to target our compliance and enforcement activities to those qualified facilities that pose a greater risk because of inadequate prevention measures or deficient inspections.

(Response 572) We are affirming our tentative decision that we will not require a qualified facility to submit to FDA, as part of its attestation, the underlying documentation that establishes its compliance. We agree that the underlying records are needed to determine compliance with the documentation requirements and that a qualified facility must retain the documents it is relying on to support its attestation and make them available to us during inspection. We also agree that the regulatory text needs to be explicit regarding the required documentation and that we need to clearly distinguish between the documentation that would be submitted to FDA and the records that a qualified facility relies on to support the submitted documentation. Therefore, we have made the following three revisions to the proposed regulatory text.

First, we have revised proposed § 117.201(a) to specify that the submitted documentation is an “attestation.” Second, we have revised proposed § 117.201(b) to update details regarding the electronic and paper submission of a form specific to this attestation requirement. Third, we have revised proposed § 117.201(e) (final § 117.201(f)) to specify that you must maintain those records relied upon to support the “attestations” that are required by § 117.201(a).

We acknowledge that requiring submission of the actual documentation would enable us to easily review food safety plans or inspection reports and to target our compliance activities based on information that we see in those food safety plans or inspection reports. However, as discussed in Response 384, we are not requiring that other facilities submit a “facility profile” that would allow us to more broadly review food safety plans and target our compliance activities based on information that we see in those food safety plans and will instead explore other mechanisms to achieve the goals we described in the 2013 proposed human preventive controls rule for a facility profile.

B. General Comments on Modified Requirements That Apply to a Qualified Facility

(Comment 573) Some comments assert that the proposed modified requirements would create a costly burden for qualified facilities (e.g., registering and making submissions to FDA) that would not be imposed on other types of exempted facilities. Some of these comments question whether the exemption for qualified facilities is meaningful in light of the significant burden imposed by the proposed modified requirements. Some comments contrast the proposed modified requirement for qualified facilities to submit documentation to FDA with proposed requirements for all other facilities to simply establish and maintain applicable records.

(Response 573) The submission requirements that we are establishing in this rule for qualified facilities reflect the statutory framework for qualified facilities (section 418(l)(2)(B) of the FD&C Act). Although the submission requirements only apply to qualified facilities, the reporting burden associated with submission of an attestation is much lower than the recordkeeping burden for facilities that are subject to the requirements for hazard analysis and risk-based preventive controls (see section LXI).

(Comment 574) Some comments ask us to minimize setting different standards even though the modified requirements reflect express statutory provisions.

(Response 574) These comments appear to be referring to the statutory provisions of section 418(n)(3)(C) of the FD&C Act, which specify that the regulations we establish to implement section 418 of the FD&C Act acknowledge differences in risk and minimize, as appropriate, the number of separate standards that apply to separate foods. We disagree that the statutory provisions of section 418(n)(3)(C) are directly relevant to the submission requirements of this rule for qualified facilities. The requirements for qualified facilities, but not other facilities, to submit documentation to FDA reflect different regulatory requirements. The different regulatory requirements are directed at different facilities, and do not set separate standards for particular foods. Regardless, even if the statutory provisions of section 418(n)(3)(C) were relevant to the submission requirements of qualified facilities, provisions of this rule that reflect express statutory provisions would not conflict with the statutory direction in section 418(n)(3)(C).

(Comment 575) Some comments ask us to implement the same labeling requirements that we proposed to establish for farms that would be eligible for a “qualified exemption” in the proposed produce safety rule, noting that such labeling requirements would allow us to trace food produced by the facility back through the supply chain if there is a problem.

(Response 575) The rule does include a labeling requirement analogous to the applicable labeling requirement in the proposed produce safety rule (see § 117.201(e)). However, that labeling requirement only applies to one of the two options that a qualified facility has for satisfying the submission requirements (see § 117.201(a)(2) and (e)). Specifically, a labeling requirement applies if the qualified facility chooses to attest that it is in compliance with applicable non-Federal food safety laws (§ 117.201(a)(2)(ii) and (e)). However, the labeling requirement does not apply if the qualified facility chooses to attest that it has identified the potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the performance of the preventive controls to ensure that such controls are effective (§ 117.201(a)(2)(i)). The difference between the requirements of the human preventive controls rule and the proposed produce safety rule reflect differences in the distinct statutory provisions governing the two rules.

(Comment 576) Some comments emphasize that the modified requirements need to ensure adequate protection of public health and state that we should maintain and exercise oversight of qualified facilities. Some comments ask that we provide enough specificity so that qualified facilities know and understand their food safety responsibilities towards consumers.

(Response 576) A facility that satisfies criteria to be a qualified facility continues to be responsible to produce food that will not be adulterated under section 402 of the FD&C Act or misbranded under section 403 of the FD&C Act. Such a facility is also subject to the requirements of section 421 of the FD&C Act regarding frequency of inspection of all facilities and to the new administrative tools provided by FSMA, such as for suspension of registration (section 415 of the FD&C Act) and for mandatory recall (section 423 of the FD&C Act). As discussed in Response 151, we expect that most qualified facilities will be subject to the CGMP requirements of subpart B. As we do now, we will continue to inspect these facilities for compliance with those CGMP requirements.

(Comment 577) Some comments ask which exemption a farm mixed-type facility should follow if it satisfies criteria for a qualified facility (§ 117.5(a)), as well as criteria for a very small business that only conducts on-farm low-risk activity/food combinations (specified in § 117.5(g) and (h)).

(Response 577) We describe these comments in more detail in Comment 202. As discussed in Response 202, a farm mixed-type facility that is a very small business and that only conducts the low-risk activity/food combinations listed in § 117.5(g) and (h) may find it advantageous to classify itself as a very small business eligible for the exemption in § 117.5(g) and (h) (which is not subject to the modified requirements in § 117.201) rather than as a qualified facility (which is subject to the modified requirements in § 117.201).

(Comment 578) Some comments express concern about State access to the records that a qualified facility maintains to support its attestations, particularly when a State would conduct an inspection for compliance with part 117 under contract to FDA. These comments express concern about the time and resources necessary to verify the status of a facility as a qualified facility and note that previous mechanisms whereby we provide information to States in advance of inspection have been slow. These comments also express concern that if the State must verify the “qualified facility” status of all firms, including those that are not FDA contracts, this could delay their ability to conduct timely inspections and increase inspection time, reducing the number of inspections conducted.

(Response 578) We are sensitive to the time required for various inspection activities and intend to communicate with States regarding our expectations for how to verify whether a facility is a qualified facility.

(Comment 579) Some comments point out that the proposed procedures for submission are silent on the process and timeframe for our review and approval of the submitted documentation and ask us to clarify this process and timeframe. Other comments ask us to clarify the consequences to a facility if its submission is found to be insufficient.

(Response 579) We will not be approving the submitted attestations. Instead, we intend to use the information to determine whether the facility should be inspected for compliance with the requirements for hazard analysis and risk-based preventive controls, or for compliance with the modified requirements. During the inspection, we would ask to see the records that the facility maintains to support any submitted attestations.

(Comment 580) Some comments ask us to clarify whether a foreign facility would need to submit documentation of its status as qualified facility. These comments note that a foreign facility also would be required to provide information to an importer and assert that submitting information to both FDA and an importer would be a duplication of effort. These comments ask us to allow a foreign facility that is a qualified facility to submit information to either FDA or the importer, rather than to both FDA and the importer.

(Response 580) We decline this request. Documentation submitted to an importer would not reach FDA and, thus, could not satisfy the requirements of this rule. As discussed in Response 572, we are requiring submission of an attestation, on a form that can be submitted either electronically or on paper, rather than submission of the underlying information.

C. Proposed § 117.201(a)—Documentation To Be Submitted

1. Proposed § 117.201(a)(1)—Documentation That the Facility Is a Qualified Facility

We proposed that a qualified facility must submit documentation that the facility is a qualified facility. We also proposed that for the purpose of determining whether a facility satisfies the definition of a qualified facility, the baseline year for calculating the adjustment for inflation is 2011. As discussed in Response 572, we have revised the provision to specify that the documentation that must be submitted is an attestation.

(Comment 581) Some comments ask us to clarify the documentation required to certify that an operation is a qualified facility. Some comments ask us to explicitly state that the documentation must include financial and sales records of the business and its subsidiaries or affiliates. Some comments ask us to clarify the types of records that would be required to be submitted by foreign establishments to support the classification of a foreign establishment as a “qualified facility.”

(Response 581) The submission to FDA will be an attestation rather than the records that the qualified facility relies on to support the attestation; however, you must maintain those records relied upon to support the “attestations” (see § 117.201(f)). As previously discussed, consistent with section 418(l)(2)(B)(ii) of the FD&C Act we intend to issue guidance on the records that a facility could retain to demonstrate that it is a qualified facility (78 FR 3646 at 3770). We intend to focus on records demonstrating that a facility is a very small business (i.e., financial records demonstrating that a business averages less than the $1,000,000 threshold adjusted for inflation, during the 3-year period preceding the applicable calendar year) rather than records demonstrating that the average annual monetary value of the food manufactured, processed, packed, or held at such facility that is sold directly to qualified end-users during a three-year period exceeded the average annual monetary value of the food sold by the facility to all other purchasers. We expect that financial records demonstrating that a business is a very small business will be less burdensome for a qualified facility to maintain and require fewer resources for FDA to review.

(Comment 582) Some comments ask whether documentation demonstrating that a facility is a qualified facility must be prepared by a “preventive controls qualified individual” as that term is defined in § 117.3.

(Response 582) The rule does not require that documentation demonstrating that a facility is a qualified facility be prepared by a “preventive controls qualified individual.”

(Comment 583) Some comments ask how the adjustment for inflation will be calculated and how regulators such as the States will get this information.

(Response 583) We intend to use the Federal calculation for the Gross Domestic Product price deflator, as provided by the Bureau of Economic Analysis, to adjust for inflation. We will make the inflation-adjusted dollar value to the baseline very small business sales cut-offs (e.g., $1,000,000 in 2011) available on our Internet site. We will update the values for the very small business exemptions and qualifications annually using this calculation.

2. Proposed § 117.201(a)(2)(i)—First Option for Documentation: Food Safety Practices

We proposed two options for satisfying the statutory documentation requirement in section 418(l)(2)(B)(i) of the FD&C Act. Under the first option (the food safety practices option), a qualified facility could submit documentation demonstrating that it has identified the potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the performance of the preventive controls to ensure that such controls are effective. As discussed in Response 572, we have revised the provision to specify that the submission is an attestation.

(Comment 584) Some comments assert that the rule is vague about what the applicable documentation should include and how exhaustive it should be. Some comments ask whether documentation (such as a food safety plan) must address all operations at the establishment or only those that trigger the registration of the establishment as a facility. Some comments ask us to clarify the difference between having documentation to support food safety practices and attesting that the facility has such documentation. Other comments ask whether a qualified facility would need to have records documenting a risk analysis and monitoring.

(Response 584) If a qualified facility submits an attestation regarding its food safety practices, the documentation that the facility maintains for review during inspection must specify that the facility has identified the potential hazards associated with the food being produced, is implementing preventive controls to address the hazards, and is monitoring the performance of the preventive controls to ensure that such controls are effective (see § 117.201(a)(2)(i)). For example, a qualified facility that produces one or more nut butters might have documentation specifying that it has determined that Salmonella is a hazard requiring a preventive control, describing the roasting process that will control Salmonella, describing sanitation controls to prevent contamination of the nut butters with Salmonella, and describing an environmental monitoring program to verify that its sanitation controls are effective. Likewise, a qualified facility that prepares cooked soups that require refrigeration for safety might have documentation specifying that it has determined that Salmonella is a hazard requiring a preventive control and supporting the temperature and time used in a thermal process to kill Salmonella, with temperature controls for safety and procedures for monitoring the temperature controls. A qualified facility that makes pickles might have documentation specifying that the hazard requiring a preventive control is C. botulinum, specifying the final equilibrium pH (of the pickled cucumbers) that is controlling the hazard, and demonstrating its monitoring of the pH during the production process.

As discussed in Response 572, a qualified facility that chooses the food safety practices option for complying with the submission requirements of this rule will attest to that by checking a statement on a form. In contrast, a food safety plan (or other documentation) that the qualified facility relies on to support the attestation will be a record subject to the recordkeeping requirements of subpart F.

(Comment 585) Some comments ask us to clarify whether the submission requirement addresses compliance with the CGMP requirements of subpart B.

(Response 585) The submission requirement does not address compliance with the CGMP requirements of subpart B.

3. Proposed § 117.201(a)(2)(ii)—Second Option for Documentation: Compliance With Other Applicable Non-Federal Food Safety Law

Under the second option for satisfying the statutory documentation requirement, a qualified facility could submit documentation that it is in compliance with State, local, county, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign countries. As discussed in Response 572, we have revised the provision to specify that the submission is an attestation. We also have revised the provision to add “tribal” as an example of applicable non-Federal food safety law to clarify for purposes of this rule that a qualified facility could submit an attestation that it is in compliance with tribal food safety law.

(Comment 586) Some comments object to the proposed provision. These comments point out that State and local requirements are inconsistent and assert that such requirements are not sufficiently rigorous to substitute for the FSMA requirement to conduct a hazard analysis and establish and execute a documented food safety plan.

(Response 586) The provision reflects the express statutory direction of section 418(l)(2)(B)(i)(II) of the FD&C Act. See Response 576.

(Comment 587) Some comments ask us to specify that a qualified facility must document its compliance with the food safety laws of the State where its products are sold.

(Response 587) We decline this request. We interpret section 418(l)(2)(B)(i)(II) of the FD&C Act to apply to the State where a qualified facility is located. This is consistent with how States conduct inspections.

(Comment 588) Some comments ask us to specify that a qualified facility must document compliance with all applicable non-Federal food safety laws.

(Response 588) We decline this request. Section 418(l)(2)(B)(i)(II) of the FD&C Act refers to compliance with “State, local, county or other applicable non-Federal food safety law” (emphasis added).

(Comment 589) Some comments ask us to revise the proposed provision to make clear that a facility could submit an applicable attestation if the facility is subject to a State or local “cottage food” law (laws allowing sale of certain food from home kitchens). These comments explain that some cottage food laws do not require State or local authorities to inspect a facility or otherwise document that the facility is in compliance with the cottage food law. In addition, under some of these cottage food laws a facility would not have documentation such as a license to support its compliance with food safety requirements. Some of these comments ask us to revise the proposed provision to specify that a facility could rely on a copy of the relevant State law or regulation and a letter from the facility stating that it complies with that law or regulation, or certification by an appropriate agency (such as a State department of agriculture).

(Response 589) As discussed in Response 572, we have revised the regulatory text.to provide for qualified facilities to submit an attestation that the facility is in compliance with State, local, county, or other applicable non-Federal food safety law. During an inspection, we expect the facility to be able to show us how the facility is complying with the applicable food safety regulation (including relevant licenses, inspection reports, certificates, permits, credentials, or certifications), and producing safe food.

(Comment 590) Some comments ask us to provide resources to the States to implement the proposed provision. These comments also ask us to develop and implement a strategic plan to provide resources (e.g., training, guidance) to State and local inspection agencies in advance of the anticipated increased burden on State and local inspection programs that will be created by the provision.

(Response 590) We do not believe that specific training for State or other government counterparts is necessary for the purposes of inspecting a qualified facility that attested to having documentation from a non-Federal regulatory authority. The State or other government counterpart would merely examine applicable documentation (such as a license, inspection report, certificate, permit, credentials, or certification by an appropriate agency (such as a State department of agriculture), which is specified in the provision. After inspecting such documentation, the State or other government counterpart would focus on inspection for compliance with CGMPs, as it has done in the past.

D. Proposed § 117.201(b)—Procedure for Submission

We proposed that the documentation must be submitted to FDA either electronically or by mail. As discussed in Response 572, we have revised the regulatory text to update details regarding the electronic and paper submission of a specific form. We are developing paper and electronic versions of Form FDA 3942a, which is an information collection provision that is subject to review by OMB under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3520). We intend to make the paper Form FDA 3942a available in the near future and invite comments consistent with procedures for approval of the form by OMB.

(Comment 591) Some comments recommend that any interface for electronic submission of certification statements post adequate notice of requirements the facility must meet and warnings detailing potential penalties (e.g., for fraudulent submission).

(Response 591) We intend that the electronic submission system will operate in a manner similar to the existing electronic submission system for registration of food facilities, including a certification statement advising the person signing the form that, under 18 U.S.C. 1001, anyone who makes a materially false, fictitious, or fraudulent statement to the U.S. Government is subject to criminal penalties. We intend to include a similar certification statement on paper forms that will be available for qualified facilities that choose to submit by paper rather than through the electronic system. The electronic and paper submission forms will focus on the attestation statements rather than on other requirements that the facility is subject to. The Small Entity Compliance Guide that we will issue in accordance with section 212 of the Small Business Regulatory Enforcement Fairness Act (Public L. 104-121) will be better suited to helping qualified facilities understand the requirements of the rule than information presented on a submission form.

E. Proposed § 117.201(c)—Frequency of Determination and Submission

We proposed that the documentation must be: (1) Submitted to FDA initially within 90 days of the applicable compliance date; and (2) resubmitted at least every 2 years, or whenever there is a material change to the information applicable to determining the status of a facility.

(Comment 592) Some comments assert that the proposed timeframe of 90 days to submit the required documentation would not provide sufficient time to gather and submit the required documentation and ask us to extend the timeframe—e.g., to 120 or 180 days.

(Response 592) We are retaining the proposed timeframe for the initial submission (within 90 days of the applicable compliance date). The only documentation that the qualified facility will need to submit is an attestation, which does not need to be gathered. Importantly, however, documentation supporting the attestation must be available for inspection by September 17, 2018. As discussed in Response 155 the compliance date for a facility to retain records to support its status as a qualified facility is January 1, 2016. As a companion change, we are explicitly requiring that a facility determine and document its status as a qualified facility on an annual basis by no later than July 1 of each calendar year (see § 117.201(c)(1)).

In addition, we have revised proposed § 117.201(c)(1) (which we are finalizing as § 117.201(c)(2)(i)(A), (B), and (C)) to specify the timeframe for the initial submission for three distinct circumstances: (1) By December 17, 2018, for a facility that begins manufacturing, processing, packing or holding food before September 17, 2018; (2) Before beginning operations, for a facility that begins manufacturing, processing, packing or holding food after September 17, 2018; or (3) By July 31 of the applicable calendar year, when the status of a facility changes from “not a qualified facility” to “qualified facility” based on the annual determination required by paragraph (c)(1) of this section. See the discussion in Response 155 regarding the approach we intend to take in a number of circumstances that could lead to a facility having records to support its status as a qualified facility for fewer than 3 preceding calendar years.

We have revised the provision to specify that the required biennial submissions of the attestations must be made during a timeframe that will coincide with the required biennial updates to facility registration (See section 102 of FSMA)—i.e., during the period beginning on October 1 and ending on December 31, beginning in 2020. In determining that 2020 would be the first year for the required biennial submissions of the attestations, we first considered that the first submission of an attestation would be approximately December 2018 for qualified facilities that are operating as of the date of this final rule (i.e., approximately 90 days after the date of publication of this rule). For qualified facilities that do not begin operations until after December 2018, the first biennial submission will be required in a timeframe less than two years, but once the qualified facility has made its first submission the subsequent biennial submissions will all be at two-year intervals. Coordinating the biennial submissions of the required attestations with the biennial registration will reduce the cumulative economic impact on the food industry of complying with two separate requirements because qualified facilities that choose to submit electronically will be able to submit electronically while accessing the same electronic portal used for facility registration. This approach is consistent with our approach to food labeling requirements, where we establish a Uniform Compliance Date (see, e.g., 79 FR 73201, December 10, 2014).

(Comment 593) Some comments ask us to include an option within the system to notify us when a facility's status as a “qualified facility” changes—e.g., because its business expands or changes.

(Response 593) Notifying us when there is a change in the facility's status from “qualified facility” to “not a qualified facility” is a requirement rather than an option. We included this requirement in the proposed rule, and are establishing it in this final rule. We made editorial changes to the provision to make this clearer.

We also established a series of dates associated with the facility's change in status from “qualified facility” to “not a qualified facility.” First, we are specifying that when the status of a facility changes from “qualified facility” to “not a qualified facility” based on the required annual determination, the facility must notify FDA of that change in status using Form 3942a by July 31 of the applicable calendar year (see § 117.201(c)(3)). We have provided the facility with flexibility to wait until July 1 of a given calendar year to determine whether its status changes (see § 117.201(c)(1)); 30 days is an adequate timeframe to submit the form notifying us of the change in status.

Second, we are specifying that when the status of a facility changes from “qualified facility” to “not a qualified facility,” the facility must comply with subparts C and G no later than December 31 of the applicable calendar year unless otherwise agreed to by FDA and the facility (see § 117.201(d)). In essence, this provision can provide a facility with up to a full year to comply with the full requirements for hazard analysis and risk-based preventive controls when the facility determines its change in status early in the calendar year. A facility that does not determine that change in status until the required date of July 1 would still have 6 months to comply with the full requirements for hazard analysis and risk-based preventive controls. As we have done in the case of a qualified exemption being withdrawn (see § 117.257(d)(1)), we are providing flexibility for a facility to comply in an alternative timeframe if agreed to by FDA and the facility.

(Comment 594) Some comments ask us to specify that the required attestations be submitted annually rather than every 2 years. These comments assert that annual submission would be consistent with the statutory provisions that determine eligibility for status as a qualified facility based on sales, which will vary each year. These comments also assert that using the current mechanism for registration of food facilities would not be burdensome and would provide us with assurances that only facilities that satisfy criteria to be a qualified facility will operate under the modified requirements, thereby minimizing risk to public health.

Other comments ask us to specify that the required attestations be submitted every 5 years rather than every 2 years. These comments assert that doing so would be consistent with the statutory direction of section 201 of FSMA (Targeting of Inspection Resources) for non-high risk food facilities. These comments also assert that we did not provide specific reasons for the proposed 2 year timeframe and that re-submitting the attestations every two years will increase cost in time and labor.

(Response 594) We decline both of these requests. The rule already requires resubmission whenever there is a material change to the information that changes the status of a facility as a qualified facility. Therefore, if the facility's sales change its status, so that it is no longer a qualified facility, the rule requires that facility to notify us when its status changes. (Note that the definition of very small business established in this rule is based on an average (of sales plus market value of human food held without sale) during the 3-year period preceding the applicable calendar year, rather than on annual sales plus market value. See Response 155.) A biennial submission is adequate to otherwise require a qualified facility to affirmatively attest that it continues to satisfy the criteria for being a qualified facility. A biennial submission is not overly burdensome, because a facility can coordinate its biennial submission with its biennial update to its facility registration. The suggested 5-year submission based on the targeted inspection frequency for non-high risk food facilities implies that all qualified facilities produce such foods, which is not the case.

F. Proposed § 117.201(d)—Notification to Consumers (Final § 117.201(e))

We proposed that a qualified facility that does not submit documentation of its food safety practices must provide notification to consumers as to the name and complete business address of the facility where the food was manufactured or processed (including the street address or P.O. box, city, state, and zip code for domestic facilities, and comparable full address information for foreign facilities).

(Comment 595) Some comments assert that the proposed requirement exceeds what is already present for food in packaged form (21 CFR 101.5), and that these differences will create confusion for regulators and producers alike, with added costs but no food safety benefits. Some comments assert that the proposed requirement will likely cause consumer confusion at point of purchase and may discourage retail and food service buyers from receiving products from qualified facilities. Some comments ask us to specify that when a food packaging label is required, the required information must appear prominently and conspicuously on the label in compliance with § 101.5.

(Response 595) We decline these requests. The requirement for notification to consumers is mandated by section 418(l)(7)(A) of the FD&C Act. The labeling requirements applicable to packaged foods (§ 101.5) are established under a different statutory provision than the labeling requirements applicable to qualified facilities (i.e., under section 403(e) of the FD&C Act (21 U.S.C. 343(e)) rather than section 418(l)(7) of the FD&C Act). The comments provide no explanation of the basis for their assertion that these differences will create confusion for consumers at point of purchase or discourage retail and food service buyers from receiving products from qualified facilities. As previously discussed (78 FR 3646 at 3771), the use of the term “business address” in section 418(l)(7) of the FD&C Act contrasts with Congress' use of a different term, “place of business,” in section 403(e) of the FD&C Act. These comments do not address the reasons we previously discussed for our tentative conclusion that the use of the term “business address” in section 418(l)(7) demonstrates Congress' intent to require the facility's full address, including the street address or P.O. box, to appear on labels or other required notifications when the facility has opted to not submit documentation directed to food safety practices. In this document, we are affirming that tentative conclusion. As discussed in section LVI.A, we are establishing January 1, 2020, as the date when a qualified facility that is subject to the notification requirements of § 117.201(e)(1) must notify consumers of the complete business address of the facility where the food was manufactured or processed.

G. Proposed § 117.201(e)—Records (Final § 117.201(f))

We proposed that a qualified facility must maintain those records relied upon to support the required documentation. We also proposed that the records that a qualified facility must maintain would be subject to the requirements that would be established in subpart F of this rule. As discussed in Response 572, after considering comments we have revised the rule to specify that a qualified facility must maintain those records relied upon to support the required attestations (rather than the required documentation).

(Comment 596) Some comments ask us to explicitly specify that we have access to documents that establish a facility as a qualified facility. Some comments assert that a facility may reasonably assume that records such as financial records would not be available to us because such records are excluded from the records that we have access to under the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the Bioterrorism Act), as provided by § 1.362.

(Response 596) The rule explicitly specifies that we have access to records that are required by the rule (see § 117.320). If a facility relies on financial records to demonstrate its status as a qualified facility, we will have access to those financial records. The exemption referred to by the comments for financial records (§ 1.362) is narrowly targeted to records required by the section 414 recordkeeping regulations and does not apply to records required by this human preventive controls rule.

(Comment 597) Some comments ask us to revise the rule to define documentation as the actual records or true copies of the actual records.

(Response 597) The rule explicitly specifies that the records a qualified facility relies on to support the required attestations must be actual records, true copies, or electronic records. However, it does so by requiring that the records that a qualified facility must maintain are subject to the requirements in subpart F (see § 117.305(a)), which specifies that these requirements apply to all records required by this rule, rather than by specifying these requirements within the provisions directed to modified requirements for qualified facilities.

(Comment 598) Some comments ask us to include a new section in subpart F to cover additional requirements applying to the records that a qualified facility must keep and make available to FDA upon request. These comments assert that such a section is necessary to ensure that qualified facilities understand their obligations. These comments also assert that clarity is needed in light of the nature of the financial records that would be required to support the facility's status as a qualified facility.

(Response 598) We decline this request. As discussed in Response 581, consistent with section 418(l)(2)(B)(ii) of the FD&C Act we intend to issue guidance on the records that a facility could retain to demonstrate that it is a qualified facility rather than specify these records in the human preventive controls rule. Section 117.201(f) already specifies that a qualified facility must maintain those records relied upon to support the required attestations. There is no need to repeat this requirement in subpart F, which establishes general requirements for all records required by the rule but does not specify those records required to demonstrate compliance with particular requirements of the rule.

XXXIX. Subpart D: Comments on Proposed § 117.206—Modified Requirements That Apply to a Facility Solely Engaged in the Storage of Unexposed Packaged Food

We proposed that if your facility is solely engaged in the storage of unexposed packaged food, you must conduct certain activities for any such refrigerated packaged food that requires time/temperature control to significantly minimize or prevent the growth of, or toxin production by, microorganisms of public health significance. We requested comment on the proposed list of modified requirements. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 599, Comment 600, Comment 604, Comment 606, Comment 608, and Comment 610) or ask us to clarify how we will interpret the provision (see, e.g., Comment 601 and Comment 602).

In this section, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 41.

A. Proposed § 117.206(a)—Modified Requirements for Unexposed Refrigerated Packaged Food That Requires Time/Temperature Controls

1. Proposed § 117.206(a)(1)—Establish and Implement Temperature Controls

We proposed that if your facility is subject to the modified requirements, you must establish and implement temperature controls adequate to significantly minimize or prevent the growth of, or toxin production by, microorganisms of public health significance.

We also tentatively concluded that it would be rare for a facility solely engaged in the storage of unexposed packaged food to not have information regarding whether a refrigerated packaged food is a TCS food and, if so, what specific temperature controls are necessary for safe storage of the food. We requested comment on this tentative conclusion.

(Comment 599) Some comments ask us to clarify that the requirement to establish and implement temperature controls applies to temperature control areas in a facility rather than to each product in a facility.

(Response 599) We agree that the requirement to establish and implement temperature controls applies to temperature control areas in a facility rather than to each product in a facility. To make this clearer, we have revised the proposed requirement to clarify that the facility must conduct activities as appropriate to ensure the effectiveness of the temperature controls rather than conduct activities “for any such refrigerated packaged food.”

(Comment 600) Some comments disagree with our tentative conclusion that it would be rare for a facility solely engaged in the storage of unexposed packaged food to not have information regarding whether a refrigerated packaged food is a TCS food and, if so, what specific temperature controls are necessary for safe storage of the food. These comments ask us to specify that the responsibility for determining whether a food is a TCS food falls to the manufacturer of the food rather than the warehouse storing the food, because the warehouse merely provides a service. Other comments note that the food product owners determine the optimal conditions for storage of their products based on their own hazard analysis and preventive controls, and that the food product owners can simply communicate those requirements to the warehouses that will store the products.

(Response 600) In this type of circumstance, it is appropriate for the manufacturer of the food to share the responsibility with the warehouse for proper storage of the food. The various provisions of section 418 of the FD&C act explicitly place the responsibility for complying with the requirements for hazard analysis and risk-based preventive controls, including modified requirements, on the owner, operator, or agent in charge of a facility and, thus, a facility that is a warehouse is responsible for its own food safety plan. Regardless, the manufacturer also has responsibilities under section 418 of the FD&C Act to determine the storage conditions necessary for food safety and to take steps to ensure that the food is stored under conditions that will ensure its safety.

It is not necessary to specify this joint responsibility for determining storage conditions in the rule, because the rule already clearly specifies that its provisions apply to persons who manufacture/process food, as well as to persons who hold food. Both the warehouse and the manufacturer have flexibility in determining how to comply with the rule, including the specific mechanism whereby the warehouse would receive information about storage of a food product from the manufacturer or owner of the product. Moreover, a citizen petition submitted to FDA [Docket No. FDA-2011-P-0561], in requesting an exemption or modified requirements for facilities solely engaged in the storage of unexposed packaged foods, asserts that such facilities work closely with food manufacturers to understand the conditions and controls needed to ensure the quality of the foods they store and distribute and that manufacturers appropriately instruct the warehouses to ensure packaged products are being properly stored (78 FR 3646 at 3712).

(Comment 601) Some comments ask us to clarify which facility—the shipping facility or the receiving facility—will be responsible for ensuring that temperature control is maintained during transportation of TCS foods.

(Response 601) See Response 423, which notes our intention to address comments regarding the responsibilities of shippers and receivers in the final sanitary transportation rule.

2. Proposed § 117.206(a)(2)—Monitor the Temperature Controls

We proposed that if your facility is subject to the modified requirements, you must monitor the temperature controls with sufficient frequency to provide assurance they are consistently performed. We requested comment on whether there would be a benefit to requiring a facility to develop written procedures for monitoring temperature.

(Comment 602) Some comments ask us to explain in the preamble of the final rule that we will accept monitoring systems that provide exception reports to satisfy the modified requirements. The comments describe exception reporting as a structure where automated systems are designed to alert operators and management when the monitoring system observes a deviation from an established limit. These comments assert that monitoring of preventive controls by automated systems can be more efficient than monitoring by personnel, and can eliminate human error.

(Response 602) See also Response 468 and Response 610. We have revised the recordkeeping provisions of these modified requirements to provide that the temperature monitoring records for the modified requirements may be kept either as affirmative records demonstrating temperature is controlled or as exception records demonstrating loss of temperature control. Although the comments explicitly ask us to provide a clarification in the preamble of this rule, we decided the clarification within the regulatory text would be clearer to facilities that are subject to the requirements, as well as to investigators who will be inspecting facilities for compliance with the rule.

(Comment 603) Some comments state that written procedures for monitoring temperature are not necessary. One reason provided by the comments is that the required records (specified in proposed § 117.206 (a)(5)) would provide sufficient information on the type and frequency of monitoring. Another reason is that the specific activities we proposed to ensure the effectiveness of the temperature controls already address activities that a facility would include in a written procedure.

(Response 603) We agree with the comments that the rule does not need to require that a facility develop written procedures for monitoring temperature.

3. Proposed § 117.206(a)(3)—Requirement to Take Corrective Actions

We proposed that if your facility is subject to the modified requirements, you must take appropriate corrective actions if there is a problem with the temperature controls for a TCS food.

(Comment 604) Some comments ask us to narrow the term “temperature controls” to more specifically focus it on temperature controls that are relevant to food safety because some problems with the controls may not impact the product temperature (and, thus, would not impact food safety).

(Response 604) We have revised the proposed requirement (and the applicable recordkeeping requirement) to specify that corrective actions are necessary only when there is a loss of temperature control that may impact the safety of a TCS food.

(Comment 605) Some comments assert that the responsibility for determining any corrective actions for a TCS food when there is a loss of temperature control falls to the manufacturer of the food rather than to the warehouse. These comments also assert that a warehouse is a third party who is not legally empowered to make independent decisions about when and where to ship the product, or not to ship it at all. These comments ask us to clarify that the responsibility of a warehouse for “preventing” affected food entering commerce ends when the product is returned to the manufacturer or processor.

(Response 605) Returning affected food to the manufacturer/processor or owner of the food is one way to satisfy the requirement to prevent food from entering commerce if the owner, operator, or agent in charge of a warehouse cannot ensure the affected food is not adulterated under section 402 of the FD&C Act, either on its own or after consultation with the manufacturer or processor of the food. It is not necessary to specify this specific action on the part of a warehouse in the regulatory text.

4. Proposed § 117.206(a)(4)—Requirement To Verify Consistent Implementation of Temperature Controls

We proposed that if your facility is subject to the modified requirements, you must verify that temperature controls are consistently implemented by: (1) Calibrating temperature monitoring and recording devices; (2) reviewing records of calibration within a reasonable time after the records are made; and (3) reviewing records of monitoring and corrective actions taken to correct a problem with the control of temperature within a week after the records are made.

(Comment 606) Some comments assert that the proposed requirement to “calibrate” devices that monitor and record temperature is inconsistent with the requirement to test such devices for accuracy in the LACF regulations in part 113. These comments assert that “accuracy check” is a more appropriate term to use in the modified requirements because many instruments that monitor or record temperature have very low drift values and may seldom require calibration.

(Response 606) We have revised the proposed requirements to require verification that temperature controls are consistently implemented by calibrating temperature monitoring and recording devices or checking them for accuracy. However, if the outcome of an accuracy check is that a temperature monitoring or recording device is not accurate, the facility must follow up by calibrating or replacing the device. See also Comment 519 and Response 519.

(Comment 607) Some comments assert that reviewing records of calibration or accuracy checks is only needed if a designated tolerance is exceeded.

(Response 607) Although we recognize that in most instances an out-of-calibration device will be identified and corrected at the time a calibration or accuracy check is performed, this is not always the case. The purpose of reviewing records of calibration or accuracy checks is to identify a problem that may have been missed or may not have been corrected rather than to react to a problem after the problem is identified. The records review is also a verification that the temperature controls were consistently implemented and that corrective actions were taken if needed.

(Comment 608) Some comments ask us to modify the frequency of checking monitoring records to specify that it be done with a frequency to demonstrate control rather than within a week after the records are made.

(Response 608) Consistent with Response 539, we have revised the proposed requirement to require review of records of monitoring (as well as records of corrective actions taken to correct a problem with the control of temperature) within 7 working days after the records are created or within a reasonable timeframe, provided that the preventive controls qualified individual prepares (or oversees the preparation of) a written justification for a timeframe that exceeds 7 working days.

(Comment 609) Some comments assert that the proposed verification and review activities are too prescriptive because they require reviews that are not necessary. However, these comments also assert that the proposed verification activities are too vague because they do not specify the reasons for reviewing the records. These comments ask us to focus the regulatory text on achieving the overall objective of the review (i.e., ensuring the adequacy of the control) and to provide examples of meaningful review activities in guidance.

(Response 609) We disagree that the proposed verification activities would require reviews that are not necessary. As noted in Response 607, the purpose of the records review is both to identify a problem with a temperature monitoring device that may not have been detected or corrected, and to verify that the temperature controls were consistently implemented and that corrective actions were taken if needed. The requirement is consistent with requirement for records review in subpart C (§ 117.165(a)(4)), which specifies records review as a verification activity to ensure that the records are complete, the activities reflected in the records occurred in accordance with the food safety plan, the preventive controls are effective, and appropriate decisions were made about corrective actions.

5. Proposed § 117.206(a)(5)—Establish and Maintain Records

We proposed that if your facility is subject to the modified requirements, you must establish and maintain records that document monitoring, corrective actions, and verification activities.

