BRC FSMA Voluntary Module and Guidance-7 Jun2018 LR

Download as pdf or txt
Download as pdf or txt
You are on page 1of 52
At a glance
Powered by AI
The document provides guidance for BRC-certified facilities on meeting FSMA requirements.

The document provides guidance on food safety standards and FSMA preventive controls preparedness.

BRC Global Standards accepts no liability for errors or omissions in the publication and excludes all implied warranties to the fullest extent permitted by law.

BRC GLOBAL STANDARD

FOOD SAFETY – ISSUE 7

FSMA PREVENTIVE
CONTROLS
PREPAREDNESS
MODULE AND
GUIDANCE FOR
BRC-CERTIFIED
FACILITIES
2018
BRC GLOBAL STANDARDS
LIABILITY
BRC Global Standards* publishes information and expresses opinions in good faith, but accepts no liability for any error or omission
in any such information or opinion, including any information or opinion contained in this publication.

Whilst BRC Global Standards has endeavored to ensure that the information in this publication is accurate, it shall not be liable for any
damages (including without limitation damages for pure economic loss or loss of business or loss of profits or depletion of goodwill
or otherwise in each case, whether direct, indirect or consequential) or any claims for consequential compensation whatsoever
(howsoever caused) arising in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or
otherwise, in connection with this publication or any information contained in it, or from any action or decision taken as a result of
reading this publication or any such information.

All warranties, conditions and other terms implied by statute or common law are, to the fullest extent permitted by law, excluded.

Nothing excludes or limits the liability of BRC Global Standards for death or personal injury caused by its negligence, for fraud or
fraudulent misrepresentation or for any matter which it would be illegal for it to exclude or attempt to exclude liability for.

The Global Standard for Food Safety: FSMA Preventive Controls Preparedness Module and Guidance for BRC-certified Facilities and
the terms of the disclaimer set out above shall be construed in accordance with English law and shall be subject to the non-exclusive
jurisdiction of the English Courts.

COPYRIGHT
© BRC Global Standards 2018

All rights reserved. No part of this publication may be transmitted or reproduced in any form (including photocopying or storage in
any medium by electronic means) without the written permission of the copyright owner. Application for permission should be
addressed to the Operations Director of Global Standards at BRC Global Standards (contact details below). Full acknowledgement
of the author and source must be given.

The contents of this publication cannot be reproduced for the purposes of training or any other commercial activity.

No part of this publication may be translated without the written permission of the copyright owner.

Warning: Any unauthorized act in relation to a copyright work may result in both a civil claim for damages and criminal prosecution.

For more information about BRC Global Standards, contact:

BRC Global Standards


7 Harp Lane
London
EC3R 6DP

Email: [email protected]
Website: www.brcglobalstandards.com

* BRC Global Standards is a trading name of BRC Trading Ltd.


CONTENTS

PART 1 INTRODUCTION
How to use this module 3
Suppliers, manufacturers and GFSI-benchmarked certifications 4
Scope and exclusions 4
Audit planning 5
The onsite audit 5
Nonconformities and corrective action 6
Grading7
Audit reporting 7
Certification7
Audit frequency, recertification and scheduling reaudit dates 7

PART II REQUIREMENTS
Relationship of the module to the Global Standard for Food Safety 9
I Preventive Controls for Human Food: 21 CFR Part 117 10
II Preventive Controls for Animal Food: 21 CFR Part 507 22
III Food Defense: 21 CFR Part 121 23
IV Sanitary Transportation: 21 CFR Part 1 subpart O 29
V Produce Safety: 21 CFR Part 112 34

APPENDICES
Appendix 1: Correlation of activities covered by the Food Safety Standard with FSMA legislation 43
Appendix 2: Process for undertaking module audits 44

GLOSSARY46

FSMA REFERENCES48

BRC FS7 FSMA MODULE 1


PART I
INTRODUCTION

How to use this module 3


Suppliers, manufacturers and GFSI-benchmarked certifications 4
Scope and exclusions 4
Audit planning 5
The onsite audit 5
Nonconformities and corrective action 6
Grading7
Audit reporting 7
Certification7
Audit frequency, recertification and scheduling reaudit dates 7

2 BRC FS7 FSMA MODULE


PART I
INTRODUCTION

The aim of this module is to assist manufacturing organizations in understanding those prescriptive
elements within the FSMA Preventive Controls for Human Foods that are not explicitly covered
within the BRC Global Standard for Food Safety.

It does not represent a certification, nor guarantee that all aspects of the site’s operations will be
found fully compliant with the regulation; rather, it is a deeper clarification of what the expected
interpretations and expectations will be, once implementation dates come into effect.

This module may be used by any facility located within the US as an assessment step in preparation
for their required compliance date. It may be used by facilities outside of the US who see this market
as a current or future export target, to show evidence to the importer of record that they have specifically
addressed certain aspects of the supplier verification program. Additionally, it may be used by
specifiers to gain understanding and evidence of compliance with specific parts of the regulations.

HOW TO USE THIS MODULE


This module supports food processing and manufacturing sites certified (or pursuing certification)
to Issue 7 of the BRC Global Standard for Food Safety to help them understand how new regulations
established under FSMA apply to their operational activities. It comprises a section on audit
protocol, a requirements section (which includes five checklists), two appendices and a glossary.
The checklists identify those legislative requirements across the suite of FSMA rules which BRC
Global Standards recommends that all sites (foreign and US-based) producing and selling food
for consumption in the US should establish and implement as a part of their food safety and quality
management system for regulatory compliance.

The checklists address compliance requirements across the following FSMA rules:

○○ Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventive Controls
for Human Food
○○ Current Good Manufacturing Practice and Hazard Analysis and Risk-Based Preventive
Controls for Food for Animals
○○ Mitigation Strategies to Protect Food Against Intentional Adulteration
○○ Sanitary Transportation of Human and Animal Food
○○ Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human Consumption

BRC FS7 FSMA MODULE 3


As the BRC Global Standard for Food Safety is applicable to sites that manufacture processed
food and prepare primary products, a certificated site may not be regulated by all FSMA rules
addressed in this module. This is because regulation is dependent upon the site’s operational
activities and whether the site must register as a food facility under section 415 of the US Federal
Food, Drug, and Cosmetic Act (FD&C). It is the site’s responsibility to determine which regulations
(i.e., FSMA rules) apply to its operation and whether the site is required to register with FDA as a
food facility. Appendix 1 of this module provides a guide to help sites determine which regulations
apply based on operational activities.

DETERMINING CHECKLIST COMPLIANCE


To determine which checklists a site must comply with, the following rules apply:

○○ Where the site is required to register with FDA as a food facility, it shall comply with applicable
requirements of Checklists I–IV.
○○ Where the site is identified as BRC Category 5 and defined as a farm or mixed-type facility
by FDA, it shall comply with all the requirements of Checklists IV and V.

N.B. Mixed-type facilities may be required to register with FDA as a food facility depending
upon operational activities. For mixed-type facilities, farm activities (i.e., harvesting, packing,
and holding) shall comply with the requirements of Checklist V and manufacturing activities
shall comply with applicable requirements of Checklists I–III. All transportation activities shall
comply with Checklist IV.

Satisfying the requirements of the checklists in Part II does not guarantee compliance with US
legislation. Rather, compliance with this module provides clear guidance to help sites navigate the
suite of FSMA rules. Examples provided throughout this module are for illustrative purposes to aid
in the interpretation of BRC Global Standards’ requirements and do not authoritatively determine
the regulation. Full regulatory compliance with FSMA legislation is the responsibility of the site.

Key terms used in the checklists are defined in the Glossary to aid in the interpretation of module
requirements. Additionally, a list of legislative and training references are provided to support sites
in regulatory compliance.

SUPPLIERS, MANUFACTURERS AND


GFSI-BENCHMARKED CERTIFICATIONS
While it is widely recognized that a certification benchmarked to the Global Food Safety Initiative
(GFSI) is a solid mechanism to assess compliance with most of the prescriptive requirements of
the US Food Safety Modernization Act (FSMA), it is also recognized that, at the time of writing,
no scheme on its own is able to fully meet them. Where a GFSI-benchmarked scheme has an
additional module to cover gaps or prescriptively identify evidence of compliance, this should be
used. Where none exists, additional evidence may be required, depending on the gaps between
the requirements of the scheme and FSMA.

SCOPE AND EXCLUSIONS


This module is applicable to facilities located within the US (as a preparedness assessment in
preparation for regulatory compliance assessments) and those facilities currently or wishing to
export products and ingredients to the US. The module is voluntary; however, for the module to
be included within the site’s certification, all products within the scope of the module shall be
included. No exclusions are permitted.

4 BRC FS7 FSMA MODULE


AUDIT PLANNING
PREPARATION BY THE COMPANY
The certification body shall be notified in advance of the audit of the intention to add the
FSMA Preventive Controls Preparedness Module to the scope of the audit. This ensures
sufficient additional time can be scheduled and that an auditor with the appropriate
qualifications for the additional module is selected.

INFORMATION TO BE PROVIDED TO THE


CERTIFICATION BODY FOR AUDIT PREPARATION
The company shall supply the certification body with any additional background information
requested prior to the audit day to ensure the auditor(s) is fully prepared to audit against the module.

AUDIT DURATION
In order for the FSMA Preventive Controls Preparedness Module to be included within the
audit program, additional time will be needed for the audit. The amount of additional time
will depend on several factors, primarily the organization, knowledge and preparedness of
the facility personnel. The certification body shall indicate the expected additional time
requirements at the time of planning the audit.

THE ONSITE AUDIT


Evidence of compliance with the requirements of the FSMA Preventive Controls Preparedness
Module shall be assessed as part of the audit against the requirements of the main Standard
and is expected to be integrated into the audit program as appropriate.

During the audit, detailed notes shall be made regarding the site’s conformities and nonconformities
against the requirements of the additional module, and these will be used as the basis for an
addendum to the audit report. The auditor(s) shall assess the nature and severity of any nonconformity.

At the closing meeting, the auditor(s) shall present their findings and discuss all nonconformities
that have been identified against the module during the audit. A written summary of the nonconformities
discussed at the closing meeting will be documented by the auditor either at the closing meeting
or within 1 working day after completion of the audit.

The decision to award certification for the additional module will be determined independently by
the certification body management, following a technical review of the audit report and the closing
of nonconformities in the appropriate timeframe. The company will be informed of the certification
decision following this review.

Typically, it is expected that the module will be conducted in conjunction with the full BRC Global
Standard audit; however, it is acknowledged that there may be instances where the module needs
to be done as a standalone. Full details on how to manage the process in this instance are outlined
in Appendix 2.

BRC FS7 FSMA MODULE 5


NONCONFORMITIES AND CORRECTIVE ACTION
The level of nonconformity assigned by an auditor against a requirement of an additional module
is an objective judgment with respect to severity and risk and is based on evidence collected and
observations made during the audit. This is verified by the certification body management.

NONCONFORMITIES
Nonconformities against requirements of an additional module shall be graded in the same way
as nonconformities identified against requirements of the main Standard, namely:

○○ Critical Where there is a critical failure to comply with a product safety or legal issue within the
scope of the module.
○○ Major Where there is a substantial failure to meet the requirements of any clause of the module
or a situation is identified which would, on the basis of available objective evidence, raise
significant doubt as to the conformity of the product to the module.
○○ Minor Where a clause of the module has not been fully met but, on the basis of objective
evidence, the conformity of the product or service to the module is not in doubt.

PROCEDURES FOR HANDLING NONCONFORMITIES AND CORRECTIVE ACTION


Following identification of any nonconformities against the requirements of the module during the
audit, the company must undertake corrective action to remedy the immediate issue (correction).
The process for ‘closing out’ nonconformities depends upon the level of nonconformity and the
number of nonconformities identified.

Critical nonconformities
If a critical nonconformity is identified against a requirement of the module, then the site cannot
be certificated for this module without a further full audit of the module.

Where this occurs at a site that already holds certification for the module, certification of the module
must be immediately withdrawn.

If it is a requirement of customers that they shall be informed when their suppliers have a critical
nonconformity identified or fail to gain certification against a module, the company shall
immediately inform its customers.

Note a critical nonconformity against a requirement of an additional module does not necessarily
prevent certification against the main Standard or other additional modules.

Major and minor nonconformities


An additional module cannot be included on a certificate until major and minor nonconformities
have been demonstrated as having been corrected, either permanently or via a temporary solution
that is acceptable to the certification body.

Close-out of nonconformities can be achieved either by objective evidence being submitted to


the certification body, such as updated procedures, records, photographs or invoices for work
undertaken, or by the certification body undertaking a further onsite visit.

If satisfactory evidence is not provided within the 28-calendar-day period allowed for submission
following the audit, certification for the module will not be granted. The site will then require a
further full audit in order to be considered for certification of the module.

The certification body will review objective evidence of corrective action completed prior to
awarding a certificate.

6 BRC FS7 FSMA MODULE


GRADING
There will be no grading of the module. The module will either be certificated or not.

Any nonconformities identified when assessing an additional module may be taken into account
when deciding the grade for certification against the Global Standard for Food Safety, if the site is
under compliance deadlines as identified by the Food and Drug Administration (FDA).

