Required Records of Selected Regulations Under the Food Safety Modernization Act

The Food Safety Modernization Act requires records be kept for FDA compliance. Yet compliance is not as simple as ticking off a checklist.

The Food Safety Modernization Act, or FSMA (2011), has dominated the conversation in food safety circles for quite some time now. Compliance dates are arriving, and companies are realizing there is a lot to be done to become compliant. Companies that traditionally had little to no contact with the FDA (if everything was going right) are now seeing activity, whether anticipated or not. Just as in traditional GFSI-approved food safety schemes, such as  Safe Quality Food (SQF), BRC Global Standards, and Food Safety System Certification (FSC) 22000, records are of paramount importance. The old saying, “if you didn’t write it down, you didn’t do it,” still holds true. Although records are not required for general Good Manufacturing Practices (GMPs), there are lots of other records that must be maintained. It can be frustrating that there is not a list that applies to all companies, or even all companies of a certain type, detailing the exact records required so that compliance is as simple as ticking a set of boxes. Compliance will require some critical thinking to determine exactly which records must be kept. However, this is by design, as the FDA wanted to leave the regulation flexible to allow for many different types of businesses to be compliant.

We must not confuse flexibility with lax enforcement, as that could be a fatal mistake. Do not mistake the agency’s kindness for weakness. Companies must evaluate whether they need certain types of records, but the decisions made cannot be based on what is easiest. Another classic saying, “have as many records as necessary, but as few as possible,” also holds true. It’s not necessary to keep records for record-keeping’s sake. Ensure each record serves a purpose, and all areas of the company that require a control for food safety have accompanying records.

FSMA Foundational Rules

There are seven foundational rules that make up FSMA, but very few (if any) companies will be subject to all seven. Although each rule has a long and complex name, the seven rules are colloquially known as:
  • Preventive Controls for Human Food
  • Preventive Controls for Animal Food
  • Foreign Supplier Verification Programs
  • Produce Rule
  • Food Defense (Intentional Adulteration)
  • Sanitary Transportation
  • Third-party audits
The first question that must be answered is whether the company is subject to one or more of the rules, and if it is, when it must be compliant. Of course, it is not prudent to wait until the compliance date has passed to begin the process of becoming compliant. Many companies already have robust food safety systems and only need certain items to round out their compliance, and it’s important to know when to set the finish date for continuous improvement CAPAs. No one can definitively answer the question of whether the law applies to you except the FDA itself. Submit an inquiry to the Technical Assistance Network, or TAN, at

Once it has been determined that one or more of the rules apply to a facility, then records must be maintained to demonstrate compliance. A summary of the records required follows. Remember that some of these may not apply to you but you must evaluate whether they do, and a person knowledgeable about food safety must make that call. A summary of the records required by four of the seven foundational rules is provided below. Additional inquiries may be directed to the author through MasterControl.

Preventive Controls for Human and Animal Food

1.   Hazard Analysis
2.   Preventive controls
· Process preventive controls
·Allergen preventive controls
·Sanitation preventive controls
3.   Supply-chain program requirements
4.   Recall plan
5.   Monitoring procedures
6.   Corrective action procedures
7.   Verification procedures
8.   Preventive control monitoring data
9.   Corrective actions taken
10.Verification (if applicable) activities
11.Validation documentation (if applicable)
12.Supply-chain program implementation
13.Applicable training
14. Reanalysis of the Food Safety Plan as required
    Preventive Controls for Human Food and Preventive Controls for Animal Food require the same types of records. There are some key differences in the two regulations but the records required are the same.

    Foreign Supplier Verification Program (FSVP)

    1.       Hazard Analysis
    2.       Foreign supplier performance evaluation
    3.       Procedures for approving foreign suppliers
    4.       Procedures to assure use of only approved foreign suppliers
    5.       Determination of verification activities and their frequency
    6.       Performance of verification activities
    7.       Corrective and preventive actions
    8.       Re-evaluations of the entire FSVP either for cause or routinely every three years
    The performance of every aspect of developing and conducting your FSVP must be documented, and you must make your FSVP records available to FDA promptly upon request.