(Comment 610) Some comments state that temperature controls in refrigerated warehouses are extremely reliable and therefore extensive recordkeeping and record review are not value-added. These comments ask us to revise the proposed provision to require a record only if a deviation in the environmental temperature from the prescribed limits was noted.

(Response 610) See also Response 468 and Response 602. We have revised the regulatory text to provide that temperature monitoring records may be kept either as affirmative records demonstrating temperature is controlled or as exception records demonstrating loss of temperature control. The revised provision is consistent with the more general requirement for monitoring records of refrigeration temperature during storage of TCS food (see § 117.145(c)(2)).

B. Proposed § 117.206(b)—Records

We proposed that the records that a facility must establish and maintain for the proposed modified requirements are subject to the requirements that would be established in proposed subpart F. We received no comments that disagreed with our proposal, and are finalizing proposed § 117.206(b) without change.

XL. Subpart E: Comments on Proposed New Provisions for Withdrawal of a Qualified Facility Exemption

In the 2013 proposed human preventive controls rule, we proposed to establish procedural requirements that would govern our withdrawal of an exemption for a qualified facility (proposed subpart E; the withdrawal provisions). In the 2014 supplemental human preventive controls notice, we discussed several comments we received on these withdrawal provisions, and proposed modifications and additions to them. Some of the re-proposed provisions would modify the provisions that we included in the 2013 proposed human preventive controls rule (such as the timeframe for compliance with an order withdrawing an exemption), whereas others would be new provisions (such as a procedure to reinstate an exemption that had been withdrawn). In this section of this document we discuss comments that we received on the withdrawal provisions in the 2013 proposed human preventive controls rule, but did not address in the 2014 supplemental human preventive controls notice. We also discuss comments that we received on the re-proposed withdrawal provisions in the 2014 supplemental human preventive controls notice.

Most of the comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 612 through Comment 614, Comment 620 through Comment 626, Comment 628, Comment 629, and Comment 631 through Comment 633) or ask us to clarify how we will interpret the provision (see, e.g., Comment 617).

For several provisions, we received no comments that disagreed with our proposal, and are finalizing the provisions without change. These provisions are § 117.274 (Presiding officer for an appeal and for an informal hearing); § 117.277 (Timeframe for issuing a decision on an appeal); § 117.280 (Revocation of an order to withdraw a qualified facility exemption); and § 117.284 (Final agency action).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 42, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.251—Circumstances That May Lead FDA To Withdraw a Qualified Facility Exemption

We proposed that we may withdraw the exemption that would apply to a qualified facility in the event of an active investigation of a foodborne illness outbreak that is directly linked to the qualified facility, or if we determine that it is necessary to protect the public health and prevent or mitigate a foodborne illness outbreak based on conditions or conduct associated with a qualified facility that are material to the safety of the food manufactured, processed, packed, or held at such facility. We also proposed that before we issue an order to withdraw an exemption, we: (1) May consider one or more other actions to protect the public health or mitigate a foodborne illness outbreak; (2) must notify you, in writing, of circumstances that may lead us to withdraw the exemption, and provide an opportunity for you to respond in writing, within 10 calendar days of the date of receipt of the notification, to our notification; and (3) must consider your actions to address the circumstances that may lead us to withdraw the exemption.

(Comment 611) Some comments agree with the proposed provisions regarding certain actions we may take, and other actions we must take, before issuing an order to withdraw a qualified facility exemption. For example, some comments agree that other regulatory actions should be considered before withdrawing a qualified facility exemption, and some comments agree that it is appropriate to assess corrective actions taken by a qualified facility in response to a food safety problem when considering whether to withdraw its exemption. Other comments agree that these provisions are reasonable and will provide qualified facilities due process and greater clarity on the withdrawal process, but suggest that we could issue guidance rather than include these provisions in the rule to allow us greater flexibility should we have to act quickly to protect the public health.

Other comments disagree with these proposed provisions and ask us to delete them from the final rule. These comments assert that FSMA does not require us to describe the actions that we may take prior to withdrawing a qualified facility exemption and that it is not necessary to do so because it is customary for us to work with a food facility to address problems before taking enforcement actions. These comments also express concern that listing possible regulatory actions before we would issue an order to withdraw a qualified facility exemption could create an expectation that we will always exercise such regulatory actions before issuing the order. These comments also express concern that being bound by these provisions could prevent us from acting quickly to protect public health.

(Response 611) We are retaining the provisions regarding certain actions we may take, and other actions we must take, before issuing an order to withdraw a qualified facility exemption. We agree that it is customary for us to work with a food facility to address problems before taking enforcement actions but disagree that specifying this customary practice in the rule would prevent us from acting quickly to protect public health. As previously discussed, we consider that issuing an order to withdraw an exemption would be a rare event, in part because alternative actions such as those described in these provisions may provide a more expeditious approach to correcting a problem than withdrawing an exemption (79 FR 58524 at 58553). We also disagree that the rule binds us to take alternative regulatory action before issuing an order to withdraw a qualified facility exemption, other than to notify the facility in writing of circumstances that may lead us to withdraw the exemption, provide an opportunity for the facility to respond in writing, and consider the actions taken by the facility to address the circumstances we describe. The rule clearly specifies that regulatory actions such as a warning letter, recall, administrative detention, suspension of registration, refusal of food offered for import, seizure, and injunction are actions that we “may” (not “must”) take before issuing an order to withdraw a qualified facility exemption. Providing the facility with an opportunity to correct the problems before we take steps to withdraw an exemption has the potential to save agency resources associated with preparing an order, responding to an appeal of the order and request for a hearing, and administering a hearing. Directing resources to help a facility correct problems, rather than to administer a withdrawal process that could be resolved by the time of a hearing, is appropriate public health policy.

(Comment 612) Some comments ask us to specify that the notification of circumstances that may lead FDA to withdraw the exemption must include facts specific to the situation and information about how the facility can remedy the situation.

(Response 612) By specifying that we must notify the facility of circumstances that may lead us to withdraw an exemption, we mean that we would include facts specific to the situation. It is the responsibility of the facility, not FDA, to remedy the situation.

(Comment 613) Some comments ask us to state affirmatively that we must not withdraw the exemption if the facility has satisfactorily addressed the problematic conditions or conduct at the facility. These comments assert that, without this affirmative statement, the requirement that we “consider the actions taken by the facility” remains unclear.

(Response 613) We decline this request. If the facility has satisfactorily addressed the problematic conditions or conduct, there would be no problematic circumstances for us to describe in the order withdrawing the qualified facility exemption.

(Comment 614) Some comments ask us to provide additional time for a qualified facility to respond, in writing, to a notification of circumstances that may lead us to withdraw its exemption. Comments suggest timeframes of 60, 90, and 120 days as a reasonable or appropriate period of time for a qualified facility to compile information and documentation of facts and to respond to a notification of circumstances that may cause us to withdraw its exemption. Some of these comments express concern that the proposed deadline is too short, and that the short timeframe violates the intent of the exemption. Some comments ask us to establish graduated response times, with less response time allowed for more serious food safety concerns.

(Response 614) We have revised the provision to provide for 15 calendar days, rather than 10 calendar days, for a facility to respond in writing to our notification. The 15-day timeframe is the same as the timeframe for responding to a warning letter. Circumstances that could lead us to withdraw a qualified facility exemption require prompt action on the part of a facility, just as circumstances that lead us to issue a warning letter require prompt action.

(Comment 615) Some comments ask us to clarify how an exemption can be revoked (and restored) on diversified farms that produce both exempt and non-exempt products.

(Response 615) We assume that this comment is referring to a farm mixed-type facility that produces some products (such as juice or dietary supplements) that are exempt from the requirements for hazard analysis and risk-based preventive controls, as well as some products that are not exempt from these requirements. Neither withdrawing nor reinstating a qualified facility exemption would have any impact on products that are not subject to the requirements for hazard analysis and risk-based preventive controls. In contrast, administrative procedures such as injunction and suspension of registration likely would apply to all food production by the facility.

(Comment 616) Some comments ask us to consistently use either “calendar days” or “working days” throughout the provisions directed to withdrawal of an exemption. Some comments ask us to use “business days” rather than “calendar days” or “working days.”

(Response 616) We have expressed the timeframes for all of the withdrawal provisions in calendar days.

(Comment 617) Some comments ask us to clarify that the decision to withdraw a qualified exemption is an individualized determination and will not be applied to a class of farmers by stating this clearly in the preamble.

(Response 617) The decision to withdraw a qualified exemption is an individualized determination and will not be applied to a class of facilities or farmers.

(Comment 618) Some comments assert that the timeframes for responding to a notification that an exemption may be withdrawn should be the same regardless of whether the notification is sent to a qualified facility subject to the human preventive controls rule or a farm subject to the produce safety rule. These comments state that many small farms do value-added processing and will be subject to both rules.

(Response 618) Although the produce safety rule is not yet final, we intend to make the administrative procedures associated with withdrawal of an exemption consistent to the extent practicable, including the timeframe for responding to a notification.

(Comment 619) Some comments ask us to expand the scope of the withdrawal provisions to include facilities that would satisfy criteria for an exemption from the requirements for hazard analysis and risk-based preventive controls for low-risk activity/food combinations (i.e., the exemptions in proposed § 117.5(g) and (h)).

(Response 619) We decline this request. Section 418 of the FD&C Act does not provide for withdrawal of the exemptions established in § 117.5(g) and (h). The withdrawal provision in section 418(l)(3) of the FD&C Act is limited to qualified facilities.

B. Proposed § 117.254—Issuance of an Order To Withdraw a Qualified Facility Exemption

We proposed procedures for the steps we would take to issue an order to withdraw an exemption applicable to a qualified facility, including procedures that would: (1) Emphasize that a senior FDA official (such as an FDA District Director, the Director of the Office of Compliance in the Center for Food Safety and Applied Nutrition, or a more senior FDA official) must approve an order to withdraw the exemption before the order is issued; (2) provide that any officer or qualified employee of FDA may issue the order after it has been approved; (3) specify that we would issue the order to the owner, operator, or agent in charge of the facility; and (4) require that the order be in writing and be signed and dated by the officer or qualified employee of FDA who is issuing the order.

(Comment 620) Some comments ask us to include in the procedures timeframes for: (1) Submitting an order after an initial determination that criteria for withdrawing an exemption are met; (2) approval or denial by the FDA District Director; (3) issuing the withdrawal (with automatic revocation of order if FDA does not issue the order within the specified timeframe); and (4) delivery of the order to the owner, operator, or agent in charge of the facility. Other comments recommend that the procedures for issuing an order specify that we send the order in a way that ensures its receipt, such as through certified mail with confirmation of delivery to ensure the facility operator receives the order.

(Response 620) We are not establishing timeframes for the steps we take before a facility receives an order for withdrawal of an exemption. The timeframes surrounding our internal process for developing an order have no bearing on the time that a facility will need to respond to the order or on the information it will need to do so. We agree that it is appropriate to specify timeframes for the procedural steps that follow a facility's receipt of an order, and the withdrawal procedures include such timeframes.

We are not specifying that we send an order in a way that ensures its receipt. Although certified mail with confirmation of delivery is one way to ensure receipt, other methods are available, including delivery through private carriers that provide mechanisms to document receipt. In light of the provision (which we included in the 2014 supplemental human preventive controls notice) linking the timeframes for a facility to comply with, or appeal, an order to the date of receipt of the order (rather than to the date of the order), it will be up to us to deliver the order in a way that provides us with evidence of receipt.

C. Proposed § 117.257—Contents of an Order To Withdraw a Qualified Facility Exemption

We proposed specific information that would be included in an order to withdraw an exemption, including: (1) The date of the order and the name, address, and location of the qualified facility; (2) a brief, general statement of the reasons for the order, including information relevant to the circumstances that led us to issue the order; (3) a statement that the facility must either comply with subpart C within 120 calendar days of receipt, or appeal the order within 10 calendar days of receipt; (4) the text of section 418(l) of the FD&C Act and of the withdrawal provisions in part 117, subpart E; (5) information about an informal hearing on an appeal of the order; and (6) contact information for appropriate senior FDA officials, as well as the name and the title of the FDA representative who approved the order.

(Comment 621) Some comments recommend that the order specify which of the two circumstances that could lead us to issue the order apply.

(Response 621) We have made editorial changes to the regulatory text to make it more clear that the provision requires us to specify which circumstance applies (i.e., an active investigation of foodborne illness, or conduct or conditions associated with the qualified facility), or whether both of these two circumstances apply. See the revised regulatory text for § 117.257(c).

(Comment 622) Some comments ask us to add more specific requirements for the content of an order to withdraw an exemption, including specific evidence about the circumstances leading to the order. The comments maintain that doing so would help the facility respond with particularity to the facts and issues contained in the order if the facility appeals the order. The comments also recommend that the order include the evidence on which the order is based including, as applicable, evidence linking the active investigation of a foodborne illness outbreak directly to the facility or measurable evidence (collected using generally accepted scientific standards) indicating the presence in the facility of pathogens that pose an imminent threat to public health, or conduct or conditions that are material to the safety of food. The comments also recommend that the order include, when applicable, a statement explaining how altering the conduct or conditions would prevent or mitigate a foodborne illness outbreak.

(Response 622) We agree that the order must provide sufficient information to enable a facility to respond with particularity to specific evidence about the circumstances leading to the order. However, we disagree that the order must do so by including the specific information recommended by the comments, and we have not revised the proposed withdrawal provisions to incorporate the suggestions of these comments. The comments appear to be more focused on whether the circumstances that lead us to issue an order meet an evidentiary standard than on explaining the problem so that a facility can both understand the problem and respond with particularity to the facts and issues contained in the order. The withdrawal provisions that we are establishing in this provision require the order to include a brief, general statement of the reasons for the order, including information relevant to: (1) An active investigation of a foodborne illness outbreak that is directly linked to the facility; or (2) conditions or conduct associated with a qualified facility that are material to the safety of the food manufactured, processed, packed, or held at the facility. The requirements that we are establishing in this provision would enable a qualified facility to both understand the problem and respond to it. In addition, because other requirements in these withdrawal provisions specify that we must notify a qualified facility of circumstances that may lead us to withdraw its exemption before we issue the actual order, the order withdrawing the exemption would be the second time that the facility hears about the problems (see § 117.251(b)(2)). We intend that the process of responding to the notification that we must send before issuing an order to withdraw an exemption, including discussing the problems with FDA as warranted, would provide additional information to the facility to enable the facility to both understand the problem and respond to it.

(Comment 623) Some comments ask us to provide 15 “business days” from date of receipt of the order, rather than the proposed 10 calendar days from date of receipt of the order, for the facility to appeal the order.

(Response 623) We have revised the provision to provide for 15 calendar days, rather than 15 business days, for a facility to appeal the order. We also have made conforming changes to establish the same 15 calendar timeframe in all provisions that specify the timeframe to appeal the order (i.e., §§ 117.260(a)(2), 117.264(a)(1), and 117.267(a)(2)). We also extended the timeframe for the hearing to be held to be within 15 calendar days, rather than the proposed 10 calendar days, after the date the appeal is filed to provide more time for the facility to prepare for the hearing (see § 117.270(a)). The timeframe for the hearing to be held continues to provide for an alternative timeframe agreed upon in writing by both the facility and FDA; a facility that would have preferred the proposed timeframe of 10 calendar days could request that the hearing be held more quickly than 15 calendar days.

The 15-day timeframe is the same as the timeframe for responding to a warning letter. As discussed in Response 614, circumstances that could lead us to withdraw a qualified facility exemption require prompt action on the part of a facility, just as circumstances that lead us to issue a warning letter require prompt action.

(Comment 624) Some comments support the proposed timeframe of 120 calendar days for a qualified facility whose exemption has been withdrawn to comply with the human preventive controls rule, but ask us to make the timeframe for complying with a FSMA rule the same regardless of whether the exemption is withdrawn from a qualified facility subject to the human preventive controls rule or from a farm subject to the produce safety rule. Other comments ask us to extend the timeframe to come into compliance—e.g., to 1 or 2 years. Some of these comments suggest that qualified facilities should have 120 days to develop a plan of action, but 2 years to fully comply. Some of the comments argue that large farms and manufacturers are given a year to come into compliance, and that requiring small and very small businesses to comply in a shorter time period would effectively drive them out of business. Other comments ask us to consider provisions that would require compliance with only those portions of the rule that formed the basis for the revocation.

(Response 624) We continue to believe that the 120-day timeframe is adequate, but we have added flexibility such that a facility may request, with a justification in writing to FDA, a reasonable timeframe for compliance that exceeds 120 calendar days from the receipt of the order. FDA must grant the request for the facility to receive the extended timeframe. We are not generally extending the timeframe because circumstances that could lead us to withdraw a qualified facility exemption require prompt action on the part of a facility. A qualified facility that receives an order to withdraw its exemption would have received advance notification of the circumstances leading to the order and would have had an opportunity to correct the problems rather than have us proceed to issue the order (see § 117.251(b)). If the facility requests a hearing, more than 40 days could elapse between the date that the facility receives the order and the date that the presiding officer for the hearing confirms the order to withdraw the exemption. Given that the circumstances that would lead us to issue the order involve either: (1) An active investigation of a foodborne illness outbreak that is directly linked to the qualified facility; or (2) a determination that withdrawal of the exemption is necessary to protect the public health and prevent or mitigate a foodborne illness outbreak based on conditions or conduct associated with the qualified facility that are material to the safety of the food manufactured, processed, packed, or held at the facility, a delay of 1 to 2 years to comply with the rule is not warranted. We also do not believe that it would be appropriate to require a facility to come into compliance with only those provisions that formed the basis of the revocation. The provisions of subparts C and G are interrelated and operate as a system and therefore are not optimized through piecemeal implementation. However, FDA may consider staggered implementation as an option in granting a request for an extension of the timeframe to comply with an order to withdraw the exemption for a qualified facility.

As already discussed, the new requirements for hazard analysis and risk-based preventive controls are not “one-size-fits-all.” Although each facility subject to the rule must prepare and implement a food safety plan, the preventive controls that the facility would establish and implement would depend on the facility, the food, and the outcome of the facility's hazard analysis. In addition, the preventive control management components that a facility would establish and implement for its preventive controls would be established as appropriate to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. (See Response 222.)

Although the produce safety rule is not yet final, we intend to make the administrative procedures associated with withdrawal of an exemption consistent to the extent practicable, including the timeframe to comply with the applicable rule if an exemption is withdrawn.

(Comment 625) Some comments ask us include in the order a statement that a facility may request that FDA reinstate an exemption that was withdrawn by following the procedures in § 117.287.

(Response 625) We have revised the requirements for the contents of an order as requested by these comments.

D. Proposed § 117.260—Compliance With, or Appeal of, an Order To Withdraw a Qualified Facility Exemption

We proposed that: (1) You must either comply with applicable requirements of part 117 within 120 calendar days of receipt, or appeal the order within 10 calendar days of receipt; (2) submission of an appeal, including submission of a request for an informal hearing, will not operate to delay or stay any administrative action unless the Commissioner of FDA, as a matter of discretion, determines that delay or a stay is in the public interest; and (3) if you appeal the order, and we confirm the order, you must comply with applicable requirements of part 117 within 120 calendar days of confirmation of receipt of the order.

(Comment 626) Some comments ask us to specify that a qualified facility that loses its exemption from the requirements for hazard analysis and risk-based preventive controls would no longer need to comply with the modified requirements that apply to qualified facilities that have an active exemption.

(Response 626) A qualified facility that loses its exemption from the requirements for hazard analysis and risk-based preventive controls would no longer need to comply with the modified requirements that apply to qualified facilities that have an active exemption. To make this clearer, the final withdrawal procedures now include this information (see the regulatory text for § 117.260(c)).

E. Proposed § 117.264—Procedure for Submitting an Appeal

We proposed that: (1) To appeal an order, you must submit a written appeal to FDA within 10 calendar days of receipt and respond with particularity to the facts and issues contained in the order, including any supporting documentation upon which you rely; and (2) in your written appeal, you may include a written request for an informal hearing.

(Comment 627) Some comments ask us to rely on records kept in the normal course of business for documentation that will be sufficient to respond to an order to withdraw a qualified facility's exemption, rather than requiring a facility to “respond with particularity to the facts and issues contained in the order, including any supporting documentation upon which the owner, operator or agent in charge of the facility relies.” These comments assert that we should not require a facility that submits a written appeal to provide documents and records that they are not required to keep.

(Response 627) We decline this request. In a withdrawal action, FDA is providing a qualified facility multiple opportunities to persuade FDA that withdrawal is not appropriate. If the facility relies on documentation as part of its response, it is reasonable to require that this documentation be provided to FDA.

F. Proposed § 117.267—Procedure for Requesting an Informal Hearing

We proposed that if you appeal the order: (1) You may request an informal hearing, and must do so together with your written appeal (within 10 calendar days of the date of receipt of the order; and (2) a request for an informal hearing may be denied, in whole or in part, if the presiding officer determines that no genuine and substantial issue of material fact has been raised by the material submitted; you would receive written notice of the presiding officer's determination, explaining the reason for the denial.

(Comment 628) Some comments ask us to guarantee a hearing so that a qualified facility can present its case in person before having its exemption revoked.

(Response 628) We decline this request. We agree that a qualified facility has a right to appeal an order to withdraw an exemption, and we have provided for a right to appeal.

G. Proposed § 117.270—Requirements Applicable to an Informal Hearing

We proposed that if you request an informal hearing, and we grant the request: (1) The hearing will be held within 10 calendar days after the date the appeal is filed or, if applicable, within a timeframe agreed upon in writing by you and by us; (2) the presiding officer may require that the hearing be completed within 1 calendar day; and (3) we must conduct the hearing in accordance with part 16 (21 CFR part 16), with some specified modifications, including that no party shall have the right, under § 16.119, to petition FDA for reconsideration or a stay of the presiding officer's final decision.

(Comment 629) Some comments object to our proposal that no party shall have the right, under § 16.119, to petition FDA for reconsideration or a stay of the presiding officer's final decision. These comments assert that our justification (i.e., that the circumstances that would lead to a withdrawal merit prompt action and that a facility has the opportunity for judicial review in accordance with 21 CFR 10.45) is not a sufficient argument for justifying the removal of the option to file a motion for reconsideration or stay. These comments ask us to revise proposed § 117.270(c)(6) to specify that the qualified facility shall have the right to file a motion for reconsideration or stay.

(Response 629) We decline this request. In the 2014 supplemental human preventive controls notice, we proposed an additional mechanism for a qualified facility to present its view that its exemption should not be withdrawn—i.e., by providing advance written notification to a qualified facility if we are considering withdrawing an exemption and providing an opportunity for the facility to respond before we issue an order to withdraw an exemption. We also proposed to provide an opportunity for reinstatement of an exemption that had been withdrawn. We believe the multiple opportunities now available to a facility provide adequate opportunities for a facility's views to be considered, and further mechanisms are not warranted.

H. Proposed § 117.287—Reinstatement of a Qualified Facility Exemption That Was Withdrawn

We proposed four provisions for reinstating a withdrawn qualified facility exemption. First, we proposed that if the FDA District Director in whose district your facility is located (or, in the case of a foreign facility, the Director of the Office of Compliance in the Center for Food Safety and Applied Nutrition) determines that a facility has adequately resolved problems with the conditions and conduct that are material to the safety of the food manufactured, processed, packed, or held at the facility and that continued withdrawal of the exemption is not necessary to protect public health and prevent or mitigate a foodborne illness outbreak, the FDA District Director in whose district your facility is located (or in the case of a foreign facility, the Director of the Office of Compliance in the Center for Food Safety and Applied Nutrition) will, on his own initiative or on the request of a facility, reinstate the exemption (proposed § 117.287(a)).

Second, we proposed that you may ask FDA to reinstate an exemption that has been withdrawn by following specific steps (§ 117.287(b)(1) and (2)). Third, we proposed that if your exemption was withdrawn in the event of an active investigation of a foodborne illness outbreak that is directly linked to your facility and FDA later determines, after finishing the active investigation of a foodborne illness outbreak, that the outbreak is not directly linked to your facility, FDA will reinstate your qualified facility exemption and will notify you in writing that your exempt status has been reinstated.

We proposed that if your exemption was withdrawn both in the event of an active investigation of a foodborne illness outbreak that is directly linked to your facility and because FDA had determined that it is necessary to protect the public health and prevent or mitigate a foodborne illness outbreak based on conditions or conduct associated with your facility that are material to the safety of the food manufactured, processed, packed, or held at such facility, and FDA later determines, after finishing the active investigation of a foodborne illness outbreak, that the outbreak is not directly linked to your facility, FDA will inform you of this finding, and you may ask FDA to reinstate your qualified facility exemption.

(Comment 630) Some comments agree with our tentative conclusion that the absence of a specific provision in section 418 of the FD&C Act for the reinstatement of an exemption that is withdrawn does not preclude us from providing for such a process (79 FR 58524 at 58553). Other comments disagree with that tentative conclusion and assert that Congress crafted the withdrawal provision as a “one strike, you're out” provision. These comments also assert that including the withdrawal provision as a “one strike, you're out” provision was an essential part of the legislative agreement that allowed for adoption of the qualified facility exemption. These comments also assert that reinstatement would undermine the intent of the withdrawal provision because it would reduce the incentive for small food processors to ensure that the products they sell are as safe as possible. These comments also assert that a recognized principle of statutory interpretation provides that exemptions to statutes should be strictly construed, particularly when the statute addresses public health and safety, and that we are giving the exemption an impermissibly broad construction.

Some comments ask why we believe that a business deserves a “second bite of the apple” in light of the understanding (under proposed § 117.251(b) and (c)) that we will first seek to correct problems before considering withdrawal. These comments also question at what point a facility would apply for reinstatement, and ask why we would allow a facility that has already come into compliance with FSMA's requirement to implement preventive controls to abandon those controls in favor of reinstating its exempt status. These comments ask us to eliminate the proposed provisions allowing for reinstatement.

Some comments do not support the proposed reinstatement provisions when a food facility has been directly linked to a foodborne illness outbreak. Some comments support the proposed reinstatement provisions only when we determine, after finishing an active investigation of a foodborne illness outbreak, that the outbreak is not directly linked to the facility that had its exemption withdrawn.

(Response 630) We disagree that the proposed reinstatement provisions would give the exemption an impermissibly broad construction. The express statutory language of section 418(l) of the FD&C Act does not support the comments' assertion that the withdrawal provision is a “one strike, you're out” provision. We also disagree that reinstatement would undermine the intent of the withdrawal provision because it would reduce the incentive for small food processors to ensure that the products they sell are as safe as possible. We expect that the withdrawal provision itself provides a big incentive for small food processors to ensure that the products they sell are as safe as possible because of the business disruption that would occur if they are subject to withdrawal of the exemption. We proposed that a facility would need to present data and information to demonstrate that it has adequately resolved the problems with the conditions or conduct that are material to the safety of the food manufactured, processed, packed, or held at the facility, such that continued withdrawal of the exemption is not necessary to protect public health and prevent or mitigate a foodborne illness outbreak.

We disagree that we should categorically refuse to consider reinstating a qualified facility exemption if we had withdrawn the exemption because a food facility had been directly linked to a foodborne illness outbreak. First, if information later comes to light to raise considerable doubt that a qualified facility had, indeed, been directly linked to a foodborne illness outbreak, and conditions and conduct at the facility do not otherwise warrant withdrawing the facility's exemption, it would be appropriate for us to reinstate the facility's exemption. Second, we would only reinstate the exemption if we determined that a facility has adequately resolved any problems with the conditions and conduct that are material to the safety of the food manufactured, processed, packed, or held at the facility and that continued withdrawal of the exemption is not necessary to protect public health and prevent or mitigate a foodborne illness outbreak.

(Comment 631) Some comments that support the reinstatement of a withdrawn exemption ask us to establish a timeframe within which FDA will reinstate an exemption. Some comments ask us to specify in the regulatory text that the reinstatement would occur in a reasonable period of time, both in circumstances where FDA has decided on its own initiative to reinstate the exemption and in circumstances where a facility submits a request for reinstatement. Some comments suggest 10 days is a reasonable period of time within which FDA should reinstate an exemption.

(Response 631) We decline the requests to establish a timeframe for reinstatement in the regulatory text. If we determine on our own initiative to reinstate an exemption (e.g., because we later determine, after finishing the active investigation of a foodborne illness outbreak, that the outbreak is not directly linked to the facility), our determination would be effective immediately. If we receive a request to reinstate a withdrawn exemption, we intend to respond in a reasonable timeframe consistent with available resources. In some cases, we may respond that we need more information in order to evaluate your request.

(Comment 632) Some comments ask that the process for reinstatement include at least one level of administrative appeal if we deny a facility's request for reinstatement.

(Response 632) We have not revised the regulatory text to provide for an administrative appeal if we deny a facility's request for reinstatement. Existing procedures allow a facility to ask for a meeting with applicable FDA officials (see 21 CFR 10.65(c)) and appeal our decision if we deny the request (see 21 CFR 10.75).

(Comment 633) Some comments ask us to establish a 1-year probationary period before the withdrawn qualified facility exemption could be fully reinstated.

(Response 633) We decline this request. We intend to act on a request for reinstatement based on the merits of the data and information presented in the request, not after a pre-determined timeframe.

I. Conforming Amendment to 21 CFR Part 16

We proposed to amend § 16.1(b)(2) to include part 117, subpart E, relating to the withdrawal of an exemption applicable to a qualified facility, in the list of regulatory provisions under which regulatory hearings are available. We received no comments that disagreed with this proposed provision, and are finalizing it as proposed.

J. Other Comments on the Withdrawal Provisions

(Comment 634) Several comments ask us to provide clarification through guidance, issued for public comment, on a variety of topics associated with the withdrawal provisions.

(Response 634) We will consider the need for guidance in the future. At this time, we consider that withdrawing an exemption would be both rare and dependent upon the circumstances. We need to direct our resources to developing guidance on issues that would apply more broadly, and more generally, than the withdrawal provisions.

(Comment 635) Some comments ask detailed questions about how we would coordinate the withdrawal process with the States.

(Response 635) In general, we work with our State partners and other government counterparts in dealing with enforcement actions, including coordinating actions or deferring to each other when one department has authority to swiftly act to protect the consumer. In the specific case of this rule, we are working through the PFP to develop and implement a national Integrated Food Safety System consistent with FSMA's emphasis on establishing partnerships for achieving compliance (see Response 5 and section 209(b) of FSMA).

(Comment 636) Some comments ask us to add provisions regarding notification of the appropriate State regulatory agency when a qualified facility exemption is withdrawn and reinstated.

(Response 636) We decline this request. As previously noted, we are sensitive to the time required for various inspection activities and intend to communicate with States regarding our expectations for how to verify whether a facility is a qualified facility. The status of a facility as a qualified facility principally affects the requirements that it is subject to, and will be most useful to FDA and our food safety partners when preparing for inspection. At this time we do not intend to establish a system notifying the applicable State authorities at a point in time when the status of a facility as a qualified facility changes, whether as a result of withdrawal or reinstatement of a qualified facility exemption or because the facility's business has grown to the point where it exceeds the financial threshold for very small business. See also Response 635.

XLI. Subpart F: Comments on Proposed New Recordkeeping Requirements

We proposed to establish in subpart F requirements that would apply to all records that would be required by the various provisions of proposed part 117, including general requirements related to the content and form of records; additional requirements specific to the food safety plan; requirements for record retention; requirements for official review of records by FDA; and public disclosure.

Some comments support the proposed requirements without change. For example, some comments state that the proposed 2-year retention period is consistent with the majority of food safety guidelines currently being used in the fresh produce industry. Some comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 639, Comment 642, and Comment 644 through Comment 646) or ask us to clarify how we will interpret the provision (see, e.g., Comment 643 and Comment 650).

In the following paragraphs, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 43, with editorial and conforming changes as shown in table 52.

A. Proposed § 117.301—Records Subject to the Requirements of Subpart F

We proposed that all records required by part 117 would be subject to all requirements of subpart F, except that certain specific requirements (proposed § 117.310) would apply only to the written food safety plan. We also proposed that certain proposed requirements (e.g., for records to contain the actual values and observations obtained during monitoring and, as appropriate, during verification activities) would not apply to the records that would be kept by qualified facilities.

(Comment 637) Some comments disagree with the proposal to exempt the records that would be kept by qualified facilities from requirements to keep accurate, detailed records. The comments note that the proposed exemption would apply to qualified facilities regardless of whether they operate under the first option for documentation (i.e., food safety practices) or under the second option for documentation (i.e., compliance with non-Federal food safety laws). These comments assert that the proposed detailed recordkeeping requirements should apply to records relating to monitoring food safety practices and ask us to revise the proposed requirements so that this exemption would apply only to those qualified facilities that operate under non-Federal food safety laws.

(Response 637) We decline this request. We based the proposed exemption on a statutory provision that a qualified facility is not subject to certain requirements, including the statutory recordkeeping requirements (see section 418(l)(2) of the FD&C Act). Although the modified requirements that apply to a qualified facility require submission of certain attestations to FDA (see § 117.201(a) and (b)), and these attestations must be supported by documentation (see § 117.201(f)), the rule does not require that records kept by a qualified facility to support its attestations be the same type of records that would be kept by a facility subject to subparts C and G. For example, if the facility attests that it has identified the potential hazards associated with the food being produced, implemented preventive controls to address the hazards, and is monitoring the performance of the preventive controls, the qualified facility might support its attestation by having a standard operating procedure for monitoring preventive controls rather than detailed records of actual monitoring.

B. Proposed § 117.305—General Requirements Applying to Records

We proposed that the records must: (1) Be kept as original records, true copies, or electronic records (and that electronic records must be kept in accordance with part 11 (21 CFR part 11)); (2) contain the actual values and observations obtained during monitoring and, as appropriate, during verification activities; (3) be accurate, indelible, and legible; (4) be created concurrently with performance of the activity documented; (5) be as detailed as necessary to provide history of work performed; and (6) include the name and location of the plant or facility, the date and time of the activity documented, the signature or initials of the person performing the activity, and, where appropriate, the identity of the product and the production code, if any.

We have revised the provision to require information adequate to identify the plant or facility (e.g., the name, and when necessary, the location of the plant or facility) rather than to always require both the name and location of the plant or facility (see § 117.305(f)(1)). In some cases, the name of the plant or facility will be adequate to identify it—e.g., when a plant or facility is not part of a larger corporation that has facilities at more than one location. In other cases, the name of the plant or facility may not, by itself, be adequate to identify the plant or facility—e.g., when a plant or facility is part of a larger corporation with more than one location and the “name” of each plant or facility is the same.

(Comment 638) Some comments assert that compliance with part 11 for the secure operation of many systems currently in use is unnecessary and would create the need to redesign and recreate existing systems, thus leading to considerable cost and complexity. These comments identify the requirement for hardware and software to be validated as a key cost concern and assert that validation activities would be difficult to maintain and would not deliver added value. As an example, these comments explain that an expectation for validation of electronic recordkeeping software and hardware would be particularly problematic because software patches and security updates are distributed on a nearly weekly basis, and express the view that validation procedures are most appropriately applied before use of a new system and after major software changes or updates. These comments also assert that it would be costly, burdensome, and require specialized resources to modify or replace existing electronic systems to comply with part 11. These comments provide an example in which a facility needed more than nine months to upgrade one system alone to comply with part 11, and note that it would not be unusual for companies to employ multiple systems, so the burden and cost would exponentially increase. These comments ask us to instead require facilities that use electronic records to use a secure system that ensures records are trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

Other comments express concern about the financial burden for small facilities such as farm mixed-type facilities and ask us to either modify requirements for farm mixed-type facilities, very small businesses, and small businesses or provide that such facilities be fully exempt from part 11 requirements for electronic records. Other comments state that, as with the recordkeeping requirements under the Bioterrorism Act, such requirements are disproportionate to the regulatory need. Other comments state that many operators that use electronic data records in the produce industry use open software and would not meet part 11 requirements.

Some comments state that major advances in software technology have been made since part 11 published in 1997, and such advances must be carefully considered in evaluating any potential expansion or new applications of part 11. These comments also state that we already are in the process of reevaluating part 11 for the regulations for which it currently applies, citing industry guidance issued more than 10 years ago in which we acknowledged that part 11 is unworkable in many respects and decided to exercise enforcement discretion for part of the regulations and announced plans to reexamine part 11 as a whole.

Some comments recommend that we develop guidance, with input from key stakeholders, to describe the kinds of systems and steps that can be used to assure records meet the required standard. This guidance should clearly establish that specific security needs will depend on the circumstances, including the system at issue, its intended use, the criticality of the preventive control or other food safety measure it is used to manage, and other relevant factors. For example, these comments explain that a quality system used to manage CCP documentation would have greater security needs than a review of a Certificate of Analysis for a non-sensitive ingredient.