Any nonconformities identified when assessing the FSMA Preparedness Module and not closed
out shall have no impact on certification to the Global Standard for Food Safety.

AUDIT REPORTING
Following each audit, a written report shall be prepared in the agreed format for the module and this
will form an addendum to the Global Standard for Food Safety audit report. The addendum report
shall be produced in English, with the addition of any other language as required by the audited site.

The report addendum covering the requirements for the module shall be prepared and dispatched
to the company within 42 calendar days of the completion of the full audit.

The full BRC audit report together with the addendum for the FSMA Preventive Controls Preparedness
Module shall be uploaded to the BRC Global Standards Directory in a timely manner irrespective of
whether a certificate is issued. The owner of the audit report may allocate access to the audit report
with the addendum to customers or other parties in the directory.

The audit report and associated documentation, including auditor’s notes, shall be stored safely
and securely for a period of 5 years by the certification body.

CERTIFICATION
After a review of the audit report for the module and documentary evidence provided in relation to
the nonconformities identified, a certification decision shall be made by the designated independent
certification manager. Where certification is granted, this shall be included on the certificate for the
BRC Global Standard for Food Safety and issued by the certification body within 42 calendar days
of the audit.

Note that the module is certificated as an addendum to the Global Standard for Food Safety. Where
certification to the Standard is not achieved, certification for the module cannot be awarded irrespective
of whether the requirements of the module have been met.

AUDIT FREQUENCY, RECERTIFICATION


AND SCHEDULING REAUDIT DATES
If certification to the module is to be maintained, the module shall be included within each
subsequent audit of the Global Standard for Food Safety. The rules for scheduling the next
audit and maintaining certification will follow the audit choice (i.e. announced or unannounced).

BRC FS7 FSMA MODULE 7


PART II
REQUIREMENTS

Relationship of the module to the Global Standard for Food Safety 9


I Preventive Controls for Human Food: 21 CFR Part 117 10
II Preventive Controls for Animal Food: 21 CFR Part 507 22
III Food Defense: 21 CFR Part 121 23
IV Sanitary Transportation: 21 CFR Part 1 subpart O 29
V Produce Safety: 21 CFR Part 112 34

8 BRC FS7 FSMA MODULE


PART II
REQUIREMENTS

RELATIONSHIP OF THE MODULE TO THE


GLOBAL STANDARD FOR FOOD SAFETY
Where the company applies for certification to the FSMA Preventive Controls Preparedness
Module, the quality management system clauses within Issue 7 of the Food Standard shall
apply to the management of the module. These management clauses include:

3.1 Food safety and quality manual

3.2 Documentation control

3.3 Record completion and maintenance

3.4 Internal audits

3.7 Corrective and preventive actions

3.8 Control of nonconforming product

3.10 Complaint handling

3.11 Management of incidents, product withdrawal and product recall

Additional references to relationships with other clauses within Issue 7 of the BRC Global Standard
for Food Safety are also included as required.

BRC FS7 FSMA MODULE 9


I PREVENTIVE CONTROLS FOR HUMAN FOOD: 21 CFR PART 117
The site shall determine if it is required to register with FDA as a food facility according to legislative requirements set forth in FD&C,
section 415. This applies to domestic (US based) and foreign sites. Where a site is based outside of the US territory and is required
to register with FDA as a food facility due to business operations, the site must designate a US representative.

Where a site determines it must register as a food facility with FDA, it shall then decide if its business operations are regulated by
21 CFR Part 117 (Preventive Controls for Human Food rule). Sites regulated by 21 CFR Part 117 shall comply with all requirements
of the following Preventive Controls for Human Food checklist for compliance with this module.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.1 4.8 117.20
MODULE ITEM
Handwashing areas, dressing and locker rooms, and bathrooms must have adequate lighting.
GUIDANCE
21 CFR § 117.20 requires handwashing areas, dressing and locker rooms, and bathrooms to have adequate lighting. The expectation for
adequate lighting in these areas is implied in the BRC Global Standard for Food Safety (referred to from now on as BRC) section 4.8,
statement of intent.
Adequate lighting is defined as lighting that provides a safe working environment, enables effective cleaning of hands and
maintenance of personal hygiene, and facilitates the changing of personal protective clothing.
RECOMMENDATION
Add verification of light levels to internal audit checklist. Consider (although not compulsory) including a measure, target levels,
and device.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.2 4.5.2 117.37
MODULE ITEM
The water distribution system must prevent backflow from, or cross-connection between, piping systems that discharge
waste water or sewage.
GUIDANCE
21 CFR § 117.37 requires that the water distribution system be protected from backflow and cross-connection from waste water
and sewage systems. The expectation for backflow and cross-connection prevention is implied in BRC clause 4.5.2.
The water distribution schematic should be reviewed to ensure all points in the system are protected from backflow or cross-connection
from waste water and sewage pipework. Where there is a potential for backflow or cross-connection, control must be applied
through the application of a backflow prevention device or other mechanism to mitigate the risk.

RECOMMENDATION
Identify backflow prevention risk areas and devices. Add to periodic check program (at a minimum, recommend annual).

10 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.3 4.6 117.40
MODULE ITEM
All food contact surfaces of plant equipment and utensils used in manufacturing, processing, packing, or holding food must be
corrosion-resistant.
Seams on food contact surfaces must be smoothly bonded or maintained so as to minimize accumulation of food particles, dirt,
and organic matter and thus minimize the opportunity for growth of microorganisms and allergen cross-contact.
GUIDANCE
21 CFR § 117.40 requires that all food contact surfaces used to manufacture, process, pack, or hold food (including utensils)
be corrosion-resistant and maintain smooth seams, which are easily cleanable and do not allow organic matter to accumulate,
causing unintentional adulteration. The expectation for the use of corrosion-resistant materials and sanitary-designed food
contact surfaces to prevent cross-contamination is implied in BRC section 4.6, statement of intent.
Corrosion is a process which causes metal to deteriorate through oxidation. Undesirable oxides appear on the surface of the
metal and can be incorporated into food products as unintentional adulterants. The use of corrosion-resistant materials, such
as 300-series stainless steel or food grade plastics, is necessary to prevent unintentional adulterants and cross-contamination
of food products.
The application of smoothly bonded seams is critical to ensuring the effective cleaning and sanitation of food contact surfaces.
Microbial harborage sites and the build-up of organic debris, which may contain allergenic proteins or other contaminants, find
a natural habitat in porous or nonsmooth seams. The harborage sites or build-up of organic debris can be very difficult to remove
once they have become established. They are known reservoirs of pathogenic microorganisms in wet and dry environments and
thereby contribute to food product adulteration and outbreaks of foodborne illness.
The preventive maintenance program as required by BRC section 4.7 should ensure criteria are established for the use of corrosion-
resistant materials and the application of smooth seams on food contact surfaces when commissioning new equipment. The program
should also include the assessment of in-use equipment against these criteria along with corrective action where corrosion or
nonsmooth seams occur.
RECOMMENDATION
Recommend specifically adding verification of seam and weld integrity, and assessment of corrosion to post-cleaning or
preoperational inspections. This should form part of the training for the individuals who perform these checks.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.4 4.5.1 117.80
MODULE ITEM
Ice used in contact with food must be manufactured in accordance with the good manufacturing practice (GMP) requirements
of 21 CFR § 117.
GUIDANCE
21 CFR § 117.80 requires that ice used in contact with food be made from water that is safe and of adequate sanitary quality. It additionally
requires that ice be manufactured in accordance with the GMP defined in 21 CFR § 117. The expectation for the production and use of
ice, which poses no risk of contamination to raw materials, ingredients and food products – and is of adequate microbiological and
chemical quality – is implied in BRC clause 4.5.1.
When microbiological pathogens and chemical contaminants are present in ice they are preserved and have the potential to
cross-contaminate food. Potable water sources meeting applicable legislative requirements, which are tested annually as per
BRC clause 4.5.1, must be used for the manufacture of ice. Additionally, ice manufacture (whether onsite or from an external
supplier) must be performed in compliance with the GMP requirements of 21 CFR § 117.
RECOMMENDATION
Treat ice, whether internal or external, as an ingredient, with specifications and requiring verification against standards. Consider
requiring ice suppliers to be certified to BRC, GFSI-benchmarked, or other equivalent standard.
Internal ice manufacture should be treated as any other production area.

BRC FS7 FSMA MODULE 11


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.5 NO EQUIVALENT OR 117.110
RELATED CLAUSE
MODULE ITEM
Where defect action levels (DALs) are established for a food, quality control operations must reduce defects to the lowest level possible.
Defect levels rendering the food adulterated may not be reduced by mixing the food with another lot.
GUIDANCE
DALs are defined in the Defect Levels Handbook for various food commodities regulated by FDA. These levels represent the
maximum allowable limit for defects that will be tolerated before the product is considered adulterated and subject to enforcement
action under section 402(a)(3) of FD&C.
21 CFR § 117.110 requires the site not only to meet DALs for all applicable commodities but also to implement quality control
operations to reduce defects to the lowest level possible. Sites may not mix (dilute) product with defect levels at or exceeding
the maximum limit with product containing minimum defects. Blending product exceeding the DAL renders the finished product
adulterated regardless of the final defect level.
RECOMMENDATION
Obtain a copy of the FDA Defect Action Level document. If ingredients or finished products are included in the DAL, ensure
specifications at a minimum meet the expectations listed.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.6 2.7.1, 2.7.2 117.130(A)
MODULE ITEM
The hazard analysis must additionally identify and evaluate the following known or reasonably foreseeable hazards, which are
associated with the food or facility:
○○ economic adulterants which affect food safety
○○ environmental pathogens where ready-to-eat (RTE) food is exposed to the environment prior to packaging and the packaged
food does not receive a kill step
○○ radiological hazards
○○ unintentional adulterants that affect food safety.
GUIDANCE
21 CFR § 117.130 requires a written hazard analysis that identifies and evaluates all known or reasonably foreseeable hazards.
The regulation defines ‘known or reasonably foreseeable hazards’ as a biological, chemical (including radiological), or physical
hazard that is known to be, or has the potential to be, associated with the facility or the food.
21 CFR § 117.130 additionally requires the identification of naturally occurring hazards (e.g., mycotoxins), unintentionally introduced
hazards (e.g., allergen cross-contact), and intentionally introduced hazards for economic gain (e.g., economically motivated
adulterants) although they will be grouped accordingly as a biological, chemical or physical hazard. Radiological hazards must
be identified and evaluated where there is a known prevalence in the raw material or ingredient due to sourcing from a susceptible
region or where materials or the food product has the potential to be contaminated (e.g., from water sources in susceptible areas).
As with Codex Alimentarius HACCP methodology, the hazard evaluation must include an assessment of the severity of illness
or injury and likelihood of occurrence if the hazard were to be present in the absence of preventive controls. The evaluation
must consider all known or reasonably foreseeable hazards in all materials (or material groups), process steps, the production
environment, supply and distribution chain activities, intended and reasonably foreseeable use, and other related elements.
Specifically, the hazard analysis must evaluate environmental pathogens where an RTE food is exposed to the environment prior
to packaging and the packaged food does not receive a kill step to eliminate or significantly minimize the pathogen. Examples of
environmental pathogens include Salmonella spp. (typically found in dry processing environments) and Listeria monocytogenes (common
in wet processing environments), although these pathogens are generally ubiquitous in food handling and processing environments.

12 BRC FS7 FSMA MODULE


A site’s hazard analysis should be reevaluated in consideration of the new regulatory requirements and updated where necessary to
achieve compliance. For example, a site may need to consider integrating or cross-referencing the hazard analysis and risk assessments
required by the BRC Food Safety Standard (e.g., raw material or allergen cross-contact) to cover the scope of the hazard analysis as
required by 21 CFR § 117.130.
Subpart F of the regulation allows for the use of existing food safety plans and records based on hazard awareness and critical control
points (HACCP), which may be supplemented or added to separately to meet requirements of the regulation.
RECOMMENDATION
Ensure that the risk assessment (either embedded in the HACCP risk analysis or as a separate analysis) includes risks from economic
adulteration, environmental pathogens, and unintentional contamination.
Specifically add ‘radiological’ to the risk category covering chemical risks.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.7 2.7.3, 2.8.1 117.130(B)
MODULE ITEM
All identified, known, or reasonably foreseeable hazards must be evaluated to determine ‘hazards that require a preventive control’
(i.e., significant hazards).
GUIDANCE
21 CFR § 117.130(a)(1) requires a hazard analysis to determine ‘hazards that require a preventive control’ or significant hazards.
Hazards requiring a preventive control may be in addition to those for which a critical control point (CCP) has already been applied.
According to FDA, ‘hazards that require a preventive control’ are those for which a person knowledgeable about the safe
manufacturing, processing, packing, or holding of food would – based on the outcome of a hazard analysis to determine that
the hazard is likely to cause illness or injury in the absence of preventive controls – establish one or more preventive controls to
significantly minimize or prevent the hazard in a food and apply components (e.g., monitoring, corrections or corrective actions,
verification, and records) to manage the control(s).
A documented decision making process consistent with the expectations of BRC clause 2.8.1 is recommended for determining
‘hazards requiring a preventive control’. Justification should be documented on the hazard analysis for qualifying or not qualifying a
known or reasonably foreseeable hazard as a hazard requiring a preventive control. For example, Salmonella is a known or reasonably
foreseeable hazard in raw peanuts. The justification for qualifying Salmonella in the receiving of raw peanuts as a hazard requiring
a preventive control lies in the knowledge that raw and processed peanuts have been the source of foodborne illness outbreaks
responsible for severe illness and death.
RECOMMENDATION
Similar to the CCPs, hazards requiring a preventive control or significant hazards should be identified. This is primarily a terminology
change, which would require both CCPs and specific prerequisite programs to be in place to manage specific risks. It may also
include supplier approval mechanisms.