    This article is related to the White Paper:
    To get the full details, please view your free White Paper.

    Produce Rule

    1.     Training records for farm workers, volunteers, interns, pesticide applicators, and  one supervisor’s completion of the Produce Safety Course is recognized as  adequate by the FDA.
    2.     Facility monitoring, including cleaning and stocking toilet and handwashing  facilities as well as maintaining first aid kits
    3.     Worker illness and injuring reporting
    4.     Types and sources of soil amendments, rates and dates of application, and    handling and sanitation practices used that reduce risks
    5.     Compost records: time, temperature, turnings and other processing steps
    6.     Purchased soil amendments: name and address of the supplier, what soil  amendments were purchased, the date and amount purchased, lot information,  and data to ensure the supplier has used scientifically validated treatment  processes and monitoring during production
    7.     Water treatment monitoring
    8.     Pre-plant land assessments
    9.     Monitoring for animal activity 
    10.  Actions taken to reduce the risks related to animal intrusion into crop
    11.  Pre-harvest risk assessments
    12.  Animal intrusion and contamination events
    13.  Findings of agricultural water system inspections
    14.  Documentation of the results of all analytical tests conducted on agricultural  water for purposes of compliance
    15.  Scientific data or information the farm relies upon to support the adequacy of the  methods used for water quality control
    16.  Documentation of the results of water treatment monitoring
    17.  Scientific data or information relied upon to support the microbial die-off or r  removal rate(s) that were used to determine the time interval (in days) between  harvest and end of storage, including other activities used to achieve the  calculated log reduction of generic E. coli
    18. Annual documentation of the results or certificates of compliance from a public  water supply
    19. Scientific data or information relied upon to support any alternative established  and used for water quality control
    20. When, how, and what was cleaned in the packing house as well as any  monitoring steps and who did the cleaning
    21. Pest control weekly monitoring and all pest management practices
    22.Cleaning and sanitizing of tools, equipment, and containers
    23.Building maintenance and monitoring 
    24.Packing area and cold storage cleaning and monitoring
    25.Vehicle cleaning and inspections prior to loading
               26. Corrective actions related to any or all of the above
      The Produce Rule has some of the most extensive record-keeping requirements of any of the new FSMA rules, and often these will apply to farms that have historically not kept many records. Technological solutions will be important to assist with the record keeping and organization that is now required.

      Sanitary Transportation

      1.  Shippers – must keep records that demonstrate they provide specifications and operating temperatures to carriers, as well as any written agreements and/or procedures provided to carriers
      2.  Carriers – records of written procedures given to them by shippers and training records
      3.  Any person subject to the rule – any written agreements assigning tasks related to this rule
      4.  Shippers, receivers, loaders and carriers under the control of a single entity – written procedures related to this rule
      5.  For foods requiring time and temperature control for safety, data that demonstrates the food was kept under appropriate temperature control for the duration of the shipping and distribution process
      Sanitary transportation records are not as clearly defined as those under some of the other subparts. This is partly because the FDA has not yet released the recognized training for this subpart. As more information becomes available, we will release it to the public as quickly as we can. No matter which subpart your business falls under, any records you are required to maintain under the law must be made available to FDA upon their written request. The FDA is now allowed to ask for any records it has a reasonable suspicion may be involved in any food safety event, so more or less - carte blanche. The need for organized and accessible records has never been more apparent. 
      Erika Miller received her Bachelor of Science degree in chemistry from the University of Florida.  A Tampa native, she is trained in and experienced with GMPs, HACCP, FSSC 22000, Internal Auditing/Risk Analysis and FSMA; including program design and implementation, facility compliance, and training.  She has completed the FDA/FSPCA Lead Instructor course for Preventive Controls for Human Food and attended the pilot importer course for the Foreign Supplier Verification Programs.She may be reached at
      [ { "key": "fid#1", "value": ["GxP Lifeline Blog"] } ]