(Response 638) In light of the substantial burden that could be created by the need to redesign large numbers of already existing electronic records and recordkeeping, we are providing in new § 117.305(g) that records that are established or maintained to satisfy the requirements of part 117 and that meet the definition of electronic records in § 11.3(b)(6) are exempt from the requirements of part 11. As we did in the section 414 recordkeeping regulations, we also are specifying that records that satisfy the requirements of part 117, but that also are required under other applicable statutory provisions or regulations, remain subject to part 11. The rule provides that a facility may rely on existing records to satisfy the requirements of this rule, and this rule does not change the status under part 11 of any such records if those records are currently subject to part 11. As we did in the rulemaking to establish the section 414 recordkeeping regulations, we are establishing a conforming change in part 11 to specify in new § 11.1(i) that part 11 does not apply to records required to be established or maintained under part 117, and that records that satisfy the requirements of part 117, but that also are required under other applicable statutory provisions or regulations, remain subject to part 11.

Although we are not specifying that part 11 applies, facilities should take appropriate measures to ensure that records are trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.

(Comment 639) Some comments assert that certain production and associated activities are not time-sensitive and would not require documentation of the time the activity is performed. These comments ask us to modify the proposed requirements so that the records would only require the time of the activity documented where appropriate for food safety.

(Response 639) We agree that certain activities (e.g., record review and verification activities) are not time-sensitive and, thus, would not need to include the time that the activity was performed. The final rule provides flexibility for the facility to determine when to document the time by specifying that the time be documented “when appropriate” (see § 117.305(f)(2)).

(Comment 640) Some comments assert that concurrent record creation will prove difficult in many food-processing environments. These comments ask us to modify the proposed requirement that records be created concurrently with the performance of the activity documented to qualify that the requirement only applies where feasible, and that the records could be created as soon as possible thereafter under circumstances where concurrent record creation is not feasible.

(Response 640) We decline this request. The comments did not provide any examples of activities where concurrent record creation in food manufacturing, processing, packing, or holding environments would prove difficult, and we are not aware of any such example. For example, we are not aware of any difficulty complying with long-standing similar requirements associated with our HACCP regulations for seafood and juice (see §§ 123.9(a)(4) and 120.12(b)(4), respectively).

(Comment 641) Some comments express concern about “apparent mandates” that we will require records to be kept in the English language and assert that the language of food factory documents should not be dictated as a precondition for food exports. These comments ask us to limit the documents that must written in English to reduce translation and records duplication. These comments also ask us to focus the requirements for English language on those documents that must be submitted to FDA.

(Response 641) We did not propose to require that any “factory records” (such as the written food safety plan (§ 117.126) and the implementation records listed in § 117.190) be kept in the English language. Consistent with other regulations for submissions to FDA (such as for registration of a food facility), the form we will use for a qualified facility to submit its required attestations (§ 117.201(b) and (c)) will be in the English language.

C. Proposed § 117.310—Additional Requirements Applying to the Food Safety Plan

We proposed that the food safety plan must be signed and dated by the owner, operator, or agent in charge of the facility upon initial completion and upon any modification.

(Comment 642) Some comments state that the provision would exclude the preventive controls qualified individual from signing and dating the food safety plan unless the preventive controls qualified individual is the owner, operator, or agent in charge of the facility. These comments ask us to revise the rule to allow the preventive controls qualified individual to sign and date the food safety plan (e.g., because it is the preventive controls qualified individual who prepares (or oversees the preparation of) the food safety plan). Some comments ask us to require that any preventive controls qualified individuals who prepare (or oversee the preparation of) specific sections of the food safety plan sign and date the applicable sections.

(Response 642) We decline these requests. The statute expressly directs the owner, operator, or agent in charge of a facility to prepare the food safety plan (see section 418(h) of the FD&C Act). As previously discussed, such a signature would provide direct evidence of the owner, operator or agent's acceptance of the plan and commitment to implementation of the plan (78 FR 3646 at 3782). A facility has flexibility to require the signature of one or more preventive controls qualified individuals who prepared, or oversaw the preparation of, its food safety plan in addition to the minimum signature requirement specified in the rule. Likewise, a facility also has flexibility to require the signature of one or more members of its food safety team who contributed to the preparation of the food safety plan, even if those individuals are not serving as the preventive controls qualified individual for the facility. (See also Response 377.)

D. Proposed § 117.315—Requirements for Record Retention

We proposed that: (1) All required records must be retained at the plant or facility for at least 2 years after the date they were prepared; (2) records relating to the general adequacy of equipment or processes being used by a facility, including the results of scientific studies and evaluations, must be retained at the facility for at least 2 years after their use is discontinued; (3) except for the food safety plan, offsite storage of records is permitted after 6 months following the date that the records were made if such records can be retrieved and provided onsite within 24 hours of request for official review; and (4) if the plant or facility is closed for a prolonged period, the records may be transferred to some other reasonably accessible location but must be returned to the plant or facility within 24 hours for official review upon request.

(Comment 643) Some comments ask us to clarify that the 2-year record retention requirement only applies to records created after the compliance date for the final rule.

(Response 643) The retention requirements only apply to records created after the applicable compliance date for the final rule. See Response 155 and section LVI.A, which explain that the compliance date for a facility to retain records to support its status as a qualified facility is January 1, 2016. See also Response 646, which explains that we have revised the record retention provisions to specify that records that a facility relies on during the 3-year period preceding the applicable calendar year to support its status as a qualified facility must be retained at the facility as long as necessary to support the status of a facility as a qualified facility during the applicable calendar year.

(Comment 644) Some comments ask us to delete the proposed requirement to keep records on site for 6 months or 2 years (depending on the record) and assert that it should suffice to require that records be available within 24 hours of request or within a reasonable period of time. Some comments assert that a facility should be able to keep records in the location where they are created, which may be at corporate headquarters. Comments also assert that specifying the location for record storage will increase costs but will not contribute to improvements in public health. Some comments ask us to permit off-site storage for all records more than 6 months old, in contrast to the 2-year retention period we proposed for records relating to the general adequacy of equipment or processes being used by a facility, including the results of scientific studies and evaluations.

(Response 644) We have revised the provisions to provide for offsite storage of all records (except the food safety plan), provided that the records can be retrieved and made available to us within 24 hours of request for official review. We expect that many records will be electronic records that are accessible from an onsite location and, thus, would be classified as being onsite (see § 117.315(c)). As a companion change, we have revised the proposed provision directed to the special circumstance of storing records when a facility is closed for prolonged periods of time so that it only relates to the offsite storage of the food safety plan in such circumstances (see § 117.315(d)).

(Comment 645) Some comments assert that a two year retention period for records is much longer than needed for a product with a short shelf life (such as milk) and may not be long enough for products with very long shelf lives (such as oils). These comments ask us to establish a retention period that is risk-based and related to the shelf life of the product rather than “one-size-fits-all.” As an example, these comments suggest that we could set the retention requirement as 2 years past the date of manufacture or 1 year past an “expiration” date, whichever is longer. These comments also suggest that documentation on raw materials could be maintained for two years after final product lot is manufactured.

(Response 645) We decline these requests. The proposed 2-year retention period is authorized by the statute (see section 418(g) of the FD&C Act). Moreover, the reasons discussed by the comments for linking the retention period to shelf life are more relevant to the record retention requirements for the purpose of tracking potentially contaminated food (21 CFR part 1, subpart J; see § 1.360) than to the record retention requirements for the purpose of evaluating compliance with this rule.

(Comment 646) Some comments ask us to require that qualified facilities keep financial and sales records for 3 or 4 years, because a qualified facility must document that the average value of food it sold during the prior 3 years did not exceed $500,000 annually.

(Response 646) We have revised the record retention provisions to specify that records that a facility relies on during the 3-year period preceding the applicable calendar year to support its status as a qualified facility must be retained at the facility as long as necessary to support the status of a facility as a qualified facility during the applicable calendar year. As discussed in Response 155, the definition of very small business established in this rule is based on an average (of sales plus market value of human food held without sale) during the 3-year period preceding the applicable calendar year. Thus, both of the criteria for the qualified facility exemption are based on financial records associated with the preceding 3-year period. The actual retention time necessary to support the status of a qualified facility during the applicable calendar year could be as long as 4 years. For example, if we inspect a facility on May 1, 2024, the facility would have retained the records from 2021-2023 for 3 years and 4 months. If we inspect the facility on December 28, 2024, the facility would have retained the records from 2021-2023 for nearly 4 years.

E. Proposed § 117.320—Requirements for Official Review

We proposed that all records required by proposed part 117 be made promptly available to a duly authorized representative of the Secretary of HHS upon oral or written request. We asked for comment on whether we should require a facility to send records to us rather than make the records available for review at a facility's place of business and, if so, whether we should require that the records be submitted electronically.

(Comment 647) Some comments assert that we should not copy documents as part of routine investigations so as to prevent critical documents from release under the Freedom of Information Act (FOIA). These comments are particularly concerned that our ability to copy verification records (such as testing records) and potentially release these records under the FOIA would discourage facilities from testing as a verification activity. These comments also express concern that some facilities would include in their food safety plans elements, not required by the proposed rule, that address food defense as well food safety, and that disclosure of such a food safety plan without proper redaction could provide useful information to persons seeking to defeat the facility's food defense strategies. In addition, these comments express concern that the task of reviewing all of these records and redacting trade secrets and confidential information would further set back FDA's already overburdened FOIA offices and create even longer delays in responding to FOIA requests.

As discussed in Comment 649, some comments suggest that we revise the proposed public disclosure requirements (proposed § 117.325) to be analogous to the public disclosure requirements in our HACCP regulations for seafood and juice (see §§ 123.9(d) and 120.12(f), respectively).

(Response 647) We have revised the proposed requirement to specify that all required records must be made promptly available “for official review and copying” to increase the alignment of the recordkeeping requirements of this rule with those of our HACCP regulations for seafood and juice. The issues raised by these comments are similar to some of the issues raised by comments during the rulemaking to establish our HACCP regulations for seafood (see the discussion at 60 FR 65096 at 65137-65140, December 18, 1995) and our regulations in part 118 for the prevention of Salmonella Enteritidis in shell eggs. We intend to copy records on a case-by-case basis as necessary and appropriate. We may consider it necessary to copy records when, for example, our investigators may need assistance in reviewing a certain record from relevant experts in headquarters. If we are unable to copy the records, we would have to rely solely on our investigators' notes and reports when drawing conclusions. In addition, copying records will facilitate follow-up regulatory actions. We primarily intend to copy records such as the results of product testing or environmental monitoring when we conduct an inspection for cause—e.g., as a result of an outbreak investigation, violative sample results, or follow up to a consumer complaint. See Response 650 for a discussion of how the FOIA would apply to records, such as records of testing as a verification activity, that we copy during an inspection and maintain in our system.

See also Response 649 for a discussion of how the public disclosure requirements of this rule align with those of our HACCP regulations for seafood and juice.

(Comment 648) Some comments strongly oppose any requirement for submission of records to FDA remotely and assert that there is no basis in FSMA for such a requirement. Some comments express concern about our ability to protect confidential information (such as supplier and customer records received by a facility under the protection of confidentially agreements) that is transmitted electronically (e.g., the information might be released through computer hacking or leaks). Some comments note that inadvertent disclosure of information related to specific products, hazards, and preventive controls implemented at food facilities could both prove harmful from a commercial or competitive standpoint and expose existing vulnerabilities in the U.S. food supply, thus potentially rendering food facilities susceptible to malicious attack.

Some comments oppose the concept of a “desk audit” whereby our investigators conduct their inspections from a remote office without actually visiting the facility and assert that our access to company records must be conducted on-site in the course of an authorized inspection so that we may understand the full context of what the records show. Some comments point out that there would be challenges associated with credential validation when we asked for records to be sent remotely, such as in an email request. Some comments ask that we modify the proposed requirement to specify that records would only be made available to us during a facility inspection.

(Response 648) We have decided not to establish any requirements for a facility to send records to us. We will review records when we are onsite in the course of an authorized inspection, and copy records as necessary and appropriate. (See also Response 647.)

We are not modifying the proposed requirement to specify that records would only be made available to us during a facility inspection because it is not necessary to do so. The regulatory text specifying that the records be made available to a duly authorized representative of the Secretary of Health and Human Services provides the context that the records would be made available during inspection.

F. Proposed § 117.325—Public Disclosure

We proposed that records required by proposed part 117 are subject to the disclosure requirements under part 20 (21 CFR part 20).

(Comment 649) Some comments assert that the proposed requirements governing public disclosure are not aligned with other risk-based preventive controls programs, such as HACCP programs. These comments argue that the proposed requirements should be realigned with other risk-based preventive controls programs to preserve the privacy of information maintained in required records unless that information has been otherwise made publicly available. Some comments suggest that we revise the proposed requirements to be analogous to the public disclosure requirements in our HACCP regulations for seafood and juice (see §§ 123.9(d) and 120.12(f), respectively). One comment acknowledged our statements that the proposed requirements governing public disclosure are consistent with, but framed differently than, the disclosure provisions of our HACCP regulations for seafood and juice (79 3646 at 3783), but nonetheless asks us to provide a more detailed explanation of how our proposed approach is consistent with the disclosure provisions in our HACCP regulations for seafood and juice.

(Response 649) We disagree that the proposed provisions governing public disclosure are not aligned with the public disclosure provisions of our HACCP regulations for seafood and juice. Our regulations in part 20 regarding public information apply to all agency records, regardless of whether a particular recordkeeping requirement says so. In the case of the recordkeeping requirements for our HACCP regulations for seafood and juice, we framed the provisions regarding public disclosure by providing specific details about how particular provisions in part 20 (i.e., § 20.61 (Trade secrets and commercial or financial information which is privileged or confidential) and § 20.81 (Data and information previously disclosed to the public)) would apply to the applicable records, because we recognized that such details were of particular interest to the regulated industries. In the case of the recordkeeping requirements for this rule, we framed the provisions regarding public disclosure by more broadly referring to all the requirements of part 20, consistent with our more recent approach for framing the provisions regarding public disclosure in the rule “Prevention of Salmonella Enteritidis in Shell Eggs During Production, Storage, and Transportation” (part 118; see § 118.10(f)). For example, provisions such as § 20.20 (Policy on disclosure of Food and Drug Administration records) apply to all records that we have in our system, including HACCP records, even though the HACCP regulations do not specify that this is the case.

As discussed in Response 647, to increase the alignment between this rule and our HACCP regulations for seafood and juice, we have revised the proposed requirement regarding our access to records to specify that all required records must be made promptly available “for official review and copying.”

(Comment 650) Some comments ask us to clarify that the disclosure requirements of part 20 include protections for trade secrets and privileged or confidential commercial information and financial information. Other comments ask us to clarify that written food safety plans and associated records are not subject to public disclosure because they represent trade secret or confidential commercial information. Other comments ask us to clarify how the disclosure requirements of part 20 would apply to verification records (such as testing records).

(Response 650) The questions raised in these comments are similar to some of the questions raised during the rulemaking to establish our HACCP regulation for seafood (see the discussion at 60 FR 65096 at 65137-65140). Our experience in conducting CGMP inspections in processing plants, our experience with enforcing our HACCP regulations for seafood and juice, and our understanding from the FRIA for this rule make it clear that food safety plans will take each facility some time and money to develop. Thus, we conclude that food safety plans generally will meet the definition of trade secret, including the court's definition in Public Citizen Health Research Group v. FDA, 704 F.2d 1280 (D.C. Cir. 1983). Plans that incorporate unique regimens or parameters to achieve product safety, which are the result of considerable research and effort, will surely meet this definition.

Moreover, there is value in a plan to a company that produces it for no other reason than that it took work to write. The equity in such a product is not readily given away to competitors. We expect that plant configurations will be unique to individual processors, or at least have unique features, as was the case in the seafood industry (Ref. 88). While generic plans will have great utility in many circumstances, they serve primarily as starting points for processors to develop their own plans. Facilities will still need to expend time and money to tailor a generic plan to their individual circumstances.

We would establish the status of verification records, such as the results of product testing and environmental monitoring, as available for, or protected from, public disclosure on a case-by-case basis. As discussed in Response 647, we primarily intend to copy such records when we conduct an inspection for cause. We also intend to copy such records if the preliminary assessment by our investigator during a routine inspection is that regulatory follow-up may be appropriate (e.g., if these records demonstrate that an environmental pathogen has become established in a niche environment in a food processing plant).

(Comment 651) Some comments assert that our regulations in §§ 20.47 and 20.48 require us to consult with the entity providing information prior to disclosing such information. These comments ask us to provide a small business compliance guide that would allow smaller entities to understand our procedures for publicly disclosing information, including information maintained in records required by this rule, to allow opportunity for redaction of “confidential” information prior to disclosure.

(Response 651) We disagree with the comments' interpretation of §§ 20.47 and 20.48. Section 20.47 requires consultation with the person providing data or information only when the confidentiality of data or information is uncertain. During any such consultation FDA would provide any necessary information to the person who provided the data or information at issue.

(Comment 652) Some comments ask us to modify the proposed requirement to clarify that it is “records required by this part and provided to the Agency,” rather than “records obtained by the Agency” that are subject to public disclosure.

(Response 652) We agree that it is appropriate to specify that the disclosure requirements of this rule apply to information that we maintain as a record (see the description of “record” in § 20.20(e)). (See also the discussion (in the proposed rule to establish our seafood HACCP regulation, 59 FR 4142 at 4160, January 28, 1994) that there are significant legal and practical questions as to whether FDA has the authority to require disclosure of industry records that are not in FDA's possession.) However, we see no meaningful distinction between records “provided to FDA” and records “obtained by FDA,” and have revised the provision to specify that records obtained by FDA in accordance with this part are subject to the disclosure requirements under part 20. The revised regulatory text makes clear that the requirements of Part 20 attach to those documents obtained by FDA. To the extent that these comments are addressing the difference between records provided during inspection and records submitted to us, as already discussed we have decided not to require submission of certain records to us (see Response 648).

G. Proposed § 117.330—Use of Existing Records

We proposed that existing records (e.g., records that are kept to comply with other Federal, State, or local regulations, or for any other reason) do not need to be duplicated if they contain all of the required information and satisfy the requirements of subpart F. Existing records may be supplemented as necessary to include all of the required information and satisfy the requirements of subpart F. We also proposed that the information required by part 117 does not need to be kept in one set of records. If existing records contain some of the required information, any new information required by part 117 may be kept either separately or combined with the existing records.

Comments that address this proposed requirement support it. For example, some comments state that this provision would provide flexibility to facilities to comply with the record requirements in an efficient manner. Other comments state that this provision would prevent companies from having to duplicate records or create new records solely to satisfy recordkeeping requirements.

(Comment 653) Some comments state that food safety plan records are a “web of related documents” that may be used in other programs and cannot be collected or “reduced to a binder.”

(Response 653) We agree that food safety plan records could be considered a “web of related documents”—i.e., a set of records that could include documents used in other programs. We also agree that the food safety plan records need not be collected in a single location or “reduced to a binder.” See the discussion in Response 215 about how a food safety plan could consist of one or more existing HACCP plans, one or more prerequisite programs that include food safety controls, and other components required by the rule, and be dated and signed even if its components are not kept in a single location.

Likewise, the records documenting implementation of the plan could be a “web of related documents.” For example, a facility that collects samples of product and sends them to a laboratory for testing would have records documenting its collection of samples, as well as records documenting the laboratory's test results. Consistent with the requirements of the rule for written procedures for product testing (§ 117.165(b)(2)) and the general recordkeeping requirements of subpart F (§ 117.305), the sampling records would contain information such as the name and location of the facility, the date when the samples were collected, the signature or initials of the person collecting the samples, and the identity and lot code of the sampled product. Likewise, the laboratory report would contain information identifying the laboratory, the product tested (and associated lot code), the test analyte, the test(s) conducted (including the analytical method(s) used), the date of the test(s), the test results, and the signature or initials of the person who conducted the test. Alternatively, it would be acceptable to have the signature or initials of the person who approved the release of the test results from the laboratory. Together, these records contain all the required information to associate them with a facility, a specific lot of product, and the results of laboratory testing on that product.

Although the provisions for use of existing records provide flexibility, there are some limitations. For example, monitoring records must be created concurrently with the monitoring activity and contain the signature or initials of the person conducting the monitoring. If the facility has an existing form that it uses to document the monitoring activity, and that form does not provide (or have space to add) information adequate to identify the plant or facility (e.g., the name and, when necessary, the location of the facility), and does have (or have space to add) a place for the signature of the person performing the activity, we expect the facility to modify the form rather than use the existing form. The provisions for “supplementing” existing records do not extend to providing information identifying the facility, or signatures, on separate pages.

(Comment 654) Some comments state that our review of records should be limited to issues under our jurisdiction, regardless of the other information that may be contained in the record. Other comments ask us to ensure that inspectors are adequately trained on how to review facility records for the requisite information across multiple sets of documents, as needed.

(Response 654) Section 418(h) of the FD&C Act requires that the written plan that documents and describes the procedures used by the facility to comply with the requirements of section 418, together with the documentation of monitoring of preventive controls, instances of nonconformance material to food safety, the results of testing and other means of verification, instances when corrective actions were implemented, and the efficacy of preventive controls and corrective actions, be made available to FDA. Our inspectors will be trained to focus on the written food safety plan and the records documenting implementation of the plan during inspections. Our inspectors have experience in the review of records that a food business establishes and maintains for more than one purpose—e.g., during the review of records kept under the section 414 recordkeeping regulations during the investigation of an outbreak of foodborne illness.

H. Final § 117.335—Special Requirements Applicable to a Written Assurance

As discussed in section XXVII, new § 117.335 establishes requirements applicable to the written assurance a manufacturer/processor obtains from its customer. New § 117.335(a) applies to all written assurances required by the rule—i.e., the assurance must contain the effective date; printed names and signatures of authorized officials; and the applicable assurance.

The provisions of § 117.335(b), together with another new provision (§ 117.137), establish legal responsibilities under the rule for a facility that provides a written assurance regarding a food product that a manufacturer/processor distributes without application of a preventive control that is needed to control a hazard. This responsibility exists even for a facility that is not itself a manufacturer/processor, such as for a facility that is a distributor. We are establishing legal responsibilities for the facilities that provide these written assurances because following these assurances is critical to ensuring that required preventive controls are applied to the food by an entity in the distribution chain before the food reaches consumers.

I. Other Comments on the Recordkeeping Requirements of Subpart F

(Comment 655) Some comments assert that the extensive recordkeeping requirements of every aspect of farm and food production would be crushing to small and mid-sized businesses. These comments ask us to replace the proposed recordkeeping requirements with a brief farm plan that outlines perceived risks and how the farmer plans to address those risks.

(Response 655) We decline this request, which is largely moot in light of the changes we have made to the “farm” definition and to the classification of activities on-farm and off-farm (see the discussion in section IV of this document and table 1 in the Appendix to the 2014 supplemental human preventive controls notice (79 FR 58524 at 58571-58572)). None of the activities within the “farm” definition (i.e., packing and holding RACs, and certain processing activities (such as drying grapes to produce raisins, and packaging RACs such as strawberries, without additional manufacturing/processing), will be subject to this rule if performed on a farm.

XLII. Subpart G: General Comments on Proposed Requirements for a Supply-Chain Program

In the 2014 supplemental human preventive controls notice, we provided an opportunity for public comment on potential requirements for a supplier program as a preventive control. The supplier program for a receiving facility would be limited to those raw materials and other ingredients for which the receiving facility has identified a significant hazard (which we now refer to as “hazard requiring a preventive control”). Under the definitions established in this rule, “supplier” means the establishment that manufactures/processes the food, raises the animal, or grows the food that is provided to a receiving facility without further manufacturing/processing by another establishment, except for further manufacturing/processing that consists solely of the addition of labeling or similar activity of a de minimis nature; “receiving facility” means a facility that is subject to subparts C and G and that manufactures/processes a raw material or other ingredient that it receives from a supplier (see § 117.3).

We previously explained our understanding that, particularly for RACs, there may be multiple establishments, including cooperatives, packinghouses, and distributors, between a receiving facility and the establishment that would be considered the supplier, which would make supplier verification very challenging under certain circumstances (79 FR 58524 at 58548). We requested comment on what verification activities would be appropriate for receiving facilities to conduct when a raw material or ingredient passes through more than one facility that would not be required to verify control of hazards if supplier programs are limited to manufacturers/processors. We discussed an example in which a receiving facility is a fresh-cut processing facility that receives produce from a distributor, who receives produce from a cooperative, and neither the distributor nor the cooperative is required to establish supplier controls for the farms where the hazards are being controlled, and we asked what supplier controls should be applied for the produce coming from the farms. We requested comment on whether and how the requirements for supplier verification should address such situations. We also requested comment regarding whether (and, if so, how) the final human preventive controls rule should address the potential for gaps in supplier controls when a hazard is controlled at Point A in the supply chain (e.g., by Supplier A, a farm), and Point B in the supply chain is a facility (such as Warehouse B, Distributor B, or Packing Shed B) that only packs or holds food, but does not manufacture/process food (and therefore would not be required to have a supplier program) before passing it on to Point C in the supply chain, which also would not be required to have a supplier program (e.g., Retail Food Establishment C or Consumer C). We discussed an example in which Packing Shed B distributes produce it packs after receiving the produce from Farm A directly to retail facilities (which would not be subject to the requirements of the human preventive controls rule); under the proposed suppler control program no supplier controls would be applied to Farm A. We requested comment on whether verification activities should be required in circumstances in which a RAC such as fresh produce will not be sent to any facilities that would be required to have preventive controls before reaching consumers.

In the remainder of this section, we discuss comments that address our request for comment on complex supply-chain scenarios such as those described in the 2014 supplemental human preventive controls notice. We also describe our reasons for revising the proposed requirements for a supplier program to provide additional flexibility for an entity other than the receiving facility to determine, conduct, and document the appropriate supplier verification activities. When an entity other than the receiving facility determines, conducts, or both determines and conducts the appropriate supplier verification activities, the receiving facility must review and assess that entity's applicable documentation, and document the receiving facility's review and assessment. Providing this additional flexibility required a series of changes to multiple proposed provisions. To improve clarity and readability we redesignated proposed § 117.136 into eight distinct sections of regulatory text in a newly established subpart G (Supply-Chain Program), with editorial changes associated with the new structure of the redesignated regulations. See table 44 for the section numbers and titles in subpart G. See table 45 for an overview of the major revisions to the proposed requirements for a supplier program. See sections XLIII through XLIX for a discussion of the specific provisions of the final requirements for a supplier program, and table 46, table 47, table 48, table 49, table 50, and table 51 for more detailed summaries of revisions to these specific provisions. Because table 45 is an overview, the changes identified in table 45 appear again in table 46, table 47, table 48, table 49, table 50, and table 51. Because the editorial changes associated with the redesignation are extensive, we do not list them in table 52.

The title of subpart G is “Supply-Chain Program” rather than “Supplier Program.” As shown in table 45 and discussed in more detail in section XLIII.D, we have added one requirement applicable to non-suppliers. “Supply-chain program” is a more appropriate term to reflect a subpart that includes a requirement applicable to non-suppliers in addition to the requirements applicable to suppliers. In the remainder of this document, we use the phrase “supply-chain program” in section headings and when referring to the provisions of the final rule. We continue to use the term “supplier program” when describing the proposed provisions and the comments regarding the proposed provisions.

(Comment 656) Several comments ask us to issue guidance rather than establish requirements for a supplier program in the rule. Some comments assert that the benefits of a supplier verification program do not outweigh the costs, that we did not consider the effects of such a requirement on farms and small businesses, and that FSMA does not actually contain a requirement for a supplier verification program. Conversely, other comments support including a mandatory supplier program in the rule for hazards that are controlled in raw materials and other ingredients before receipt by the receiving facility, although many comments assert that a supplier verification program should be viewed as a verification activity rather than a preventive control. Some comments assert that a mandatory domestic supplier program is necessary to provide parity with the requirements of the FSVP rule authorized by FSMA, while other comments assert that FSMA's authorization of foreign supplier verification should not be used to justify a domestic supplier program. Some of these comments single out our request for comment, in the proposed FSVP rule, on whether to allow an entity that would be both an importer (under the FSVP rule) and a receiving facility (under the human preventive controls rule) to be deemed in compliance with the FSVP rule if it was in compliance with the supplier verification provisions of the human preventive controls rule, and agree with such an approach (78 FR 47730 at 45748).

(Response 656) We agree that it is necessary to include a mandatory supply-chain program in the rule to ensure the safety of food where hazards are controlled in raw materials and other ingredients before receipt by a receiving facility, and we are finalizing such a requirement in this rule. The statute specifically identifies supplier verification activities as a preventive control (see section 418(o)(3) of the FD&C Act). Further, we believe a supply-chain program is a measure that a person knowledgeable about food safety would establish and implement in order to significantly minimize or prevent hazards requiring a preventive control in an incoming raw material or other ingredient.

Supplier verification is sufficiently important for the control of hazards in both domestic and imported foods that FSMA contains provisions for both domestic and foreign supplier verification (sections 418(o)(3) and 805 of the FD&C Act). Because we have aligned the provisions for supplier verification in the FSVP rule with the provisions for a supply-chain program in this rule, we are allowing importers and receiving facilities to take advantage of that fact in considering compliance with both part 117 and our forthcoming FSVP regulations that we proposed to establish in part 1, subpart L, so that they do not have to duplicate verification activities (see § 117.405(a)(2)).

(Comment 657) Some comments that addressed questions we asked in the 2013 proposed human preventive controls rule and the 2014 supplemental human preventive controls notice recommend that we add flexibility to the requirements for a supplier program such that any entity in the supply chain between the supplier and the receiving facility can perform supplier verification activities. Some comments ask us to allow a receiving facility to have a supplier program established for it by another entity. Other comments assert that it would be too burdensome for a receiving facility to consider any information related to the supplier's supplier or to go further back in the supply chain beyond the entity that is one back from the receiving facility. Other comments assert that we should eliminate any requirements for a supplier program from the rule because a supplier program involving more entities than just the receiving facility and the supplier would become too complex. Some comments express concern that we would be creating “an environment where our supply chain is required to be disclosed to our customers via product testing, audits and supplier verification,” asserting that this would discourage customers from buying from entities such as re-packers when they could go to the source. Some comments state that we have not taken into account the low-risk nature of specific industries such as those that re-pack already processed foods. Other comments ask us to confirm that distributors and warehouses are not included in the requirements for a supplier program because they would not likely meet the definition of a receiving facility or a supplier.

(Response 657) We agree with comments recommending additional flexibility in the supply-chain program with regard to who can perform certain activities and have added this flexibility to the final rule (see § 117.415). Because the receiving facility and the supplier may be separated by several entities in a supply chain, we are allowing such entities (e.g., distributors, brokers, aggregators) to determine, conduct, and document supplier verification activities as a service to the receiving facility, provided that the receiving facility reviews and assesses applicable documentation provided by the other entity and documents that review and assessment. However, because the approval of suppliers is ultimately the responsibility of the receiving facility, the rule specifies that only a receiving facility can approve suppliers (see §§ 117.415(a)(1) and 117.420(a) and Response 658).

We disagree that complex supply chains make a supply-chain program too difficult and that a receiving facility cannot be expected to reach further back in a supply chain than the entity immediately before it in the supply chain. Supply-chain programs are currently used by facilities as a standard business practice and we understand that some of those supply chains are complex, with entities between the receiving facility and the supplier. We acknowledge that complex supply chains present a challenge because information will need to flow through several entities to allow the link between the receiving facility and the supplier. However, we believe a supply-chain program is a critical preventive control for receiving facilities that will rely on suppliers to control hazards in raw materials and other ingredients. Although distributors, brokers, and other entities in the supply chain between a receiving facility and its supplier are not required to have a role in supplier verification, they have the option to determine, conduct, and document supplier verification activities as a service to the receiving facility if they so choose. If these entities choose not to participate in supplier verification, the receiving facility will need to reach back in the supply chain past them. In such situations, it may be necessary for the entities between the receiving facility and the supplier to provide the identity of the supplier to the receiving facility, if that identity is not available on the raw material or other ingredient or otherwise apparent. In such cases, the role that distributors, brokers, aggregators, and similar entities would play in supplier verification would be minimal. We cannot determine whether having to provide the identity of the supplier to the receiving facility would change buying practices. However, we believe that manufacturers consider a number of factors in determining who they will purchase from, including the services provided, and that there will continue to be a role for aggregators, re-packers, brokers, and others. We have provided flexibility for these entities to play a role in supplier verification if the receiving facility and the business entity determine there is a benefit to do so.

See also the discussion in section XLV regarding the specific provisions of § 117.415. Although comments focus on flexibility for an entity in the supply chain between the supplier and the receiving facility to perform supplier verification activities, and such entities are the most likely entities to be the entities determining, conducting, and documenting supplier verification activities, the flexibility provided by the rule is not limited to such entities.

(Comment 658) Some comments ask us to establish a general requirement for a supplier program without specifying roles and responsibilities for the various entities involved. Other comments ask us to define “supplier” as the entity with which the receiving facility has a commercial relationship.

(Response 658) We disagree that we should establish a general requirement for a supply-chain program without specifying roles and responsibilities for the various entities involved. Although we have added flexibility to provide that an entity other than the receiving facility may determine, conduct, and document supplier verification activities (see § 117.415), we continue to believe it is important to clearly define two roles in the supply chain that share the primary responsibility in the supplier verification process—i.e., the receiving facility and the supplier. In all cases where we have added flexibility for participation by an entity other than the receiving facility, the responsibility for the supply-chain program is clearly lodged with the receiving facility, and linked to the supplier (see § 117.415). To emphasize the responsibility of the receiving facility and its link to the supplier, the final rule clearly states that the receiving facility must approve its suppliers before receiving raw materials and other ingredients (see § 117.420(a)).

For the supply-chain program to be meaningful and robust, there must be an exchange of information between these two entities—the entity receiving the food and the entity that controlled the hazard—even when an entity other than the receiving facility participates by determining, conducting, and documenting some supplier verification activities. The ultimate responsibility for supplier verification rests with the receiving facility through its determination in approving suppliers and in reviewing and assessing applicable documentation provided by another entity. Therefore, we also disagree that the definition of “supplier” should be revised to be the next entity back in a supply chain (e.g., the entity with which a receiving facility has a commercial relationship). The entity with which a receiving facility has a commercial relationship might be a distributor, broker, or aggregator. A distributor, broker, or aggregator does not control an identified hazard and, therefore, cannot assume the same role as an establishment that manufactures/processes the food, raises the animal, or grows the food.

(Comment 659) Some comments ask us to provide flexibility in the content of the supplier program. Some comments assert that specifying the content of the supplier program would result in duplicative requirements on suppliers, who must first comply with certain regulations and then demonstrate that compliance in order to comply with a different regulation.

(Response 659) We disagree that a requirement for a supply-chain program in which compliance with an underlying regulation is demonstrated is duplicative with the need to comply with the underlying regulation. The requirement for a supply-chain program is not mandating that the facility or farm comply twice with the human preventive controls rule or the produce safety rule; it is merely requiring that the compliance by the facility or the farm with the applicable regulation be verified to ensure that hazards requiring a preventive control are being controlled.

We are continuing to specify the basic content of a supply-chain program—i.e., using approved suppliers; determining appropriate supplier verification activities; conducting supplier verification activities; and establishing records documenting these activities (see § 117.410(a)). However, the rule provides flexibility in the choice of supplier verification activities and how often such activities must be performed. (See §§ 117.410(b)(4) and 117.430(b)(2), (c), (d), and (e)). In addition, the rule provides for an alternative supplier verification activity for certain entities (see § 117.430(c), (d), and (e)) regarding alternative supplier verification activities for qualified facilities, certain produce farms, and certain shell egg producers, respectively).

(Comment 660) As already noted in this section, in the 2014 supplemental human preventive controls notice we asked for comment on whether verification activities should be required in circumstances in which a RAC such as fresh produce will not be sent to any facilities that would be required to have preventive controls before reaching consumers. In response, we received comments both in support of, and in opposition to, a requirement that verification activities be conducted in circumstances in which produce would go directly from an establishment that would not be required to have supplier controls (e.g., farm, warehouse, distributor) to another establishment not required to have supplier controls (e.g., retail food establishment) or to a consumer. Some comments assert that any firm that sells directly to retail food establishments or consumers should have a supplier program in place, while other comments assert that this is not necessary, particularly in the case of RACs.

Some comments maintain that the produce safety rule will provide adequate assurances of safety for covered produce and that covering such products with the supplier verification requirements of the human food preventive controls rule would be subjecting this produce to duplicative requirements. These comments recommend that, if some verification is required in these “gaps” on which we asked for comment, entities in these categories be allowed to voluntarily apply certain supplier verification best practices rather than be subject to the supplier program requirements of this rule.

(Response 660) As previously discussed (79 FR 58524 at 58548), fresh produce often goes directly from the farm to a distributor and then on to retail food establishments and/or consumers. We are not requiring any of the entities in this supply chain to do supplier verification under part 117, so the farm's compliance with the produce safety rule, if applicable, will not be verified unless done voluntarily. In contrast, we are requiring that a manufacturer/processor that uses covered produce to make a processed product such as fresh-cut produce establish and implement a supply-chain program. As we have previously discussed, processing fresh produce into fresh-cut products increases the risk of bacterial growth and contamination (Ref. 89). This has the potential to increase the exposure to pathogens, because contamination of a few pieces of raw produce can be spread to many servings of processed fresh-cut produce. Disturbing the physical barriers of produce (e.g., by cutting the produce) and inadequate temperature control of fresh-cut produce can enhance bacterial growth (including growth of pathogens, if present). The increased risk presented by processing of fresh produce makes it appropriate to subject this processed food to the full requirements of the human preventive controls rule in addition to the requirements of the forthcoming produce safety rule for the RACs that are used to make this processed food.