BRC FS7 FSMA MODULE 13


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.8 2.2.1, 2.8.1 117.135
MODULE ITEM
Establish one or more preventive control(s) for each identified ‘hazard that require a preventive control’ (i.e., significant hazard) such
that the control significantly minimizes or prevents the food manufactured, processed, packed, or held by the facility from being
adulterated under section 402 of FD&C or misbranded under section 403(w) of FD&C.
GUIDANCE
21 CFR § 117.135 requires the establishment of one or more preventive controls for each identified ‘hazard that require a preventive
control’. Preventive controls must be risk-based, reasonably appropriate procedures, practices, or processes, that control a specific
hazard. The control must be capable of significantly minimizing or preventing the associated hazard. This is consistent with the
current scientific understanding of safe food practices. Preventive controls must be written and may include CCPs. A preventive
control may also be a procedure, practice, or process at activities or process steps other than at CCPs.
For example, where a site handles allergenic (e.g., tree nuts) and nonallergenic materials (e.g., dried fruit) and produces allergen-free
products, tree nuts are considered to be a ‘hazard that requires a preventive control’ because of the potential for allergen cross-contact
in nonallergenic products and adulteration/misbranding under FD&C sections 402 and 403. Thus, one or more preventive control(s)
must be applied to prevent allergens occurring in nonallergenic food products and ensure accurate labeling (e.g., dedicated lines or
utensils, time segregation, allergen cleaning, and label verification). An allergen management program as required by BRC section 5.3
should still be applied as a prerequisite program (PRP) to ensure adequate environmental and operational conditions for the overall
management of allergens and routes of contamination.
Elements of existing PRPs required by the BRC Global Standard for Food Safety (e.g., sanitation, supplier approval and monitoring,
and labeling and pack control) may serve as effective preventive controls where an associated significant hazard is identified.
Subpart F of the regulation allows for the use of existing HACCP based food safety plans and records, which may be supplemented
or added to separately to meet requirements of the regulation.
RECOMMENDATION
Where hazards are identified, adequate controls must be in place.
Such controls may include precautionary labeling (labeling includes specifications) for subsequent users, even where the site’s
finished product will be an ingredient at a different site. As an example, untreated flour could advise customers of the need to cook
prior to consumer consumption.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.9 3.11.2 117.139
MODULE ITEM
Evaluate and update the recall and withdrawal procedure as necessary to ensure it contains procedures and responsibility for the following:
○○ notifying consignees of how to return or dispose of recalled product
○○ conducting effectiveness checks to verify recall is carried out
○○ appropriate disposal of recalled product (i.e., destroy, divert, repurpose).

GUIDANCE
21 CFR § 117.139 requires a recall plan where the site identifies a hazard requiring a preventive control. The recall plan must include
responsibility and steps for notifying consignees about how to return or dispose of product, conducting effectiveness checks and
appropriate disposal. The expectation for these activities is implied in BRC clause 3.11.2, which generally requires a plan for recovery
or disposal.
It is recommended that sites review their recall and withdrawal procedure to ensure it defines responsibility and steps for the specific
activities described in the regulation. Template letters for notifying consignees about how to return or dispose of product and
conducting effectiveness checks may be drafted in advance and reviewed for effectiveness as a part of the annual mock recall.
Methods for determining appropriate disposal should be science- and risk-based and determined by an individual(s) with the
appropriate knowledge and authority.
RECOMMENDATION
The recall plan should include the identified bullet points. The effectiveness of the plans should be assessed during the site mock recall.

14 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.10 2.10.1, 2.10.2 117.145
MODULE ITEM
Establish monitoring activities and a written procedure for each preventive control in a manner consistent with the requirements of
BRC section 2.10.
GUIDANCE
21 CFR § 117.145 requires monitoring activities for each applied preventive control. A preventive control is a planned
sequence of observations or measurements to assess whether control measures are operating as intended. The monitoring
requirements of the regulation are consistent with those defined in BRC section 2.10.
Monitoring may not have any critical limits, depending upon the nature of the hazard and preventive control, but it must be performed
in a manner and at a frequency that will ensure consistent and effective implementation of the preventive control. A written monitoring
procedure must be established and document how to perform the monitoring activity, its frequency, who is responsible, and the
recordkeeping requirements. The preventive controls qualified individual (PCQI) is responsible for conducting or overseeing the
review of monitoring records within 7 days from the date of creation.
RECOMMENDATION
Ensure the designated PCQI has oversight of verifications and that they are completed within 7 days of creation.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.11 2.11.1, 3.7.1 117.150
MODULE ITEM
Establish corrective action procedures when preventive controls are not implemented in a manner consistent with the requirements
of BRC sections 2.11 and 3.7.
Corrective action procedures must be established and implemented when the presence of a pathogen (or indicator organism) is
detected as a part of verification activities (i.e., product testing and/or environmental monitoring).
GUIDANCE
21 CFR § 117.150 requires corrective action to take place when preventive controls are not implemented. Additionally, the presence of
a pathogen or indicator organism following product testing or environmental monitoring as verification activities triggers corrective
action. The corrective action requirements of the regulation are consistent with those defined in BRC sections 2.11 and 3.7.
The immediate correction of a failure to implement preventive controls, followed by a corrective action procedure, is critical to correcting
the problem, reestablishing monitoring, evaluating affected product, and determining the root cause of the failure to prevent its
recurrence. Corrective action records must be maintained and reviewed by the PCQI (or their authorized designee) within 7 days.
RECOMMENDATION
A general procedure should be in place to capture affected product in the event that controls are not utilized or only partially utilized.
This usually includes determining the affected product, isolating it, and determining outcomes.

BRC FS7 FSMA MODULE 15


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.12 2.9.2, 5.3.8 117.160
MODULE ITEM
Validate all established process controls prior to implementation of the food safety plan, upon changes requiring revalidation or within
90 calendar days of the first food production.
Validate allergen, sanitation and supply-chain controls as appropriate to the nature of the hazard, control and facility.
GUIDANCE
21 CFR § 117.160 requires the PCQI to validate the preventive controls. This requirement is fundamentally consistent with BRC clause 2.9.2.
21 CFR § 117.160 definitively requires validation for all process controls, which are analogous to critical control points (CCPs), with
defined maximum and/or minimum parameters (limits). The regulation does not explicitly require validation of allergen, sanitation,
recall plan, and supply-chain controls, although validation is expected where possible (e.g., validation of allergen cleaning practices
as required by BRC clause 5.3.8). Other preventive controls as allowed by the regulation do not require validation where the PCQI
documents justification that validation is not applicable based on the nature of the hazard, control, and role in the food safety system.
Sites should reanalyze all identified preventive controls and consider the need for validation where this is not presently documented.
RECOMMENDATION
Documented validations of controls should be in place for all activities.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.13 2.10.2, 2.12.1, 3.7.2 117.165(A)
MODULE ITEM
The PCQI (or authorized designee) reviews the monitoring and corrective action records within 7 days. Where an alternate timeframe
exceeding 7 days is used, the PCQI must document justification.
The PCQI (or their authorized designee) reviews the verification records for all preventive controls (e.g., calibration records, product
testing, supply-chain audits) within a reasonable timeframe after the record has been created.
GUIDANCE
The review of records related to the implementation and management of preventive controls is defined as a core verification activity
in the regulation. The PCQI has overall responsibility for it to ensure that any failure in implementing preventive controls is identified
within an appropriate timeframe to prevent adulterated product from reaching consumers.
21 CFR § 117.165 requires the PCQI to conduct (or oversee) record reviews for monitoring and corrective action records within 7 days
and all verification records within a reasonable timeframe. This requirement is consistent with the monitoring expectations for record
review, as defined in BRC clause 2.10.2. Consideration should be given to the 7-day timeframe; where a timeline exceeding 7 days is
used, the PCQI must document justification.
Requirements for the review of corrective action and verification records are implied in BRC clauses 2.12.1 and 3.7.2. The corrective
action and verification procedures related to the food safety plan should be evaluated and updated as necessary to ensure there is
provision for records to be reviewed by the PCQI or their designee.
RECOMMENDATION
All control-related records should be reviewed within 7 days by the designated individual. Sufficient backup should be in place for the
main PCQI to ensure coverage in case of absence. Record reviews should be dated.

16 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.14 5.6.2.3 117.165(B)
MODULE ITEM
Where product testing for a pathogen (or indicator organism) or other hazard is used as a verification activity, a scientifically valid and
written testing procedure must identify the following:
○○ sampling procedure to include method, quantity, frequency, and number of samples
○○ analytical method
○○ laboratory conducting an analysis
○○ corrective action procedure where a pathogen is detected.

GUIDANCE
Product testing for a pathogen (or indicator organism) or other hazard is a defined verification activity in 21 CFR § 117.165 of the
regulation. Where product testing is used as a verification activity, the site must establish and implement a scientifically valid testing
procedure, which defines sampling, frequency, test method, laboratory, and corrective action procedure. Generally, expectations to
meet this requirement are defined by BRC clause 5.6.2.3.
Where product testing is used as a verification activity to confirm the effective implementation of a preventive control, the site should
reanalyze the applicable procedures for analyses that are critical to safety and legality and update them as necessary to ensure that
the procedure(s) documents all requirements of the regulation.
RECOMMENDATION
Sample and test methodology should follow industry-accepted practices, and reference to such practices should be part of the procedure.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.15 5.6.2.3 117.165(C)
MODULE ITEM
Where environmental monitoring for a pathogen (or indicator organism) is used as a verification activity, a scientifically valid and
written testing procedure must identify the following:
○○ adequate number and location of sample sites
○○ timing and frequency of sampling
○○ analytical method
○○ laboratory conducting the analysis
○○ corrective action procedure where a pathogen is detected.

GUIDANCE
Environmental monitoring for a pathogen (or indicator organism) is a required verification activity as defined in 21 CFR § 117.165 of
the regulation where RTE product is exposed to the environment before being packaged and the packaged food does not receive
a kill step to eliminate or significantly minimize the pathogen. Where environmental monitoring is applied as a verification activity
for exposed RTE product, the site must establish and implement a scientifically valid testing procedure, which defines sampling
(including location of sites), timing and frequency, test method, laboratory, and the corrective action procedure. Generally, expectations
to meet this requirement are defined by BRC clause 5.6.2.3.
It is recommended that science-based guidance on the establishment, implementation, and maintenance of a pathogen environmental
monitoring program be reviewed when determining the test organism, sample locations and number, timing, frequency, and test
method. This is because these variables significantly impact the ability of the program to verify the effective implementation of
environmental pathogen controls.
Where environmental monitoring is used as a verification activity to confirm the effective implementation of a preventive control
(e.g., sanitation) for an environmental pathogen, the site should reanalyze the applicable procedures for analyses that are critical
to safety and legality and update them as necessary to ensure that the procedure documents all the requirements of the regulation.
RECOMMENDATION
Sample sites and frequency of testing should be based on a risk assessment.
Corrective action should include product disposition in the case of positive results, immediate correction (i.e., reclean), and
corrective action (i.e., reassessment of cleaning procedures).

BRC FS7 FSMA MODULE 17


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.16 3.4.1 117.165
MODULE ITEM
Devices used to verify preventive controls must be calibrated.
GUIDANCE
21 CFR § 117.165 requires the calibration of the devices used to verify preventive controls in addition to those used to conduct
monitoring. The expectation for the calibration of the devices used to verify preventive controls is implied in BRC section 6.4,
statement of intent, which requires calibration of measuring equipment.
Where the site establishes verification activities such as product testing, the measuring devices utilized in the analytical method must
be calibrated at an appropriate frequency and all calibration activities must be recorded. Calibration records are verification records and
thus they are subject to record review by the PCQI (or their designee) within an appropriate timescale from when the record is created.
Sites should review their documented list of measuring devices, as required by BRC clause 3.4.1, and this list should be updated
as necessary with any additional measuring devices that are specifically used in preventive controls verification activities.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.17 NO EQUIVALENT OR 117.180
RELATED CLAUSE
MODULE ITEM
Identify a PCQI responsible for developing the food safety plan, validating preventive controls, review of records, and reanalysis of the plan.
Document the PCQI’s training or qualifications via job experience.
GUIDANCE
21 CFR § 117.180 requires that one or more PCQIs (as defined in the regulation) be responsible for developing the food safety plan,
validating preventive controls, reviewing the records, and reanalyzing the plan.
The PCQI can qualify in one of two ways. The first pathway is to complete training in the FDA recognized preventive controls
curriculum, which reviews how to conduct a hazard analysis and develop and apply appropriate risk-based preventive controls
consistent with the regulation. The Food Safety Preventive Controls Alliance (FSPCA) training course on preventive controls for
human food is the only currently recognized curriculum.
The second pathway for qualifying as a PCQI is through job experience of developing and applying a food safety system. Experience
of developing and implementing a BRC food safety system may qualify an individual as a PCQI. Whichever pathway qualifies the site’s
PCQI, their training or experience must be documented.
Sites may utilize consultants as PCQIs; however, the responsibilities defined in 21 CFR § 117.180 still apply and the site is responsible
for the implementation and management of the preventive controls.
RECOMMENDATION
Strong recommendation that at least one individual per site undertakes the recognized FSPCA PCQI training. Alternative training
and qualifications that focus on food safety expertise, as well as an understanding of FSMA rules, may be acceptable.