XLIII. Subpart G: Comments on Requirement To Establish and Implement a Supply-Chain Program

We proposed that the receiving facility must establish and implement a risk-based supplier program for those raw materials and ingredients for which the receiving facility has identified a significant hazard when the hazard is controlled before receipt of the raw material or ingredient (proposed § 117.136(a)). We also proposed circumstances when a receiving facility would not be required to have a supplier program.

In the following sections, we discuss comments that ask us to clarify the proposed requirement to establish and implement a written supplier program or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the regulatory text as shown in table 46.

A. Requirement for a Written Supply-Chain Program (Final § 117.405(a)(1) and (b))

We proposed that the receiving facility must establish and implement a risk-based supplier program for those raw materials and ingredients for which the receiving facility has identified a significant hazard when the hazard is controlled before receipt of the raw material or ingredient. We also proposed that the supplier program must be written. (See proposed § 117.136(a)(1)(i) and (2).) To improve clarity, we have revised the revision to substitute the phrase “hazard requiring a supply-chain-applied control” for the phrase “significant hazard when the hazard is controlled before receipt of the raw material or ingredient.” We have added a definition for the term “supply-chain-applied control” to mean a preventive control for a hazard in a raw material or other ingredient when the hazard in the raw material or other ingredient is controlled before its receipt (see § 117.3) and use the more specific term “supply-chain-applied control,” rather than the broader term “preventive control,” throughout the provisions for a supply-chain program.

(Comment 661) As discussed in Comment 656, several comments ask us to issue guidance rather than establish requirements for a supplier program in the rule.

(Response 661) See Response 656 for a discussion of our reasons for declining this request and establishing requirements for a supply-chain program in the rule.

(Comment 662) Some comments ask us to revise the regulatory text to remove the condition that all hazards be foreseeable so that the supplier program can address economically motivated adulteration.

(Response 662) This comment is unclear. The requirement for a supply-chain program applies when the outcome of a hazard analysis is that a known or reasonably foreseeable hazard requires a preventive control, and the hazard would be controlled by the receiving facility's supplier. The requirement applies regardless of whether the hazard requiring a preventive control is, or is not, a hazard that would be introduced into a food for the purposes of economic gain.

(Comment 663) Some comments ask us to specify that a Certificate of Analysis or other documentation of the existence and/or level of a hazard could be provided to the receiving facility to indicate the potential for an actual existence of a hazard so that the receiving facility could evaluate whether the hazard requires a preventive control. One comment explains that chemical contaminants such as lead are not controlled through easily described “procedures” but are instead controlled through factors such as product formulation (e.g., controlling the levels of contaminants in each ingredient depending on the proportion of the ingredient in the finished food) and serving size. These comments explain that chemical contaminants such as lead may require control in one context (e.g., if children are the target consumers) but not in another context (e.g., if adults are the target consumers and the product is unlikely to be consumed by children). This comment expresses concern about whether customers would be willing to provide the receiving facility with confidential information about the customer's own hazard analysis with respect to sensitive topics (e.g., how much lead it has decided to allow in its finished products, or how its product formulation controls the level of lead in its finished food). Furthermore, in such cases the receiving facility will not even know whether the chemical contaminant constitutes an actual “hazard” for the purposes of the customer's finished food. This comment also asserts that a Certificate of Analysis provided to a receiving facility constitutes “control before receipt of the raw material or ingredient.”

(Response 663) We do not understand the concern of this comment. A receiving facility and a supplier do not need to share all of the details of product formulation for a receiving facility to communicate its requirements to a supplier. In the example provided by the comment, the receiving facility could provide the supplier with a written specification for a contaminant such as lead, and the supplier could demonstrate that it satisfied the receiving facility's specification by providing a Certificate of Analysis showing the results of laboratory testing for lead. Neither the written specification provided by the receiving facility, nor the Certificate of Analysis provided by the supplier, would disclose confidential information about the formulations or procedures of either entity.

This comment also appears to misunderstand the applicability of the supply-chain program. The rule requires a supply-chain program when the receiving facility has identified, through its hazard analysis, that there is a hazard requiring a supply-chain-applied control. In the circumstances described by the comment, a Certificate of Analysis or other documentation of test results from the supplier to the receiving facility could demonstrate that the supplier has controlled the hazard to the receiving facility's specifications, but would not overturn the outcome of the receiving facility's hazard analysis that there is a hazard requiring a preventive control, and that the appropriate control is applied by the supplier. On the contrary, the Certificate of Analysis simply demonstrates that the supply-chain-applied control functioned as intended.

(Comment 664) One comment asks us to specify in the regulatory text that the supplier program must be written “if required” because there are specified circumstances when a supplier program is not required.

(Response 664) We decline this request. Although the rule provides circumstances when a supply-chain program is not required (see § 117.405(a)(2)), it is not necessary to specify, for all other provisions of the supply-chain program, that the provision only applies “if required.”

B. Circumstances That Do Not Require a Written Supply-Chain Program (Final § 117.405(a)(2))

We proposed that the receiving facility is not required to establish and implement a supplier program for raw materials and ingredients for which there are no significant hazards; the preventive controls at the receiving facility are adequate to significantly minimize or prevent each of the significant hazards; or the receiving facility relies on its customer to control the hazard and annually obtains from its customer written assurance that the customer has established and is following procedures (identified in the written assurance) that will significantly minimize or prevent the hazard. (See proposed § 117.136(a)(1)(ii)(A), (B), and (C).)

We are deleting the proposed provision that a supplier program is not required for raw materials and ingredients for which there are no “significant hazards” (which we now refer to as “hazards requiring a preventive control”) because it is unnecessary. The supply-chain program is required when a hazard identified in the receiving facility's hazard analysis identifies a hazard requiring a supply-chain-applied control; it is not necessary to also state the converse. Likewise, we are deleting the proposed provision that a supplier program is not required if the preventive controls at the receiving facility are adequate to significantly minimize or prevent each of the significant hazards. In such a case, the outcome of the hazard analysis would not be that the hazard requires a supply-chain-applied control.

As discussed in section XXVII, after considering comments, we are shifting the provision in which the receiving facility relies on its customer to control the hazard from the requirements for a supply-chain program to a series of provisions that apply when a manufacturer/processor identifies a hazard requiring a preventive control, but can demonstrate and document that the hazard will be controlled by an entity in its distribution chain (see §§ 117.136 and 117.137). However, as discussed in Response 665 and section XLIII.C, we also are establishing two additional circumstances when a supply-chain program is not required (see § 117.405(a)(2) and (3)).

(Comment 665) As noted in Comment 656, some comments single out our request for comment, in the proposed FSVP rule, on whether to allow an entity that would be both an importer (under the FSVP rule) and a receiving facility (under the human preventive controls rule) to be deemed in compliance with the FSVP rule if it was in compliance with the supplier verification provisions of the human preventive controls rule, and agree with such an approach (78 FR 47730 at 45748).

(Response 665) As noted in Response 656, we have aligned the provisions for supplier verification in the FSVP rule with the provisions for a supply-chain program in this rule, and we are allowing importers that are receiving facilities to take advantage of that fact in considering compliance with our forthcoming FSVP regulations that we proposed to establish in part 1, subpart L, so that they do not have to duplicate verification activities (see § 117.405(a)(2)).

(Comment 666) Some comments support the specified criteria for when a receiving facility would not be required to establish and implement a supplier program. Other comments express concern that these criteria suggest no supplier verification is needed at all in some circumstances despite supplier verification activities being potentially informative about a particular supplier. These comments ask us to establish some general requirement to perform verification activities for all suppliers.

(Response 666) We decline this request because it is neither risk-based nor consistent with the nature and purpose of the supply-chain program, which is to provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented (see the regulatory text of § 117.410(c)). We agree that some degree of verification of all suppliers may prove useful to a receiving facility for various purposes, and the rule would not prevent a receiving facility from establishing a supply-chain program for all of its suppliers regardless of risk and regardless of whether the applicable hazard in a raw material or other ingredient is controlled before its receipt.

(Comment 667) Some comments ask us to specify that a “kill step” would be an adequate indicator to significantly minimize or prevent significant hazards identified by the receiving facility when the receiving facility controls the hazard.

(Response 667) These comments appear to misunderstand the applicability of the supply-chain program. The rule requires a supply-chain program when the receiving facility has identified, through its hazard analysis, that there is a hazard requiring a preventive control and the receiving facility's manufacturing/processing will not control the hazard. In the circumstances described by the comment, the receiving facility is controlling the hazard and a supply-chain program for the raw material or other ingredient is not required. It is not necessary to specify the types of controls that the receiving facility may use to control the hazard.

(Comment 668) Some comments ask us to specify that a receiving facility need not establish and implement a supplier program for raw materials and ingredients if those raw materials or ingredients were received from an affiliated party within the same corporate or controlling entity.

(Response 668) We decline this request. With the revisions we have made to the proposed requirements for a supplier program, the supply-chain program that we are establishing in this rule provides ample opportunities for an affiliated party within the same corporate or controlling entity to establish and implement a supply-chain program that is suited to its relationship to these entities. For example, as discussed in Response 687, a receiving facility might be able to determine and document a justification for a supplier verification activity other than an annual audit when a supplier is an affiliated party based on the receiving facility's knowledge of the corporate policies regarding food safety practices (see § 117.430(b)(2)). In addition, as discussed in Response 690, we have agreed that the corporate parent of a facility can be active in developing and implementing the facility's food safety plan (see section XXIV.A). If, for example, a corporate headquarters establishes and implements a supply-chain program for use company-wide, a receiving facility could rely on supplier verification activities conducted by its corporate headquarters, with applicable documentation available during inspection.

C. Exemption for Food Supplied for Research or Evaluation (Final § 117.405(a)(3))

We are establishing an exemption from the requirement for a receiving facility to establish and implement a supply-chain program when it receives food for the purposes of research or evaluation, provided that certain conditions are met (see § 117.405(a)(3)). Those conditions are that the food: (1) Is not intended for retail sale and is not sold or distributed to the public; (2) is labeled with the statement “Food for research or evaluation use”; (3) is supplied in a small quantity that is consistent with a research, analysis, or quality assurance purpose, the food is used only for this purpose, and any unused quantity is properly disposed of; and (4) is accompanied with documents, in accordance with the practice of the trade, stating that the food will be used for research or evaluation purposes and cannot be sold or distributed to the public. The exemption is analogous to an exemption we proposed for the FSVP rule under section 805(f) of the FD&C Act. (See proposed § 1.501(c), 78 FR 45730 at 45745). We believe it is not necessary to conduct supplier verification activities when food is obtained in this limited circumstance.

D. Additional Requirements for Non-Suppliers (Final § 117.405(c))

As discussed in section IV.B, the final rule includes several revisions to the “farm” definition in response to comments. For example, as discussed in Comment 23 comments emphasize that farming operations can have complex business structures, and ask us to revise the “farm” definition to provide for these business models. In response to these comments, we have added a new definition for a “secondary activities farm,” which provides for practices such as packing by cooperatives and packinghouses under the ownership of multiple growers to remain within the “farm” definition (See Response 25). Another change to the “farm” definition accommodates business models in which one operation grows crops but does not harvest them, and another operation, not under the same management, harvests crops but does not grow them (see Response 32). As discussed in Response 32, this revision is a change from the “farm” definition established in the section 415 registration regulations in 2003, and the proposed revisions to the “farm” definition in the 2013 proposed human preventive controls rule and the 2014 supplemental human preventive controls notice, which all describe a “farm” as an entity “devoted to the growing and harvesting of crops” (emphasis added).

We proposed the requirements for a supplier program in the context of a single business entity “devoted to the growing and harvesting of crops” (emphasis added), in which packing operations were often done by that same business entity. The final “farm” definition accommodates business models where growing, harvesting, and packing operations will be done by different business entities. Harvesting and packing operations include some supply-chain-applied controls, such as controls on worker hygiene, quality of water used during harvesting and packing operations, and establishing and following water-change schedules for recirculated water, even though the harvesting and packing operations do not fall within the definition of “supplier.”

A receiving facility has an obligation to identify and implement preventive controls to provide assurances that any hazards requiring a preventive control will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act (see section 418(c) of the FD&C Act and § 117.135(a)). That obligation includes responsibilities for raw materials and other ingredients when a supply-chain-applied control is applied by an entity other than the receiving facility's supplier. An example of such a situation is when produce that will be covered by the forthcoming produce safety rule is grown, harvested, and packed under different management. To clarify the receiving facility's responsibilities when a supply-chain-applied control is applied by a non-supplier, we are establishing a requirement specifying that when a supply-chain-applied control is applied by an entity other than the receiving facility's supplier (e.g., when a non-supplier applies controls to certain produce (i.e., produce that will be subject to the forthcoming produce safety rule), because growing, harvesting, and packing activities are under different management), the receiving facility must: (1) Verify the supply-chain-applied control; or (2) obtain documentation of an appropriate verification activity from another entity, review and assess the entity's applicable documentation, and document that review and assessment. See § 117.405(c). Because § 117.405(c) refers to provisions in a future produce safety rule, we will publish a document in the Federal Register announcing the effective date of that provision once we finalize the produce safety rule.

We do not expect the receiving facility to follow all of the requirements of subpart G applicable to “suppliers” when verifying control by a “non-supplier,” as required by § 117.405(c). Instead, we expect the receiving facility will take steps such as a review of the non-supplier's applicable food safety records. For example, if a receiving facility receives produce from a supply chain that includes a separate grower, harvester, and packer, the grower is the supplier and the requirements of subpart G applicable to “suppliers” apply to the grower. To verify controls applied by the harvester, the receiving facility could review the harvester's records, such as records of training for harvest workers and records of agricultural water quality used in harvest operations. To verify controls applied by the packer, the receiving facility could review the packer's records, such as records of agricultural water quality used in packing operations. As discussed in Response 657, we are allowing entities such as distributors, brokers, and aggregators to determine, conduct, and document verification activities that apply to suppliers as a service to the receiving facility, provided that the receiving facility reviews and assesses applicable documentation provided by the other entity and documents that review and assessment. Likewise, under § 117.405(c)(2) a receiving facility could obtain documentation of review of applicable records maintained by the harvester or packer from another entity, review and assess the entity's applicable documentation, and document that review and assessment.

E. Proposed General Requirements for the Supply-Chain Program That We Are Not Including in the Final Rule (Proposed § 117.136(a)(4) and (5))

We proposed that when supplier verification activities are required for more than one type of hazard in a food, the receiving facility must conduct the verification activity or activities appropriate for each of those hazards. We also proposed that for some hazards, in some situations it will be necessary to conduct more than one verification activity and/or to increase the frequency of one or more verification activities to provide adequate assurances that the hazard is significantly minimized or prevented. We have concluded that these provisions are largely self-evident and need not be included in the regulatory text. Therefore, we are not finalizing these proposed provisions. We will consider whether it will add value to discuss the principles in these proposed provisions in guidance that we intend to develop for the supply-chain program.

XLIV. Subpart G: Comments on General Requirements Applicable to a Supply-Chain Program

We proposed several requirements generally applicable to the supplier program (such as factors to consider in determining appropriate supplier verification activities (proposed § 117.136(b)), as well as several requirements more narrowly targeted to specific aspects of the supplier program (such as requirements applicable to onsite audits). As part of the redesignation of proposed § 117.136 into subpart G, with eight distinct sections, we are establishing the more general requirements in § 117.410 (see table 47).

Most comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 671, Comment 672, Comment 675, Comment 676, and Comment 678). In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the regulatory text as shown in table 47.

A. Description of What the Supply-Chain Program Must Include (Final § 117.410(a))

We proposed to require that a supplier program include verification activities, as appropriate to the hazard, and documentation of these activities, to ensure raw materials and ingredients are received only from suppliers approved for control of the hazard(s) in that raw material or ingredient (or, when necessary and appropriate, on a temporary basis from unapproved suppliers) (proposed § 117.136(a)(3)(i)). We also proposed to require that a supplier program include verification activities, as appropriate to the hazard, and documentation of these activities. We also proposed requirements applicable to the determination and documentation of appropriate supplier verification activities (proposed § 117.136(b)). We also proposed specific documentation requirements for records associated with the supplier program (proposed § 117.136(g)).

The final rule specifies that the supply-chain program must include: (1) Using approved suppliers; (2) determining appropriate supplier verification activities (including determining the frequency of conducting the activity); (3) conducting supplier verification activities; and (4) documenting supplier verification activities. For clarity, § 117.410(a) states this general requirement for the supply-chain program and §§ 117.420, 117.425, 117.430, 117.435, and 117.475 provide the specific requirements for using approved suppliers, determining appropriate supplier verification activities, conducting verification activities, specific requirements for onsite audits, and records, respectively. See the discussion of the specific requirements of §§ 117.420, 117.425, 117.430, 117.435, and 117.475 in sections XLVI, XLVII, XLVIII, and XLIX, respectively.

As discussed in section XLIII.D, the final rule establishes a verification requirement when a supply-chain-applied control is applied by an entity other than the receiving facility's supplier (see § 117.405(c)). For clarity, § 117.410(a) states this general requirement for the supply-chain program in § 117.405(a)(5), and § 117.405(c) provides the specific requirements that apply when a supply-chain-applied control is applied by an entity other than the receiving facility's supplier.

B. Appropriate Supplier Verification Activities ((Final § 117.410(b))

We proposed to require that appropriate supplier verification activities include: (1) Onsite audits; (2) sampling and testing of the raw material or ingredient, which may be conducted by either the supplier or receiving facility; (3) review by the receiving facility of the supplier's relevant food safety records; or (4) other appropriate supplier verification activities based on the risk associated with the ingredient and the supplier (proposed § 117.136(c)(1)).

(Comment 669) Some comments support the inclusion of onsite audits as an appropriate supplier verification activity. However, other comments oppose it, and ask us to remove the onsite audit requirement from the supplier verification program, stating that Congress prohibited FDA from requiring third parties to verify or audit compliance with the rules. These comments express concern that the supplier verification program effectively imposes an “entire second layer of regulation” on produce farms that are supplying ingredients to processors, and claim this is an unnecessary burden that is not authorized by FSMA.

(Response 669) We are retaining onsite audits as an appropriate supplier verification activity. As noted in our memorandum on supplier programs, onsite audits are commonly used by industry in the verification of supplier performance (Ref. 83). Onsite audits provide the opportunity to review the food safety plan and written procedures and to observe the implementation of food safety procedures, as well as to review the records related to the past application of control measures, including laboratory test results. Audits also provide the opportunity to interview employees to assess their understanding of the food safety measures for which they are responsible. Thus, an audit can provide for a more comprehensive assessment of food safety implementation by a facility, and often is used in approving food suppliers. Comments that oppose including onsite audits as a verification activity are concerned that farms will be required to have audits to verify that they are in compliance with produce safety standards or facilities will be required to have audits to verify preventive controls. These comments apparently refer to the provision in section 419(c)(1)(E) of the FD&C Act that the regulation issuing standards for the safety of produce “not require a business to hire a consultant or other third party to identify, implement, certify compliance with these procedures, processes and practices,” or the provision in section 418(n)(3)(D) of the FD&C Act that the preventive controls regulation “not require a facility to hire a consultant or other third party to identify, implement, certify or audit [preventive] controls.” The regulations proposed under section 419 of the FD&C Act do not impose such requirements. The requirements for supplier verification in this rule (under section 418 of the FD&C Act) provide for audits as one supplier verification activity. Although the rule does specify an annual onsite audit as the appropriate supplier verification activity when a hazard in a raw material or other ingredient will be controlled by the supplier and is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans, the receiving facility is not required to hire a third party to conduct the audit. Any qualified auditor, other than the supplier, may conduct the audit, including an employee of the receiving facility or another entity, such as an entity in the supply chain between the supplier and the receiving facility. The rule also provides that a receiving facility may determine and document that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled (see § 117.430(b)(1) and (2)). Audits already conducted on a supplier's facility or operation for other business purposes may meet the requirement for supplier verification. In addition, the rule provides alternative requirements for verification of suppliers that are farms that are not a covered farm under part 112 in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5 (see § 117.430(d)). Finally, we have also provided that inspections may substitute for an audit under specified circumstances (see § 117.435(c)).

While we realize that some farms may receive audits under the supplier verification provisions of part 117, we note that farms that might receive an audit because they are suppliers to a receiving facility produce a limited subset of the total produce production that comes from farms. These are products such as leafy greens for fresh-cut processing operations and fruits and vegetables that are going into ready-to-eat products like deli salads. These are products for which there is a history of outbreaks and, therefore, good reason to do appropriate supplier verification activities.

(Comment 670) Some comments support the inclusion of sampling and testing of the raw material or other ingredient as an appropriate supplier verification activity, and note that verification testing is more effective when conducted by the supplier than the receiving facility because the supplier can control the lot of product tested. However, other comments oppose it, stating that sampling and testing is not useful for products with short shelf life, such as fresh produce.

(Response 670) We are retaining sampling and testing as an appropriate supplier verification activity. As noted in our memorandum on supplier programs, sampling and testing are commonly used by industry in the verification of supplier performance (Ref. 83). We have previously discussed factors that impact the utility and frequency of raw material/ingredient testing (see the Appendix published in the 2013 proposed human preventive controls rule (78 FR 3646 at 3818-3820); republished in its entirety with corrected reference numbers on March 20, 2013, 78 FR 17142 at 17149-17151). We agree that there are benefits in having sampling and testing conducted by the supplier, because the supplier can then take appropriate action with respect to the findings, including not shipping contaminated product. However, because contamination with microbial pathogens is likely to be non-homogeneous and the numbers of pathogens are likely to be low, a negative does not guarantee the absence of contamination. This should be taken into account when deciding which verification activity (or activities) is appropriate. Because of the limitations of sampling and testing, the controls the supplier has in place to minimize contamination, and the management of those controls, are key in determining when sampling and testing is appropriate as a verification activity. For short shelf life products, where holding product pending test results can negatively impact product shelf life, an onsite audit to verify control of hazards may be more appropriate than sampling and testing.

(Comment 671) Some comments ask us to specify in the regulatory text that sampling and testing can be conducted by or on behalf of the supplier or the receiving facility.

(Response 671) The provisions of § 117.415 specify the responsibilities of the receiving facility, and allow a receiving facility to conduct all supplier verification activities, including sampling and testing. These provisions also provide that a supplier, or an entity other than the receiving facility (such as an entity in the supply chain between the supplier and the receiving facility), can conduct sampling and testing, provided that the receiving facility reviews and assesses the documentation provided by the supplier. The rule places no restrictions on when a receiving facility, a supplier, or an entity other than the receiving facility could have a business relationship with a third party (such as a contract laboratory) to conduct sampling and testing.

(Comment 672) Some comments suggest that, for a facility regularly undergoing audits, reviewing a “supplier's relevant food safety records” should allow for the receiving facility to review documentation related to pre-existing audits. These comments ask us to revise the provision to add “including, but not limited to, records related to audits previously performed on the supplier's facility.”

(Response 672) We decline this request. The comment misinterprets what we mean by a “supplier's relevant food safety records.” The rule provides for onsite audits as a verification activity, as well as reviewing a “supplier's relevant food safety records.” When an annual audit is determined to be an appropriate verification activity (see § 117.430(b)(1)), the audit would be reviewed by the receiving facility, but a review of this audit is not what we meant by a “supplier's relevant food safety records.” As described in our memorandum on supplier programs, food safety records are records documenting that the food safety procedures that have been established to control hazards are being followed and are adequately controlling such hazards (Ref. 83). Thus, a receiving facility may obtain documentation of a supplier's control measures for a particular lot of a raw material or ingredient provided to the receiving facility, such as the records created when a process control measure was applied. The food safety records may also include supplier records that show that the supplier's supplier has controlled a hazard. Such records may include audits, for example, when the supplier's supplier controls the hazard and the supplier's records include records of an audit conducted with respect to the hazard control activities of the supplier's supplier. To emphasize that the review of a supplier's relevant food safety records can include records other than records of audits, we have revised the documentation requirements applicable to review of a supplier's food safety records to specify that the documentation must include the general nature of the records reviewed (see § 117.475(c)(9)). By “general nature of the records reviewed,” we mean information such as “records of process controls.”

(Comment 673) Some comments support the inclusion of other appropriate supplier verification activities based on the risks associated with the ingredient and the supplier, because it provides flexibility for facilities to design risk-based programs that are appropriate for their operations. Comments suggest other verification activities may include receiving raw materials and other ingredients from a supplier without a full audit report if the supplier maintains certification to a standard recognized by GFSI; providing for documentary verification (such as fact-specific questionnaires and representations exchanged between the supplier and the receiving facility); and confirming that a facility, especially a small manufacturing facility, is licensed by the appropriate State or local regulatory authority.

(Response 673) We are retaining this provision to allow other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material or other ingredient. We have revised the regulatory text to refer to “supplier performance and the risk associated with the raw material or other ingredient” because “supplier performance” is more appropriate than “risk associated with the supplier.” We use the term “risk” as defined by the Codex Alimentarius Commission to be “a function of the probability of an adverse health effect and the severity of that effect, consequential to a hazard(s) in food” (Ref. 90). As discussed in section XLIV.D, the considerations for supplier performance, which can be related to the probability of a hazard in the raw material or ingredient and the severity of adverse health effects that can result, are broader than this.

We agree that a supplier's certification to a GFSI scheme that considers FDA food safety regulations can be a consideration in the determination of the type and frequency of the verification activity conducted. Similarly, fact-specific questionnaires and representations exchanged between the supplier and the receiving facility can be a consideration in the determination of the type and frequency of the verification activity conducted. Confirming that a facility is licensed by the appropriate State or local regulatory authority should not serve as the only verification that a supplier is controlling the hazard, because the requirements for a license and the degree of inspectional oversight could vary greatly. We do provide for modified supplier verification activities for qualified facilities, which are very small businesses (§ 117.430(c)).

C. Purpose of Supplier Verification Activities for Raw Materials and Other Ingredients (Final § 117.410(c))

We proposed to require that a supplier program include verification activities, as appropriate to the hazard, and documentation of these activities, to verify that: (1) The hazard is significantly minimized or prevented; (2) the incoming raw material or ingredient is not adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act; and (3) the incoming raw material or ingredient is produced in compliance with the requirements of applicable FDA food safety regulations (proposed § 117.136(a)(3)(ii)). We have revised the provision to specify that the supply-chain program must provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented. If the supply-chain program provides assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented, it is not necessary to also specify that the incoming raw material or ingredient is not adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. We also have deleted the requirement that the verification activities must verify that the incoming raw material or ingredient is produced in compliance with the requirements of applicable FDA food safety regulations and instead focused that requirement as a factor that must be considered in approving suppliers and determining the appropriate supplier verification activities and the frequency with which they are conducted rather than as one of the stated purposes of the supply-chain program. See the regulatory text of § 117.410(d)(i)(iii)(B).

(Comment 674) Some comments ask us to revise this provision to state that the receiving facility's use of the incoming raw material or ingredient will not cause the finished food to be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. These comments assert that FSMA does not mandate, nor is it reasonable to expect, that incoming raw materials and ingredients will not be adulterated under section 402, and that it is acceptable for a receiving facility to control the “adulterating hazard,” even if it relies on the supplier to control other hazards.

(Response 674) We decline this request. We acknowledge that in some circumstances a receiving facility may rely on the supplier to control certain hazards, while controlling other hazards itself. For example, a receiving facility that produces peanut-derived products could rely on its supplier for the control of the chemical hazard aflatoxin, but control the biological hazard Salmonella through its own roasting process. However, the supply-chain program applies to hazards requiring a supply-chain-applied control, and the supply-chain program must provide assurance that a hazard requiring a supply-chain-applied control has been significantly minimized or prevented. In the example where the receiving facility is relying on the supplier to control aflatoxin, the provision would require the receiving facility to verify that the hazard (aflatoxin) has been significantly minimized or prevented by the supplier.

D. Factors That Must Be Considered When Approving Suppliers and Determining Appropriate Supplier Verification Activities for Raw Materials and Other Ingredients (Final § 117.410(d))

We proposed that in determining and documenting the appropriate verification activities, the receiving facility must consider the following: (1) The hazard analysis, including the nature of the hazard, applicable to the raw material and ingredients; (2) where the preventive controls for those hazards are applied for the raw material and ingredients—such as at the supplier or the supplier's supplier; (3) the supplier's procedures, processes, and practices related to the safety of the raw material and ingredients; (4) applicable FDA food safety regulations and information relevant to the supplier's compliance with those regulations, including an FDA warning letter or import alert relating to the safety of the food; (5) the supplier's food safety performance history relevant to the raw materials or ingredients that the receiving facility receives from the supplier, including available information about results from testing raw materials or ingredients for hazards, audit results relating to the safety of the food, and responsiveness of the supplier in correcting problems; and (6) any other factors as appropriate and necessary, such as storage and transportation practices (proposed § 117.136(b)).

As discussed in Response 657, Response 658, and section XLVI.A, we have revised the regulatory text regarding use of approved suppliers to more explicitly state that the receiving facility must approve suppliers. The factors that must be considered in determining the appropriate supplier verification activities are equally relevant to approving suppliers, and the final rule requires that these factors must be considered in approving suppliers, as well as in determining appropriate supplier verification activities. For clarity and consistency with terms used throughout the final provisions for a supply-chain program, the final rule specifies “the entity or entities that will be applying controls for the hazards requiring a supply-chain-applied control” rather than “Where the preventive controls for those hazards are applied for the raw material and ingredients—such as at the supplier or the supplier's supplier.”

As discussed in Response 673, we are using the term “supplier performance,” rather than “risk of supplier,” when discussing factors associated with suppliers. The final rule groups three of the proposed factors as “supplier performance.” As a companion change to emphasize that “supplier performance” applies to all three of these factors, we refer to the supplier's “food safety history” rather than “food safety performance history.”

We also have revised the regulatory text to clarify that consideration of supplier performance includes, when applicable, relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States and information relevant to the supplier's compliance with those laws and regulations. We made this change because the final rule includes several provisions that acknowledge that some food establishments, including food establishments that are “suppliers” as that term is defined in this rule, operate in a foreign country. (See, e.g., the definition of “qualified auditor” in § 117.3 and §§ 117.201(a)(2)(ii), 117.201(e), 117.405(a)(2), 117.430(c), 117.435(c)(1)(ii), 117.435(c)(2), and 117.475(c)(15)). Some of these provisions (e.g., §§ 117.405(a)(2), 117.430(c), 117.435(c)(1)(ii), 117.435(c)(2), and 117.475(c)(15)) are in the requirements for a supply-chain program. When the supplier is in a foreign country whose food safety system FDA has officially recognized as comparable or determined to be equivalent to that of the United States, a receiving facility may substitute the written results of an inspection by the applicable food safety authority for an audit, provided that certain conditions are met (see § 117.435(c)(1)(ii) and (2)).

The final rule provides flexibility for alternative verification requirements for certain entities (see § 117.430(c), (d), and (e)). We have revised the factors that must be considered regarding supplier performance to reflect the flexibility the rule provides for conducting supplier verification activities for these entities (see § 117.410(d)(2)).

(Comment 675) Some comments support the flexibility for receiving facilities to determine the appropriate supplier verification activities and frequency with which to conduct these activities. Some comments state that not all of the factors that we proposed a receiving facility consider are relevant for the process of selecting the verification activity. These comments suggest changing the regulatory text to require a receiving facility to consider “both food and supplier related risks, including the following, as appropriate” and then listing the factors as proposed. Other comments suggested similar changes to the regulatory text.

(Response 675) We disagree that some of the factors that we proposed a receiving facility must consider are not relevant to determining the appropriate verification activity. Every factor might not be determinative in all cases, and our requirement merely to consider each factor does not assume so. However, any one of these factors could be crucial depending on the food, the hazard, and the nature of the preventive control. We continue to consider it appropriate to require receiving facilities to consider each of these factors in making their determinations about the appropriate verification activities.

(Comment 676) Some comments ask us to clarify that the phrase “the nature of the hazard” means the nature of the hazard requiring control.

(Response 676) We have revised the regulatory text to specify “the nature of the hazard controlled before receipt of the raw material or other ingredient.” The revised regulatory text is consistent with regulatory text in the provisions for the preventive control management components (see § 117.140(b), which specifies “taking into account the nature of the hazard controlled before receipt of the raw material or other ingredient”).

(Comment 677) Some comments agree that a receiving facility must consider where the preventive controls for hazards are applied for the raw materials and ingredients, such as at the supplier or the supplier's supplier. Other comments assert that this consideration should not be used to determine if supplier oversight is needed. Other comments state that it may be hard to review the procedures used by a supplier's supplier and beyond and ask us to provide clear flexibility regarding requirements for the content and performance of a receiving facility's supplier program.

(Response 677) The purpose of the requirement to consider where the hazard is controlled is to assist a receiving facility in determining what supplier verification activities are appropriate, not to determine whether supplier oversight is needed. Once a receiving facility has already determined that a hazard requiring a preventive control is controlled before receipt of a raw material or other ingredient, supplier oversight is needed.

We recognize that there is need for additional flexibility regarding conducting supplier verification activities. As discussed in Response 657, we are providing significant additional flexibility to address this situation in the final rule.

(Comment 678) Some comments object to the proposed requirement to consider applicable FDA food safety regulations and information relevant to the supplier's compliance with those regulations, including an FDA warning letter or import alert relating to the safety of the food. These comments assert that it is difficult for a receiving facility to know a supplier's compliance status, because it is not easy to obtain this kind of information in a timely fashion. Some comments ask us to develop an online database to house this information to help make it easier to find. Some comments ask us to replace the broad requirement to consider applicable FDA food safety regulations and information relevant to the supplier's compliance with those regulations with a narrower requirement to only consider any FDA warning letter or import alert relating to the safety of the food.

(Response 678) We are retaining the broad requirement to consider applicable FDA food safety regulations and information relevant to the supplier's compliance with those regulations. Such information is relevant to supplier performance regardless of whether there is an applicable warning letter or import alert. For example, if a receiving facility purchases canned green beans to use in making vegetable soup, it is appropriate for the receiving facility to verify that its supplier is producing the canned green beans in accordance with part 113.

We currently have a searchable online database for warning letters (Ref. 91) and another searchable online database for import alerts (Ref. 92). Both of these databases are available to the public from our homepage at http://www.fda.gov . We also publicize actions to suspend a facility's registration, such as in our 2012 suspension of registration due to Salmonella contamination of nut butter and nut products manufactured, processed, packed, and held by the facility (Ref. 93). Under the requirement to consider supplier performance with respect to applicable food safety regulations, a receiving facility cannot ignore published information relating to a supplier's compliance with applicable FDA food safety regulations in determining the appropriate verification activities, such as publicized information regarding suspension of registration. To emphasize this point, we have revised the regulatory text to specify that the applicable information includes “other FDA compliance actions related to food safety.” We also have revised the regulatory text to specify that the compliance relates to an FDA warning letter or import alert relating to the “safety of food,” rather than the “safety of the food,” to provide flexibility for a receiving facility to identify information that may raise a question about a supplier's compliance history in a more general way, rather than only with respect to a particular food.

(Comment 679) Some comments state we should only require consideration of the supplier's food safety performance history relevant to the hazards requiring control in the raw materials or ingredients that the receiving facility receives from the supplier.

(Response 679) Consideration of the supplier's food safety history relevant to the raw materials or other ingredients that the receiving facility receives from the supplier will be focused on the hazard that the supplier is controlling because that is the food safety information the receiving facility will consider to be most relevant and for which the receiving facility would develop a history. The information could indicate that certain verification activities may be more appropriate than others for verifying the control of the hazard at that particular supplier or provide information useful in determining a frequency for the verification activity. However, we decline to revise the provision to specify that consideration should be limited to the hazards requiring control. Even though this is the most relevant information, a facility may become aware of information with respect to a raw material or other ingredient provided to another customer of the supplier that may suggest the need to conduct a different verification activity. For example, if the receiving facility is obtaining a cheese product from a supplier that is controlling pathogens such as L. monocytogenes and Salmonella, and becomes aware that cheeses from this supplier have been associated with an undeclared allergen due to improper labeling, the receiving facility would determine that it should implement verification activities related to label control to prevent undeclared allergens.

(Comment 680) Some comments ask us to replace the phrase “examples of factors that a receiving facility may determine are appropriate and necessary are storage and transportation” with “such as storage and transportation.”

(Response 680) We have made this editorial change.

E. Supplier Non-Conformance (Final § 117.410(e))

We proposed that if the owner, operator, or agent in charge of a receiving facility determines through auditing, verification testing, relevant consumer, customer or other complaints, or otherwise that the supplier is not controlling hazards that the receiving facility has identified as significant, the receiving facility must take and document prompt action in accordance with § 117.150 to ensure that raw materials or ingredients from the supplier do not cause food that is manufactured or processed by the receiving facility to be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act (proposed § 117.136(f)).