18 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.18 3.3.1 117.305
MODULE ITEM
All records required by 21 CFR § 117 must include:
○○ the date and time of the activity being documented
○○ signature/initials of individual performing the activity or conducting the record review
○○ information to identify the facility (e.g., name and location)
○○ the identity of the product and lot code where applicable.

GUIDANCE
21 CFR § 117.305 specifically requires site, responsible person and product identification information on all records related to the food
safety plan. The expectation for recordkeeping identifiers and the signature or initials of the individual responsible for authorized
verification is implied in BRC clause 3.3.1.
It is recommended that sites review all existing records related to the food safety plan and update the forms as required by the
regulation in a manner consistent with the site’s document control procedures. New forms must take into account all recordkeeping
requirements as described in 21 CFR § 117.305.
RECOMMENDATION
Ensure that records identify all bullet points, specifically the site and traceability to specific product lots.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.19 1.1.3 117.310
MODULE ITEM
The owner, operator, or agent in charge of the facility must sign and date the written food safety plan initially and again upon any
changes following reanalysis.
GUIDANCE
21 CFR § 117.310 requires the owner, operator, or agent in charge of the facility to sign and date the written food safety plan, which
includes the following: hazard analysis, preventive controls, supply-chain program, recall plan, monitoring procedure(s), corrective
action procedure(s), and verification procedure(s) (including validation) where applicable. Additionally, the responsible individual
must sign and date it whenever there are changes following reanalysis.
This requirement is to ensure the commitment of senior management to responsibility for the food safety plan. This requirement must
be met initially and thereafter may be integrated as a component of the senior management review to comply with BRC clause 1.1.3.
RECOMMENDATION
The site senior manager must review (or be present during the review, as in the annual management review) the food safety plan.
Verification of the activity must be in the form of a signed, dated document within the food safety plan.

BRC FS7 FSMA MODULE 19


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.20 3.3.1, 3.3.2 117.315
MODULE ITEM
All documents and records relating to the food safety plan (i.e., all records required by 21 CFR § 117) must be retained at the facility for
2 years after the record is created. Where records are stored offsite, they must be retrievable within 24 hours, with the exception of the
food safety plan, which must remain onsite.
GUIDANCE
21 CFR § 117.315 requires all documents and records relating to the food safety plan to be retained for a period of 2 years regardless of the
shelf life of the product. The food safety plan must be retained onsite; however, documents and records outside the scope of the food
safety plan may be retained offsite provided they are retrievable within 24 hours upon verbal or written request by FDA for official review.
Electronic records are subject to all the requirements of this section, but are not subject to the requirements of 21 CFR § 11 unless this
is required by other applicable statutory provisions. Electronic records are considered to be ‘onsite’ where they can be retrieved from
an onsite location.
Sites should review their document control and recordkeeping procedures to ensure that they comply with the regulation, and they
should update their policies regarding record retention and storage as necessary.
RECOMMENDATION
Ensure that the record retention policy identifies which records are to be kept, and that they are kept for at least 2 years.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.1.21 3.5.1.1 117.405
MODULE ITEM
Where a hazard requiring a supply-chain-applied control is identified in the hazard analysis, the receiving facility must establish
and implement specific supplier approval and verification activities.
Where a hazard requiring a supply-chain-applied control is identified and the control is applied by an entity other than the receiving
facility’s supplier, the receiving facility is responsible for verifying implementation of the control.
GUIDANCE
The raw material risk assessment as required by BRC clause 3.5.1.1 may be utilized for determining materials with hazards requiring
a supply-chain-applied control (i.e., the material hazard is controlled before it is received by the receiving facility). Hazards requiring
a supply-chain-applied control are subject to verification requirements as defined in 21 CFR § 117.430. Raw material hazards and
low-risk materials, which may be adequately controlled by PRPs or other preventive controls at the receiving facility, should be
documented on the hazard analysis.
In circumstances where the supply-chain-applied control is performed by an entity other than the receiving facility’s supplier
(e.g., a farm or processor under different management), the site is responsible for verifying implementation of the supply-chain-
applied control. Verification may be completed directly (e.g., second-party onsite audit of the entity) or indirectly through review
of supplier-provided verification documentation (e.g., third-party audit report or material test results).
RECOMMENDATION
Regardless of how many times a required control is applied prior to being received at a site, the receiving site is responsible for
verifying that the control has been applied.
As an example, when cooked chicken is received (with no additional kill step required by the receiving facility), the site where the
cook step takes place must be included in supplier verification, specifically verifying controls around the cook step.

20 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.1.22 3.5.1, 3.5.2.1, 3.5.1.4 117.420
MODULE ITEM
Supplier approval must be documented before receiving and using raw materials and ingredients.
Verification activities must be conducted before receiving and using raw materials and ingredients on a temporary basis from
unapproved suppliers.
GUIDANCE
21 CFR § 117.420 requires documented supplier approval and a written procedure with criteria for receiving and accepting materials.
Supplier approval must be documented before receiving and using materials. The expectation for supplier approval before use is
implied in BRC section 3.5.1, statement of intent. Requirements for a written acceptance procedure are defined in BRC clause 3.5.2.1
and these are consistent with the regulation. Where the receiving facility relies on supplier self-documented methods as a part of
its verification activities for acceptance criteria (e.g., a certificate of analysis), the receiving facility is responsible for reviewing the
supplier documentation and for documenting completion of the review.
Consistent with the requirements of BRC clause 3.5.1.4, 21 CFR § 117.420 allows for the use of unapproved suppliers only on a
temporary basis and where adequate verification activities are conducted before receiving and using the materials. Verification
activities must be appropriate to the level of risk and consistent with the requirements of 21 CFR § 117.410(b).
RECOMMENDATION
Specific attention must be paid to approval prior to receiving materials. It is not acceptable to receive on hold, then approve.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


5.1.23 3.5.1.2, 3.5.2.1 117.430
MODULE ITEM
One or more supplier verification activities (as defined in 21 CFR § 117.410(b)) must be conducted for each supplier before using
raw materials and ingredients and periodically thereafter at an adequate frequency.
GUIDANCE
21 CFR § 117.430 requires verification activities to ensure that supply-chain-applied controls are consistently implemented. Verification
activities are required only where the site identifies a material hazard requiring a supply-chain-applied control. The term ‘verification’
in the context of the regulation is analogous to supplier monitoring in the BRC Food Safety Standard. Verification activities must be
established and conducted for each supplier of a material with a hazard requiring a supply-chain-applied control before using the
material and at an adequate frequency thereafter.
21 CFR § 117.430 contains two critical requirements regarding supplier verification activities. The first critical element is § 117.430(a),
which requires one or more supplier verification activities as defined in 21 CFR § 117.410(b) for initial approval and periodically thereafter.
Verification activities, other than onsite audits as defined in 21 CFR § 117.410(b) and 21 CFR § 117.410(c), include the following: material
sampling and testing, review of the supplier’s food safety records, review of the supplier’s third-party audit report, and other supplier
verification activities as appropriate based on material risk and supplier performance. Determining the appropriate verification activities
and frequency is consistent with the requirements of BRC clause 3.5.2.1.
The second critical element is 21 CFR § 117.430(b), which requires an initial and annual onsite audit thereafter as the designated
verification activity where the supplier controls the hazard. Other verification activities more appropriate to ensure that hazards are
effectively controlled by the supplier, or less frequent audits, may be applied where documented justification is provided. Onsite
audits must be conducted by a qualified auditor.
Sites approving and monitoring medium- to high-risk materials and suppliers through onsite audits as required by BRC clause 3.5.1.2
meet the verification requirements of 21 CFR § 117.430, provided that the onsite audit is conducted initially and annually thereafter,
or where documented justification in the risk assessment identifies that less frequent audits are adequate to verify the control of the
hazard by the supplier.
The regulation defines a qualified auditor as a qualified individual (as defined in 21 CFR § 117) who has technical expertise obtained
through education, training, or experience (or a combination thereof) necessary to perform the auditing function as required by 21
CFR § 117.180(c)(2). Qualified auditors may include auditors registered with GFSI-benchmarked schemes, government inspectors,
or appropriately trained and experienced second-party auditors.
RECOMMENDATION
Of specific note, where a supplier controls a specific hazard (which is not controlled post receiving, as in the case of cooked chicken),
the supplier must be approved via audit.

BRC FS7 FSMA MODULE 21


II PREVENTIVE CONTROLS FOR ANIMAL FOOD: 21 CFR PART 507
The site shall determine if it is required to register with FDA as a food facility according to legislative requirements set forth in FD&C,
section 415. This applies to domestic (US-based) and foreign sites. Where a site is based outside of the US territory and is required to
register with FDA as a food facility due to business operations, the site must designate a US representative.

Sites identified as BRC Category 11 for pet food shall comply with all requirements of the Preventive Controls for Human Food Checklist
and the following additional requirements of the Preventive Controls for Animal Food checklist for compliance with this module.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.2.1 4.13.3 507.28
CHECKLIST ITEM
Human food byproducts held for distribution as animal food must be held under conditions that will protect against contamination,
including the following:
○○ During holding, human food byproducts for use as animal food must be accurately identified.
○○ Labeling that identifies the product by the common or usual name must be affixed to or accompany the human food byproducts
for use as animal food when distributed.
○○ Shipping containers (e.g., totes, drums, and tubs) and bulk vehicles used to distribute human food byproducts for use as animal
food must be examined prior to use to protect against the contamination of animal food from the container or vehicle when the
facility itself is responsible for transporting the human food byproducts or arranges with a third party to transport the human food
byproducts for use as animal food.

GUIDANCE
There are specific requirements regarding the labeling of animal food, as well the byproducts to be used (or potentially used), in the
manufacture of animal food that utilizes a common or trade name.
Transport containers, including vehicles, must be assessed for contamination risk.
RECOMMENDATION
Ensure that the risks unique to animal food (dependent on destination use or potential) are identified and mitigated.

22 BRC FS7 FSMA MODULE


III FOOD DEFENSE: 21 CFR PART 121
Sites required to register with FDA as a food facility shall comply with all requirements of the following Food Defense checklist for
compliance with this module.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.3.1 7.1 121.4
CHECKLIST ITEM
A qualified individual (QI) is responsible for developing the site’s food defense plan, conducting a vulnerability assessment,
identifying mitigation strategies, and conducting a reanalysis of the plan. The QI responsible for developing the food defense plan
shall be identified on the site’s organizational chart.
One or more QIs shall be responsible for implementing mitigation strategies at actionable process steps.
GUIDANCE
The QI responsible for developing the site’s food defense plan must have completed training recognized by FDA for implementing
requirements of the Food Defense rule. At present, the only recognized course is the Food Safety Preventive Controls Alliance
(FSPCA) Intentional Adulteration training course.
QIs responsible for implementing mitigation strategies may be in addition to the QI responsible for developing the food defense plan.
These individuals must receive training in food defense awareness.
RECOMMENDATION
The individual or team responsible for developing and reviewing the food defense plan should be able to justify their expertise in the
subject. Recommend some form of training.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.3.2 4.2.1, 4.2.2 121.126
CHECKLIST ITEM
The site shall have a written food defense plan, which includes the following:
○○ a vulnerability assessment identifying significant vulnerabilities and actionable process steps
○○ appropriate mitigation strategies to reduce the vulnerability
○○ procedures for food defense monitoring, corrective action, and verification.

GUIDANCE
21 CFR § 121.126 requires a written food defense plan, which contains the following components:
○○ a written vulnerability assessment
○○ written mitigation strategies
○○ written food defense monitoring procedures
○○ written food defense corrective action procedures
○○ written food defense verification procedures.

Sites should review their security assessments and security arrangements for compliance with the regulation and update or establish
new procedures to formalize a food defense plan as described above.
RECOMMENDATION
Note that food defense must assess both external and internal threats.

BRC FS7 FSMA MODULE 23


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.3.3 4.2.1 121.130
CHECKLIST ITEM
A written vulnerability assessment shall be prepared for each food type manufactured, processed, packed, or held, which evaluates
the following key criteria (at a minimum):
○○ scale and severity of threat if a contaminant is added to product
○○ degree of physical access to the product
○○ ability of an attacker to successfully contaminate product – including consideration of an inside attacker.