(Comment 681) Some comments object to the use of the word “significant” in this proposed provision, recommending that we replace it with “requiring control by the supplier.” These comments reason that these activities are only necessary if the receiving facility is relying on the supplier to control the specific hazards.

(Response 681) We have revised the regulatory text to state “a hazard requiring a supply-chain-applied control” rather than “significant.”

XLV. Subpart G: New Requirement Specifying the Responsibilities of the Receiving Facility (Final § 117.415)

As discussed in Response 657, after considering comments we are providing flexibility for an entity other than the receiving facility to determine, conduct, and document the appropriate supplier verification activities, provided that the receiving facility reviews and assesses the entity's applicable documentation, and documents the receiving facility's review and assessment. We are specifying that flexibility in § 117.415. We have titled this section “Responsibilities of the receiving facility” to emphasize the responsibility of the receiving facility for its supply-chain program. (See Response 657 and Response 658.) Although comments focus on flexibility for an entity in the supply chain between the supplier and the receiving facility to perform supplier verification activities, and such entities are the most likely entities to be the entities determining, conducting, and documenting supplier verification activities, the flexibility provided by the rule is not limited to such entities.

The rule does, however, set some bounds on the flexibility for determining, conducting, and documenting appropriate supplier verification activities. For example, as discussed in Response 657 and Response 658, only the receiving facility can approve its suppliers. As another example, although it would not be appropriate for a supplier to determine the appropriate supplier verification activities for itself, we had proposed that it would be appropriate for a supplier to conduct sampling and testing of raw materials and ingredients as a supplier verification activity (proposed § 117.136(c)(1)(ii)), and we are retaining that provision in the final rule (see § 117.415(a)(4)). Likewise, it is common industry practice for a supplier to arrange for an audit by a third party (Ref. 83), and the new flexibility provision does not prohibit a receiving facility from relying on an audit provided by its supplier when the audit of the supplier was conducted by a third-party qualified auditor in accordance with the requirements of the rule applicable to audits (§ 117.435). See § 117.415 for the full text of this new flexibility provision.

XLVI. Subpart G: Comments on Using Approved Suppliers and Determining Appropriate Supplier Verification Activities

We proposed requirements for the use of approved suppliers (proposed § 117.136(a)(3)(i)) and for determining and documenting appropriate supplier verification activities (proposed § 117.136(b)). See table 48 for a description of the final provisions and the changes we have made to clarify the requirements.

A. Using Approved Suppliers (Final § 117.420)

We proposed to require that a supplier program include verification activities, as appropriate to the hazard, and documentation of these activities, to ensure raw materials and ingredients are received only from suppliers approved for control of the hazard(s) in that raw material or ingredient (or, when necessary and appropriate, on a temporary basis from unapproved suppliers whose raw materials or ingredients the receiving facility subjects to adequate verification activities before acceptance for use) (proposed § 117.136(a)(i)).

This proposed requirement included an implicit requirement that a facility must approve suppliers. For clarity, we make that requirement, and documentation of that approval, explicit in the final rule. (See § 117.420(a)).

The rule continues to require that a receiving facility ensure raw materials and other ingredients are received only from suppliers approved for control of the hazard(s) in that raw material or other ingredient (or, when necessary and appropriate, on a temporary basis from unapproved suppliers whose raw materials or other ingredients are subject to adequate verification activities before acceptance for use), but we revised the provision to specify that the receiving facility must do so by establishing and following written procedures, and require documentation that these procedures were followed. To simplify the provisions, we also established a definition for the term “written procedures for receiving raw materials and other ingredients” to mean written procedures to ensure that raw materials and other ingredients are received only from suppliers approved by the receiving facility (or, when necessary and appropriate, on a temporary basis from unapproved suppliers whose raw materials or other ingredients are subjected to adequate verification activities before acceptance for use), and use that term throughout subpart G. For example, a facility could design a checklist for employees to use when raw materials and other ingredients are delivered to the facility. We decided to specify use of written procedures for receiving raw materials and other ingredients in light of the flexibility the final rule provides for an entity other than the receiving facility (such as an entity in the supply chain between the supplier) to conduct this activity (see § 117.415(a)(2)). Although we agree that such an entity can do this as a service to the receiving facility, a written procedure is appropriate to ensure a robust and meaningful verification. As a companion change, we revised the associated documentation requirement to specify documentation of use of the written procedures.

(Comment 682) Some comments support the requirement to approve suppliers. Other comments ask us to provide guidance for use of unapproved suppliers on a temporary basis, because the use of unapproved suppliers could be a high risk situation. Other comments emphasize that if the final supplier approval process is significantly changed compared to the proposed supplier approval process, industry must have enough time to plan and develop supplier verification plans and a process for unapproved sources.

(Response 682) We will consider including guidance for use of unapproved suppliers on a temporary basis in guidance that we intend to issue regarding the supply-chain program. We do not believe that the final requirements regarding the use of approved suppliers will require increased implementation time. The principal change is to allow flexibility for entities in the supply chain other than the receiving facility to establish written procedures for receiving raw materials and other ingredients and document that written procedures for receiving raw materials and other ingredients are being followed.

B. Determining Appropriate Verification Activities (Final § 117.425)

The rule requires that a supply-chain program include determining appropriate supplier verification activities (including determining the frequency of conducting the activity) (see § 117.410(a)(2)). Comments that addressed the proposed provision for determining appropriate verification activities (which provides flexibility to the facility to determine the appropriate verification activities) did not disagree with it. (See Comment 675.) The rule also requires that certain factors must be considered in determining appropriate verification activities (§ 117.410(d)). We discuss those factors, and comments that addressed those factors, in section XLIV.D. Both of these provisions (i.e., § 117.410(a)(2) and § 117.410(d)) derive from the proposed requirement regarding factors that must be considered in determining appropriate supplier verification activities (proposed § 117.136(b)). To give prominence to both the responsibility and the flexibility to determine appropriate supplier verification activities, and emphasize the factors that must be considered in addressing this responsibility, new § 117.425 specifies that appropriate supplier verification activities (including the frequency of conducting the activity) must be determined in accordance with the requirements of § 117.410(d).

XLVII. Subpart G: Comments on Conducting Supplier Verification Activities for Raw Materials and Other Ingredients

We proposed requirements applicable to conducting supplier verification activities (proposed § 117.136(c)). Most comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 688, Comment 690, and Comment 695) or ask us to clarify how we will interpret the provision (see, e.g., Comment 684 and Comment 685). In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 49.

A. Requirement To Conduct One or More Supplier Verification Activities (Final § 117.430(a))

With two exceptions, we proposed that the receiving facility must conduct and document one or more specified supplier verification activities for each supplier before using the raw material or ingredient and periodically thereafter (proposed § 117.136(c)(1)). See section XLIV.B for a discussion of comments regarding the appropriate verification activities (i.e., onsite audits, sampling and testing, records review, and other appropriate supplier verification activities based on supplier performance and the risk associated with the raw material or other ingredient). See sections XLVII.C and XLVII.D for a discussion of the proposed exceptions to this requirement to conduct and document verification activities. As discussed in section XLVII.E, the final rule provides for an additional circumstance in which an alternative supplier verification activity may be conducted—i.e., when the supplier is a shell egg producer that has fewer than 3,000 laying hens.

B. Requirement for an Onsite Audit as a Verification Activity When a Hazard Has a Reasonable Probability of Resulting in Serious Adverse Health Consequences or Death to Humans (Final § 117.430(b))

We proposed that when a hazard in a raw material or ingredient will be controlled by the supplier and is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans, the receiving facility must have documentation of an onsite audit of the supplier before using the raw material or ingredient from the supplier and at least annually thereafter. We also proposed that this requirement does not apply if the receiving facility documents its determination that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled. (Proposed § 117.136(c)(2)).

(Comment 683) Some comments support the provision for audits when there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans. Some of these comments state that audits should be the default verification activity in order to eliminate facilities choosing the lowest cost option regardless of whether it was best for food safety. Other comments state that audits would be the best option for facilities that cannot visit each supplier annually and that onsite inspection can identify problems in ways that paperwork reviews cannot.

However, other comments oppose this requirement. Some of these comments express concern that this requirement does not allow the necessary flexibility for a facility to tailor an effective supplier program based upon risk. Other comments state that annual audits are neither the preferred nor the most effective verification measure and express concern that the provision sets a precedent that annual audits are the preferred or most effective verification measure and that other verification activities often can help paint a more accurate picture of a supplier over time. Other comments express concern that audits only give a “snapshot” of a supplier's performance at a given time and ask that we not overemphasize audits.

(Response 683) We are retaining this provision as proposed. As we indicated in the Appendix of our 2013 proposed preventive controls rule, an increasing number of establishments are requiring, as a condition of doing business, that their suppliers become certified to food safety management schemes that involve third-party audits (78 FR 3646 at 3818-3820); republished in its entirety with corrected reference numbers on March 20, 2013, 78 FR 17142 at 17149-17151). An online survey of retail suppliers noted that such certification enhanced their ability to produce safe food (Ref. 94). We agree that onsite audits can identify problems in ways that paperwork reviews cannot. Because an audit involves more than simply observing the facility producing a food product, we believe it is more than just a “snapshot” of the supplier's programs. As discussed in Response 669, onsite audits can include observations, records review and employee interviews.

The requirement to conduct an annual audit in specified circumstances is risk-based because the specified circumstances are limited to situations where there is a reasonable probability that exposure to the hazard in the raw material or other ingredient will result in serious adverse health consequences or death to humans. The food safety controls applied by suppliers of such raw materials or other ingredients are more important than for other types of hazards because of the serious adverse health consequences that can occur if the hazards are not controlled. Annual audits are required of certification schemes that are benchmarked to the Global Food Safety Initiative Guidance Document for GFSI recognition (Ref. 95). We disagree that this requirement does not provide flexibility in choosing verification activities; in recognition that other verification activities can help paint a more accurate picture of a supplier over time, we have provided for alternative verification activities or audit frequencies if the receiving facility documents its determination that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled (see § 117.430(b)(2)).

(Comment 684) Some comments ask us to define those products that may trigger the requirement for an audit, especially with respect to farms. These comments question how to assess whether a hazard could result in serious adverse health consequences or death to humans.

(Response 684) We decline this request. Any list of such products would be extensive and it is unlikely we could capture all the circumstances in which this could apply. Hazards for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans are those for which a recall of a violative product posing such a hazard is designated as “Class 1” under 21 CFR 7.3(m)(1). Examples of such hazards that, in some circumstances, have resulted in serious adverse health consequences or death to humans include pathogens or their toxins in RTE foods and undeclared food allergens. Foods (other than dietary supplements or infant formula) containing a hazard for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans or animals are considered reportable foods; examples of foods FDA has considered to present a reasonable probability of serious adverse health consequences or death can be found in our Guidance for Industry: Questions and Answers Regarding the Reportable Food Registry as Established by the Food and Drug Administration Amendments Act of 2007 (Ref. 32) and (Ref. 33).

(Comment 685) Some comments ask us to clarify the role of third-party audits and the GAP program and ask us to allow GAPs to be a voluntary mechanism to satisfy buyer demands for food safety certification.

(Response 685) Although the rule would not require a receiving facility to hire a third party to conduct an audit, onsite audits can include third-party audits. There are likely to be benefits for suppliers to have a third-party audit, because the same audit may be acceptable by multiple receiving facilities as an appropriate supplier verification activity. For farms, GAPs audits may be viewed as an appropriate supplier verification activity. GAPs audits and other third-party audits would need to comply with the requirements of this rule applicable to onsite audits (see § 117.435).

(Comment 686) Some comments assert that we should delete this provision entirely, stating that this requirement for an audit is “outside the scope of FSMA.” Other comments state that manufacturing or processing facilities should not require suppliers that are produce farms to conduct annual onsite audits in three specified circumstances: (1) If the farm is not subject to the produce safety standards (e.g., the produce is not eaten raw, or the farm is not covered because total annual sales exclude it, because these farms are so small as to pose minimal risk to the food supply and audits would be cost-prohibitive for them); (2) if the farm is subject to the produce safety standards (because these farms are already regulated); and (3) if the farm has been GAP certified (because this would mean they were undergoing duplicative requirements).

(Response 686) When a supplier farm is not subject to the produce safety standards because of low sales revenue, we have provided for modified verification requirements (see § 117.430(d)). For produce not subject to the produce safety standards because they are rarely consumed raw, we would not expect receiving facilities to identify hazards requiring a preventive control that would be controlled before receipt of the raw material or ingredient; thus such produce would not be subject to the supply-chain program.

We disagree that a farm should not be subject to the requirements of the supply-chain program in this rule simply because it is subject to the produce safety rule. The produce subject to the produce safety rule may contain hazards that could result in serious adverse health consequences or death to humans; unless such produce will receive a treatment that significantly minimizes these hazards, the controls for the hazards are those applied by the farm. GAP certification involves an audit of the farm; as noted in Response 685, GAPs audits that comply with the requirements of this rule may be viewed as an appropriate verification activity, and the certification audit could serve two purposes.

We disagree that a requirement for an audit is “outside the scope of FSMA.” See the discussion in Response 669 regarding the provision in section 419(c)(1)(E) of the FD&C Act that the regulation issuing standards for the safety of produce “not require a business to hire a consultant or other third party to identify, implement, certify compliance with the procedures, processes and practices” and the provision in section 418(n)(3)(D) of the FD&C Act that the preventive controls regulation “not require a facility to hire a consultant or other third party to identify, implement, certify or audit preventive controls.” As noted in that response, a facility is not required to hire a third party to conduct an audit.

(Comment 687) Some comments support the flexibility to not conduct an annual onsite audit if the receiving facility documents its determination that other verification activities and/or less frequent onsite auditing of the supplier provide adequate assurance that the hazards are controlled. Other comments question how a facility would prove that alternative measures are equally effective as an annual audit, when it is not known how effective an annual audit is. Other comments assert that the provision is meaningless because a farm or facility would not take the legal risk of verifying it has received “adequate assurance,” because this would be subject to an FDA inspector's interpretation.

(Response 687) This provision requires a facility to use a verification activity that provides adequate assurance that a hazard is controlled, not to determine how effective an audit is and assess whether alternative measures are equally effective.

As an example of using an alternative approach to an annual onsite audit, consider the situation in which a receiving facility is part of a larger corporation, is making trail mix, and obtains roasted peanuts from a supplier that is a subsidiary of the corporation and is operating under the same food safety system as the receiving facility. The receiving facility could determine that the food safety requirements established by the parent company and applied at the subsidiary provide the needed assurance that Salmonella in raw peanuts is adequately controlled. The facility could support its decision by documenting this determination, including the procedures in effect at the supplier and the activities used by the corporation to verify that the subsidiary operates in accordance with corporate food safety policies and practices to ensure that hazards are adequately controlled.

We disagree that the provision is meaningless because a farm or facility would see a legal risk in using an alternative to annual onsite audits as a supplier verification activity. First, a farm would be a supplier and would not be the entity that would determine whether an onsite audit or some other supplier verification activity is appropriate. As established in § 117.415, determining the appropriate supplier verification activity would be the responsibility of a receiving facility, and although appropriate supplier verification activities could be determined by another entity in the receiving facility's supply chain as a service, the supplier verification activities could not be determined by the supplier itself. Second, although there is always a potential for differences in interpretation between an FDA inspector and an inspected firm, we are establishing a new inspection paradigm focused on whether firms are implementing systems that effectively prevent food contamination, requiring fundamentally different approaches to food safety inspection and compliance. For example, FDA intends to deploy specialized investigators, backed up by technical experts, to assess the soundness and performance of a facility's food safety system (Ref. 12). In addition, a central element of FDA's strategy to gain industry compliance is to help make available to farmers, food processors, and importers—especially small businesses—the education and technical assistance they need to understand and implement FSMA's new prevention-oriented standards (Ref. 6). The new inspection paradigm and the assistance and training for industry should help minimize different interpretations between industry and regulators.

(Comment 688) Some comments ask us to require facilities to notify us when they determine that an alternative to an audit is an appropriate supplier verification activity and be able to justify and document how an alternative verification activity provides the same level of assurance as an onsite audit.

(Response 688) We decline this request. We will assess a facility's supplier verification activities during a facility inspection, including the documentation that an alternative verification activity provides the same level of assurance as an onsite audit.

(Comment 689) Some comments ask us to specify the type of documentation required for our investigators to determine when the activities are “in compliance with the law and sufficient to protect public health.”

(Response 689) We decline this request. The facility's approach to the determination, and the applicable documentation required to support that determination, would depend on the circumstances. For example, in Response 687 we discuss a possible approach in a situation in which a receiving facility is part of a corporation and obtains an ingredient from a supplier that is a subsidiary of the corporation and is operating under the same food safety system as the receiving facility. Another situation could be when a receiving facility has many years of experience with the same supplier, but the approach and documentation in that situation likely would be different from an approach and documentation used when the supplier and the receiving facility are part of the same corporation.

(Comment 690) Some comments ask that we not limit the determination for a supplier verification activity other than an onsite audit to a determination by the receiving facility. These comments explain that the corporate parent of a facility can be the entity that makes this determination. These comments suggest that we can account for the role of the corporation by specifying that a facility documents “the determination” (rather than “its” determination).

(Response 690) We have agreed that the corporate parent of a facility can be active in developing and implementing the facility's food safety plan (see section XXIV.A). However, the specific suggestion of these comments is not necessary to achieve the outcome requested by the comments because of editorial changes we made to provide for entities other than the receiving facility to determine and conduct the appropriate supplier verification activities.

C. Alternative Verification Activity When the Supplier Is a Qualified Facility (Final § 117.430(c))

We proposed that if a supplier is a qualified facility the receiving facility need not comply with the specified verification requirements if the receiving facility: (1) Documents, at the end of each calendar year, that the supplier is a qualified facility; and (2) obtains written assurance, at least every 2 years, that the supplier is producing the raw material or ingredient in compliance with applicable FDA food safety regulations and that the raw material or ingredient is not adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act. The written assurance must include a brief description of the processes and procedures that the supplier is following to ensure the safety of the food.

This rule has several provisions that require written assurances. We have established specific elements that each of these written assurances must include—i.e., the effective date; printed names and signatures of authorized officials; and the applicable assurance (see § 117.335).

We have revised the provision to clarify that the receiving facility must have written assurance that a facility is a qualified facility: (1) Before first approving the supplier for an applicable calendar year; and (2) by December 31 of each calendar year (rather than “at the end of the calendar year”) and that the written assurance is regarding the status of the qualified facility for the following calendar year. By specifying “by December 31,” a receiving facility can work with each applicable supplier to determine the specific date within a calendar year for that supplier to annually notify the receiving facility about its status. See also Response 155, Response 592, and Response 593, the requirements in § 117.201(a) for an annual determination of the status of a facility as a qualified facility, and the requirements in § 117.201(d) that apply when the status of a facility changes from “qualified facility” to “not a qualified facility.” A receiving facility and its suppliers have flexibility to approach the potential for the status of a facility to shift between “qualified facility” and “not a qualified facility” (or vice versa) in a way that works best for their specific business relationship.

As discussed in section XLIV.D, we have revised the requirements for considering supplier performance to provide that the receiving facility may, when applicable, consider relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States, and information relevant to the supplier's compliance with those laws and regulations, rather than consider applicable FDA food safety regulations and information relevant to the supplier's compliance with applicable FDA food safety regulations. We have made a conforming change to the alternative verification activities for a qualified facility (see the regulatory text of § 117.430(c)(2)).

(Comment 691) Some comments support this alternative supplier verification activity because it provides flexibility. Other comments ask us to revise the provision so that it only requires that the supplier document its status as a qualified facility. Still other comments ask us to remove all provisions on qualified facilities because they view these provisions as effectively adding a second layer of regulations on produce farms, and claim this is not authorized by FSMA. Other comments ask us to delete the requirement that the written assurance include a brief description of the processes and procedures that the supplier is following to ensure the safety of the food.

(Response 691) We have revised the provisions for an alternative verification activity for a qualified facility to better align with the responsibilities of a qualified facility to submit an attestation to FDA about its food safety practices (§ 117.201(b)(2)(i)) or its compliance with State, local, county, tribal, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign countries (§ 117.201(b)(2)(ii)) (see the regulatory text of § 117.430(c)). Importantly, a qualified facility is still subject to CGMPs and the FD&C Act, and if the qualified facility is a supplier controlling a hazard it is reasonable for a receiving facility to expect the qualified facility to provide to the receiving facility an assurance that reflects an attestation the facility has made to FDA. As modified, one possibility is for a qualified facility to provide a receiving facility with a brief description of the preventive controls it is implementing to control the applicable hazard, consistent with an attestation of its food safety practices in accordance with § 117.201(a)(2)(i). For example, the qualified facility could state that its manufacturing processes include a lethality step for microbial pathogens of concern. As required by § 117.201(f), a qualified facility that submits an attestation to FDA about its food safety practices would have documentation of those practices to support its attestation to FDA and, thus, would have documentation to support its written assurance to the receiving facility. Although a qualified facility that submits an attestation to FDA about its food safety practices also would have documentation of monitoring the performance of the preventive controls to ensure that such controls are effective as required by § 117.201(a)(2)(i), we are not requiring the qualified facility to describe its monitoring of the performance of preventive controls to ensure that they are effective. Alternatively, a qualified facility could provide a receiving facility with a statement that the facility is in compliance with State, local, county, tribal, or other applicable non-Federal food safety law, including relevant laws and regulations of foreign countries.

We disagree that the alternative verification activity for produce farms would add a second layer of regulations on produce farms and are retaining this provision. See Response 693.

(Comment 692) Some comments ask us to remove the requirement that the written assurance be obtained at least every 2 years. Other comments ask us to revise the purpose of the written assurance from “the raw material or ingredient is not adulterated” to “the receiving facility's use of the raw material or ingredient will not cause the finished food to be adulterated.”

(Response 692) We decline these requests. A supplier verification activity needs to consider supplier performance on an ongoing basis. Procedures and practices evolve over time, and it is appropriate for a receiving facility that is obtaining written assurance from a supplier as an alternative verification activity to be aware of both procedures and practices that have changed, as well as procedures and practices that have stayed the same. The specified timeframe for updating the written assurance—i.e., at least every two years—is reasonable.

A supplier can only provide assurance about raw materials and other ingredients that it supplies to the receiving facility, not about the food product that the receiving facility will produce using the supplier's raw material or other ingredients.

D. Alternative Verification Activity When the Supplier Is a Produce Farm That Is Not a “Covered Farm” for the Purposes of the Future Produce Safety Rule (Final § 117.430(d))

We proposed that if a supplier is a farm that is not subject to the requirements that we have proposed to be established in the produce safety rule in accordance with proposed § 112.4 regarding the raw material or ingredient that the receiving facility receives from the farm, the receiving facility does not need to comply with the verification requirements if the receiving facility: (1) Documents, at the end of each calendar year, that the raw material or ingredient provided by the supplier is not subject to the produce safety rule; and (2) obtains written assurance, at least every 2 years, that the supplier is producing the raw material or ingredient in compliance with applicable FDA food safety regulations and that the raw material or ingredient is not adulterated under section 402 of the FD&C Act. See also § 117.335, which establishes specific elements that this written assurance must include—i.e., the effective date; printed names and signatures of authorized officials; and the applicable assurance.

Produce farms that are not “covered farms” under § 112.4 of the forthcoming produce safety rule have less than $25,000 in annual sales averaged over the previous 3-year period, or satisfy the requirements for a qualified exemption in § 112.5 and associated modified requirements in § 112.6 based on average monetary value of all food sold (less than $500,000) and direct farm marketing (during the previous 3-year period, the average annual monetary value of food sold directly to qualified end users exceeded the average annual monetary value of the food sold to all other buyers). In the 2014 supplemental human preventive controls notice, we erroneously referred to these farms as farms “not subject to the requirements in part 112.” While produce farms that make less than $25,000 are not subject to the requirements in part 112, produce farms that satisfy the requirements for a qualified exemption are not subject to the full requirements of part 112, but they do have certain modified requirements that they must meet, as described in § 112.6. We have corrected the description of these farms in § 117.430(d).

We have revised the provision to clarify that the receiving facility must have documentation that the raw material or other ingredient provided by the supplier is not subject to part 112 in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5: (1) Before first approving the supplier for an applicable calendar year; and (2) by December 31 of each calendar year (rather than “at the end of the calendar year”) and that the documentation is regarding the status of supplier for the following calendar year. By specifying “by December 31,” a receiving facility can work with each applicable supplier to determine the specific date within a calendar year for that supplier to annually notify the receiving facility about its status. See also the discussion in section XLVII.C regarding a similar revision we made when the supplier is a qualified facility.

(Comment 693) Some comments support the proposed alternative supplier verification activity. Other comments support applying the proposed alternative supplier verification activity more broadly—i.e., to any farm that will not be subject to part 112 (e.g., a farm that grows wheat), stating that both small and large non-produce farms should have the same option as farms that are exempted under § 112.4. Some comments ask us to revise the alternative verification requirements to apply to raw materials from farms that do not grow and harvest “produce” as we proposed to define it in § 112.3(c) so that the alternative verification requirements would apply to grain. Some comments assert that it is not possible to receive “written assurances” of compliance from growers of grain because there is no safety standard for grain growers, and that any such documents would be essentially meaningless.

Some comments ask us to revise the requirement to obtain written assurance so that it does not apply to “food not subject to the requirements of part 112 of this chapter pursuant to part 112.2.” Other comments assert that a documentation requirement for commodities that will be exempt from the produce safety rule would increase recordkeeping burdens without added benefit because produce that will be exempt from the produce safety rule is low-risk.

Some comments assert that farms should not have to provide written assurances because the requirement is ambiguous. These comments assert that exempt farmers are small-scale producers who are subject primarily to state and local laws and this provision would require them to provide written assurances that they are complying with unspecified Federal regulations. The comments claim that, without seeking legal counsel, many exempt farmers would be unable to provide such assurances, limiting the ability of these farmers to market their products to non-exempt facilities (the overwhelming majority of the food market).

(Response 693) We have revised the provision to specify that the written assurance from the farm must state that the farm acknowledges that its food is subject to section 402 of the FD&C Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States). Any business that introduces food into interstate commerce is subject the prohibited acts provisions in section 301 of the FD&C Act, and is accountable if it produces food that is adulterated.

As discussed in Response 444, new § 117.136(a) allows a manufacturer/processor to not implement a preventive control if it determines and documents that the type of food (e.g., RACs such as cocoa beans, coffee beans, and grains) could not be consumed without application of the appropriate control. We believe most receiving facilities will take advantage of this provision, and not establish supply-chain controls under the supply-chain program in subpart G for a number of RACs.

This alternative supplier verification activity is intended to minimize the burden on suppliers that are small farms. The amount of food produced by such farms is small, and the exposure to food from such farms therefore is low. We disagree that a written assurance from such a farm would be meaningless. Any business that distributes food in interstate commerce is subject to the FD&C Act, and must produce food that is in compliance with the FD&C Act, regardless of whether FDA has established a specific regulation governing the production of the food.

(Comment 694) Some comments ask us to delete this alternative supplier verification activity because they see it as a contradiction to the traceability provisions of the Bioterrorism Act and FSMA, because “traceback” is only required for “one step back” or for a single supplier for a particular shipment of food.

(Response 694) The supply-chain program that is being established in this rule is a preventive control for the ongoing production of safe food, not a “traceback” provision, established under the Bioterrorism Act, to help address credible threats relating to food that is reasonably believed to be adulterated and to present a threat of serious adverse health consequences or death to humans or animals.

(Comment 695) Some comments ask us to specify 3 options for verification if a supplier is a farm subject to the requirements of part 112: (1) Documentation at the end of each calendar year that the raw material or ingredient provided by the supplier is subject to part 112; (2) written assurance, at least every 2 years, that the supplier is producing the raw material or ingredient in compliance with applicable FDA food safety regulations and that the raw material or ingredient is not adulterated under the FD&C Act; or (3) evidence that the supplier is certified to a recognized third-party GAP/GHP/GMP/HACCP audit scheme. (We note that we are assuming that “GHP” is an abbreviation for “Good Hygienic Practice.”)

(Response 695) We decline this request. Documenting that a raw material or other ingredient is subject to the produce safety rule has no bearing on whether the farm is complying with that rule to control the hazards. With respect to all farms subject to the requirements of part 112 providing a written assurance, as discussed in Response 693, the amount of food produced by the small farms that could provide written assurance to a receiving facility is small, and the exposure to food from such farms therefore is low. We disagree that it is appropriate to extend this alternative supplier verification activity to larger farms because such farms provide a larger volume of produce.

A farm that has been subject to an audit that complies with the requirements of this rule can provide the results of the audit.

E. Alternative Verification Activity When the Supplier Is a Shell Egg Producer That Has Less Than 3,000 Laying Hens (Final § 117.430(e))

We are establishing an additional alternative supplier verification activity when a supplier is a shell egg producer that is not subject to the requirements of part 118 because it has less than 3,000 laying hens. See the regulatory text of § 117.430(e). The provision is analogous to the alternative supplier verification activity when a supplier is a farm that meets the criteria in § 117.430(d) and would account for a very small amount of eggs in the food supply. See also § 117.335, which establishes specific elements that the required written assurance must include—i.e., the effective date; printed names and signatures of authorized officials; and the applicable assurance.

F. Independence of Persons Who Conduct Supplier Verification Activities (Final § 117.430(f))

In the 2014 supplemental preventive controls notice, we requested comment on whether we should include in the final preventive controls rule requirements to address conflicts of interest for individuals conducting verification activities and, if so, the scope of such requirements.

(Comment 696) Some comments ask that conflict of interest provisions not be written too broadly, and be limited to circumstances where the individual employee carrying out the verification activities has a direct personal financial interest in or financial ties to the supplier (e.g., owns a substantial amount of stock in the supplier or is personally paid directly by the supplier). Comments state that it would not be uncommon for a receiving facility to have a shared financial interest in the supplier (e.g., partial ownership of one by the other or both being owned by the same parent company). Thus, employees that have an indirect financial interest (e.g., owning stock in a supplier because they own stock in their own company, which in turn owns an interest in the supplier) should not be disqualified from performing verification activities. Comments also indicate that a laboratory analyst performing ingredient testing should not be precluded from testing ingredients from a supplier in which the analyst has a potential conflict of interest, as long as the analyst is not aware of the identity of the supplier at the time the test is performed.

(Response 696) We are establishing a requirement that there must not be any financial conflicts of interests that influence the results of the verification activities listed in § 117.410(b) and payment must not be related to the results of the activity. This does not prohibit employees of a supplier from performing the functions specified in § 117.415 in accordance with § 117.415. For example, this provision would not prohibit an employee of a supplier from conducting sampling and testing so that the supplier could provide the results in documentation provided to the receiving facility. The provisions would not prevent a person who is employed by a receiving facility from having an indirect financial interest in a supplier (e.g., if a company in which the employee owns stock owns an interest in the supplier).

(Comment 697) Comments ask that we not preclude a supplier from hiring an outside party to perform onsite audits, food certifications, or sampling and testing.

(Response 697) We have specified that the requirements do not prohibit a receiving facility from relying on an audit provided by its supplier when the audit of the supplier was conducted by a third-party qualified auditor (see § 117.415(c)). We also have specified that a supplier may conduct and document sampling and testing of raw materials and other ingredients, for the hazard controlled by the supplier, as a supplier verification activity for a particular lot of product and provide the documentation to the receiving facility (see § 117.415(a)(4)). This acknowledges that it is common for suppliers to include Certificates of Analysis for tests conducted on specific lots of product along with the shipment to the receiving facility.

XLVIII. Subpart G: Comments on Onsite Audit

We proposed requirements that would apply to an onsite audit. Most comments that support the proposed provisions suggest alternative or additional regulatory text (see, e.g., Comment 698, Comment 701, and Comment 702) or ask us to clarify how we will interpret the provision (see, e.g., Comment 703 and Comment 704). In the following sections, we discuss comments that ask us to clarify the proposed requirements or that disagree with, or suggest one or more changes to, the proposed requirements. After considering these comments, we have revised the proposed requirements as shown in table 50.

A. Requirements Applicable to an Onsite Audit (Final § 117.435(a) and (b))

We proposed that an onsite audit of a supplier must be performed by a qualified auditor. If the raw material or ingredient at the supplier is subject to one or more FDA food safety regulations, an onsite audit must consider such regulations and include a review of the supplier's written plan (e.g., HACCP plan or other food safety plan), if any, including its implementation, for the hazard being audited (proposed § 117.136(d)). We have revised “including its implementation” to “and its implementation” to emphasize that implementation of the plan is distinct from the plan itself (e.g., § 117.126(c) establishes the recordkeeping requirement for the food safety “plan,” and § 117.190 lists implementation records).

As discussed in section XLIV.D, we have revised the requirements for considering supplier performance to provide that the receiving facility may, when applicable, consider relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States, and information relevant to the supplier's compliance with those laws and regulations, rather than consider applicable FDA food safety regulations and information relevant to the supplier's compliance with applicable FDA food safety regulations. We have made a conforming change to the requirements for an onsite audit to clarify that an onsite audit may consider relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States.

(Comment 698) Comments support a requirement that an onsite audit be performed by a qualified auditor, provided that we finalize provisions (in proposed § 117.136(e)) whereby an inspection by certain authorities could substitute for an audit. Some comments ask us to specify that the rule permits the use of audits conducted by private third-party food safety auditing firms. Other comments ask us to provide a list of recognized private third-party food safety schemes and consider making third-party food safety certification to a recognized audit scheme mandatory for all food operations that grow, pack, hold, and manufacture/process food for wholesale markets. Other comments ask us to further specify that FDA will audit all food facilities no less than once every 5 years to verify that private third-party audits are consistent with FDA audits and findings.

(Response 698) See our discussion in section XLVIII.B of the final provisions governing substitution of inspection for an audit. We agree that onsite audits may be conducted by third parties but disagree that it is necessary to specify this in the rule. Nothing in this rule prevents a facility from hiring a third party to conduct audits.

We decline the requests to provide a list of recognized private third-party food safety schemes or to make third-party food safety certification to a recognized audit scheme mandatory for all food operations that grow, pack, hold, and manufacture/process food for wholesale markets. The rule provides flexibility regarding use of third-party auditors and the information is easily obtained from other sources. Likewise, we decline the request to specify that FDA will “audit” all food facilities no less than once every 5 years to verify that private third-party audits are consistent with FDA audits and findings. We will inspect food facilities for compliance with this rule, not to verify the findings of a third-party audit, with a frequency consistent with our responsibilities under the FD&C Act.

(Comment 699) Some comments express concern about the multiple audits that facilities are subject to each year and ask us to encourage those subject to the rule to accept an audit performed by any of the “bona fide authorities” where it is warranted. Other comments note that food manufacturers conduct their own audits and have developed extensive expertise in doing so, and oppose any supplier verification requirement that would affect those audits. Other comments ask us to allow audits such as GFSI benchmark schemes to satisfy supplier verification requirements to avoid adding a new audit to audits currently being conducted. Some comments express concern that requiring a new audit in addition to audits already being conducted could lead to auditor shortages and unnecessary additional costs.

(Response 699) We expect that a facility will adopt an approach to audits that works best for the facility and minimizes the number of audits conducted for the same facility. An employee of a receiving facility may perform an audit, provided that the employee satisfies the criteria established in the rule for qualified auditors. Under § 117.3 and § 117.180, a qualified auditor is a qualified individual (as defined in § 117.3) and has technical expertise obtained through education, training or experience (or a combination thereof) necessary to perform the auditing function. See Response 700, in which we discuss auditor qualifications with respect to the GFSI's auditor competency model, noting that the provisions for auditor competency for GFSI are consistent with our definition of a qualified auditor. GFSI schemes that consider FDA food safety regulations and include a review of the supplier's written HACCP plan (or other food safety plan), if any, and its implementation, with respect to the hazard being controlled are likely to satisfy the requirements for an onsite audit. We expect that audits being conducted for other purposes will also be used to satisfy supplier verification audit requirements and such audits will be adjusted as needed to conform to the requirements of this rule.

(Comment 700) Some comments assert that GFSI-benchmarked audits and other similarly accredited audits should be considered equivalent to onsite audits.

(Response 700) See our description of GFSI in Response 496. The GFSI guidance document requires audit scheme owners to have a clearly defined and documented audit frequency program, which must ensure a minimum audit frequency of one audit per year of an organization's facility (Ref. 83), and a GFSI-compliant food safety scheme must include procedures for conducting internal audits (Ref. 95). To be used to satisfy the requirements of this rule, a GFSI-benchmarked audit, as with any audit, must address all requirements of this rule, including the requirement to consider applicable FDA food safety regulations and include a review of the supplier's written plan (e.g., HACCP plan or other food safety plan), if any.

As discussed in our memorandum on supplier programs (Ref. 83), the GFSI guidance document also specifies that the person who performs the audit needs to be qualified to do so. As described in “GFSI Food Safety Auditor Competencies,” the GFSI's auditor competency model lists three main components for auditor competencies: (1) Auditing skills and knowledge; (2) technical skills and knowledge; and (3) behavior and systems thinking (Ref. 96). Within each main component, GFSI provides details of specific tasks and the required auditor knowledge and skills to perform the specific tasks (Ref. 96). The provisions for auditor competency are consistent with our definition of a qualified auditor.