A vulnerability assessment shall be documented for each food type regardless of the outcome and provide justification as to why
each point, step or procedure in the operation was or was not identified as an actionable process step.
GUIDANCE
21 CFR § 121.130 requires a written vulnerability assessment for each food type manufactured, processed, packed, or held at the site.
The assessment must evaluate key criteria defined in this requirement against each step of the operation for the food type being
analyzed. The QI is responsible for conducting the vulnerability assessment.
The vulnerability assessment must identify two important pieces of information: significant vulnerabilities and actionable process
steps. Utilizing a process flow diagram is recommended.
Significant vulnerabilities are a point, step or procedure in processing, manufacturing, packing, or holding operations susceptible to
intentional adulteration with a likelihood of causing wide-scale public health harm. An example of a significant vulnerability may be the
storage of bulk liquid due to the potential to contaminate a large volume of food uniformly as the result of the homogeneous nature of
the material and continuous mixing.
Actionable process steps are a point, step or procedure where a vulnerability exists and a mitigation strategy can be applied, which is
necessary to minimize or prevent the vulnerability. An example of an actionable process step is ‘material receiving’ where a significant
vulnerability exists for the receiving of bulk liquids. Several types of mitigation strategies (e.g., controlled access, visitor sign-in,
locked storage tanks, etc.) may be applied individually or in combination as appropriate to the operation and vulnerability.
RECOMMENDATION
Risk matrices should take into account ease of access to open product. In general, access restriction to processing and storage
areas will manage external but not internal threats. Internal threats may be managed by a combination of access restriction, employee
vetting, restriction of materials entering the area (limiting what employees can bring into production area), and oversight.

24 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.3.4 4.2.1, 4.2.2, 4.2.3, 4.16.5 121.135
CHECKLIST ITEM
Written mitigation strategies shall be established and implemented for each actionable process step identified in the
vulnerability assessment.
Justification shall be documented explaining how the strategy significantly minimizes or prevents the vulnerability.
GUIDANCE
21 CFR § 121.135 requires written mitigation strategies for each actionable process step identified in the vulnerability assessment.
The QI is responsible for determining appropriate mitigation strategies for each identified actionable process step.
Many security measures implemented by the site for compliance with the BRC Food Safety Standard clauses may be adapted to form
actionable process steps and incorporated into written mitigation strategies. Where current security measures do not fully minimize
or prevent identified vulnerabilities at actionable process steps, new mitigation strategies should be sought.
Examples of BRC clauses requiring security measures (i.e., mitigation strategies) include:
○○ clause 4.2.1 requiring the implementation of security arrangements to reduce the potential for unauthorized access to products
where products or ingredients are vulnerable to malicious contamination
○○ clause 4.2.2 requiring measures to ensure only authorized personnel have access to production and storage areas. This clause
also requires a visitor reporting system as well as staff training in site security procedures and challenging unknown visitors
○○ clause 4.2.3 requiring locked external storage areas when not in use
○○ clause 4.16.5 requiring security arrangements for finished product in transport (e.g., tamper-evident seals, locks, etc.).

It is important to note that each mitigation strategy must be tied to an identified actionable process step, documented, and justified
to explain how it prevents or reduces the corresponding vulnerability.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.3.5 NO EQUIVALENT OR 121.140
RELATED CLAUSE
CHECKLIST ITEM
Written monitoring procedures shall be established and implemented to include the activity and frequency for monitoring food
defense mitigation strategies.
Procedures shall include recordkeeping requirements for all monitoring activities.
GUIDANCE
21 CFR § 121.140 requires that mitigation strategies have associated monitoring activities to ensure consistent implementation
of the strategy as intended.
A food defense monitoring procedure shall be established and should include:
○○ scope of mitigation strategies
○○ how to perform the monitoring activity
○○ frequency
○○ responsibility
○○ recordkeeping.

RECOMMENDATION
Recommend including verification or assessment of mitigation strategies into internal audit systems.

BRC FS7 FSMA MODULE 25


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.3.6 3.7.1, 3.7.2 121.145
CHECKLIST ITEM
Written corrective action procedures shall be established and implemented when mitigation strategies are not properly
implemented. The procedure shall include the following criteria:
○○ method for identifying and correcting a lack of implementation
○○ method for reducing the likelihood of recurrence
○○ recordkeeping requirements for corrective actions.

GUIDANCE
21 CFR § 121.145 requires that mitigation strategies have associated corrective action procedures where implementation is not
performed as intended.
BRC clause 3.7.1 requires a corrective action procedure. The scope of this procedure should ensure that deviations (i.e., nonconformities)
from implementing mitigation strategies, food defense monitoring, or food defense verification are covered by the procedure and
subject to the established corrective action protocol as required by clause 3.7.2.
RECOMMENDATION
Corrective action procedures within the food defense plan should include failure of, or failure to utilize, mitigation strategies.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.3.7 3.4.1 121.150
CHECKLIST ITEM
Written verification procedures shall be established and implemented to ensure that food defense monitoring and corrective action are
performed according to procedures. Verification procedures shall describe activities to verify implementation of mitigation strategies.
Verification procedures shall include:
○○ a review of monitoring and corrective action records within an appropriate timeframe (e.g., 7 days)
○○ other verification activities as appropriate (e.g., internal audit)
○○ method for verifying that reanalysis of the food defense plan was conducted
○○ frequency for verification activities
○○ recordkeeping requirements of all verification activities.

GUIDANCE
21 CFR § 121.150 requires that mitigation strategies be verified through several mechanisms to ensure consistent implementation
of the strategy as intended.
A food defense verification procedure shall be established and should include:
○○ scope of mitigation strategies
○○ verification activities, which include those specified in the requirement
○○ frequency of verification to include a schedule of activities
○○ responsibility
○○ recordkeeping.

Where internal audits shall be used as ‘other verification activities’ to satisfy compliance with this requirement, the scope of the
internal audit procedure and schedule required by BRC clause 3.4.1 shall be expanded to include all mitigation strategies.
RECOMMENDATION
Recommend including verification procedures for all mitigation strategies in internal audit activities.

26 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.3.8 4.2.1 121.157
CHECKLIST ITEM
Reanalysis of the food defense plan shall be documented and performed every 3 years or whenever:
○○ there is a change in facility operations which creates a new significant vulnerability
○○ knowledge about a new threat applicable to the food or facility becomes known
○○ mitigation strategies are not implemented as intended
○○ FDA requires reanalysis based on new threats or scientific evidence.

GUIDANCE
21 CFR § 121.157 requires that the food defense plan be reanalyzed every 3 years (at a minimum) or following changes, which can
impact the outcome of the vulnerability assessment and effective application of mitigation strategies. The QI is responsible for
performing reanalysis of the food defense plan.
Revisions to the food defense plan shall occur where facility or operational changes create a new potential vulnerability or elevate
a vulnerability to significant status. Reanalysis and changes shall be made (and documented) before changes at the site occur,
within 90 days of production or within an appropriate timeframe based on justification.
BRC clause 4.2.1 requires a documented review of the security risk assessment and results whenever changes at the facility occur or
annually (at a minimum). Site procedures for the documented review should be expanded to cover review of the vulnerability assessment,
actionable process steps, mitigation strategies, and food defense monitoring, corrective action and verification procedures.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.3.9 3.3.1 121.305
CHECKLIST ITEM
All records required by 21 CFR § 121 must include:
○○ date and time of activity being documented
○○ signature/initials of individual performing activity or conducting record review
○○ information to identify the facility (e.g., name and location)
○○ identity of the product and lot code where applicable.

GUIDANCE
21 CFR § 121.305 is equivalent to § 117.305 (refer to guidance in Preventive Controls for Human Food checklist) for records that
relate to the food defense plan – including monitoring, corrective action, and verification.
It is recommended that sites review all existing records related to food defense and site security and update forms as required
by the regulation in a manner consistent with the site’s document control procedures. New forms (e.g., food defense monitoring)
must consider all recordkeeping requirements as described in 21 CFR § 121.305.
RECOMMENDATION
Specific attention to be paid to the last two bullet points, ensuring site identification and lot code where applicable.

BRC FS7 FSMA MODULE 27


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.3.10 1.1.3 121.310
CHECKLIST ITEM
The owner, operator or agent in charge of the facility must sign and date the written food defense plan initially and then upon any
changes following reanalysis.
GUIDANCE
21 CFR § 121.310 is equivalent to § 117.310 (refer to guidance in Preventive Controls checklist), which requires the owner, operator,
or agent in charge of the facility to sign and date the written food defense plan. This includes: vulnerability assessment, mitigation
strategies, monitoring procedure(s), corrective action procedure(s), and verification procedure(s). Additionally, the responsible
individual must sign and date any changes following reanalysis.
This requirement is to ensure commitment from senior management for responsibility of the food defense plan. This requirement must
be met initially and thereafter may be integrated as a component of the senior management review to comply with BRC clause 1.1.3.
RECOMMENDATION
The site senior manager must review (or be present during the review, as in the annual management review) the food defense plan.
Verification of the activity must be in the form of a signed, dated document within the food defense plan.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.3.11 3.3.1, 3.3.2, 4.2.1 121.315
CHECKLIST ITEM
All documents and records relating to the food defense plan (i.e., all records required by 21 CFR § 121) must be retained at the facility
for 2 years after the record is created. Where records are stored offsite, they must be retrievable within 24 hours with the exception
of the food defense plan, which must remain onsite.
GUIDANCE
21 CFR § 121.315 is equivalent to § 117.315 (refer to guidance in Preventive Controls for Human Food checklist), which requires all
records relating to the food defense plan to be retained for a period of 2 years after the creation date. The food defense plan must
be retained onsite and be kept for 2 years after discontinued use. Documents and records outside the scope of the food defense
plan may be retained offsite provided they are retrievable within 24 hours upon verbal or written request by FDA for official review.
Electronic records are not subject to the requirements of 21 CFR § 11 unless required by other applicable statutory provisions.
Electronic records are considered onsite where they can be retrieved from an onsite location.
Sites should review their document control and recordkeeping procedures to ensure compliance with the regulation and update
policies regarding record retention and storage as necessary.
RECOMMENDATION
Adjust record retention policy to identify relevant records and maintain for a minimum of 2 years.

28 BRC FS7 FSMA MODULE


IV SANITARY TRANSPORTATION: 21 CFR PART 1 SUBPART O
The site shall ensure sanitary transportation practices for food transported by motor or rail vehicle within the US and shall comply
with all requirements of the following Sanitary Transportation checklist for compliance with this module.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.4.1 4.16.1, 4.16.2 1.906
CHECKLIST ITEM
Vehicles and transportation equipment must be maintained and stored in a sanitary condition appropriate for the intended use to
prevent food from becoming unsafe during transportation. Where inspection reveals that vehicles or containers are not in a clean
condition, they shall not be used.
A documented procedure shall describe cleaning and storage practices of all vehicles and transportation equipment maintained
by the site whether leased or owned and as appropriate for the intended use. The procedures shall be fully implemented. Cleaning
activities shall be recorded.
GUIDANCE
21 CFR § 1.906 requires vehicle and transportation equipment to be appropriately designed, maintained, cleaned, and stored
as appropriate for the intended use and to prevent food from becoming unsafe during transportation. The regulation additionally
requires that transportation equipment used for temperature-controlled product must be equipped and maintained to provide
the required temperature control.
BRC section 4.16 ensures the cleanliness of loading and unloading equipment and the inspection of vehicles or containers for
cleanliness prior to loading. However, the requirements do not specify the requirement for maintaining the cleanliness of vehicles
and containers during use and storage due to the scope of the Standard. Vehicle cleaning requirements are managed by the BRC
Global Standard for Storage and Distribution as many food processing and manufacturing sites utilize a third party for transportation.
Documented procedures must be in place describing vehicle cleaning and storage practices, which prevent or eliminate sources
of contamination (e.g., product residue, pests) for vehicles and containers maintained and stored at the manufacturing site for the
transportation of food products. Where vehicles and containers are not owned by the site, responsibility for cleaning should be
identified in the vehicle contract.
RECOMMENDATION
Procedures for managed transport equipment should include maintaining them in sanitary condition during use. Recommend
adding this to driver training and/or contracts for logistics suppliers.