(Comment 701) Some comments ask us to delete the proposed requirement for a review of the supplier's written plan as part of an audit because review of the supplier's food safety plan should be part of an overall supplier verification program when the supplier is controlling a hazard that could cause serious adverse health consequences or death, but should not be tied to an audit. These comments state that receiving facilities may choose to use an unannounced audit program where the auditor spends time focusing on the actual conditions on the production floor, with a review of the supplier's food safety plan being done as a separate verification activity.

(Response 701) We decline this request. We agree that review of an applicable food safety plan should be part of an overall supplier verification program and that the review of the food safety plan may be conducted separately from the observation of actual conditions on the production floor, provided that both are conducted within the annual timeframe. However, we believe it important that the audit address whether the food safety plan is being implemented as designed, and other comments to this rule support that view. For example, as discussed in Comment 648 regarding our inspection of a food facility, some comments assert that our access to company records must be conducted onsite in the course of an authorized inspection so that we may understand the full context of what the records show. Thus, the onsite observations and the food safety plan review cannot be entirely separated, as the comment seems to suggest.

We note that the requirement to include a review of the supplier's food safety plan only applies when the supplier has a food safety plan. For example, we did not propose a requirement for a farm that would be subject to the forthcoming produce safety rule to have a food safety plan.

B. Substitution of Inspection by FDA or an Officially Recognized or Equivalent Food Safety Authority

We proposed that instead of an onsite audit, a receiving facility may rely on the results of an inspection of the supplier by FDA or, for a foreign supplier, by FDA or the food safety authority of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States, provided that the inspection was conducted within 1 year of the date that the onsite audit would have been required to be conducted. For inspections conducted by the food safety authority of a country whose food safety system FDA has officially recognized as comparable or determined to be equivalent to that of the United States, the food that is the subject of the onsite audit must be within the scope of the official recognition or equivalence determination, and the foreign supplier must be in, and under the regulatory oversight of, such country (proposed § 117.136(e)).

(Comment 702) Some comments ask us to allow State or local inspection reports, as well as FDA inspection reports, to substitute for an onsite audit for small and very small facilities. Other comments ask us to create a “safe harbor” provision in which a supplier providing a copy of permits obtained from the most recent inspection done by Federal, State, or local health authorities satisfies the supplier verification requirement; if there are no permits, review of relevant records and/or sampling of raw material based on scale of production should be adequate.

(Response 702) We have revised the regulatory text to provide for an appropriate inspection of the supplier for compliance with applicable FDA food safety regulations by FDA, by representatives of other Federal agencies (such as USDA), or by representatives of State, local, tribal, or territorial agencies. We are specifying that the inspection must be “appropriate” and be conducted for compliance “with applicable FDA regulations” to make clear that the inspection must be sufficiently relevant to an onsite audit to credibly substitute for an onsite audit. For example, inspection by USDA to determine whether a farm satisfies the requirements of the produce safety rule could constitute an appropriate inspection that could substitute for an audit, but an inspection by USDA to determine whether a farm satisfies the requirements of the National Organic Program could not.

We have not provided for substitution of a “permit obtained from the most recent inspection” for an onsite audit. We do not see how a “permit” could shed light on whether a business is complying with specific applicable FDA regulations. We have provided for an alternative verification activity to the annual onsite audit (such as a review of relevant records and/or sampling of raw material) with a written justification (see § 117.430(b)). The rule would not preclude an appropriate review of records, or sampling and testing of raw materials, by other Federal agencies, or by representatives of State, local, tribal, or territorial agencies, provided that the receiving facility satisfies the requirements for an adequate written justification.

(Comment 703) Some comments ask us to clarify what we mean by “food safety authority of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States.” These comments also ask whether a specific country qualifies and whether HACCP certificates issued by a specific foreign government agency would replace an onsite audit.

(Response 703) A country whose food safety system FDA has officially recognized as “comparable” to that of the United States would be one for which there is a signed systems recognition arrangement or other agreement between FDA and the country establishing official recognition of the foreign food safety system. Information on FDA systems recognition can be found on the FDA Web site (Ref. 97). As of March 2015, FDA only has a signed systems recognition agreement with New Zealand, but agreements with other countries are under development. We would not accept a HACCP certificate issued by a foreign government as a substitute for an onsite audit, but a receiving facility could consider whether such a certificate could be part of its justification for conducting another supplier verification activity in lieu of an annual onsite audit, or for conducting an audit on a less frequent basis than annually.

(Comment 704) Some comments ask us to clarify that the applicable standards will be those applied by the food safety authority of a country with a food safety system recognized as comparable or equivalent rather than having to achieve compliance with the applicable U.S. FDA food safety regulations.

(Response 704) The applicable standards will be those applied by the food safety authority of a country with a food safety system recognized as comparable or equivalent to that of the United States.

C. Onsite Audit by a Third-Party Auditor Accredited for the Purposes of Section 808 of the FD&C Act

We have proposed to establish regulations (in part 1, subpart M) to provide for accreditation of third-party auditors/certification bodies to conduct food safety audits of foreign food entities, including registered foreign food facilities, and to issue food and facility certifications (78 FR 45782, July 29, 2013). The purpose of the proposed third-party certification rule is to help us ensure the competence and independence of third-party auditors/certification bodies who conduct foreign food safety audits and to help ensure the reliability of food and facility certifications, issued by third-party auditors/certification bodies, that we will use in making certain decisions relating to imported food, such as food certifications required by FDA as a condition of granting admission to a food determined to pose a safety risk.

(Comment 705) Comments support use of third-party auditors, but emphasize that such auditors need not be accredited under the requirements to be established under our forthcoming third-party certification rule.

(Response 705) We agree that a third-party auditor who conducts an audit as a supplier verification activity to satisfy the requirements of this rule need not be accredited under our forthcoming third-party certification rule. In addition, we see no reason that any requirements of our forthcoming third-party certification rule should apply to an audit merely because it was conducted by a person who had been accredited under that rule. To make this clear, we have added a provision to specify that if an onsite audit is solely conducted to meet the requirements of this rule by an audit agent of a certification body that is accredited in accordance with regulations in part 1, subpart M, the audit is not subject to the requirements in those regulations. See § 117.435(d). Because § 117.435(d) refers to provisions in a future third-party certification rule, we will publish a document in the Federal Register announcing the effective date of § 117.435(d) once we finalize the third-party certification rule.

XLIX. Subpart G: Comments on Records Documenting the Supply-Chain Program

We proposed to require documentation of verification activities in records, including minimum requirements for records documenting an audit, records of sampling and testing, and records documenting a review by the receiving facility of the supplier's relevant food safety records. We also proposed that the receiving facility must review such records in accordance with the requirements applicable to review of records as a verification activity (i.e., in accordance with § 117.165(a)(4)).

We did not receive comments on the documentation requirements associated with a written supplier program, determination of appropriate supplier verification activities, review of records, supplier verification activities other than an annual onsite audit when the hazard being controlled by the supplier is one for which there is a reasonable probability that exposure to the hazard will result in serious adverse health consequences or death to humans, alternative supplier verification activity when the supplier is a qualified facility, substitution of inspection for an audit, or supplier nonconformance (proposed § 117.136(g)(1), (2), (7), (9), (10), (12), and (13), respectively). We are finalizing these documentation requirements with editorial and conforming changes associated with the final requirements of the supply-chain program.

The supply-chain program includes two provisions that are explicit requirements of the final human preventive controls rule, but had been implicit requirements of the proposed human preventive controls rule. The first of these provisions is the explicit requirement that the receiving facility must approve suppliers in accordance with the requirements of § 117.410(d), and document that approval, before receiving raw materials and other ingredients from those suppliers (see § 117.420(a)). The second of these requirements is that written procedures for receiving raw materials and other ingredients must be established and followed (see § 117.420(b)(1)). We are including in § 117.475 the documentation associated with these requirements (see § 117.475(c)(3) and (4)).

The supply-chain program includes four provisions that were not in the proposed human preventive controls rule: (1) A receiving facility that is an importer can comply with the foreign supplier verification requirements in the FSVP rule rather than conduct supplier verification activities for that raw material or other ingredient under this rule (§ 117.405(a)(2)); (2) a receiving facility may use an alternative verification activity for a supplier that is a shell egg producer that is not subject to the requirements established in part 118 because it has less than 3,000 laying hens (§ 117.430(e)); (3) when applicable, a receiving facility must verify a supply-chain-applied control applied by an entity other than the receiving facility's supplier (§ 117.405(c); and (4) entities other than the receiving facility may determine, conduct, and document certain specified supplier verification activities, provided that the receiving facility reviews and assesses the other entity's applicable documentation, and documents its review and assessment (§ 117.415). We are establishing the associated documentation requirements in § 117.475(c)(2), (14), (17), and (18), respectively.

In the following sections, we discuss comments on the proposed records for the supplier program. After considering these comments, we have revised the proposed requirements as shown in table 51.

A. Applicability of the Recordkeeping Requirements of Subpart F

We have added new § 117.475(a) to specify that the records documenting the supply-chain program in subpart G are subject to the requirements of subpart F. Under the proposed human preventive controls rule, the documentation requirements would have been in subpart C, and the applicability of subpart F was specified in § 117.190 in subpart C. The new provision specifying the applicability of subpart F to the records associated with the supply-chain program is a consequential change associated with establishing the requirements for a supply-chain program in subpart G, rather than in subpart C.

B. Requirement To Review Records of the Supply-Chain Program (Final § 117.475(b))

We proposed that a receiving facility must review records documenting the supplier program in accordance with the requirements applicable to review of records as a verification activity (i.e., in accordance with § 117.165(a)(4)). (Proposed § 117.136(g))

(Comment 706) Some comments ask us to provide consideration for records associated with the supplier program to be administered and maintained at corporate headquarters rather than at individual facilities, because this is common industry practice.

(Response 706) We are aware that certain programs are administered, and records are maintained, at corporate headquarters rather than at individual facilities. The rule provides that offsite storage of records is permitted if such records can be retrieved and provided onsite within 24 hours of request for official review and electronic records are considered to be onsite if they are accessible from an onsite location (see § 117.315(c)). We expect that the facility would be able to access information and records relevant to the supply-chain program within 24 hours (e.g., electronically) when the records are maintained at corporate headquarters. As necessary and appropriate, we intend to work with facilities on a case-by-case basis to determine the best way to review records associated with the supply-chain program when the supply-chain program is administered at the corporate level.

(Comment 707) Some comments ask us to clarify in the regulatory text that the required records are “as appropriate to the supplier program.”

(Response 707) We have revised the regulatory text to specify that the required records are “as applicable to its supply-chain program” (see § 117.475(c)).

C. Documentation Demonstrating Use of the Written Procedures for Receiving Raw Materials and Other Ingredients (Final § 117.475(c)(5))

We proposed to require documentation demonstrating that products are received only from approved suppliers (proposed § 117.136(g)(4)).

(Comment 708) Some comments support the proposed requirement with no changes. Other comments ask us to specify “raw materials and ingredients” rather than “products” in the regulatory text.

(Response 708) We have revised the regulatory text to specify “raw materials and other ingredients” with associated conforming changes.

D. Documentation of the Conduct of an Onsite Audit (Final § 117.475(c)(7))

We proposed to require documentation of an onsite audit. This documentation must include: (1) Documentation of audit procedures; (2) the dates the audit was conducted; (3) the conclusions of the audit; (4) corrective actions taken in response to significant deficiencies identified during the audit; and (5) documentation that the audit was conducted by a qualified auditor. For clarity, we have revised the regulatory text to specify documentation of the “conduct” of an audit and added a requirement for the documentation to include the name of the supplier subject to the onsite audit.

(Comment 709) Some comments ask us to maintain the confidentiality of audit reports and exempt such audit reports from disclosure under the FOIA.

(Response 709) These comments are similar to comments we received related to disclosure of other records required by this part (See Comment 647 and Comment 650). We would establish the status of supply-chain program records, such as audit reports, as available for, or protected from, public disclosure on a case-by-case basis. As discussed in Response 647, we primarily intend to copy such records when we conduct an inspection for cause or if the preliminary assessment by our investigator during a routine inspection is that regulatory follow-up may be appropriate (e.g., if the report indicates that a significant food safety problem was noted). See Response 650 for a discussion of situations in which records would, or would not, be protected from disclosure.

(Comment 710) Some comments express concern about maintaining documentation of the conclusions of an audit and documentation of corrective actions taken in response to significant deficiencies identified during the audit. These comments explain that FDA's access to such documentation during inspection might discourage suppliers from allowing unannounced audits. These comments ask us to delete these proposed requirements. If the requirement regarding documentation of corrective actions remains in the final rule, these comments ask us to limit such documentation to situations in which the identified deficiencies posed a risk to public health.

(Response 710) We are retaining these documentation requirements as proposed. These comments appear to be suggesting that documentation requirements be established based on whether a business entity would want us to see information during inspection rather than on the utility and value of the documentation. We expect that receiving facilities, in general, maintain documentation of the conclusions of audits that they have conducted or arranged to have conducted. A receiving facility must approve all of its suppliers, and documentation of corrective actions taken in response to significant deficiencies identified during an audit has value to a receiving facility in determining whether to approve a supplier before first receiving any raw materials or other ingredients and then on an ongoing basis.

The rule does not require that onsite audits be unannounced, although we acknowledge that some receiving facilities may see value in unannounced audits. We decline the request to require a receiving facility to maintain documentation of corrective actions only if the identified deficiencies posed a risk to public health. If, for example, a supplier's facility has filthy conditions or the raw materials and other ingredients it supplies are contaminated with filth, a receiving facility may find it inappropriate to approve that supplier. Even though filth often does not pose a risk to public health, a food may be deemed to be adulterated under section 402(a)(4) of the FD&C Act if it has been prepared, packed, or held under insanitary conditions whereby it may have become contaminated with filth.

E. Documentation of Sampling and Testing (Final § 117.475(c)(8))

We proposed to require records of sampling and testing. These records must include: (1) Identification of the raw material or ingredient tested (including lot number, as appropriate) and the number of samples tested; (2) identification of the test(s) conducted, including the analytical method(s) used; (3) the date(s) on which the test(s) were conducted; (4) the results of the testing; (5) corrective actions taken in response to detection of hazards; and (6) information identifying the laboratory conducting the testing.

(Comment 711) Some comments ask us to not apply the requirement to maintain records related to sampling and testing to the receipt of RACs because sampling and testing of RACs is neither common nor effective for detecting biological or chemical hazards, especially in raw, intact produce.

(Response 711) We decline this request. These comments appear to suggest that documentation requirements be established based on the frequency and utility of sampling and testing a particular commodity rather than on a determination by a receiving facility that sampling and testing is an appropriate supplier verification activity for a particular supplier. We disagree with such a suggestion. A receiving facility that has determined that sampling and testing is an appropriate supplier verification activity needs to maintain records of those results as it would for any other supplier verification activity. To the extent that these comments are concerned that the supply-chain program requires sampling and testing of RACs, we emphasize that this is not the case. See also Response 525 for a discussion of the usefulness of sampling and testing as a verification measure for RACs.

(Comment 712) Some comments ask us to allow documentation of testing to include the date the test results were reported as an alternative to the date(s) on which the test(s) were conducted.

(Response 712) We have revised the provision to require “The date(s) on which the test(s) were conducted and the date of the report.” We agree that the date on which the test results are reported can be important, but it should not be a replacement for the date of the test.

(Comment 713) Some comments ask us to add “if necessary” to the end of the proposed requirement for documentation of corrective actions taken in response to detection of hazards.

(Response 713) We decline this request. The documentation is always necessary if corrective actions are taken. The provision is about maintaining documentation when corrective actions are taken, not about the fact that corrective actions may not always be needed.

F. Documentation of Other Appropriate Supplier Verification Activity (Final § 117.475(c)(10))

We proposed to require records of other appropriate verification activities based on the risk associated with the ingredient. For clarity and consistency, we have revised the proposed requirement to specify “documentation” of the other appropriate supplier verification activity rather than “records” of the activity. As a conforming change associated with using the term “supplier performance,” rather than “risk of supplier,” when discussing factors associated with suppliers (see Response 673), the final requirement specifies that the other appropriate supplier verification activities are based on the supplier performance and the risk associated with the raw material or other ingredient.

(Comment 714) Some comments ask us to also specify that an “other” appropriate supplier verification activity be based on the risk associated with raw materials and suppliers.

(Response 714) We have revised the regulatory text to specify “Documentation of other appropriate supplier verification activities based on the supplier performance and the risk associated with the raw material or other ingredient.” The revised regulatory text of the documentation tracks the regulatory text of this “other” appropriate supplier verification activity (see § 117.410(b)(4)). As discussed in Response 673, “supplier performance” is more appropriate than “risk associated with the supplier.”

G. Documentation of an Alternative Verification Activity for a Supplier That Is a Farm That Is Not a “Covered Farm” for the Purposes of the Future Produce Safety Rule (Final § 117.475(c)(13))

We proposed to require documentation of an alternative verification activity for a supplier that is a farm that is not a “covered farm” for the purposes of the future produce safety rule, including: (1) The documentation that the raw material or ingredient provided by the supplier is not subject to the produce safety rule; and (2) the written assurance that the supplier is producing the raw material or ingredient in compliance with applicable FDA food safety regulations and that the raw material or ingredient is not adulterated under section 402 of the FD&C Act. We have revised the documentation to reflect the final requirements of § 117.430(d)—i.e., to require: (1) Written assurance that the supplier is not a covered farm under part 112 in accordance with § 112.4(a), or in accordance with §§ 112.4(b) and 112.5, before approving the supplier and on an annual basis thereafter; and (2) the written assurance that the farm acknowledges that its food is subject to section 402 of the FD&C Act (or, when applicable, that its food is subject to relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States).

(Comment 715) Some comments ask us to delete this documentation requirement because RACs except fruits and vegetables should be exempt from supplier verification.

(Response 715) See Response 693. This alternative supplier verification activity is intended to minimize the burden on suppliers that are small farms.

(Comment 716) Some comments ask us to include a cross-reference to the applicable requirement.

(Response 716) We have not added this cross-reference. We agree that adding the cross-reference has the potential to be helpful, but it also has the potential to clutter the regulatory text. We considered it would be more useful to specify what the documentation needs to be rather than to specify the cross-reference to the applicable alternative supplier verification activity.

L. Holding Human Food By-Products Intended for Use in Animal Food

In the 2014 supplemental animal preventive controls notice, we discussed proposed revisions to the human food CGMPs to address comments about the practice of human food manufacturers sending by-products to local farmers or animal food manufacturers for use as animal food (79 FR 58524 at 58558). We explained that we were proposing these revisions as part of the rulemaking for the animal preventive controls rule. (See the discussion of these proposed revisions in the animal preventive controls rule.) Because we proposed these revisions as part of the rulemaking for the animal preventive controls rule, we also are finalizing these provisions as part of that rulemaking. See the final animal preventive controls rule, published elsewhere in this issue of the Federal Register, for our response to comments on these proposed revisions to the human food CGMPs. The final provisions, being established in § 117.95 (Holding and distribution of human food by-products for use as animal food), require that:

(1) Human food by-products held for distribution as animal food without additional manufacturing or processing by the human food processor, as identified in § 507.12, must be held under conditions that will protect against contamination, including the following:

• Containers and equipment used to convey or hold human food by-products for use as animal food before distribution must be designed, constructed of appropriate material, cleaned as necessary, and maintained to protect against the contamination of human food by-products for use as animal food;
• Human food by-products for use as animal food held for distribution must be held in a way to protect against contamination from sources such as trash; and
• During holding, human food by-products for use as animal food must be accurately identified.

(2) Labeling that identifies the by-product by the common or usual name must be affixed to or accompany human food by-products for use as animal food when distributed.

(3) Shipping containers (e.g., totes, drums, and tubs) and bulk vehicles used to distribute human food by-products for use as animal food must be examined prior to use to protect against contamination of the human food by-products for use as animal food from the container or vehicle when the facility is responsible for transporting the human food by-products for use as animal food itself or arranges with a third party to transport the human food by-products for use as animal food.

LI. Comments by Foreign Governments and Foreign Businesses

We received several comments from foreign governments and foreign businesses covering a wide range of issues. Many of those comments were similar to comments made on certain topics by domestic stakeholders, so we are addressing those comments in other sections throughout this preamble. In this section, we are responding to comments that are primarily focused on international issues, such as the obligations of the United States under the World Trade Organization Agreement (WTO).

(Comment 717) Some comments by foreign government representatives ask us to provide “special and differential treatment” along with technical assistance to help exporters from developing countries meet the requirements of the rule. For special and differential treatment, the comments propose extended periods of time for the implementation of the rule by producers in developing countries, and flexibility in implementation for small businesses in those countries. For technical assistance, the comments request training and other forms of assistance to help producers understand and implement the regulation.

(Response 717) The concept of special and differential treatment is incorporated in the WTO Agreements. Article 10.2 of the WTO SPS Agreement states: “Where the appropriate level of sanitary or phytosanitary protection allows scope for the phased introduction . . . longer time-frames for compliance should be accorded on products of interest to developing country Members so as to maintain opportunities for their exports.”

In 2001, at the WTO Ministerial Conference in Doha, WTO Members issued a Ministerial Decision that interpreted the special and differential obligations of the SPS Agreement (Ref. 98). The Ministerial Decision defined “longer time-frame for compliance” to normally mean a period of not less than 6 months.

We recognize that businesses of all sizes may need more time to comply with the new requirements established under this rule. As discussed in section LVI.A, the first compliance date for businesses other than small and very small businesses will be one year after this final rule is published in the Federal Register. Recognizing that smaller businesses may need more time to comply with the requirements, FDA is allowing two years for small businesses and three years for very small businesses to comply. We anticipate that these extended implementation periods for small businesses and very small businesses will apply to a number of businesses in developing countries. Because all of these time periods are longer than the 6 month minimum defined in the WTO Ministerial Decision, we believe these implementation periods are sufficient to address the needs of businesses in developing countries, particularly for small and very small businesses in such countries.

In addition to the extended time periods for compliance for small and very small businesses, we have also established modified requirements for very small businesses, which we define as a business (including any subsidiaries and affiliates) averaging less than $1,000,000, adjusted for inflation, per year, during the 3-year period preceding the applicable calendar year in sales of human food plus the market value of human food manufactured, processed, packed, or held without sale (e.g., held for a fee). These modified requirements for very small businesses are less burdensome and are described in § 117.201 of this regulation.

In addition to the 1 to 3 year time periods for compliance for all firms, and modified requirements for very small businesses, we intend to work with the food industry, education organizations, USDA, the United States Agency for International Development, and foreign governments to develop tools and training programs to facilitate implementation of this rule.

(Comment 718) Some comments assert that the food safety systems of the European Union and other countries afford a similar level of food safety protection and must therefore be recognized by FDA as equivalent under the WTO SPS Agreement. These comments urge FDA to accept the HACCP plans and other steps taken to comply with European food safety laws as being sufficient to comply with this rule.

(Response 718) The concept of “equivalence” for food safety regulatory measures is contained in Article 4 of the World Trade Organization Agreement on the Application of Sanitary and Phytosanitary Measures (the “SPS Agreement”) (Ref. 99). That article provides that WTO Member countries “shall accept the sanitary or phytosanitary measures of other Members as equivalent, even if these measures differ from their own or from those used by other Members trading in the same product, if the exporting Member objectively demonstrates to the importing Member that its measures achieve the importing Member's appropriate level of sanitary or phytosanitary protection.” This provision of the SPS Agreement envisions a process in which the exporting country provides evidence to the food safety regulator in the importing country in order to “objectively demonstrate” that the food safety system in the exporting country meets the level of food safety protection established by the importing country. To date, FDA has considered equivalence as most appropriately applied to the assessment of a foreign government's specific programs for specific types of foods, such as shellfish and dairy products. In that context, the equivalence assessment provides a very detailed comparison of each measure that a country applies in controlling risks associated with the particular commodity under review. FDA continues to have latitude to engage in equivalence determinations for market access and as required by our regulations for certain commodities. For example, FDA has active equivalence deliberations underway on Grade “A” dairy and will continue to engage in equivalence activities as needed.

In contrast to the assessment of equivalence for the regulation of specific foods based upon a detailed review of an individual food safety measure or group of measures applied to a specific food, FDA has established a process of assessing foreign food safety systems to identify systems that offer a comparable level of public health protection as the U.S. food safety system for FDA regulated foods. We refer to that process as “systems recognition,” which we discuss in Response 719.

(Comment 719) Some comments urge FDA to include a provision in this rule that would reflect a determination made by FDA in the “systems recognition” process so that FDA's compliance framework, including audit and inspection activities, take into account the effectiveness of the regulatory or administrative control of food safety systems. These comments ask us to include a provision in this rule establishing that an affirmative systems recognition determination by FDA for an exporting country would be a sufficient basis to exempt exporting producers from that country from their obligation to comply with the requirements of this rule. Another comment urges FDA to utilize the systems recognition process to recognize the effectiveness of the EU system in order to avoid unnecessary or duplicative requirements and controls on food imports from the European Union.

(Response 719) We agree, in part, with this comment. Since 2010, FDA has been developing a program of “systems recognition” to explore ways to leverage the work of food safety authorities in countries that have food safety systems that are comparable to that of FDA. Systems recognition assessment provides a tool for identifying countries where FDA can establish closer regulatory partnerships, including leveraging the work conducted by FDA and foreign food safety authorities.

We agree that the systems recognition program can allow FDA to take into account the effectiveness of a foreign food safety regulatory system as we develop a compliance framework for imported foods from a country for which we have made an affirmative determination of comparability via the systems recognition program. While we decline to add an exemption for food imported from a country with affirmative systems recognition determination by FDA, we note that the systems recognition program is based upon the concept that foreign food producers can meet U.S. food safety requirements by providing assurances that these foods are produced according to the food safety standards of a country that FDA has found to be comparable or equivalent to that of the United States. Therefore, foreign producers of foods that are subject to a systems recognition agreement can show that their products are meeting FDA's requirements for imported foods by virtue of the fact that they are meeting their domestic food safety standards. Several provisions of the supply-chain program specifically provide for consideration of relevant laws and regulations of a country whose food safety system FDA has officially recognized as comparable or has determined to be equivalent to that of the United States (see §§ 117.410(d)(1)(iii)(B); 117.430(c)(2), (d)(2), and (e)(2); and 117.435(b) and (c)(1)(ii).

We also note that we intend to publish a final FSVP rule in the near future. There, we intend to establish modified requirements for food imported from a foreign supplier in, and under the regulatory oversight of, a country whose food safety system FDA has officially recognized as “comparable” to that of the United States.

Section 117.405(a)(2) of this rule provides the option for a receiving facility that is an importer to comply with the supplier verification requirements in this rule or with the foreign supplier verification program requirements that we will establish in part 1, subpart L for a raw material or other ingredient. We intend that the final FSVP rule will contain a similar provision (derived from proposed § 1.502), so that only one supplier verification procedure needs to be undertaken in order to comply with both rules when the specified conditions are met.

LII. Editorial and Conforming Changes

The revised regulatory text includes several changes that we have made to make the requirements more clear and improve readability. The revised regulatory text also includes several conforming changes that we have made when a change to one provision affects other provisions. We summarize the principal editorial and conforming changes in table 52.

LIII. Comments on FSMA's Rulemaking Provisions

A. Comments on Requirements in Section 418(n)(3) of the FD&C Act Regarding Content

FSMA specifies that this rule acknowledge differences in risk and minimize, as appropriate, the number of separate standards that apply to separate foods (section 418(n)(3)(C) of the FD&C Act). As previously discussed, we consider that the proposed human preventive controls rule strikes what we consider to be an appropriate balance between acknowledging differences in risk and minimizing the number of separate standards applied to separate foods (78 FR 3646 at 3785).

(Comment 720) Some comments agree that the proposed human preventive controls rule reflects a risk-based approach and our recognition that a “one -size-fits-all” approach is not appropriate in the application of hazard analysis and risk-based preventive controls across the entire domestic and international food industry. These comments ask us to retain this flexibility in the final rule by describing the required and expected results of the program, but not going as far as prescribing the process and methodology taken to get there. Other comments emphasize that the final rule must provide sufficient flexibility to allow facilities to adopt practices that are practical and effective for their specific, individual operations.

(Response 720) The final rule directs the owner, operator, or agent in charge of a facility to establish and implement a food safety plan that includes a written hazard analysis, preventive controls that the facility identifies to control hazards requiring a preventive control, and establish and implement appropriate preventive control management components to ensure the effectiveness of the preventive controls, taking into account the nature of the preventive control and its role in the facility's food safety system. As requested by the comments, the rule does not prescribe the process and methodology to “get there.”

(Comment 721) Some comments ask us to adopt a commodity-specific approach to RACs when activities conducted on RACs are subject to the human preventive controls rule. The requested commodity-specific approach would exempt (or, at a minimum, defer regulation of) “low-risk commodities (such as table grapes)” from the human preventive controls rule. These comments note that we have acknowledged that just five commodity groups (leafy greens, tomatoes, herbs, melons, and sprouts) accounted for 77 percent of all produce-related outbreaks, 54 percent of produce-related illnesses, and 56 percent of produce-related hospitalizations between 1996 and 2010 (78 FR 3504 at 3525). These comments assert that the principal benefits of the FSMA rules will come from regulating these crops and that we cannot claim to have acknowledged differences in risk if we adopt a “one-size-fits-all” strategy. These comments ask us to apply the human preventive controls rule only to RACs that fall within the five highest-risk commodity groups and to any other specific commodities that we have determined pose a comparable risk based on outbreak history and the commodity's characteristics.

Other comments asserting that the rule is “one-size-fits-all” likewise ask us to apply the human preventive controls rule only to the highest risk commodities but do not narrowly direct their request to RACs. Some of these comments state that regulations must be scale- and supply-chain appropriate to be effective and assert that a “one-size-fits-all” approach will put small and mid-sized farms and processors out of business, undermining public health goals, such as increased production of, availability of, and access to healthy foods, as well as economic opportunity, equity, and job-creation goals.

(Response 721) We decline these requests to apply the human preventive controls rule only to foods determined to be of the highest risk and disagree that the rule is “one-size-fits-all.” For example, several provisions of the rule expressly qualify that the requirements apply as appropriate to the facility, the food, the nature of the preventive control and its role in the facility's food safety system, the nature of the hazard, or a combination of these factors (see, e.g., § 117.135(c), (c)(1), and (c)(3); § 117.140(a) and (b); § 117.150(a); § 117.160(a); § 117.165(a) and (b)); and § 117.410(d)(1)). The exemptions we are establishing are provided by section 103 of FSMA. As discussed in Response 222, facilities that are subject to the rule would consider the risk presented by the products as part of their hazard evaluation. A facility that appropriately determines that there are no hazards requiring a preventive control associated with its food products would document that determination in its written hazard analysis but would not need to establish preventive controls and associated preventive control management components for its products. (See also Response 16.)

(Comment 722) Some comments interpret the statutory direction in section 418(n)(3)(C) of the FD&C Act to mean that Congress granted us authority to provide flexibility for businesses of all sizes and types (i.e., not just small businesses), as well as to acknowledge differences in risk. These comments assert that section 418(n)(3)(C) grants us authority to exempt distribution centers from the requirements for hazard analysis and risk-based preventive controls because: (1) Distribution centers are very low-risk facilities and (2) requiring distribution centers to comply with those requirements would not be practicable.

(Response 722) We disagree with these comments. See Response 221 for our response to comments that ask us to establish exemptions based on the risk presented by a food product and Response 226 for our response to comments that request an exemption for facilities such as supermarket distribution centers. The rule establishes an exemption for facilities solely engaged in the storage of unexposed packaged food (see § 117.7(a)), except that there are modified requirements for such establishments engaged in the storage of TCS foods (see § 117.7(b) and 117.206).

(Comment 723) Some comments state that Grade “A” dairy products are already effectively regulated under the PMO, and assert that subjecting these products to the human preventive controls rule would apply two separate standards, doubling rather than minimizing the number of separate standards that apply to separate foods. These comments ask us to instead acknowledge the reduced risk profile of foods produced in accordance with the PMO and allow dairy products to continue to be regulated under one standard, the PMO. These comments also assert that exempting PMO-regulated facilities from the rule would allow us to better tailor our requirements to those foods not currently manufactured under such regulatory programs, which would also minimize the need to develop separate guidance and standards for this segment of the dairy industry.

(Response 723) See Response 214 for a discussion of our approach to PMO-regulated facilities.

(Comment 724) Some comments assert that the rule addresses differences in risk based on the number of people affected in the event of contaminated product being sold rather than on the types of hazards identified for a particular food and the ability to address those hazards via preventive practices, because the rule bases modified requirements on company revenues, customer type (restaurant and retail establishments), and customer location (275 mile radius). These comments assert that the proposed modified requirements do not properly address food safety risk through prevention and ask us to establish risk-based standards that require preventive practices to address identified hazards for a particular food and process for all companies manufacturing, processing, packing, and holding food.

Other comments assert that the statutory direction to require hazard analysis and risk-based preventive controls for all facilities that are required to register as a food facility under the section 415 registration regulations does not take into consideration the significant differences in risk profiles of fresh produce facilities and food processing and manufacturing facilities. These comments further assert that the section 415 registration regulations are not risk-based but simply served to keep a catalogue of facilities supplying the U.S. food supply and that it is not logical or appropriate that a fresh produce facility that packs RACs should be subject to the same regulatory controls as food manufacturing facilities such as those that produce canned foods or infant formula.

(Response 724) We disagree with these comments. See Response 222, in which we respond to comments asserting that a food safety plan should only be required for high-risk processing facilities. The new requirements for hazard analysis and risk-based preventive controls are not “one-size-fits-all,” and facilities that are subject to the rule would consider the risk presented by the products as part of their hazard evaluation.

B. Comments on Requirements in Section 418(n)(5) of the FD&C Act Regarding Review of Hazard Analysis and Preventive Controls Programs in Existence on the Date of Enactment of FSMA

FSMA directs us to review regulatory hazard analysis and preventive control programs in existence on the date of its enactment, including the PMO, to ensure that the regulations we establish are consistent, to the extent practicable, with applicable domestic and internationally-recognized standards in existence on that date. (See section 418(n)(5) of the FD&C Act.) Consistent with that statutory direction, we previously compared the key features of our proposed requirements to implement section 418 of the FD&C Act to certain domestic and international food safety standards (Ref. 100) (78 FR 3646 at 3785 to 3788).

In the following paragraphs, we discuss comments specifically directed to the statutory direction in section 418(n)(5) of the FD&C Act. For examples of other comments related to the consistency of the proposed human preventive controls rule with applicable domestic and internationally-recognized standards, see Comment 8, Comment 215, Comment 372, Comment 718, and Comment 719.

(Comment 725) Some comments assert that a proper harmonization is needed with international standards and ask us to harmonize the FSMA requirements for the food safety plan with international and domestic HACCP programs. These comments also ask us to explain any differences between the FSMA food safety plan and the existing HACCP programs and ask us to provide exporters with background information and specific examples of differences, including how firms are directed to set their CCPs and critical limits.

(Response 725) As previously discussed (Ref. 102 and 78 FR 3646 at 3785 to 3788), we believe the human preventive controls rule is consistent with existing food safety programs. We have updated our 2012 memorandum entitled “Comparison of Proposed Subpart C (Hazard Analysis and Risk-Based Preventive Controls) to Various Existing Domestic and International HACCP-Based Standards” (Ref. 102) to reflect the provisions of the final human preventive controls rule (rather than the proposed human preventive controls rule) (Ref. 65). The comparative format of the updated memorandum provides the background information and specific examples of differences requested by these comments.

However, neither this rule nor our updated memorandum (Ref. 65) provide firms with direction on how to set their CCPs and critical limits. A facility has flexibility to establish and implement appropriate preventive controls, including controls at CCPs and including any critical limits that the facility determines are necessary to provide assurances that hazards requiring a preventive control will be significantly minimized or prevented and the food manufactured, processed, packed, or held by the facility will not be adulterated under section 402 of the FD&C Act or misbranded under section 403(w) of the FD&C Act.

(Comment 726) Some comments ask whether we concluded, in light of the statutory direction in section 418(n)(5) of the FD&C Act, that the CGMP requirements in combination with the standards of identity for cheese in part 133 do not provide adequate public health controls within the cheese manufacturing industry. According to these comments, under regulations in part 133 many cheeses have an option to use unpasteurized milk, provided the cheese manufactured from unpasteurized milk is aged for at least 60 days at not less than 35 degrees F. These comments ask whether the 60 day aging process will be recognized as a preventive control.

(Response 726) Section 418(n)(5) of the FD&C Act directs us to review “regulatory hazard analysis and preventive control programs” in existence on the date of its enactment. We have not considered provisions in the standards of identity (whether in part 133 or in other standards of identity) in our analysis directed by section 418(n)(5) of the FD&C Act, because standards of identity are not hazard analysis and preventive controls programs. We establish food standards, such as the standards in part 133 (Cheeses and Related Cheese Products) under section 401 of the FD&C Act (21 U.S.C. 341) to promote honesty and fair dealing in the interest of consumers. In contrast to this role of food standards, hazard analysis and preventive control programs (e.g., HACCP) involve a systematic approach to the identification and assessment of the risk (likelihood of occurrence and severity) of hazards from a particular food or food production process or practice and the control of those hazards (78 FR 3646 at 3659).