BRC FS7 FSMA MODULE 29


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.4.2 3.5.3.2, 4.16.1, 4.16.5, 1.908(A)
4.16.6
CHECKLIST ITEM
The site shall ensure that contracts with US shippers, receivers, loaders, and carriers specify their responsibility for compliance
with FSMA’s Sanitary Transportation rule. Where the site acts as the shipper or receiver, it shall ensure compliance with the rule.
Responsibilities shall ensure transportation operations are conducted in a manner to prevent food from becoming unsafe during
transport (i.e., apply controls) and that responsibility for compliance with the regulation is assigned to competent supervisory personnel.
GUIDANCE
Sites that arrange for the transportation of food in the US are defined as ‘shippers’ in the Sanitary Transportation rule. Sites that receive
food at any point in the US after ground transportation – even when they are not the final recipient – are defined as ‘receivers’ in the
Sanitary Transportation rule.
Examples of conditions and controls to prevent food from becoming unsafe include segregation, isolation, packaging, handwashing,
and temperature control. The type of food must be considered when establishing transport conditions and controls.
Where controls fail and food may be rendered unsafe, the shipper, receiver, loader, or carrier shall not sell or distribute the food. They
are responsible for communicating the failure to other parties to ensure that food is not sold unless a qualified individual determines
that the control deviation did not render the food unsafe.
RECOMMENDATION
US-based (and those crossing into the US) transporters should comply with the relevant FSMA regulations embedded in their contracts.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.4.3 4.16.1, 4.16.6 1.908(B)
CHECKLIST ITEM
Where the site arranges transportation, it shall document sanitary design requirements and cleaning procedures of vehicles
appropriate for the type of food to be transported. These requirements shall be communicated to the loader and carrier.
Where the site does not arrange transportation, the above provision shall be documented in the shipping service contract to ensure
that the shipper documents sanitary specifications of vehicles for the loader and carrier, which are appropriate for the type of food.
GUIDANCE
The shipper (i.e., site or third party) shall specify in writing and communicate to the US carrier or loader the sanitary specifications for
ensuring that vehicles and equipment are in an appropriate sanitary condition for the transport of food. This shall include sanitary
design requirements and cleaning practices, which are appropriate for the type of food.
Examples of sanitary specifications include:
○○ specifying the temperature and any requirements for a precooling phase where temperature-controlled product is shipped
○○ procedures for ensuring that the previous load does not cross-contaminate food where bulk food is transported
○○ procedures for cleaning, sanitizing, and inspecting vehicles
○○ segregation methods to prevent cross-contamination or cross-contact.

RECOMMENDATION
Responsibility for appropriate transport equipment shall be undertaken by the site or embedded into the contract for service suppliers.

30 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.4.4 3.5.3.2, 4.16.2, 4.16.6 1.908(C)
CHECKLIST ITEM
Contracts with loaders shall specify that the loader is responsible for following sanitary specifications provided by the shipper.
GUIDANCE
Contracts with US loaders shall provide an agreement between the site and its service provider that loaders shall follow written
sanitary specifications from the shipper regardless of whether the shipper is the site or another entity.
RECOMMENDATION
Adjust transport service provider contracts as necessary, to include adherence to FSMA requirements.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.4.5 3.5.2.1, 4.16.3 1.908(D)
CHECKLIST ITEM
Where the site receives temperature-controlled product immediately following transportation, it shall conduct an assessment to
determine whether the food was subject to temperature abuse.
GUIDANCE
Where the site receives temperature-controlled product, it is responsible for assessing and recording whether the food was subject
to temperature abuse.
The assessment may include:
○○ measuring the product temperature upon unloading
○○ documenting the refrigeration unit’s temperature setting
○○ measuring the ambient temperature of the container or refrigeration unit holding the product
○○ evaluating the product for physical and quality indicators of temperature abuse (e.g., warm product, off-odors, etc.).

Where the site’s customer or another entity receives the product, they bear responsibility for assessing and documenting
temperature abuse.
This clause applies even when the site is not the final recipient.
RECOMMENDATION
This requirement applies to all steps, interim and final, in the transport chain for temperature-controlled product. Where a site
receives temperature-controlled product, it may need to verify multiple previous steps if the risk assessment indicates the need.

BRC FS7 FSMA MODULE 31


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.4.6 3.5.3.2, 4.16.2, 4.16.3, 1.908(E)
4.16.4, 4.16.6
CHECKLIST ITEM
Contracts with carriers shall specify that the carrier is responsible for the following sanitary activities where agreed in writing with shipper:
○○ sanitary condition of the vehicles and transportation equipment
○○ following the shipper’s sanitary specifications (including precooling requirements where applicable)
○○ recording compliance with operating temperatures where critical to food safety
○○ procedures for the use of bulk vehicles, which include recording the previous cargo and the most recent cleaning activity for the shipper.

GUIDANCE
Where formally agreed upon with the shipper, the US carrier is responsible for the following sanitary activities:
○○ ensuring that the vehicles and activities meet the shipper’s sanitary specifications
○○ documenting compliance with the specified operating temperature where temperature-controlled product is shipped
(e.g., data loggers or recording the temperature during loading and unloading)
○○ precooling of the refrigeration unit where specified by the shipper
○○ identifying the previous cargo of bulk transport to the shipper upon request
○○ disclosing the most recent cleaning of the vehicle to the shipper upon request
○○ establishing and implementing cleaning, sanitizing, and inspection procedures for ensuring that vehicles and transportation
equipment are maintained in a sanitary condition.

RECOMMENDATION
Procedures should include not only initial verification of cleanliness, but also the expectation to maintain these conditions during transport.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.4.7 3.5.3.2, 4.16.5, 4.16.6, 1.910
7.1.1–7.1.6
CHECKLIST ITEM
Contracts with carriers shall specify that the carrier implements a training program for all personnel engaged in transportation
activities, which covers:
○○ awareness of potential food safety problems that may occur during food transportation
○○ basic sanitary transportation practices to address those potential problems
○○ the responsibilities of the carrier.

GUIDANCE
The site shall document assurance that US carriers implement adequate training programs required by the Sanitary Transportation
rule in carrier contracts.
Where the US carrier is responsible for the sanitary conditions of the transportation operations, the training requirements defined in
the Sanitary Transportation rule shall include the following:
○○ provision of adequate training to all personnel engaged in transportation regarding: the awareness of potential food safety
problems that may occur during food transportation; basic sanitary transportation practices to address those potential problems;
and the responsibilities of the carrier
○○ provision of training upon hire and periodically thereafter
○○ maintenance of training records which include the date of the training, the type of training, and the person(s) trained.

RECOMMENDATION
All transport employees responsible for the product will require adequate training on the relevant FSMA regulations (primarily those
identified in this section).

32 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.4.8 3.3.2, 3.5.3.2, 4.16.1, 1.912(A–E)
4.16.6
CHECKLIST ITEM
The site shall keep all records related to US transportation operations and transportation service contracts as original or electronic
records for a minimum of 12 months beyond termination of the activity or contract. Offsite records shall be retrievable within 24 hours.
GUIDANCE
Service contracts shall specify the following recordkeeping requirements as appropriate to the nature of the service to ensure compliance.
○○ shippers shall retain records that they provide to carriers documenting transportation specifications and operating temperatures
as well as carrier agreements for 12 months beyond termination of the agreement with the carrier
○○ carriers shall retain records of implemented procedures for 12 months beyond expiration of transportation agreements and
records of training for 12 months beyond when the individual no longer performs the activity
○○ any person providing services for compliance with the Sanitary Transportation rule shall maintain records of activities and
agreements for 12 months beyond termination of the transportation agreement.

RECOMMENDATION
Ensure that the record retention policy identifies key transport-related records, and that they are maintained for a minimum of 12 months.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.4.9 3.3.1, 3.3.2 1.912(F–I)
CHECKLIST ITEM
The recordkeeping policy shall ensure that all sanitary design requirements and cleaning procedures for vehicles are maintained
onsite and all offsite records are retrievable within 24 hours.
GUIDANCE
21 CFR § 1.912 requires sanitary design requirements and cleaning procedures for vehicles be retained onsite; however, documents
and records outside the scope of these procedures may be retained offsite provided they are retrievable within 24 hours upon verbal
or written request by FDA for official review.
Electronic records may be maintained and are not subject to the requirements of 21 CFR § 11 unless required by other applicable
statutory provisions. Electronic records are considered onsite where they can be retrieved from an onsite location.
Sites should review their document control and recordkeeping procedures to ensure compliance with the regulation and update their
policies regarding record retention and storage as necessary.
RECOMMENDATION
No additional recommendations.

BRC FS7 FSMA MODULE 33


V PRODUCE SAFETY: 21 CFR PART 112
Sites identified as BRC Category 5 shall determine if business operations fall within the scope of FDA’s farm or mixed-type
facility definition. Refer to the Glossary in this module and 21 CFR § 112.3 for the definitions of farm and mixed-type facility
to determine applicability.

Where a site determines that its business operations are regulated by 21 CFR Part 112 (Produce Safety rule), it shall comply
with all requirements of the following Produce Safety checklist for compliance with this module.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.1 7.1.1, 7.1.2, 7.2.1, 7.3.1, 112.22(A)
7.3.2
CHECKLIST ITEM
Personnel (permanent and temporary) who handle produce or touch food contact surfaces must receive additional training
on the following:
○○ principles of food hygiene and food safety
○○ produce safety standards applicable to an individual’s job.

GUIDANCE
21 CFR § 112.22(a) requires that all persons engaged in handling produce or food contact surfaces receive training in:
○○ principles of food hygiene and food safety
○○ health and personal hygiene – including recognizing symptoms of health conditions likely to contaminate produce or
food contact surfaces
○○ produce safety standards applicable to the individual’s job.

The intent of this regulatory requirement is covered by BRC section 7.1 as the Food Safety Standard requires all personnel to receive
‘appropriate’ training commensurate with the type of work and all persons engaged in activities related to CCPs to be trained and
assessed for competency.
To ensure clarity in expectations for personnel who handle produce or food contact surfaces and regulatory alignment, the site shall
ensure compliance with this module requirement, which is in addition to compliance with all training requirements of BRC section 7.1.
As the Produce Safety rule does not require the implementation of HACCP and CCPs, but rather the application of specific produce
standards, personnel who handle produce or food contact surfaces shall be additionally trained in these standards (e.g., water
quality measures) where applicable.
RECOMMENDATION
No additional recommendations.

34 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.2 7.1.1 112.22(B)
CHECKLIST ITEM
Personnel (permanent and temporary) who conduct harvest activities (including washing and cooling) must receive additional
training on the following:
○○ recognizing produce contaminated with known or reasonably foreseeable hazards
○○ inspecting harvest containers and equipment to ensure that they are clean, maintained, and do not contaminate produce with hazards
○○ correcting problems with harvest containers or equipment.

GUIDANCE
21 CFR § 112.22(b) requires that all persons engaged in harvest activities receive training on methods to prevent and correct
cross-contamination of produce and food contact surfaces.
As discussed in the previous clause, the intent of this regulatory requirement is covered by BRC section 7.1 as the Food Safety
Standard requires all personnel to receive ‘appropriate’ training commensurate with the type of work. However, to ensure clarity
in expectations and regulatory alignment, the site shall ensure compliance with this module requirement.
RECOMMENDATION
Indication of potential sources of and contamination by pathogens represent the key area of focus for the training.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.3 NO EQUIVALENT OR 112.22(C)
RELATED CLAUSE
CHECKLIST ITEM
One or more supervisors or individuals responsible for the operation must have successfully completed food safety training
equivalent to a standardized curriculum recognized by FDA.
GUIDANCE
The individual responsible for ensuring the operation’s compliance with the Produce Safety rule must have completed training
recognized by FDA for implementing the requirements of the Produce Safety rule. At present, the only recognized course is the
Produce Safety Alliance (PSA) Produce Safety training course.
RECOMMENDATION
Strong recommendation that each site or process area should have an individual trained to the PSA course.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.4 1.2.1 112.23
CHECKLIST ITEM
A supervisor shall be identified with responsibility for the operation and ensuring compliance with the Produce Safety rule.
This individual shall be identified on the site’s organizational chart.
GUIDANCE
21 CFR § 112.23 requires a designated supervisor to be responsible for the operation and ensuring compliance with 21 CFR Part 112.
A deputy for the designated individual should be identified, which is consistent with the requirements of BRC clause 1.2.1.
RECOMMENDATION
Adjust organizational chart to comply.

BRC FS7 FSMA MODULE 35


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.5 7.2.1, 7.2.2 112.32
CHECKLIST ITEM
Personnel (permanent and temporary) shall avoid contact with animals or take measures such as handwashing and protective
clothing to prevent contamination of produce and food contact surfaces following contact with worker animals.
GUIDANCE
21 CFR § 112.32 requires that persons in contact with produce or food contact surfaces apply appropriate hygiene practices
to prevent cross-contamination. This includes avoiding contact with animals or implementing appropriate measures where
this cannot be avoided.
BRC clauses 7.2.1 and 7.2.2 cover this regulatory requirement but they do not explicitly address preventing cross-contamination
from contact with worker animals. Site policies and procedures for compliance with clauses 7.2.1 and 7.2.2 should be updated
to reflect this requirement.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.6 3.7.1, 4.5.1, 4.5.2, 4.7.1 112.42
CHECKLIST ITEM
The water distribution system supplying agricultural water used for harvest, packing, holding – and associated equipment – shall
be maintained, regularly inspected, and equipment properly stored to prevent the system from being a source of contamination
to produce and food contact surfaces. The system shall be inspected for conditions which could introduce known or foreseeable
hazards into or onto produce.
Where testing of the water source or a system inspection reveals contamination, deficiencies shall be corrected such as the repair
of well caps or sanitary seals.
GUIDANCE
21 CFR § 112.42 requires that all agricultural water systems under the site’s control be inspected annually (minimum) – ideally at the
beginning of the growing season – which includes inspection of the water source, distribution system, and associated equipment.
BRC clause 4.5.1 requires annual testing (at a minimum) of water sources for microbiological and chemical quality based on the risk
assessment conducted for compliance with clause 4.5.2. However, the clause does not explicitly require annual inspection of the
distribution system and associated equipment.
Site procedures for compliance with clause 4.5.1 should be expanded to include annual inspection of the distribution system and
equipment in additional to testing the water source. Inspections should seek to identify conditions which could introduce known or
reasonably foreseeable hazards into or onto produce. Inspections should take into consideration: the nature of the water source; the
extent of the operation’s control over the water source; the degree of protection afforded to the water source; the adjacent land use;
and the likelihood of introducing a hazard from another water source user before the water reaches the operation.
Additionally, the requirement for regular maintenance of the distribution system – including inspection and proper storage of
equipment – should be added to the site’s preventive maintenance program as required by clause 3.7.1.
RECOMMENDATION
No additional recommendations.

36 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.7 4.5.1 112.43
CHECKLIST ITEM
Agricultural water treatment must be delivered and monitored at a frequency that ensures water is safe, of adequate sanitary quality,
and meets the microbial quality criteria of no detectable generic Escherichia coli (E. coli) in 100 mL.
GUIDANCE
21 CFR § 112.43 requires that treated water be delivered and monitored at a frequency that ensures the water is consistently safe,
of adequate sanitary quality and consistently meets microbial quality criteria.
BRC clause 4.5.1 requires annual testing (at a minimum) of water sources for microbiological and chemical quality, which includes
treated water.
Where water is treated, site procedures for compliance with clause 4.5.1 may need to be expanded to include an appropriate frequency
of water testing (i.e., monitoring) that ensures microbial quality criteria are consistently met. An example of this may be free chlorine
testing at a predetermined frequency based on risk where chlorine treatment is used, to ensure residual chlorine is present at an
acceptable level at all points in the distribution system to eliminate microbiological hazards.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.8 4.5.1 112.44
CHECKLIST ITEM
Potable water quality standards used shall ensure the microbial quality criterion is met, which is no detectable generic E. coli in 100 mL.
GUIDANCE
21 CFR § 112.44 requires that water in direct contact with produce, food contact surfaces, used to make ice, and/or used for
handwashing must be safe, of adequate sanitary quality, and not contain detectable generic E. coli in 100 mL.
BRC clause 4.5.1 requires potable water (or water that poses no risk of contamination) for the specified activities, which ensures
no generic E. coli in 100 mL as per US Environmental Protection Agency (EPA), EU and WHO drinking water quality standards.
Where these water quality standards are not referenced for the water source, the reference potable or drinking water standard shall
ensure no detectable generic E. coli in 100 mL.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.9 3.7.2 112.45
CHECKLIST ITEM
Where agricultural water does not meet microbial quality criteria or is determined to be unsafe and not of adequate sanitary quality,
water use must be discontinued along with treatment or other correction that reestablishes sanitary and microbial quality criteria.
Where water treatment is not performed, reinspection of the entire affected agricultural water system shall be conducted followed
by the identification of conditions leading to the introduction of hazards into or onto produce or food contact surfaces, and the
correction, and verification of correction, to ensure water meets microbial quality criteria.
GUIDANCE
21 CFR § 112.45 requires that water sources be discontinued where they do not meet the microbial quality criteria, and corrective
action be applied to the water distribution system.
BRC clause 3.7.1 requires a corrective action procedure for correcting all failures in the food safety and quality system. The scope of
this procedure should include the failure to meet microbial quality criteria for potable water sources and be subject to the established
corrective action protocol as required by clause 3.7.2. The protocol for correcting water quality nonconformities shall ensure
compliance with this module requirement.
RECOMMENDATION
No additional recommendations.

BRC FS7 FSMA MODULE 37


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.10 4.5.1, 5.6.2.3 112.47
CHECKLIST ITEM
Agricultural water testing may be performed by the site (or site representative) or by a third party, provided that representative
samples of the site’s water source are secured.
Aseptic water sampling must be performed. The method of analysis for water testing is EPA ‘Method 1603: Escherichia coli (E. coli)
in water by membrane filtration using modified membrane-thermotolerant Escherichia coli agar (modified mTEC),
EPA–821–R–09–007)’, December 2009 or equivalent method.
GUIDANCE
21 CFR § 112.47 specifies the criteria for conducting agricultural water testing.
Site procedures for ensuring tests critical to food safety and legality are conducted by a laboratory accredited to ISO 17025 for the
method of analysis as required by BRC clause 5.6.2.3. The procedures should be updated to include the specified requirements
for agricultural water testing.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.11 4.3.6, 4.3.7 112.48
CHECKLIST ITEM
During harvest, packing, and holding operations (e.g., hydrocooling, washing), water must be managed to maintain its safety
and sanitary quality and to prevent contamination of produce. This includes establishing and following a water-change schedule
for recirculated water.
The quality of water used for harvest, packing, and holding activities must be visually monitored for organic buildup (e.g., soil, plant debris).
The temperature of water used for harvest, packing, and holding activities as appropriate to the commodity and operation
must be maintained and monitored to minimize the infiltration of pathogens into produce.
GUIDANCE
21 CFR § 112.48 requires management of the water used during harvest, packing, and holding operations to prevent the
cross-contamination or the infiltration of pathogens into produce.
BRC clauses 4.3.6 and 4.3.7 require risk assessment to assess cross-contamination from pathogens in high-care and ambient
high-care areas which apply to produce operations, and the application of appropriate controls to mitigate any identified risks.
These requirements apply to washing and cooling water used in postharvest operations. However, the Food Safety Standard
does not explicitly state requirements for managing water to include a water-change schedule for recirculated water, visual
inspection of water quality, or temperature monitoring to minimize the potential for infiltration (e.g., in tomato wash operations).
It is recommended that risk assessments be updated to consider water management according to this module requirement.
RECOMMENDATION
No additional recommendations.

38 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.12 3.5.1.1, 3.5.2.1 112.114
CHECKLIST ITEM
Dropped produce (i.e., produce that comes in contact with the ground prior to harvest) where the produce would not normally
touch the ground as a part of growing and harvest (e.g., cantaloupe, almonds, etc.) shall not be distributed.
GUIDANCE
21 CFR § 112.114 prevents dropped produce from being distributed.
Supplier risk assessments as required by BRC clause 3.5.1.1 should identify commodities (i.e., raw materials) at-risk for dropped
produce (e.g., apples).
Material acceptance procedures as required by clause 3.5.2.1 should be updated to ensure farms (supplier) do not harvest ‘dropped
produce’ where this risk is present. Additionally, sites may want to include a requirement for certificates of conformance (COCs) to
confirm ‘no dropped produce’ on the document, which is specific to the harvested lot. Supplier monitoring procedures may include
audits of harvest practices to verify conformity.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.13 4.4 SOI, 4.4.3, 4.12 SOI, 112.131
4.12.2
CHECKLIST ITEM
Sewage disposal and septic systems shall be controlled and appropriate for the site to prevent the contamination of produce
and food contact surfaces.
GUIDANCE
21 CFR § 112.131 requires the control of sewage disposal and septic systems to prevent contamination of produce and food
contact surfaces.
BRC section 4.4 (statement of intent) requires the site, buildings and facility to be suitable for the intended purpose, which expects
the prevention of produce contamination from sewage disposal and septic systems. Additionally, BRC section 4.12 requires the
disposal of all waste in accordance with legal requirements.
To ensure clarity in expectations for the control of sewage disposal and septic systems and regulatory alignment, the site shall
ensure compliance with this module requirement, which is in addition to compliance with clauses 4.4.3 (appropriate drainage
for process waste) and 4.12.2 (waste handling).
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.14 4.4.3, 4.4.4, 4.5.1 112.133
CHECKLIST ITEM
Plumbing shall not allow backflow or cross-connection between waste and potable water lines.
GUIDANCE
21 CFR § 112.133 requires plumbing that prevents backflow and cross-connection between waste and potable water lines.
The expectation for backflow and cross-connection prevention is implied in BRC clause 4.5.2.
The water distribution schematic should be reviewed to ensure all points in the system are protected from backflow or
cross-connection from waste water and sewage pipework. Where there is a potential for backflow or cross-connection,
control must be applied through the application of a backflow prevention device or other mechanism to mitigate the risk.
RECOMMENDATION
No additional recommendations.

BRC FS7 FSMA MODULE 39


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.15 3.3.1, 3.3.2 112.161
CHECKLIST ITEM
All produce safety-related records must be reviewed, dated, and signed within a reasonable timeframe after being made by the
supervisor or responsible party.
GUIDANCE
21 CFR § 112.161 requires all records of produce safety related to the assessment, inspection, monitoring (testing), and
implementation/verification of controls to include:
○○ name and location of farm
○○ actual values or observations
○○ description of produce (commodity name, lot, other identifiers)
○○ location of the field or packing shed
○○ date and time of activity
○○ recording at time of activity
○○ legible results
○○ date and signature of person performing the activity.

Additionally, all records must be reviewed, dated, and signed within a reasonable time after the records are made by a supervisor
or responsible party.
BRC clauses 3.3.1 and 3.3.2 capture most requirements of the regulation but it is recommended that sites review all existing records
related to produce safety and update forms as required by the regulation in a manner consistent with the site’s document control
procedures. New forms must consider all recordkeeping requirements described in 21 CFR § 112.161.
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.16 3.3.2 112.162, 112.163
CHECKLIST ITEM
All produce safety documents and records must be retained at the site for 2 years after the record is created.
Where records are stored offsite, they must be retrievable within 24 hours.
Records related to equipment or processes used by the site for analyses, sampling, or action plans – including the results of scientific
studies, tests, and evaluations – shall be retained at the site for at least 2 years after their use is discontinued.
GUIDANCE
21 CFR § 112.162 and 112.163 require all produce safety documents and records to be retained for a period of 2 years after their
creation date.
Electronic records are not subject to the requirements of 21 CFR § 11 unless required by other applicable statutory provisions.
Electronic records are considered onsite where they can be retrieved from an onsite location.
Sites should review their document control and recordkeeping procedures to ensure compliance with the regulation and update
their policies regarding record retention and storage as necessary.
RECOMMENDATION
Ensure site’s record retention policy includes identification of relevant documents, and that they are retained for a minimum of 2 years.

40 BRC FS7 FSMA MODULE


NEW CLAUSE BRC CLAUSE REGULATORY SECTION
15.5.17 NO EQUIVALENT OR 112.145
RELATED CLAUSE
CHECKLIST ITEM
Specific additional requirements for the harvesting, packing, and holding of sprouts.
Establish and implement a written environmental monitoring plan for the testing of Listeria spp. or Listeria monocytogenes.
The environmental monitoring plan shall include the following criteria:
○○ target test (i.e., Listeria spp. or L. monocytogenes)
○○ sample frequency (no less than monthly)
○○ sample timing (i.e., when in the process are samples collected)
○○ sample sites where the number of samples and location are sufficient to determine the efficacy of controls
(includes food contact and non-food contact surfaces).

The plan shall describe aseptic methods for sample collection and testing according to FDA’s ‘Testing methodology
for Listeria species or L. monocytogenes in environmental samples,’ Version 1, October 2015 (or equivalent).
RECOMMENDATION
No additional recommendations.

NEW CLAUSE BRC CLAUSE REGULATORY SECTION


15.5.18 NO EQUIVALENT OR 112.146
RELATED CLAUSE
CHECKLIST ITEM
Specific additional requirements for the harvesting, packing, and holding of sprouts.
The environmental monitoring plan shall include a corrective action plan if any samples are positive for Listeria spp. or L. monocytogenes.
If Listeria spp. or L monocytogenes are identified in the harvesting, packing, or holding area, the following activities shall occur
as a part of the corrective action process:
○○ resample positive surfaces and the surrounding area to determine the extent of contamination
○○ clean and sanitize the affected and surrounding areas
○○ resample and retest to confirm the elimination of Listeria spp. or L. monocytogenes
○○ conduct finished product testing as appropriate
○○ take additional action to prevent recurrence and to prevent adulterated food from entering commerce.

RECOMMENDATION
No additional recommendations.

BRC FS7 FSMA MODULE 41


APPENDICES

Appendix 1: Correlation of activities covered by the Food Safety Standard with FSMA legislation 43
Appendix 2: Process for undertaking module audits 44

42 BRC FS7 FSMA MODULE


APPENDIX 1:
CORRELATION OF ACTIVITIES
COVERED BY THE FOOD SAFETY
STANDARD WITH FSMA LEGISLATION
I must register with FDA as a food facility according to
legislative requirements set forth in FD&C section 415 and
I manufacture, process, pack, reregister every 2 years. This applies to domestic (US
or hold human or animal food based) and foreign companies. Where a company is
products for sale in the US based outside of the US territory and is required to register
with FDA as a food facility due to business operations,
the company must designate a US representative.

I must comply with 21 CFR Part 117: Preventive


I must register with FDA as a food
Controls for Human Food (or 21 CFR Part 507 for
facility and take physical possession
Animal Food) and 21 CFR Part 121: Mitigation
of human or animal food products
Strategies to Protect Food Against Intentional
for the purpose of manufacturing,
Adulteration, unless excepted. I am responsible
processing, packing or holding
for reporting an adulterated or misbranded food.