We acknowledge that part 133 requires an aging period, such as at least 60 days at not less than 35 degrees F, for cheese manufactured from unpasteurized milk, and that this aging period was presumed to act as a control measure to reduce the risk that pathogens would be present when the cheese was consumed. We recently issued a request for comments and for scientific data and information that would assist us in identifying and evaluating intervention measures that might have an effect on the presence of bacterial pathogens in cheeses manufactured from unpasteurized milk (80 FR 46023, August 3, 2015). It is premature to determine what role, if any, an aging process could play in a food safety plan for the manufacture of cheese from unpasteurized milk.

(Comment 727) Some comments assert that we did not make the required comparison of the proposed human preventive controls rule to the PMO available for review.

(Response 727) The required comparison of the proposed human preventive controls rule to the PMO is available in the docket for this rulemaking (Docket FDA-2011-N-0920) (see Reference 193 to the proposed human preventive controls rule). We stated that it was available during the discussion of section 418(n)(5) of the FD&C Act (36 FR 3646 at 3786). For this final rule, we have both updated this comparison (Ref. 65) and prepared a separate comparison of the final provisions of this rule to the PMO (Ref. 49).

LIV. Comments on Proposed Removal of 21 CFR Part 110—Current Good Manufacturing Practice in Manufacturing, Packing, or Holding Human Food

We proposed to remove current part 110 after the compliance date for all businesses to be in compliance with the requirements of new part 117. We received no comments that disagreed with this proposal. As discussed in section LVI.A, businesses will be required to comply with new part 117 1, 2, or 3 years after September 17, 2015, depending on the size of the business. Thus, part 110 will be removed on September 17, 2018.

LV. Comments on Proposed Conforming Amendments

We proposed a series of conforming amendments to current regulations (in §§ 106.100(j) and (n), 114.5, 120.3, 120.5, 120.6(b), 123.3, 123.5(a), 123.11(b), 129.1, 179.25(a), and 211.1(c)) that refer to the requirements of part 110. With the proposed conforming changes, these current regulations would refer to part 117, as well as part 110. We also proposed that when part 110 is removed, all references to part 110 be removed from our regulations.

We received no comments that disagreed with the proposed conforming changes. Therefore, at this time we are amending each of these current regulations so that they refer to part 117, as well as part 110. When part 110 is removed, we will issue conforming amendments to remove all references to part 110 from our regulations.

LVI. Effective and Compliance Dates

A. Effective and Compliance Dates for Part 117

We proposed that any final rule based on proposed part 117 become effective 60 days after its date of publication in the Federal Register, with staggered compliance dates (78 FR 3646 at 3673). Businesses other than small and very small businesses would have 1 year from the date of publication of the final rule to comply with the rule, whereas small businesses would have 2 years and very small businesses would have 3 years to comply with the rule. We proposed that these staggered compliance dates would apply to the modernized CGMPs that would be established in subpart B of part 117, as well as the new requirements for hazard analysis and risk-based preventive controls (78 FR 3646 at 3674). The staggered compliance dates for compliance with the modernized CGMPs would apply to all food establishments, including those establishments that are subject to the CGMPs in subpart B, but exempt from the new requirements for hazard analysis and risk-based preventive controls in subparts C and G. For the purpose of determining its compliance date, the definitions of “small business” and “very small business” established in this rule apply, regardless of whether a food establishment is subject to requirements of another rule (such as our HACCP regulation for juice in part 120) that may have a different definition for “small business” and “very small business.”

Most of the comments support staggering the compliance dates. For example, one comment states that the rule would substantially prevent wide-ranging harm associated with contaminated processed foods, but at a reasonable cost to the food industry, with ample exclusions and extended compliance dates for small facilities. However, some of the comments that support staggering the compliance dates suggest extending the compliance dates for some sizes of business (see, e.g., Comment 728, Comment 730, and Comment 731).

In the following sections, we discuss comments that suggest extensions to the proposed compliance dates or ask us to clarify how the compliance dates will apply. After considering these comments, we are establishing the effective and compliance dates as proposed, except for the following three changes. First, we are extending the compliance date for PMO-regulated facilities to comply with the requirements of subparts C and G to September 17, 2018 (See Response 214). Second, we are establishing an earlier compliance date for the financial records that a facility maintains to support its status as a very small business that is eligible for the qualified facility exemption in § 117.5(a). Specifically, the compliance date for a facility to retain records to support its status as a qualified facility is January 1, 2016. (See Response 155.) Third, we are establishing separate compliance dates for the supply-chain program provisions. As discussed in Response 729, a receiving facility's compliance date with the supply-chain program provisions of this rulemaking is the later of: (1) March 17, 2017; (2) for a receiving facility that is a small business, September 18, 2017; and (3) when the supplier of a raw material or other ingredient will be subject to the human preventive controls rule or the produce safety rule, 6 months after the receiving facility's supplier of that raw material or other ingredient is required to comply with the applicable rule. See table 53 and table 54 for a summary of these compliance dates.

We also are establishing two additional compliance dates applicable to qualified facilities. First, we are establishing December 17, 2018 as the compliance date for (1) the initial submission of the attestation by a facility that it is a qualified facility (see § 117.201(a)(1)) and (2) the attestation by a qualified facility about its food safety practices (see § 117.201(a)(2)(i)) or that it is in compliance with non-Federal food safety law (see § 117.201(a)(2)(ii)).

Second, we are establishing January 1, 2020, as the compliance date for the notification requirement of § 117.201(e)(1). A qualified facility that submits an attestation that it is in compliance with applicable non-Federal food safety law must notify consumers as to the name and complete business address of the facility where the food was manufactured or processed (see § 117.201(e)). If a food packaging label is required, the required notification must appear prominently and conspicuously on the label of the food (see § 117.201(e)(1)). This notification requirement may require some qualified facilities to update the labels of their packaged food products.

For many labeling requirements, the timeframe for a food establishment to comply with new or revised labeling requirements is governed by a uniform compliance date (see, e.g., 79 FR 73201, December 10, 2014 and 77 FR 70885, November 28, 2012). Use of a uniform compliance date provides for an orderly and economical industry adjustment to new labeling requirements by allowing sufficient lead time to plan for the use of existing label inventories and the development of new labeling materials. This policy serves consumers' interests as well because the cost of multiple short-term label revisions that would otherwise occur would likely be passed on to consumers in the form of higher prices. We generally announce a uniform compliance date during November or December of even-numbered calendar years, and establish the uniform compliance date to be January 1 of an upcoming even-numbered calendar year. For example, in December, 2014, we issued a final rule establishing January 1, 2018, as the uniform compliance date for food labeling regulations that are issued between January 1, 2015, and December 31, 2016 (79 FR 73201). Likewise, in November, 2012, we issued a final rule establishing January 1, 2016, as the uniform compliance date for food labeling regulations that are issued between January 1, 2013, and December 31, 2014 (77 FR 70885, November 28, 2012). These uniform compliance dates provide a minimum of 1 year between the date when a food labeling regulation is issued and the date when a food establishment must comply with that regulation. Following this pattern, we intend that the next uniform compliance date will be January 1, 2020 for food labeling regulations that are issued between January 1, 2017 and December 31, 2018. A qualified facility that submits an attestation that it is in compliance with non-Federal food safety law would become subject to the notification requirement during this timeframe—i.e., by December 31, 2018.

The compliance date that we are establishing for the notification requirement of § 117.201(e) (i.e., January 1, 2020) is consistent with the approach of a uniform compliance date and will provide a qualified facility that chooses to submit an attestation about compliance with non-Federal food safety law with more than 1 year from the applicable general compliance date to comply with the notification requirement. This compliance date also will provide such a qualified facility with more than 4 years to comply with the notification requirement relative to the date of publication of this rule.

(Comment 728) Some comments assert that one year is not a sufficient amount of time for any size firm to comply with the human preventive controls rule based on experiences with the implementation of our HACCP regulation for seafood. These comments assert that HACCP required a “cultural change” for many seafood processors. The comments acknowledge that the knowledge of HACCP and food safety systems has advanced throughout the food industry in the nearly 20 years since we established our HACCP regulation for seafood but nonetheless assert that firms will need to modify previously developed food safety plans in order to comply with the rule. The comments also assert that training cannot realistically begin until both the final rule and associated guidance are published and that the experiences with implementing our HACCP regulation for seafood should be magnified for the human preventive controls rule because the universe of food processors needing to comply will be much larger, both in the United States and throughout the world. These comments ask us to establish a 2-year compliance period for the largest firms to allow time for the training programs and guidance documents to be developed.

(Response 728) We decline this request. As the comments acknowledge, approximately 20 years have elapsed since we issued the final rule establishing our HACCP regulation for seafood, and requirements such as conducting a hazard analysis and implementing appropriate preventive controls, with associated preventive control management components, are no longer novel. We agree that the details of the final requirements could not be known until publication of this final rule, and that the guidance we are developing can help businesses develop or modify their food safety plans and training programs. However, the statutory direction in section 418 of the FD&C Act is extensive and, thus, signaled the general nature of the requirements as early as January 4, 2011, when FSMA was signed into law. In addition, we conducted extensive stakeholder outreach during the 10-month comment period for the 2013 proposed human preventive controls rule (79 FR 58524 at 58528). We also provided public notice about proposed changes to the farm-related definitions that affect the determination of whether a business is subject to the rule, the framework for hazard analysis and risk-based preventive controls, and about specific potential requirements for environmental monitoring, product testing, and a supplier program, in the 2014 supplemental human preventive controls notice, and conducted outreach activities to discuss the new or revised proposed provisions in that supplemental notice (see section I.A and Ref. 1 and Ref. 2). In light of the broad awareness of preventive programs such as HACCP, the statutory direction in FSMA, and extensive outreach associated with this rulemaking, we disagree that the largest businesses will need more than one year to fully adapt their programs to the specific requirements of the final rule. Although a business may find it useful to revise certain aspects of its food safety plan, or enhance its training materials, after we issue implementation guidance such as that discussed in Response 2, such revisions would serve to enhance the company's food safety plan rather than be a necessary resource before a food safety plan could be developed and implemented or before employees could be trained in their specific duties associated with implementing the plan.

Moreover, for our HACCP regulation for seafood we established a single compliance date regardless of the size of the business, and announced our intention to monitor the progress of the industry after publication of the final rule. If we determined that the compliance date for that regulation was placing a significant and unreasonable burden on the industry, particularly on small businesses, we were willing to consider an extension for as much as one additional year or some form of additional technical assistance (Federal Register of December 18, 1995, 60 FR 65096 at 65169). Approximately 5 years later, we issued the final rule for our HACCP regulation for juice (January 19, 2001, 66 FR 6138), in which we staggered the compliance dates based on business size and provided only one year for the largest businesses to comply. The staggered compliance dates that we proposed for the human preventive controls rule based on business size are consistent with the approach we took for the HACCP regulation for juice, given increased awareness of hazard analysis and the application of risk-based preventive controls in the years after we issued the final rule for seafood HACCP.

(Comment 729) Some comments point out that there are staggered compliance deadlines for small and very small businesses under both the human preventive controls rule and the produce safety rule. These comments express concern that to the extent a receiving facility subject to the human preventive controls rule is required to comply with the rule sooner than a current or prospective supplier, that receiving facility is in effect creating pressure for that supplier to come into compliance on a timetable inconsistent with that established in the rules. The “adequacy” of the receiving facility's verification activities becomes potentially even more problematic to demonstrate to FDA inspectors.

(Response 729) We are establishing separate compliance dates for the supply-chain program provisions. While this adds complexity, we are doing this for two main reasons. First, we are aligning, to the extent feasible, the compliance dates of the supply-chain program provisions of this rule with the compliance dates of the forthcoming FSVP rule, which we intend to publish in the near future. This will provide greater consistency across the programs, particularly with respect to the verification of domestic and imported raw materials and ingredients. For the FSVP rule, we proposed a minimum compliance period of 18 months.

Second, to address the concerns expressed in these comments we want to minimize the likelihood that a receiving facility will be required to comply with the supply-chain program provisions of this rulemaking before its supplier is required to comply with applicable new food safety regulations implementing FSMA. Our goal is to avoid a situation in which a receiving facility would be required to develop a supply-chain program for a food from a particular supplier and then be required to revise this supply-chain program shortly thereafter once the supplier is subject to an applicable new food safety regulation—specifically, the human preventive controls rule or the forthcoming produce safety rule.

Therefore, a receiving facility's compliance date with the supply-chain program provisions of this rulemaking is the later of: (1) March 17, 2017; (2) for a receiving facility that is a small business, September 18, 2017; and (3) when the supplier of a raw material or other ingredient will be subject to the human preventive controls rule or the produce safety rule, six months after the receiving facility's supplier of that raw material or other ingredient is required to comply with the applicable rule.

(Comment 730) One comment from a State department of agriculture asserts that the farm-related definitions in the 2013 proposed human preventive controls rule would cover a large sector of agricultural operations that would not be able to comply due to cost and would need a longer compliance schedule.

(Response 730) We believe that the revised definitions that we proposed in the 2014 supplemental human preventive controls notice for “farm,” and for on-farm manufacturing, processing, packing, and holding activities that trigger a requirement for an establishment that is also a farm to register as a food facility, largely address these comments. Many activities that farms conduct on RACs, and that would have triggered a requirement to register under the definitions established in the section 415 registration regulations in 2003 (68 FR 58894), will not trigger a requirement to register under the definitions we are establishing in this final rule.

We are aware of the impact that food safety rulemakings may have on small and very small businesses, and in the 2001 final rule to establish our HACCP regulation for juice we began the practice of reducing the burden on these businesses by staggering the compliance dates and giving small and very small businesses additional time to comply with food safety regulations. Since that time, we have continued this practice of staggering compliance dates in rulemakings such as establishing CGMPs for dietary supplements (June 25, 2007, 72 FR 34752) and preventing Salmonella Enteritidis in Shell Eggs During Production, Storage, and Transportation (July 9, 2009, 74 FR 33030 at 33034). We believe that the staggered compliance dates in this final rule provide adequate time for businesses of all sizes to comply with the rule, and that the additional compliance time provided for small and very small businesses sufficiently minimizes the burden on those businesses. (See also Response 731.)

(Comment 731) Some comments assert that differences between the proposed compliance dates for different sizes of businesses subject to the human preventive controls rule and the proposed compliance dates for different sizes of businesses subject to the produce safety rule will create confusion within industry and State and local regulators. These comments also express concern that certain farms will be subject to both rules at the same time, and that compliance with each rule will require significant investment of both resources and time, both to understand and to implement the various provisions. These comments ask us to consider a process to permit very small and small farms (as defined under the proposed produce safety rule) that are also mixed-type facilities subject to the human preventive controls rule to apply for a one-time compliance period extension of twelve months by notifying FDA in writing. These comments assert that only a small percentage of businesses will be eligible for such a one-time extension and that the extension will enable a farmer to plan accordingly, first implementing the produce safety rule and then implementing the human preventive controls rule.

(Response 731) We decline this request. See Response 730 regarding the impact of the revised farm-related definitions on businesses that conduct on-farm activities. A small or very small business that only conducts the on-farm low-risk activity/food combinations we have specified as exempt (see § 117.5(g) and (h)) is exempt from all requirements for hazard analysis and risk-based preventive controls. A very small business that conducts on-farm activity/food combinations in addition to those low-risk activity/food combinations would be subject to an exemption as a qualified facility and is subject only to the modified requirements we are establishing in § 117.201.

A small business that would not be exempt because it conducts other activities in addition to those low-risk activity/food combinations that would qualify the business for an exemption will have 2 years to comply with the human preventive controls rule. We acknowledge that complying with both the human preventive controls rule and the produce safety rule involves significant new requirements, but we have provided extended compliance periods and done substantial outreach.

(Comment 732) Some comments ask us to clarify when a very small business would need to comply with the rule if the business starts up after the rule goes into effect. For example, if a very small business starts up six months after the date of the final rule, would that business have 2.5 years to comply, or would it need to comply immediately?

(Response 732) A very small business that is operating as of the date of publication of the final rule, or begins operating any time before the compliance date for very small businesses, must comply with the rule by the compliance date for very small businesses. That date is fixed in time and is not a moving date based on market entry. A very small business that begins operation any time after the compliance date for very small businesses must comply with the rule when it begins operation, and should plan accordingly.

B. Effective and Compliance Dates for Revisions to Part 1

This rule includes revisions to the “farm definition,” and to activities related to the “farm definition,” in §§ 1.227 and 1.328. This rule also includes technical amendments to §§ 1.241, 1.276, and 1.361. We did not discuss effective and compliance dates for these revisions to part 1 in either the 2013 proposed human preventive controls rule or the 2014 supplemental human preventive controls notice. See table 55 for the effective dates and compliance dates that we are establishing in this final rule. As with the requirements we are establishing in part 117, the revisions to part 1 become effective 60 days after the date of publication of this rule (i.e., November 16, 2015). The compliance dates for the technical amendments to §§ 1.241, 1.276, and 1.361 are the same as the effective dates. Two of these technical amendments change the citation to the FD&C Act from “the act” to “the Federal Food, Drug, and Cosmetic Act”; the third technical amendment updates a cross-reference to the definition of “manufacturer” in regulations for the prior notice of imported food.

The principal impact of the substantive revisions to the definitions in the section 415 registration regulations and the section 414 recordkeeping regulations is whether the revised definitions affect the classification of a business as an entity that is subject to these regulations. We believe that some businesses that were subject to one or both of these regulations will no longer be subject to either of these regulations because the activities that these businesses conduct are now within the “farm” definition and, thus, exempt from those regulations. During the 60 day period between the publication of this rule and its effective date, FDA does not intend to prioritize enforcing the section 415 registration regulations and the section 414 recordkeeping regulations for businesses that will no longer be subject to either or both of those regulations once the revisions are effective.

However, we cannot predetermine whether some businesses that previously were not subject to the section 415 registration regulations, the section 414 recordkeeping regulations, or both will not become subject to one or both of those regulations. The approach we are taking to the compliance date for the revisions to these regulations is the same as the approach we took when we first established these regulations. First, for the section 415 registration regulations, the compliance date is the same date as the effective date. Such establishments must register as a food facility by November 16, 2015. (See 68 FR 58894, which establishes an effective date for the section 415 registration regulations but does not establish a different date for compliance with those regulations.) An establishment that is required to register as a food facility by November 16, 2015 will be required to comply with the requirements in part 117 as described in section LVI.A.

For the section 414 recordkeeping regulations, we are requiring that establishments that become subject to these requirements for the first time as a result of the revisions that become effective November 16, 2015 comply with the requirements using the same criteria as we applied when we first established this regulation as shown in table 55. (See 69 FR 71562, December 9, 2004.)

C. Effective Dates for Conforming Amendments

The conforming amendments to regulations in parts 106, 114, 120, 123, 129, 179, and 211 are technical amendments that add a cross-reference to part 117 where the current regulation refers to part 110. The conforming amendment to part 11 adds a reference to the scope of part 11 that the records required under part 117 are not subject to part 11. The conforming amendment to part 16 adds a reference to the scope of part 16 for new procedures in part 117, subpart E that provide a person with an opportunity for a hearing under part 16. These conforming amendments are effective on November 16, 2015, the same date as the effective date of part 117. We are not establishing compliance dates for these conforming amendments. As a practical matter, compliance dates will be determined by the dates for compliance with part 117.

D. Delayed Effective Dates for Provisions That Refer to the Forthcoming Rules for Produce Safety and Third-Party Certification

The following provisions refer to provisions we intend to establish in the near future in part 112 (Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption): §§ 117.5(k)(2), 117.8, 117.405(c), 117.410(d)(2)(ii), 117.430(d), and 117.475(c)(13). In addition, paragraph (2) of the definition of “qualified auditor” in § 117.3, and § 117.435(d) refers to provisions we intend to establish in the near future in part 1, subpart M (Accredited Third-Party Food Safety Audits and Food or Facility Certification). In addition, §§ 117.405(a)(2) and 117.475(c)(2) refer to provisions we intend to establish in the near future in part 1, subpart L (Foreign Supplier Verification Programs for Food Importers). We will publish a document in the Federal Register announcing the effective dates of paragraph (2) of the definition of “qualified auditor” in § 117.3, and §§ 117.5(k)(2), 117.8, 117.405(c), 117.410(d)(2)(ii), 117.430(d), 117.405(a)(2), 117.435(d), 117.475(c)(2) and 117.475(c)(13).

LVII. Compliance and Enforcement

Gaining industry compliance with the provisions of this rule is as important as establishing the provisions. A central element of our strategy to gain industry compliance is to help make available to facilities subject to this rule the education and technical assistance they need to understand and implement the requirements (Ref. 6). Within the Agency we are establishing a Food Safety Technical Assistance Network and seeking funding to increase FDA staffing to provide a central source of information to support industry understanding and implementation of FSMA standards (Ref. 6). This will allow us to respond in a timely and consistent way to industry questions on preventive controls technical and compliance issues (Ref. 6).

We also are working in collaboration with the FSPCA to develop training materials and establish training and technical assistance programs (Ref. 5) and (Ref. 7). The FSPCA includes members from FDA, State food protection agencies, the food industry, and academia. It is funded by a grant to the Illinois Institute of Technology's Institute for Food Safety and Health, a nationally-recognized leader in food safety. In addition to developing a standardized preventive controls training curriculum, the FSPCA is developing selected sections of model food safety plans for several food types that will provide needed instructional examples. Although we have provided funding to the FSPCA to develop a standardized preventive controls training curriculum, we are unable to fund training for individual groups who might need particular training materials.

We also are partnering with the NIFA of USDA to administer the FSMA-mandated National Food Safety Training, Education, Extension, Outreach, and Technical Assistance Program, a grant program to provide technical assistance for FSMA compliance to owners and operators of small and medium-size farms and small food processors (Ref. 8). Such efforts will help ensure widespread voluntary compliance by encouraging greater understanding and adoption of established food safety standards, guidance, and protocols.

With regard to inspections, we will conduct regular inspections of domestic facilities to ensure that facilities subject to this rule are adequately implementing the required preventive controls and supply-chain program, pursuant to our inspection authority under section 704 of the FD&C Act. Our inspections will verify that such facilities are implementing systems that effectively prevent food contamination, and in particular, that they comply with the rule by implementing preventive controls, including supply-chain programs, to provide assurances that any hazard requiring a preventive control or supply-chain applied control has been significantly minimized or prevented.

In order to effectively carry out this new paradigm of food safety prevention, we will need to reorient and retrain our staff. To this end, we are seeking additional funding, including for the training of more than 2,000 FDA inspectors, compliance officers, and other staff involved in food safety activities (Ref. 12).

We also plan to leverage the resources of State, local, tribal, and territorial governments to conduct domestic verification activities. We are working with officials from these governments through the PFP to develop and implement a national Integrated Food Safety System, which will focus on establishing partnerships for achieving compliance (see section 209(b) of FSMA), and which will allow us to utilize the thousands of State, local, and tribal inspectors available to help with the domestic verification process.

Consistent with FSMA, we will use our current resources, new resources that we obtain, and our partnerships to conduct regular inspections of covered facilities, focusing on those facilities that pose the highest risk to food safety. Section 201 of FSMA mandates that FDA inspect domestic high-risk facilities no less than once every 3 years. We are currently meeting this mandate, and even exceeding it with respect to certain domestic high-risk facilities. Once the FSMA rulemakings come into effect, we intend to build on this track record and to have an FDA or State inspection of domestic high-risk human food facilities on an annual basis to ensure hazards have been significantly minimized or prevented in compliance with this rule.

LVIII. Executive Order 13175

In accordance with Executive Order 13175, FDA has consulted with tribal government officials. A Tribal Summary Impact Statement has been prepared that includes a summary of Tribal officials' concerns and how FDA has addressed them (Ref. 101). Persons with access to the Internet may obtain the Tribal Summary Impact Statement at http://www.fda.gov/pchfrule or at http://www.regulations.gov . Copies of the Tribal Summary Impact Statement also may be obtained by contacting the person listed under FOR FURTHER INFORMATION CONTACT.

LIX. Economic Analysis of Impacts

FDA has examined the impacts of the final rule under Executive Order 12866, Executive Order 13563, the Regulatory Flexibility Act (5 U.S.C. 601-612), and the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4). Executive Orders 12866 and 13563 direct Agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). The Agency believes that this final rule is a significant regulatory action under Executive Order 12866.

The Regulatory Flexibility Act requires Agencies to analyze regulatory options that would minimize any significant impact of a rule on small entities. Because facilities with less than 20 employees (both qualified and non-qualified facilities) will bear a large portion of the costs, the Agency concludes that the final rule will have a significant economic impact on a substantial number of small entities.

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that Agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” The current threshold after adjustment for inflation is $144 million, using the most current (2014) Implicit Price Deflator for the Gross Domestic Product. FDA expects this final rule to result in a 1-year expenditure that will exceed this amount.

LX. Analysis of Environmental Impact

FDA has determined under 21 CFR 25.30(j) that this action is of a type that does not individually or cumulatively have a significant effect on the human environment (Ref. 102) (Ref. 103). Therefore, neither an environmental assessment nor an environmental impact statement is required.

LXI. Paperwork Reduction Act of 1995

This rule contains information collection provisions that are subject to review by OMB under the Paperwork Reduction Act (PRA) of 1995 (44 U.S.C. 3501-3520). A description of these provisions is given in the following paragraphs with an estimate of the annual recordkeeping and reporting burdens. Included in the estimate is the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing each collection of information.

Title: Current Good Manufacturing Practice, Hazard Analysis and Risk-Based Preventive Controls for Human Food.

Description: The Food and Drug Administration (FDA) is proposing to amend its regulation for Current Good Manufacturing Practice in Manufacturing, Packing, or Holding Human Food (CGMPs) to modernize it and to add requirements for domestic and foreign facilities that are required to register under section 415 of the Federal Food, Drug, and Cosmetic Act (the FD&C Act) to establish and implement hazard analysis and risk-based preventive controls for human food. FDA is taking this action as part of its announced initiative to revisit the CGMPs since they were last revised in 1986 and to implement new statutory provisions in section 418 of the FD&C Act.

Description of Respondents: Section 418 of the FD&C Act is applicable to the owner, operator or agent in charge of a food facility required to register under section 415 of the FD&C Act. Generally, a facility is required to register if it manufactures, processes, packs, or holds food for consumption in the United States. There are 83,819 such facilities; 37,134 of these facilities are considered “qualified” facilities and have reduced requirements in regards to this rule-making.

In the following paragraphs, we describe and respond to the comments that we received for the PRA for both our 2013 proposed human preventive controls rule and our 2014 supplemental human preventive controls notice. We numbered each comment to help distinguish between different comments. The number assigned to each comment is purely for organizational purposes and does not signify the comment's value, importance, or the order in which it was received.

(Comment 733) Comments stated that we overestimated the recordkeeping burden because we assume the burden is evenly distributed across all facilities beginning in the first year. However, facilities that are not small or very small have one year from the effective date of the rule to come into compliance. For small facilities, compliance is delayed for 2 years and very small facilities will have 3 years. The agency's 7 year horizon for discounting burdens would need to be staggered to account for the delayed compliance dates in order to arrive at a consistent annualized burden of the records collection.

(Response 733) We clarify that our estimate for the recordkeeping burden for the first year is for the first full year that all facilities are responsible for the requirements for the rule. We note that the FRIA (Ref. 38) now uses a 10 year horizon for discounting burdens.

(Comment 734) Comments support our estimate that many facilities already keep the records required by section 418 of the FD&C Act and the proposed human preventive controls rule as good business practice. Comments believe that preventive food safety systems are the norm for the food industry. Comments believe this is demonstrated by what they cite as 57 percent of the industry already operating under HACCP programs. Not accounting for the effects of widespread adoption of HACCP may result in an overestimate. The reason a majority of food facilities have already implemented HACCP or a HACCP‐like systems is that preventive systems are the best, most cost‐effective means of insuring against recall costs and potential criminal liability for releasing adulterated product into commerce. If the industry standard is prevention, then the baseline for calculating PRA burdens should be adjusted to account for that.

(Response 734) We concur that we do not account for those facilities that are in the process of adopting our requirements independently. We do address the impact of a likely trend toward adopting our requirements in the uncertainty analysis of our FRIA (Ref. 38).

(Comment 735) Comments assert that knowledge transferred from facilities already applying HACCP will be available to small and very small facilities during the delayed implementation period. Delayed implementation periods usually contemplate that smaller businesses will benefit from increased availability of advanced technology and knowledge that can lower the costs of compliance. Related comments suggest that the PRA does not appear to have considered that during the three‐year implementation period standardized templates and software for hazard analyses and food safety plans may become available for food facilities. The availability of templates and software would reduce the time needed for small and very small facilities to prepare mandatory documents.

(Response 735) We concur that delayed implementation periods will benefit smaller businesses from the increased availability of advanced technology and knowledge that can lower the costs of compliance. We allowed the staggered compliance period for this very reason. We revised our estimate of the costs to learn about the requirements of rule in the main analysis. In our revised analysis, we estimate that facilities with fewer than 20 employees will devote 5 hours to learning about their requirements, rather than 10 hours. For facilities with 20 to 99 employees, one individual at the level of an operations manager will take about 10 hours to review and assess the requirements or to learn about the requirements for their facility rather than 15 hours.

(Comment 736) Comments suggest that the PRA review does not account for reduced training costs for small and very small facilities derived from the availability for hire of trained employees. The average turnover rate in manufacturing in 2010 was 15 percent, suggesting some small businesses will be able to hire qualified individuals rather than training current employees.

(Response 736) We agree that some new employees will already be trained but we believe that we accounted for those that are already trained by only including burden hours for employees at facilities that disclosed to our survey that they did not conduct training. In addition, we estimated a turnover rate of 10 percent, which indicates that fewer new employees would require training than proposed by the comments, indicating that we did not overestimate the burden hours.

(Comment 737) Comments assert that we underestimated the recordkeeping burden of the proposed information collection, that our methodology and assumptions are wrong or that it is not possible to adequately assess the accuracy of our recordkeeping burden estimates. Comments further dispute our assessment that creation of a single food safety plan will require 110 hours and that one plan will be required per facility. In the experience of the comments' member organization, it takes considerably longer, with a median of over 200 hours per facility. Additionally, many plants currently have more than one HACCP plan in place. Large plants have multiple products, raw materials, processes, and equipment. Comments report that one large plant has 34 plans in place that took approximately 860 hours to develop and another large plant has 25 plans in place that took approximately 1385 hours to develop.

(Response 737) We concur that establishments might have more than one HACCP plan in place and we acknowledge that large establishments might require considerably more than 110 hours to develop a food safety plan. Our estimate is based on the average time to create a food safety plan for establishments of all sizes, so our estimate includes very small facilities that are likely to require considerably less than 110 hours, too.

(Comment 738) Comments assert that it is not clear if our assessment includes the considerable pre-work time that is required as an input to development of a HACCP plan. Pre-work includes activities such as employee training, assembling the food safety plan team (which may require outside experts, and specific company experts like microbiologists, procurement, research and development, etc.), creating the processing and product profile, and creating a flow diagram. Some estimated that approximately 150-300 hours of pre-work are needed per facility before the actual HACCP plan is prepared.

(Response 738) Our analysis for the PRA includes pre-work time to the extent that pre-work time includes preparing the documents that are required in accordance with the rule. The preparation of records for the validation of process controls might be considered pre-work and would be considered in our estimate. We disagree that all of the pre-work mentioned by the comments should be included in our estimate of the burden hours.

(Comment 739) Comments believe that a robust food safety plan should be developed by a multidisciplinary group of professionals with a broad skill set. These comments believe that it is unclear what wage rate we used in our estimate of the operating and maintenance costs associated with implementing and maintaining a food safety plan or if those estimates consider the range of wages applicable to the broad team involved in plan development.

(Response 739) We concur that a multidisciplinary group of professionals is likely to be involved in the plan development. Our estimate is based on an average wage rate for the type of professional that would be likely to develop the specific document. We included our estimate for the average wage rate that we used for each type of document in our description.

(Comment 740) Comments suggest that our estimate that facilities will keep records of 730 monitoring activities and that each record can be made in about three minutes (36.5 hours total per year per facility), severely underestimates both the number of activities and the time required.

(Response 740) Comments did not provide supporting evidence. In the absence of a better substantiated estimate, we decline to revise our estimate.

(Comment 741) Comments assert that we severely underestimated the number of monitoring records. Comments claim that several of their members reported over 50,000 monitoring events in their facilities annually. They provided as an example that if one production line has two metal detectors and one barcode scanner, there would be three records per shift, with three shifts per day. Assuming 300 days of operation per year, this one line would have 2700 records per year. Most plants have multiple lines and conduct monitoring beyond metal detectors and bar code scanners. A large plant may have well over 730 monitoring events per day—not per year as FDA estimates.

(Response 741) We concur that a large establishment might have significantly more monitoring events. Our analysis is based on the average of all establishments, including very small establishments that are unlikely to so many events. In the absence of substantiated evidence for the large average number of monitoring events, we decline to revise our estimate.

(Comment 742) Comments let us know that it is unclear what activities are included in our time estimate. Comments claim that the amount of time required to produce a record will vary depending on whether the estimate only includes documenting time to create the record or whether it also includes the underlying task of monitoring and follow-up tasks like filing. Furthermore, the number of monitoring events could be significantly higher than the estimate if all preventive controls are subject to similar monitoring requirements as critical control points. Thus, although some tasks may take only three minutes to monitor, our members suggest that six minutes per monitoring event may be a more accurate estimate of the information collection burden.

(Response 742) We concur with the comments that time will vary by what's included in the task. The PRA requires that we include in our burden estimate the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing each collection of information. We believe our estimate of 3 minutes, as an average over time, accurately reflects the entire requirement for recordkeeping, including the initial time to create, maintain and file the records. Many, if not most, records can be created, maintained and filed in batch to reduce time, especially when done electronically, so we decline to revise our estimate of 3 minutes, in the absence of more evidence.

(Comment 743) Comments claim that our estimated burden for corrective action records assumes that 18,291 facilities subject to preventive controls will have two corrective actions to document, which will take one hour each to record. Our assessment does not explain the basis for estimating that only 18,291 facilities will engage in corrective actions. Because occasional deviations from expected values are an unavoidable part of any manufacturing environment, it should be expected that all facilities subject to preventive controls regulations will have corrective actions to document annually. Comments claim that our time estimate also appears to be low. Comments report that their member's facilities typically engage in between 10 and 60 corrective actions per year for critical control point deviations, which is considerably higher than our proposed estimate of two actions per year. Although it may take only one hour to manage the record involved with the corrective action, additional time would be required to investigate the underlying issue and implement the corrective action. We expect it can take between two and four hours to investigate a single corrective action and come up with a solution.

(Response 743) We revised our estimate for the number of establishments that would be subject to the requirements to 16,285 based on the most recent number of facilities registered with FDA and that are subject to subparts C and G. We address elsewhere our reason for not requiring all facilities to be subject to subparts C and G. We recognize that some facilities will conduct more than our estimate of two corrective actions per year. Our estimate is based on actions that must be made to correct a problem that has occurred with the implementation of a preventive control; or that might affect the safety of the food. Many corrective actions might occur to address product quality problems, unrelated to food safety. Further, our estimate for the PRA is necessarily only related to the recordkeeping burden, and should not include the additional time that would be required to investigate the underlying issue and implement the corrective action.

(Comment 744) Comments noted that our estimate for keeping verification records assumes facilities will keep records of 244 verification events and that each record can be made in about three minutes (12.2 hours total per year per facility). Comments claim that our assessment does not explain whether this estimate considers the broad scope of activities included in the definition of “verification” in the proposed rule (proposed § 117.150), although it should. The proposed regulatory definition of verification not only includes verification of monitoring, corrective actions, and implementation and effectiveness (e.g., calibration), but also includes validation and reanalysis. Validation and reanalysis of a food safety plan are extensive activities that take tens, if not hundreds, of hours to conduct. The estimate does not appear to account for these activities. The comments note that even when considering just the traditional activities considered as verification under HACCP, their members' experience shows that our current verification estimate is too low. They received a wide range of estimates of the number of verification events conducted annually—from about 200 to over 14,000 events per year. Similarly, their members report that it takes them between 8 minutes and 2 hours per verification event. It is unclear whether our estimate includes only the time to handle the record or also the time to conduct the verification. The comments suggest this missing information in our estimate may explain the range of responses in our survey. Comments claim that the time to conduct the verification should be included.

(Response 744) We concur that our estimates should assess the full scope of activities associated with recordkeeping. Our analysis did neglect to include the recordkeeping activities for the validation of process controls, which are an essential part of verification. We added our estimate for the burden of validation and we revised our description about the recordkeeping burden for the food safety plan to state that our estimate does include the burden of reanalysis of the food safety plan. For the purposes of the PRA, our estimate of the burden of recordkeeping is only for the time of recordkeeping, not the full verification activity. We decline to revise our estimate based on the comment because insufficient evidence was presented about just the time for recordkeeping.