I receive human or animal food in


I must comply with 21 CFR Part 1 subpart 0:
the US following transportation
Sanitary Transportation of Human and Animal
by motor or road vehicle for food
Food, unless excepted.
to be sold within the US

I arrange shipment of human or


I must comply with 21 CFR Part 1 subpart 0:
animal food within the US by one
Sanitary Transportation of Human and Animal
or more carriers for food to be
Food, unless excepted.
sold within the US

I grow, harvest, pack, and/or hold I must comply with 21 CFR Part 112: Standards for
produce on a farm (as defined by FDA) the Growing, Harvesting, Packing, and Holding of
for food to be sold within the US Produce for Human Consumption, unless excepted.

BRC FS7 FSMA MODULE 43


APPENDIX 2:
PROCESS FOR UNDERTAKING
MODULE AUDITS

PLANNING THE ONSITE AUDIT


There are a number of options for undertaking the FSMA module depending on the site’s
certification status (to the BRC Global Standard for Food Safety) and timelines.

1 FSMA MODULE WITH CERTIFICATION OR RECERTIFICATION AUDIT


The preferred option is to couple the FSMA Preventive Controls Preparedness Module assessment
with the full audit for the BRC Global Standard for Food Safety. In these cases, a half-day for the
FSMA module should be added to the total audit duration.

2 STANDALONE FSMA ASSESSMENT


Where it is not possible to undertake the audit for the module at the same time as the audit for the
Food Safety Standard, a return visit to the site, not in combination with the Standard audit, may be
made by the same auditor who undertook the audit for the Standard.

In this case, it is recommended that the audit is planned for 1 day in duration, and the auditor should
assess both the FSMA module and reassess the relevant aspects of the Standard where needed
as specified below.

Where a return visit to a seasonal site is required and it is not in operation, the module may be
evaluated, providing the auditor can audit sufficient records and production areas to have
confidence of compliance with the requirements.

3 UNCERTIFICATED SITE
Where the site is not currently certificated to the Standard, the FSMA Preventive Controls
Preparedness Module may not be used alone. If a non-certificated site wishes to be assessed
for the FSMA module, the certification body must follow the full protocol for onboarding and
certifying a new site to the BRC Global Standard.

44 BRC FS7 FSMA MODULE


STANDALONE MODULE: EXPECTATIONS WHEN
UNDERTAKING THE AUDIT AND REPORTING
The FSMA assessment shall be conducted along the same principles as the original audit
(i.e., it will include an opening meeting, inspection of the operation of the process, documentation
trails, and closing meeting).

Identified nonconformities should be documented and actioned within the normal protocol of
the Standard (i.e., the company has 28 days to provide appropriate evidence of close out and the
certification body should review the information and confirm the decision in the normal manner).

If practices are seen during the FSMA assessment that give the auditor cause to doubt continued
compliance with the Standard, then nonconformities against the Standard may be raised which
will require close out. This will not affect the current grade of the certificate in force. However, if
a high number of nonconformities are identified, then action on the BRC certificate may be taken,
resulting in a full reaudit. If a critical nonconformity is identified, the certification body shall withdraw
the current certificate and arrange a full reaudit of the site.

As the module audit will not be undertaken at the same time as the Standard audit (although it will
be carried out by the same auditor), controls may have changed and therefore it is important that
the auditor audits all the relevant areas and provides details of the controls in place. The following
is a guide regarding the additional details:

○○ The standalone report template contains a section to outline a description of the company
and any major changes since the last Standard audit. This section can include management
changes, for example.
○○ The template also contains a section to outline an overview of the facility inspection. Here the
auditor can summarize whether the facility is secure, the building fabric has been maintained,
and whether it is in a hygienic state. This section should confirm that there were no concerns
regarding foreign body and allergen controls.

BRC FS7 FSMA MODULE 45


GLOSSARY

Actionable process step A point, step, or procedure in a food process where a mitigation strategy can be applied
(Food Defense rule) and is necessary to minimize or prevent an existing significant vulnerability.
Agricultural water Water used in growing, harvesting, packing, and holding activities (including washing or
(Produce Safety rule) cooling), which is in contact with produce or food contact surfaces.
Carrier A person or entity that physically moves food by rail or motor vehicle in commerce within the US.
The term ‘carrier’ does not include any person who transports food while operating as a parcel
delivery service.
Covered activity Growing, harvesting, packing, or holding produce on a farm (see farm).
(Produce Safety rule)
Entity A legal business.
Environmental pathogen A pathogen of the manufacturing, processing, packing, or holding environment, which can
contaminate food and cause foodborne illness if consumed. An example of an environmental
pathogen common in wet environments is Listeria monocytogenes. An example of an
environmental pathogen common in dry environments is Salmonella.
Farm (Produce Safety rule) FDA defines two types of farms, which fall under the scope of the Produce Safety regulation:
primary production farm and secondary activities farm.

A primary production farm is an operation under one management in one general physical location
devoted to the growing and harvesting of crops. Farm activities include: packing or holding raw
agricultural commodities (RACs); drying or dehydrating RACs to create a distinct commodity
such as raisins where additional manufacturing is not applied; treatment to facilitate ripening;
and packaging or labeling where the activity includes additional manufacturing (e.g., irradiation).

A secondary activities farm is an operation not located on a primary production farm whose
operations are dedicated to harvesting (e.g., hulling or shelling), packing, holding, and/or other
activities applied to the RACs described above where the primary production farm supplying the
RACs jointly owns or has a majority interest in the secondary activities farm.
Food defense Activities which protect food from intentional adulteration.
Foreign supplier A supplier that produces, processes, or manufactures food which is exported to the US.
Harvesting Cutting or separating the edible portion of fruits and vegetables from the plant. This includes
(Produce Safety rule) removing or trimming leaves, husks, roots, stems, etc. Examples of harvest activities include
cooling, field coring, filtering, gathering, hulling, removing stems and husks, shelling, sifting,
threshing, trimming outer leaves, and washing produce grown on a farm.
Hazard, known or A biological, chemical (including radiological) or physical hazard associated with a food or the
reasonably foreseeable process/facility of production.
Hazard requiring a control A known or reasonably foreseeable hazard (see hazard, known or reasonably foreseeable)
requiring one or more controls to prevent, significantly minimize or eliminate the hazard in the
food as determined by a hazard analysis.
Holding All activities related to the storage of food. Examples of holding activities include the following,
provided that the activity does not process or transform the product: storage, drying, blending,
fumigation, and handling unexposed product. Holding facilities may include (but are not limited to)
bulk silos, cold storage facilities, grain elevators, liquid tanks, shipping containers, and warehouses.
Loader A person or entity that loads food onto a rail or motor vehicle during transportation operations.
Mitigation strategy A risk-based measure determined from a vulnerability assessment, which is applied at a point
in the supply chain or at a process step to prevent or minimize a threat intending to cause
widespread public health harm.

46 BRC FS7 FSMA MODULE


Mixed-type facility A facility that conducts activities included and exempt from registration under section 415 of
(Produce Safety rule) the US Federal Food, Drug, and Cosmetic Act. For example, a ‘farm mixed-type facility’ is an
operation that conducts farm activities exempt from registration as a food facility and conducts
manufacturing, processing, packing, or holding of food (outside the definition of farm which
requires the facility to register).
Packing Putting packaged or unpackaged food into containers. This may include related activities
(e.g., sorting, culling, grading, weighing, repacking) where the activity does not transform
the raw agricultural commodity (RAC).
Preventive control Procedures, practices or activities which prevent or significantly minimize a food safety hazard
from occurring and are not reliant on a specific process step to which the control is applied.
Preventive controls may or may not be traditional critical control points (CCPs) as defined by
HACCP terminology.
Preventive Controls Qualified A designated individual with responsibility for development of the food safety plan, validating
Individual (PCQI) controls, reviewing records, and reanalysis of the plan. The PCQI shall have successfully
completed the FSPCA Preventive Controls training course.
Qualified auditor An individual independent of the supplier who has the appropriate education, technical expertise
and experience in auditing principles and food safety management systems to assess food
suppliers for compliance with the requirements of the Standard and regulatory compliance under
the US Food, Drug, and Cosmetic Act. Qualified auditors may be registered auditors with
GFSI-benchmarked schemes, government inspectors or appropriately trained and experienced
second-party auditors provided they meet all expectations of this definition.
Qualified individual (QI) An individual with appropriate education, training, and/or experience to develop and/or
(Food Defense rule) implement the requirements of the food defense plan according to the individual’s job
responsibilities. QIs with responsibility for developing the site’s food defense plan, conducting
a vulnerability assessment, identifying mitigation strategies, and conducting a reanalysis of the
plan shall have successfully completed the FSPCA’s Intentional Adulteration training course.
Qualified individual An individual with appropriate education, training, and/or experience to ensure the manufacturing,
(Preventive Controls rule) processing, packing, or holding of safe food according to the individual’s job responsibilities.
Receiver A person or entity that receives food at a point in the US after transportation, whether or not they
represent the final point of receipt for the food.
Shipper A person or entity (e.g., the manufacturer or a freight broker) who arranges for the transportation
of food in the US by a carrier or multiple carriers sequentially.
Significant vulnerability The susceptibility of a point, step or procedure in processing, manufacturing, packing, or holding
operations to intentional adulteration, which – if exploited – is reasonably likely to cause wide-
scale public health harm.
Transportation operations All activities associated with transporting food, which may affect the sanitary condition of the
food. This includes, but is not limited to, cleaning, inspection, maintenance, loading and
unloading, and operation of vehicles and transportation equipment. Transportation operations
do not include activities associated with the transportation of food completely enclosed by a
container, except for food requiring temperature control for safety, compressed food gases, food
contact substances, human food byproducts transported for use as animal food without further
processing, or live food animals (except molluscan shellfish).
Vulnerability assessment An evaluation of the vulnerabilities within the supply chain or food production process, which can
be exploited to intentionally contaminate a product and cause widespread public health harm.
The assessment must include an evaluation of the degree of physical access to the product, the
ability of an attacker to successfully contaminate product, and the severity and magnitude of
harm in the event of successful contamination.

BRC FS7 FSMA MODULE 47


FSMA REFERENCES

LEGISLATION
FSMA Final Rule for Preventive Controls for Human Food: Current Good Manufacturing Practice,
Hazard Analysis, and Risk-Based Preventive Controls for Human Food
https://www.fda.gov/food/guidanceregulation/fsma/ucm334115.htm

FSMA Final Rule for Preventive Controls for Animal Food: Establish Current Good Manufacturing
Practice and Hazard Analysis and Risk-Based Preventive Controls for Food for Animals
https://www.fda.gov/food/guidanceregulation/fsma/ucm366510.htm

FSMA Final Rule on Foreign Supplier Verification Programs (FSVP) for Importers of Food for Humans
and Animals
https://www.fda.gov/food/guidanceregulation/fsma/ucm361902.htm

FSMA Final Rule for Mitigation Strategies to Protect Food Against Intentional Adulteration
https://www.fda.gov/food/guidanceregulation/fsma/ucm378628.htm

FSMA Final Rule for Sanitary Transportation of Human and Animal Food
https://www.fda.gov/food/guidanceregulation/fsma/ucm383763.htm

Summary: Standards for the Growing, Harvesting, Packing, and Holding of Produce for Human
Consumption (Final Rule)
https://www.fda.gov/downloads/Food/GuidanceRegulation/FSMA/UCM360734.pdf

GUIDANCE
Food Facility Registration User Guide: Step-by-Step Instructions
https://www.fda.gov/food/guidanceregulation/foodfacilityregistration/ucm073706.htm

Draft Guidance for Industry: Questions and Answers Regarding Food Facility Registration (Seventh
Edition – Revised)
https://www.fda.gov/Food/GuidanceRegulation/GuidanceDocumentsRegulatoryInformation/
FoodDefense/ucm331959.htm

FSMA Rules & Guidance for Industry (a list of all FSMA-related guidance documents)
https://www.fda.gov/food/guidanceregulation/fsma/ucm253380.htm

TRAINING
Further information on the following training courses is available at https://www.fda.gov/food/
guidanceregulation/fsma/ucm461513.htm

FSPCA: Foreign Supplier Verification Programs (FSVP): FSVP Curriculum and Training

FSPCA: Intentional Adulteration: Intentional Adulteration Curriculum and Training

FSPCA Preventive Controls for Animal Food: Training

FSPCA Preventive Controls for Human Food: Training

Produce Safety Alliance: Training

48 BRC FS7 FSMA MODULE


BRC Global Standards
Floor 2
7 Harp Lane
London EC3R 6DP
Tel: +44 (0)20 3931 8150
Email: [email protected]

To learn more about the BRC Global Standards


certification programme please visit
WWW.BRCGLOBALSTANDARDS.COM
To learn more about the BRC Global Standards online
publication service for certificated sites, please visit
WWW.BRCPARTICIPATE.COM
To purchase printed copies or PDFs from its full range
of BRC Global Standards publications please visit
WWW.BRCBOOKSHOP.COM

You might also like