(Comment 745) Comments noted that we estimate that 47,484 food manufacturers will need to document the training of their preventive controls qualified individual, which will take 15 minutes per facility. (We note that the proposed rule defined and used the term “qualified individual, but the term in the final rule is “preventive controls qualified individual, and we use the term “preventive controls qualified individual” in describing these comments on this topic.) They are unclear why we estimate that only 47,484 food manufacturers and not all registered facilities subject to preventive controls would be required to have a preventive controls qualified individual and to document that person's training. Comments state that their members found that we are accurate in our assumption, although our estimate for the documentation may take 30 minutes in some situations. Comments also suggest that many facilities may need to document more than one preventive controls qualified individual. Comments provide as an example, that a thermal process authority outside of the plant may be a qualified individual in terms of confirming the process has a validated kill step, while the same facility will likely have a qualified individual responsible for approving the food safety plan. This situation would increase the time burden beyond estimate.

(Response 745) Our estimate of 47,484 establishments that will need to document the training of their preventive controls qualified individual was based on our estimate of the number of facilities that are subject to subparts C and G of the rule. We updated our estimate to 46,685 based on our most recent count of facilities registered with FDA. Our estimate is based on the requirement that only one preventive controls qualified individual is necessary to perform the requirements of the provisions that require a preventive controls qualified individual. Moreover, some preventive controls qualified individuals may be qualified by experience and there would not be a need for documentation of training.

(Comment 746) Comments note that our estimate for submitting a new domestic food facility profile will take 15 minutes. Comments believe that we grossly underestimate the amount of time retailers will need to respond to the form. Comments believe that the typical distribution center carries 26 of the 27 product categories listed in the Draft Form. Providing detail on the potential hazards and preventive controls implemented for each product will take retailers a total of 20-30 or more hours per facility. Most chain retailers have multiple facilities. A national retailer will easily have a dozen or more distribution centers. The largest food retailers will have several dozen. It is conceivable that hundreds of hazard and preventive control entries will be required to be made for each distribution center to respond to the Draft Form if such facilities are required to input information on hazards they do not control. The typical distribution center carries more than 13,000 different SKUs of FDA-regulated foods. Completing the form itself will require several hours due to all of the entries. Compiling the information for each facility will take 20-30 hours. Under the PRA, comments believe that we are required to consider not only the time it takes to complete the form, but also the time it takes to compile the information. Comments believe that we must revise our estimate of the burden imposed by the information collection request (ICR).

(Response 746) We requested comment on whether to require submission to FDA of a subset of the information that would be in a food safety plan. After considering comments, we decided that we will not establish a requirement for submission of a facility profile. To the extent that this comment is addressing the form used for registering a food facility with FDA, such a comment is outside the scope of this rule-making. Moreover, an establishment that meets the definition of a retail food establishment is not a facility required to register.

(Comment 747) Comments believe that our ICR contains redundant collections. Comments believe that our existing Food Facility Registration Module requests information on facility type and products handled, while our ICR seeks the same information. Commenters believe that we should minimize redundancies to the greatest extent possible and use the information that we already have. As such, we should not be requesting information on facility type, products handled and, if it decides to as we recommend, types of storage, through this ICR. All of these data points are already collected by the existing Food Facility Registration Module.

(Response 747) The ICR associated with this rule-making is not redundant. The ICR associated with food facility registration with FDA is a separate rule-making and a separate burden. This PRA contains the ICR for completing all the requirements for a food facility to develop a hazard analysis and preventive controls; not register their facility. See Response 746.

(Comment 748) Comments suggest that our estimated time and costs to comply with the requirement to label products from certain qualified facilities do not come under the PRA because the address requirement is a disclosure, and not an information collection.

(Response 748) We concur that the requirement to add a qualified facility address to the product label is a third-party disclosure burden, and because it is a disclosure burden, is subject to the PRA. We revised our estimate for the hour burden for each of these disclosures to be 15 minutes as shown in table 69 of the PRA, to reflect that this will not be a coordinated label change for most qualified facilities so most will not be updating their labels anyway.

Information Collection Burden Estimate

FDA estimates the burden for this information collection as follows:

Recordkeeping Burden

We estimate that about 46,685 facilities subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls will need to create a food safety plan (§ 117.175(a)(1)) which is a compilation of many written food safety procedures. We total the hour burdens as presented throughout the FRIA (Ref. 38) to then create an average hour burden for each facility to create or complete a food safety plan. We estimate that creation of the food safety plan will require 110 hours. The total hour burden on an annual basis is 46,685 facilities × 110 hours = 5,135,350 hours. There are no capital costs or operating and maintenance costs associated with this collection of information.

We estimate the burden for disclosing to a customer, in documents to accompany foods that require further processing, that the food has not been processed to control a specified hazard (§ 117.136), is 15 minutes per record. We estimate that 16,285 establishments will each make one of these disclosures for a total recordkeeping burden of 4,071 hours.

The burden for keeping monitoring records (§ 117.175(a)(2)) follows the same pattern as that for the food safety plan. We estimate that there are 8,143 facilities subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls that will need to keep additional records of the monitoring that they do of different activities within their food facilities. Based on estimates of monitoring created, when appropriate, throughout the FRIA, we estimate that each of the 8,143 facilities will keep records of 730 monitoring activities and that each record can be made in about 3 minutes (0.05 hours) for a total hour burden of 297,220.

For the burden for corrective action records (§ 117.175(a)(3) we estimate that twice per year 16,285 facilities subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls will have corrective actions to document. The documentation of those corrective actions is expected to take one hour for each record for a total hour burden of 32,570.

We estimate that there are 8,143 facilities subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls that will need to keep additional records of verification activities. Based on estimates of verification records created, when appropriate, throughout the FRIA, we estimate that 8,143 facilities will keep records of 244 verification activities and that each record can be made in about 3 minutes (0.05 hours) for a total hour burden of 101,675.

The burden for keeping validation records (§ 117.160) follows the same pattern as that for verification records. We estimate that there are 3,677 facilities subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls that will need to keep additional records of the validation of their process control activities within their food facilities. Based on estimates of the establishments that will require validation, when appropriate, throughout the FRIA, we estimate that each of the 3,677 facilities will keep records of six validation activities for a total of 22,062 records. We estimate that each record can be made in about 15 minutes (0.25 hours) for a total hour burden of 5,515.

The burden for keeping supplier records is for the use of approved suppliers and for establishments to document their audits § 117.475(c)(7), the sampling and testing of their ingredients § 117.475(c)(8), and the review of their supplier's relevant food safety records § 117.475(c)(9), among up to 18 possible supplier related records. Our estimate follows the same pattern as that for other records. We estimate that there are 16,285 facilities subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls that will need to keep as many as 18 additional records for an average of 10 records of their approved suppliers and review records. Based on estimates throughout the FRIA, we estimate that each of the 16,285 establishments will maintain these records and that the total time for this recordkeeping will be about 4 hours for a total hour burden of 651,400.

We estimate that 46,685 establishments subject to subparts C and G Hazard Analysis and Risk-Based Preventive Controls will need to document the training of their preventive controls qualified individuals (§ 117.180(d)). We estimate that this will require 15 minutes (0.25 hours) per facility total for a total hour burden of 11,671.

Under § 117.206(a)(5) facilities are required to keep records documenting (1) the monitoring of temperature controls for refrigerated packaged food, (2) the corrective actions taken when there is a problem with the control of temperature for refrigerated packaged food, and (3) the verification activities relating to the temperature control of refrigerated packaged food. We believe that the keeping of such records is already common industry practice and will not constitute an additional paperwork burden.

Table 56 shows the estimated annual recordkeeping burden associated with this rule. There are no capital costs or operating and maintenance costs associated with this collection of information.

Reporting Burden

Table 57 shows the estimated annual reporting burden associated with this rule.

Qualified facilities must report their status as such a facility every 2 years; status will likely be reported electronically through a web portal maintained by FDA. This requirement will cause the 37,134 qualified facilities to spend 0.5 hour every 2 years reporting to FDA their status as a qualified facility for a total annual hour burden of about 9,283 hours (37,134 facilities × 0.5 responses annually × 0.5 hours per response).

Third Party Disclosure Burden

Under § 117.201(e) qualified facilities must add the address of the facility where the food is manufactured to their label. We estimate the hour burden of this disclosure is 15 minutes per disclosure. This requirement will cause the 37,134 qualified facilities to spend 0.25 hours adding their address to their new labels for a total hour burden of about 9,283 hours (37,134 facilities × 0.25 hours per response).

LXII. Federalism

FDA has analyzed this final rule in accordance with the principles set forth in Executive Order 13132. FDA has determined that the rule does not contain policies that have substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Accordingly, the Agency has concluded that the rule does not contain policies that have federalism implications as defined in the Executive order and, consequently, a federalism summary impact statement is not required.

LXIII. References

The following references have been placed on display in the Division of Dockets Management (see ADDRESSES) and may be seen by interested persons between 9 a.m. and 4 p.m., Monday through Friday. These references are also available electronically at http://www.regulatons.gov . We have verified the Web site addresses, but we are not responsible for any subsequent changes to Web sites after this document publishes in the Federal Register.

1. FDA Memorandum, “FDA Memorandum to Dockets on Records of Outreach,” 2013. See Reference 7 to the 2014 supplemental human preventive controls notice.

2. FDA Memorandum, “Memoranda of Outreach,” 2015.

3. FDA, “Food CGMP Modernization—A Focus on Food Safety,” ( http://www.fda.gov/Food/GuidanceRegulation/CGMP/ucm207458.htm ), November 2, 2005. Accessed and printed on March 20, 2015. See Reference 1 to the 2013 proposed human preventive controls rule.

4. FDA, “Qualitative Risk Assessment: Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm,” 2015.

5. FDA, “Technical Staffing and Guidance Development at FDA,” ( http://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM436592.pdf ), 2015. Accessed and printed on March 22, 2015.

6. FDA, “Education and Technical Assistance for Industry,” ( http://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM436593.pdf ), March 5, 2015. Accessed and printed on March 26, 2015.

7. FDA, “Food Safety Preventive Controls Alliance,” ( http://www.fda.gov/food/guidanceregulation/fsma/ucm284406.htm ), 2015. Accessed and printed on August 29, 2015.

8. FDA, “FDA Announces Competitive Grant Program With NIFA to Fund Food Safety Training, Education and Technical Assistance,” ( http://www.fda.gov/food/newsevents/constituentupdates/ucm430492.htm ), January 15, 2015. Accessed and printed on March 27, 2015.

9. FDA, “Guidance for Industry: Questions and Answers Regarding Food Facility Registration (Sixth Edition),” ( http://www.fda.gov/downloads/Food/GuidanceRegulation/UCM332460.pdf ), 2014. Accessed and printed on June 2, 2015.

10. Partnership for Food Protection National Workplan Workgroup, “Model for Local Federal/State Planning and Coordination of Field Operations and Training: a Partnership for Food Protection “Best Practice,” ( http://www.fda.gov/downloads/ForFederalStateandLocalOfficials/FoodSafetySystem/UCM373333.pdf ), October, 2013. Accessed and printed on May 19, 2014.

11. FDA, “Operational Strategy for Implementing the FDA Food Safety Modernization Act (FSMA),” ( http://www.fda.gov/Food/GuidanceRegulation/FSMA/ucm395105.htm ), May 2, 2014. Accessed and printed on May 19, 2014.

12. FDA, “Inspection Modernization and Training: Key Investments for Implementing the FDA Food Safety Modernization Act (FSMA),” ( http://www.fda.gov/food/guidanceregulation/fsma/ucm432576.htm ), 2015.

13. FDA, “Guidance for Industry: Guide to Minimize Microbial Food Safety Hazards for Fresh Fruits and Vegetables,” 1998.

14. Dictionary.com, “Definition of “Management”,” ( http://dictionary.reference.com/browse/management ), 2015. Accessed and printed on February 26, 2015.

15. FDA, “Guidance for Industry: Antimicrobial Food Additives,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/IngredientsAdditivesGRASPackaging/ucm077256.htm ), July, 1999. Accessed and printed on October 17, 2011. See Reference 118 to the 2013 proposed human preventive controls rule.

16. Produce Marketing Association, “Foreign Supplier Verification Programs for Importers of Food for Humans and Animals (Docket No. FDA-2011-N-0143),” ID FDA-2011-N-0143-018, 2014.

17. USDA Agricultural Marketing Service, Memorandum for the Record, “Documenting April 2015 Conversation Relative to Contract Harvesting Scenarios,” 2015.

18. FDA, “Draft Qualitative Risk Assessment: Risk of Activity/Food Combinations for Activities (Outside the Farm Definition) Conducted in a Facility Co-Located on a Farm,” 2012. See Reference 115 to the 2013 proposed human preventive controls rule.

19. Muth, M. K., C. Zhen, M. Coglaiti, S. Karns, and C. Viator, “Food Processing Sector Study,” 2011. See Reference 34 to the 2014 supplemental human preventive controls notice.

20. Painter, J. A., R. M. Hoekstra, T. Ayers, R. V. Tauxe, C. R. Braden, F. J. Angulo, and P. M. Griffin, “Attribution of Foodborne Illnesses, Hospitalizations, and Deaths to Food Commodities by Using Outbreak Data, United States, 1998-2008,” Emerging Infectious Diseases, 19:407-415, 2013.

21. Capogrossi, K., L. Calvin, M. Coglaiti, D. Hinman, S. Karns, A. Lasher, T. Minor, M.K. Muth, V. Nigh, P. Vardon, C. Viator and C. Zhen, “Food Processing Sector Study, (Contract HHSF-223-2011-10005B, Task Order 20), Final Report,” 2015.

22. Merriam-webster.com, “Definition of “Include”,” ( http://www.merriam-webster.com/dictionary/include ), 2015. Accessed and printed on June 3, 2014.

23. Grocery Manufacturers Association, “Food Supply Chain Handbook,” ( http://www.gmaonline.org/downloads/technical-guidance-and-tools/GMA_SupplyChain2.pdf ), April 16, 2008. Accessed and printed on March 13, 2015. See Appendix Reference 92 to the 2013 proposed human preventive controls rule.

24. Grocery Manufacturers Association, “Industry Handbook for Safe Processing of Nuts,” ( http://www.gmaonline.org/downloads/technical-guidance-and-tools/Industry_Handbook_for_Safe_Processing_of_Nuts_1st_Edition_22Feb10.pdf ), February 22, 2010. Accessed and printed on March 13, 2015.

25. FDA, “The Reportable Food Registry: A New Approach to Targeting Inspection Resources and Identifying Patterns of Adulteration—First Annual Report: September 8, 2009—September 7, 2010,” ( http://www.fda.gov/downloads/Food/ComplianceEnforcement/UCM291297.pdf ), January, 2011. Accessed and printed on February 24, 2014. See Reference 60 to the 2013 proposed human preventive controls rule.

26. FDA, “The Reportable Food Registry: Targeting Inspection Resources and Identifying Patterns of Adulteration—Second Annual Report: September 8, 2010—September 7, 2011,” ( http://www.fda.gov/downloads/Food/ComplianceEnforcement/UCM301013.pdf ), April 19, 2012. Accessed and printed on February 24, 2014. See Reference 61 to the 2013 proposed human preventive controls rule.

27. FDA, “The Reportable Food Registry: Targeting Inspection Resources and Identifying Patterns of Adulteration—Third Annual Report: September 8, 2011-September 7, 2012,” ( http://www.fda.gov/downloads/Food/ComplianceEnforcement/RFR/UCM349856.pdf ), May 1, 2013. Accessed and printed on February 24, 2014.

28. FDA, “The Reportable Food Registry: Targeting Inspection Resources and Identifying Patterns of Adulteration—Fourth Annual Report: September 8, 2012-September 7, 2013,” ( http://www.fda.gov/downloads/Food/ComplianceEnforcement/RFR/UCM395684.pdf ), May 5, 2014. Accessed and printed on September 26, 2014.

29. FDA, “Guidance for Industry: Measures to Address the Risk for Contamination by Salmonella Species in Food Containing a Peanut-Derived Product as an Ingredient,” 2009. See Reference 6 to the 2013 proposed human preventive controls rule.

30. FDA, “Guidance for Industry: Measures to Address the Risk for Contamination by Salmonella Species in Food Containing a Pistachio-Derived Product as an Ingredient,” 2011. See Reference 156 to the 2013 proposed human preventive controls rule.

31. FDA, “Bad Bug Book: Foodborne Pathogenic Microorganisms and Natural Toxins Handbook. Second Edition,” 2012. See Reference 49 to the 2013 proposed human preventive controls rule.

32. FDA, “Draft Guidance for Industry: Questions and Answers Regarding the Reportable Food Registry As Established by the Food and Drug Administration Amendments Act of 2007 (Edition 2),” ( http://www.fda.gov/downloads/Food/GuidanceRegulation/UCM213214.pdf ), May, 2010. Accessed and printed on March 27, 2015.

33. FDA, “Guidance for Industry: Questions and Answers Regarding the Reportable Food Registry As Established by the Food and Drug Administration Amendments Act of 2007,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/RFR/ucm180761.htm ), September, 2009. Accessed and printed on March 13, 2015.

34. Codex Alimentarius Commission, “Hazard Analysis And Critical Control Point (HACCP) System And Guidelines For Its Application. Annex to CAC/RCP 1-1969 (Rev. 4—2003),” ( http://www.codexalimentarius.org/download/standards/23/CXP_001e.pdf ), 2003. Accessed and printed on December 12, 2011. See Reference 35 to the 2013 proposed human preventive controls rule.

35. National Advisory Committee on Microbiological Criteria for Foods, “Hazard Analysis and Critical Control Point Principles and Application Guidelines,” Journal of Food Protection, 61:1246-1259, 1998. See Reference 34 to the 2013 proposed human preventive controls rule.

36. FDA, “The Food Defect Action Levels: Levels of Natural or Unavoidable Defects in Foods That Present No Health Hazards for Humans,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/SanitationTransportation/ucm056174.htm ), February, 2005. Accessed and printed on October 14, 2011. See Reference 141 to the 2013 proposed human preventive controls rule.

37. FDA, “CPG Sec. 527.300 Dairy Products—Microbial Contaminants and Alkaline Phosphatase Activity,” ( http://www.fda.gov/downloads/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/UCM192468.pdf ), December, 2009. Accessed and printed on March 25, 2015. See Reference 7 to the 2013 proposed human preventive controls rule.

38. FDA, “Part 117. FSMA Final Rulemaking for Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food: Final Regulatory Impact Analysis, Final Regulatory Flexibility Analysis, Final Unfunded Mandates Reform Act Analysis, and Final Paperwork Reduction Act Analysis,” 2015.

39. Codex Alimentarius Commission, “Guidelines for the Validation of Food Safety Control Measures, CAC/GL 69-2008,” ( www.codexalimentarius.org/input/download/standards/11022/CXG_069e.pdf ), 2008. Accessed and printed on August 29, 2011. See Reference 127 to the 2013 proposed human preventive controls rule.

40. FDA, “NPRM Human Preventive Controls Rule Submitted to OMB,” 2011. See Tab A in “OMB Review of Proposed Rule re Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls For Human Food, January 16, 2013—Memorandum” in Docket No. FDA-2011-N-0920, No. FDA-2011-N-0920-0014.

41. FDA, “Preliminary Regulatory Impact Analysis for the Proposed Sanitary Transportation of Human and Animal Food Rule,” 2014.

42. FDA, “Fish and Fishery Products Hazards and Controls Guidance, Fourth Edition,” ( http://www.fda.gov/downloads/Food/GuidanceRegulation/UCM251970.pdf ), 2011. See Reference 3 to the 2013 proposed human preventive controls rule.

43. FDA, “Guidance for Industry: Juice HACCP Hazards and Controls Guidance First Edition; Final Guidance,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/Juice/ucm072557.htm ), March 3, 2004. Accessed and printed on March 20, 2015. See Reference 4 to the 2013 proposed human preventive controls rule.

44. Dictionary.com, “Definition of “Solely”,” ( http://dictionary.reference.com/browse/solely ), June 11, 2014. Accessed and printed on June 11, 2014.

45. Scallan, E., R. M. Hoekstra, F. J. Angulo, R. V. Tauxe, M.-A. Widdowson, S. L. Roy, J. L. Jones, and P. M. Griffin, “Foodborne Illness Acquired in the United States—Major Pathogens,” Emerging Infectious Diseases, 17, 2011. See Reference 45 to the 2013 proposed human preventive controls rule.

46. Stiles, T., “Post-Pasteurization Contamination of Milk by Listeria Monocytogenes in Massachusetts,” ( http://www.aphl.org/conferences/proceedings/Documents/2008_12th_Annual_PulseNet_Update_Meeting/7-StilesListeriainMass.pdf ), December 27, 2008. Accessed and printed on March 20, 2015.

47. FDA, “Company Recalls Various Products Due to Potential Salmonella Contamination,” ( http://www.fda.gov/safety/recalls/archiverecalls/2009/ucm169471.htm ), June 28, 2009. Accessed and printed on September 9, 2011. See Reference 155 to the 2013 proposed human preventive controls rule.

48. FDA Memorandum, “Grade “A” Pasteurized Milk Ordinance (PMO) description and comparison to the requirements of the Preventive Controls for Human Food Rule,” 2015.

49. FDA Memorandum, “Comparison of the Requirements for Hazard Analysis and Risk-Based Preventive Controls in 21 CFR 117 and the Requirements of the Grade “A” Pasteurized Milk Ordinance (PMO),” 2015.

50. USDA Agricultural Marketing Service, “Regional Food Hub Resource Guide,” ( http://www.ams.usda.gov/AMSv1.0/getfile?dDocName=STELPRDC5097957 ), April, 2012. Accessed and printed on March 26, 2015.

51. FDA, “Food Code,” ( http://www.fda.gov/downloads/Food/GuidanceRegulation/RetailFoodProtection/FoodCode/UCM374510.pdf ), 2013. Accessed and printed on December 9, 2014.

52. Institute of Food Technologists, “Evaluation and Definition of Potentially Hazardous Foods,” ( http://www.fda.gov/Food/FoodScienceResearch/SafePracticesforFoodProcesses/ucm094141.htm ), December 31, 2005. Accessed and printed on December 14, 2011. See Reference 140 to the 2013 proposed human preventive controls rule.

53. O'Mahony, M., E. Mitchell, R. J. Gilbert, D. N. Hutchinson, N. T. Begg, J. C. Rodhouse, and J. E. Morris, “An Outbreak of Foodborne Botulisum Associated With Contaminated Hazelnut Yoghurt,” Epidemiol.Infect, 104:389-395, 1990.

54. Serkaya, A., C. Fenton, N. Ackerley, A. Berlind, J. Bryant, and C. Marsden, “2010 Nationwide Survey of Food Industry Safety Practices,” 2011.

55. FDA Memorandum, “Environmental Monitoring,” 2014. See Reference 23 to the 2014 supplemental human preventive controls notice.

56. Evancho, G. M., W. H. Sveum, L. J. Moberg, and J. F. Frank, “Microbiological Monitoring of the Food Processing Environment,” In: Compendium of Methods for the Microbiological Examination of Foods, edited by F. P. Downes and K. Ito, 4th edition, Washington, DC, Chapter 3, pp. 25-35, American Public Health Association, 2001. See Appendix Reference 63 to the 2013 proposed human preventive controls rule.

57. Kornacki, J. and J. Johnson, “Enterobacteriaceae, Coliforms, and Escherichia Coli As Quality and Safety Indicators,” In: Compendium of Methods for the Microbiological Examination of Foods, 4th Edition, Washington, DC, Chapter 8, pp. 69-82, American Public Health Association, 2001.

58. FDA, “CPG Sec. 570.550 Reconditioning—Tree Nuts Contaminated With E. Coli,” ( http://www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm074602.htm ), December 9, 1988. Accessed and printed on March 24, 2015.

59. FDA, “CPG Sec. 540.275 Crabmeat—Fresh and Frozen—Adulteration With Filth, Involving the Presence of the Organism Escherichia Coli; Draft Guidance,” ( http://www.fda.gov/downloads/iceci/compliancemanuals/compliancepolicyguidancemanual/ucm426995.pdf ), December 16, 2014. Accessed and printed on March 24, 2015.

60. FDA, “CPG Sec. 555.300 Foods, Except Dairy Products—Adulteration With Salmonella,” ( http://www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm074553.htm ), March, 1995. Accessed and printed on September 21, 2007. See Reference 8 to the 2013 proposed human preventive controls rule.

61. FDA, “CPG Sec. 560.600 Clams, Mussels, Oysters, Fresh or Frozen—Adulteration With by Bacteriological Contamination,” ( http://www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm074574.htm ), November 29, 2005. Accessed and printed on March 24, 2015.

62. FDA, “CPG Sec. 570.450 Tree Nuts—Adulteration With Filth, Involving the Presence of the Organism Escherichia Coli,” ( http://www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm074600.htm ), November 29, 2005. Accessed and printed on March 24, 2015.

63. FDA, “Guide to Produce Farm Investigations,” ( http://www.fda.gov/ICECI/Inspections/InspectionGuides/ucm074962.htm ), November, 2005. Accessed and printed on October 17, 2011. See Reference 132 to the 2013 proposed human preventive controls rule.

64. FDA, “Pasteurized Milk Ordinance, 2011 Revision,” ( http://www.fda.gov/downloads/food/guidanceregulation/ucm291757.pdf ), 2011. Accessed and printed on April 2, 2015. See Reference 37 to the 2013 proposed human preventive controls rule.

65. FDA Memorandum, “Comparison of Requirements for Hazard Analysis and Risk-Based Preventive Controls in 21 CFR part 117 to Various Existing Domestic and International HACCP-Based Standards,” 2015.

66. Byrd-Bredbenner, C., J. Berning, J. Martin-Biggers, and V. Quick, “Food Safety in Home Kitchens: A Synthesis of the Literature,” International Journal of Environmental Research and Public Health, 10, 2013.

67. Lando, A. and E. Carlton, “2010 Food Safety Survey: Topline Frequency Report,” ( http://www.fda.gov/downloads/Food/FoodScienceResearch/ConsumerBehaviorResearch/UCM407008.pdf ), 2010. Accessed and printed on March 26, 2015.

68. FDA, “CPG Sec. 560.750 Radionucleotides in Imported Foods—Levels of Concern,” ( http://www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm074576.htm ), November 29, 2005. Accessed and printed on October 14, 2011. See Reference 151 to the 2013 proposed human preventive controls rule.

69. FDA, “FDA Recalls Web site,” ( http://www.fda.gov/Safety/Recalls/default.htm ), June 4, 2014. Accessed and printed on March 13, 2015.

70. Food Allergy Research & Resource Group and the University of Nebraska, Lincoln, “Components of an Effective Allergen Control Plan,” ( http://farrp.unl.edu/c/document_library/get_file?uuid=3fcc9e7c-9430-4988-99a0-96248e5a28f7&groupId=2103626 ), 2011. Accessed and printed on October 17, 2011. See Reference 123 to the 2013 proposed human preventive controls rule.

71. Jackson, L. S., F. M. Al-taher, M. Moorman, J. W. DeVries, R. Tippett, K. M. J. Swanson, T.-J. Fu, R. Salter, G. Dunaif, S. Estes, S. Albillos, and S. M. Gendel, “Cleaning and Other Control and Validation Strategies to Prevent Allergen Cross-Contact in Food-Processing Operations,” Journal of Food Protection, 71:445-458, 2008. See Reference 124 to the 2013 proposed human preventive controls rule.

72. FDA, “FDA Allergy Warning Letter,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/Allergens/ucm106546.htm ), June 10, 1996. Accessed and printed on October 17, 2011. See Reference 120 to the 2013 proposed human preventive controls rule.

73. FDA, “Food Allergen Partnership,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/Allergens/ucm106779.htm ), January, 2001. Accessed and printed on September 17, 2014.

74. FDA, “CPG, Sec. 555.250 Statement of Policy for Labeling and Preventing Cross-Contact of Common Food Allergens,” ( http://www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm074552.htm ), November 29, 2005. Accessed and printed on September 12, 2014.

75. FDA, “Draft Guidance for Industry: Questions and Answers Regarding Mandatory Food Recalls,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/ucm445428.htm ), May, 2015. Accessed and printed on May 21, 2015.

76. FDA, “FDA Homepage,” ( http://www.fda.gov/ ), March 25, 2015. Accessed and printed on March 25, 2015.

77. FDA, “Recalls, Market Withdrawals, & Safety Alerts (FDA Email Sign-up Web page),” ( https://service.govdelivery.com/accounts/USFDA/subscriber/new?topic_id=USFDA_48 ), 2015. Accessed and printed on June 3, 2015.

78. FDA, “Guidance for Industry: Product Recalls, Including Removals and Corrections,” ( http://www.fda.gov/Safety/Recalls/IndustryGuidance/ucm129259.htm ), November 3, 2003. Accessed and printed on February 19, 2015.

79. FoodSafety.gov, “Get Food Safety Widget,” ( http://www.foodsafety.gov/recalls/widget/index.html ), March 27, 2015. Accessed and printed on March 13, 2015.

80. U.S. Department of Health and Human Services, “Employers and Health Information in the Workplace HIPAA Privacy Rule,” ( http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/employers.html ), 2015. Accessed and printed on April 2, 2015.

81. Codex Alimentarius Commission, “Recommended International Code of Practice: General Principles of Food Hygiene CAC/RCP1-1969, Rev. 4-2003,” ( https://www.idfa.org/docs/default-source/resource-library/391_cxp_001e.pdf?sfvrsn=0 ; http://www.codexalimentarius.org/download/standards/23/CXP_001e.pdf ), 2003. Accessed and printed on October 27, 2009. See Reference 44 to the 2013 proposed human preventive controls rule.

82. FDA, “Guidance for Industry: Testing for Salmonella in Human Foods and Direct-Human-Contact Animal Foods,” ( http://www.fda.gov/food/guidanceregulation/guidancedocumentsregulatoryinformation/salmonella/ucm295271.htm ), March, 2012. Accessed and printed on February 20, 2015.

83. FDA Memorandum, “Supplier Programs,” 2014. See Reference 24 to the 2014 supplemental human preventive controls notice.

84. USDA Food Safety and Inspection Service, “FSIS Compliance Guideline HACCP Systems Validation,” ( http://www.fsis.usda.gov/wps/wcm/connect/a70bb780-e1ff-4a35-9a9a-3fb40c8fe584/HACCP_Systems_Validation.pdf?MOD=AJPERES ), 2015. Accessed and printed on July10, 2015.

85. FDA Memorandum, “Product Testing,” 2014. See Reference 18 to the 2014 supplemental human preventive controls notice.

86. FDA, “Draft Qualitative Assessment of Risk to Public Health From on-Farm Contamination of Produce,” 2014.

87. FDA, “Guidance for Industry: Control of Listeria Monocytogenes in Refrigerated or Frozen Ready-to-Eat Foods (Draft Guidance),” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/FoodProcessingHACCP/ucm073110.htm ), February, 2008. Accessed and printed on September 13, 2011. See Reference 126 to the 2013 proposed human preventive controls rule.

88. FDA Memorandum, “Unique Configuration of HACCP Plans,” 1995.

89. FDA, “Guidance for Industry: Guide to Minimize Microbial Food Safety Hazards of Fresh-cut Fruits and Vegetables,” ( http://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/ucm064458.htm ), February, 2008. Accessed and printed on June 1, 2015.

90. Codex Alimentarius Commission, “Codex Alimentarius Commission Procedural Manual, 23rd Edition,” (ftp://ftp.fao.org/codex/Publications/ProcManuals/Manual_23e.pdf), 2015. Accessed and printed on March 26, 2015.

91. FDA, “Inspections, Compliance, Enforcement, and Criminal Investigations: Warning Letters,” ( http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/default.htm ), March 26, 2015. Accessed and printed on March 26, 2015.

92. FDA, “Import Alerts,” ( http://www.fda.gov/ForIndustry/ImportProgram/ImportAlerts/default.htm ), 2015. Accessed and printed on March 26, 2015.

93. FDA, “Letter to Sunland Inc. Concerning Suspension of Food Facility Registration; Notice of Opportunity for Hearing,” ( http://www.fda.gov/aboutfda/centersoffices/officeoffoods/cfsan/cfsanfoiaelectronicreadingroom/ucm329370.htm ), November 26, 2012. Accessed and printed on March 26, 2015.

94. Crandall, P., EJ Van Loo, CA O'Bryan, A Mauromoustakos, F Yiannas, N Dyenson, and I Berdik. 2012. Companies' opinions and acceptance of Global Food Safety Initiative benchmarks after implementation. J. Food Protection. 75: 1660-1672.

95. Global Food Safety Initiative, “GFSI Guidance Document, Version 6.3,” ( http://www.mygfsi.com/images/mygfsi/gfsifiles/gfsi_guidance/GFSI_Guidance_Document_Over.pdf ), 2013. Accessed and printed on June 2, 2015.

96. Global Food Safety Initiative & The Consumer Goods Forum, “GFSI Food Safety Auditor Competencies, Edition 1,” ( http://www.mygfsi.com/images/mygfsi/gfsifiles/information-kit/GFSI_Food_Safety_Auditor_Competencies_-_Edition_1_October_2013.pdf ), 2013. Accessed and printed on April 2, 2015.

97. FDA, “Information for Foreign Governments: Frequently Asked Questions on Systems Recognition,” ( http://www.fda.gov/Food/InternationalInteragencyCoordination/ucm367400.htm ), September 5, 2013. Accessed and printed on March 26, 2015.

98. World Trade Organization, “WTO Ministerial Conference: Implementation-Related Issues and Concerns,” ( https://www.wto.org/english/thewto_e/minist_e/min01_e/mindecl_implementation_e.pdf ), November 20, 2001. Accessed and printed on March 17, 2015.

99. World Trade Organization, “The WTO Agreement on the Application of Sanitary and Phytosanitary Measures (SPS Agreement),” ( https://www.wto.org/english/tratop_e/sps_e/spsagr_e.htm ), April 15, 1994. Accessed and printed on March 17, 2015.

100. FDA, “Comparison of Proposed Subpart C (Hazard Analysis and Risk-Based Preventive Controls) to Various Existing Domestic and International HACCP-Based Standards,” 2012. See Reference 193 to the 2013 proposed human preventive controls rule.

101. FDA, “Tribal Summary Impact Statement,” 2015.

102. FDA, “Memorandum on the Modernization of Food Current Good Manufacturing Practices (CGMP) As Required by the Food Safety Modernization Act of 2011,” 2011. See Reference 36 to the 2014 supplemental human preventive controls notice.

103. FDA, “Memorandum on the Re-Proposal of Select Provisions of the Proposed Rule: Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive Controls for Human Food,” 2014. See Reference 35 to the 2014 supplemental human preventive controls notice.

List of Subjects

21 CFR Part 1

• Cosmetics
• Drugs
• Exports
• Food labeling
• Imports
• Labeling
• Reporting and recordkeeping requirements

21 CFR Part 11

• Administrative practice and procedure
• Computer technology
• Reporting and recordkeeping requirements

21 CFR Part 16

• Administrative practice and procedure

21 CFR Part 106

• Food grades and standards
• Infants and children
• Nutrition
• Reporting and recordkeeping requirements

21 CFR Part 110

• Food packaging
• Foods

21 CFR Part 114

• Food packaging
• Foods
• Reporting and recordkeeping requirements

21 CFR Part 117

• Food packaging
• Foods

21 CFR Part 120

• Foods
• Fruit juices
• Imports
• Reporting and recordkeeping requirements
• Vegetable juices

21 CFR Part 123

• Fish
• Fishery products
• Imports
• Reporting and recordkeeping requirements
• Seafood

21 CFR Part 129

• Beverages
• Bottled water
• Food packaging
• Reporting and recordkeeping requirements

21 CFR Part 179

• Food additives
• Food labeling
• Food packaging
• Radiation protection
• Reporting and recordkeeping requirements
• Signs and symbols

21 CFR Part 211

• Drugs
• Labeling
• Laboratories
• Packaging and containers
• Prescription drugs
• Reporting and recordkeeping requirements
• Warehouses

Therefore, under the Federal Food, Drug, and Cosmetic Act and under authority delegated to the Commissioner of Food and Drugs, 21 CFR chapter I is amended as follows:

PART 1—GENERAL ENFORCEMENT REGULATIONS

1. The authority citation for 21 CFR part 1 continues to read as follows:

Authority: 15 U.S.C. 1333, 1453, 1454, 1455, 4402; 19 U.S.C. 1490, 1491; 21 U.S.C. 321, 331, 332, 333, 334, 335a, 343, 350c, 350d, 352, 355, 360b, 360ccc, 360ccc-1, 360ccc-2, 362, 371, 374, 381, 382, 387, 387a, 387c, 393; 42 U.S.C. 216, 241, 243, 262, 264.

2. Revise § 1.227 to read as follows:

3. In § 1.241, revise paragraph (a) to read as follows:

4. In § 1.276, revise paragraph (b)(9) to read as follows: