conducting a recall. However, we decline the request to specify what a
facility must include in its procedures because facilities may use
different approaches in how they carry out recalls and the information
they need to do so. For example, not all facilities use that same data
for identifying the product that may be impacted by a recall.
    (Comment 453) Some comments ask us to specify that the procedures
require facilities to notify us about a recall to ensure that all
suppliers, retailers, and consumers will have adequate notification of
the recall action. Other comments agree that it is important for
facilities to involve us in a recall situation as soon as possible, but
assert that the best way to address such a notification is through the
existing RFR system. These comments assert that additional procedures
or means to notify us would involve unnecessary additional steps and be
duplicative, with no improvement to the public health. Some comments
ask us to specify that the appropriate State regulatory agency with
inspection jurisdiction be notified in the event of a recall.
    (Response 453) We agree with comments that it is important to
notify us about a recall and that doing so can help to ensure that
suppliers, retailers, and consumers will have adequate notification of
the recall action. We also agree that the existing procedures to notify
us through the RFR system can accomplish this goal when a food presents
a risk of serious adverse health consequences or death and that it
therefore is not necessary to duplicate the notification procedures
already established in the RFR system in part 117. However, we
encourage facilities to include in their recall plan any procedures
they have to comply with the RFR or to include a cross-reference to
those procedures. Doing so may save time, which is critical during a
recall. When the recalled food does not present a risk of serious
adverse health consequences or death (and, thus, there is no report to
the RFR), our guidance entitled ``Guidance for Industry: Product
Recalls, Including Removals and Corrections'' recommends that recalling
firms notify the local FDA District Recall Coordinator as soon as a
decision is made that a recall is appropriate and prior to the issuance
of press or written notification to customers (Ref. 78). Including this
guidance with the facility's recall procedures may also save time.
    Likewise, we agree with comments that it is important to notify
appropriate State regulatory agencies about a recall. However,
procedures are available for

State regulatory agencies to rapidly receive information from us about
food recalls. For example, State regulatory agencies can receive
automatic notification about food recalls that we post on our Web site
(Ref. 79). We note that whatever methods are used to dispose of
adulterated food should comply with State and local requirements.
    (Comment 454) Some comments ask us to add a requirement for mock
recalls on a regular basis, such as annually. Some of these comments
state that mock recalls would familiarize the staff and communications
network(s) with the recall process and would improve the facility's
capacity to conduct effective and efficient recalls in the event of a
contamination event. Other comments assert that mock recalls would be
the only way to determine the effectiveness of a recall program. Some
comments note that mock recalls would be particularly critical for
manufacturers that have limited experience in actual recalls. Other
comments note that information from mock recalls could support
development of guidance on best practices for recalls. Some comments
recommend that any requirement for a mock recall as a verification
measure include sufficient flexibility to accommodate diverse
procedures and mechanisms.
    Some comments acknowledge that a mock recall could be an important
element of a recall plan but recommend that mock recalls remain
voluntary, such as by including mock recalls as an example of how
verification may be accomplished. Other comments note that the current
recall procedures in part 7 do not recommend mock recalls. Some
comments assert that a requirement to include a mock recall as a
verification activity would be an excessive and inappropriate burden.
Some comments note that retail facilities execute multiple recalls each
week and that adding the requirement to perform a mock recall would be
an unnecessary burden on the retail industry. Likewise, some comments
note that foodservice distributors are experts in conducting recall
activities, because they are routinely affected by manufacturer
recalls.
    Some comments ask us to clarify the ``metrics'' for a mock recall,
particularly with respect to the consequences of failing to meet an
appropriate metric if a mock recall is conducted as a verification
activity.
    (Response 454) We agree that a mock recall would familiarize the
facility with the recall process, could improve the facility's capacity
to conduct effective and efficient recalls during a contamination
event, may be particularly helpful for manufacturers that have limited
experience in actual recalls, and could support the development of
guidance on best practices for recalls, and we encourage facilities to
conduct one or more mock recalls to accomplish these goals. However, as
previously discussed, a recall plan would address food that had left
the facility, whereas the proposed requirements for monitoring,
corrective actions, and verification would all be directed at food
while it remains at the facility. Comments are mixed regarding whether
the rule should require a mock recall as a verification activity for
the recall plan, and we have decided to not require a facility to
conduct a mock recall as a verification activity for its recall plan so
that the focus of the monitoring, corrective actions, and verification
in the rule remains focused on food being produced rather than on food
that is distributed in commerce. A facility that voluntarily conducts a
mock recall would establish metrics appropriate to its plan and take
action (such as modifications to its procedures, or additional training
for its employees) if it is not satisfied with the results of the mock
recall.
    We note that retail companies are not subject to this rule and,
thus, are not subject to the requirement to have a written recall plan.

XXIX. Comments on Proposed Sec.  117.140--Preventive Control Management
Components

    We proposed preventive control management components as appropriate
to ensure the effectiveness of the preventive controls, taking into
account the nature of the preventive control. Most of the comments that
support the proposed provisions suggest alternative or additional
regulatory text (see, e.g., Comment 455).
    In the following sections, we discuss comments that disagree with,
or suggest one or more changes to, the proposed requirements. After
considering these comments, we have revised the proposed requirements
as shown in table 33, with editorial and conforming changes as shown in
table 52.

 Table 33--Revisions to the Proposed Requirements for Preventive Control
                          Management Components
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.140.......................  Flexible           Provide that
                                 requirements for   preventive control
                                 preventive         management
                                 control            components take into
                                 management         account both the
                                 components.        nature of the
                                                    preventive control
                                                    and its role in the
                                                    facility's food
                                                    safety system.
------------------------------------------------------------------------

A. Proposed Sec.  117.140(a)--Flexible Requirements for Monitoring,
Corrective Actions and Corrections, and Verification

    We proposed that, with some exceptions, the preventive controls
would be subject to three preventive control management components as
appropriate to ensure the effectiveness of the preventive controls,
taking into account the nature of the preventive control: monitoring,
corrective actions and corrections, and verification.
    (Comment 455) Some comments support our proposal to provide
flexibility in the oversight and management of preventive controls,
including the explicit provision that preventive control management
components take into account the nature of the preventive control. Some
of these comments state that the provisions for the preventive control
management components will allow facilities to tailor their food safety
plans to their specific facility, product, and process and ensure that
the regulatory requirements are risk-based. Other comments state that
the proposed approach acknowledges the safety benefits derived from the
use of prerequisite programs, such as CGMPs, and provides for a
framework whereby appropriate decisions may be reached regarding
hazards that require management controls that may include monitoring,
corrections or corrective actions, verification, and records. Other
comments state that the provisions will allow businesses to allocate
resources to spend the most time and resources controlling and
monitoring those hazards that pose the greatest risk to public health.
    However, many of these comments also ask us to convey not only that
the application of a particular management component be appropriate
(i.e., capable

of being applied), but also that it be necessary for food safety (i.e.,
to meet the overall FSMA food safety goals or to ensure a particular
control is effective) by specifying that the preventive control
management components take into account both the nature of the
preventive control and its role within the facility's overall food
safety system. Some of these comments ask us to make companion changes
reflecting that the preventive control management components take into
account both the nature of the preventive control and its role within
the facility's overall food safety system throughout applicable
provisions of the rule, such as the definition of ``significant
hazard'' (which we now refer to as ``hazard requiring a preventive
control'') and in the requirements for preventive controls, monitoring,
corrective actions and corrections, and verification. Some comments ask
us to consistently refer to ``the nature of the preventive control''
(rather than simply to ``the preventive control'') when communicating
the flexibility that a facility has in identifying preventive controls
and associated preventive control management components.
    One comment provides two examples of refrigeration controls to
explain its view that the management components for refrigeration
controls will vary depending on the role of refrigeration within the
facility's overall food safety system. In the first example, a facility
that manages the process of cooling a cream cheese as a CCP would
validate its refrigeration control, establish time and temperature
parameters that must be met, monitor those parameters and confirm their
use through verification, and, if the parameters were not met, then
follow a specific corrective action procedure to address the situation.
In contrast, after the initial cooling process for the hot-filled
product, the facility would manage refrigerated storage differently.
The facility would not keep validation data to support the specific
temperature chosen because the temperatures needed to keep food safe
are widely known and accepted. Although the facility may choose to
establish temperature parameters, the facility typically would not
apply such values as hard and fast limits in the same way as it would
for a CCP (e.g., because a 5 degree increase over the upper end of the
temperature range for a short time would not be meaningful to food
safety). The facility may choose not to monitor temperature
continuously and, even if the facility does monitor temperature
continuously it would only generate ``exception records'' when the
temperature exceeds a specific value. The facility also would find it
unnecessary to verify its ongoing monitoring.
    (Response 455) We agree that preventive control management
components should take into account both the nature of the preventive
control and its role in the facility's food safety system and have
modified the regulatory text of Sec.  117.140 to incorporate this
suggestion. We reviewed the full regulatory text of proposed subpart C
and made similar modifications to the regulatory text for the
definition of ``hazard requiring a preventive control'' (Sec.  117.3);
process controls (Sec.  117.135(c)(1)); monitoring (Sec.  117.145);
verification (Sec.  117.155); validation (Sec.  117.160); and
verification of implementation and effectiveness (Sec.  117.165).
    (Comment 456) Some comments assert that the flexibility explicitly
provided in the regulatory text could result in some facilities taking
a broad approach to significant hazards and other facilities taking a
more detailed approach. These comments express concern that inspectors
will view the detailed approach (e.g., with more preventive controls)
as the standard to judge compliance with the rule. Other comments
express concern that identifying a large number of preventive controls
could also undermine the value of HACCP programs because treating too
many controls as CCPs will pull resources from those controls that are
truly critical.
    (Response 456) We agree that facilities are likely to take
different approaches to complying with the rule. A facility-specific
approach is consistent with FSMA, which places responsibility for
hazard analysis and risk-based preventive controls on the owner,
operator, or agent in charge of the facility (section 418(a) of the
FD&C Act). We agree that having too many CCPs could dilute their
significance, but not every hazard will require a CCP to be controlled.
See table 6 in the 2014 supplemental preventive controls rule for two
examples of preventive controls that would not be CCPs (79 FR 58524 at
58542).
    During the initial stages of implementation, we expect that our
investigators will ask subject matter experts in CFSAN to review the
outcome of the facility's hazard analysis, the preventive controls
established by the facility, and the associated preventive control
management components that the facility has established and
implemented. Over time, as our investigators gain experience, we expect
that there will be fewer circumstances in which our investigators would
consult CFSAN about such an outcome. See also Response 5.
    (Comment 457) Some comments express concern with the number of
provisions that will impact certain types of operations. As an example,
these comments assert that a fresh-cut produce facility potentially
could be required to implement supplier verification, environmental
monitoring, and product testing, whereas a peanut butter producer may
not be required to implement any of those three provisions. According
to these comments, supplier verification most likely would not be
required if the manufacturing operation of the peanut butter
manufacturer includes a kill step to significantly minimize Salmonella,
because the ``significant hazard'' would be addressed at the receiving
facility. These comments interpret our previous discussions about
product testing, in the 2013 proposed preventive controls rule, as
evidence that such a peanut butter manufacturer also would likely not
conduct product testing. If the peanut butter product is hot-filled
into jars, there would be no RTE food exposed to the environment and,
thus, the facility's hazard analysis would not be required to consider
the potential for contamination with environmental pathogens.
    (Response 457) We acknowledge that some facilities will need to do
more than others, because the rule is flexible and risk-based.
Importantly, the rule does not require every fresh-cut produce
operation to conduct environmental monitoring, even though it does
require each fresh-cut produce operation to consider whether it is
necessary.
    We disagree that the flexibility provided in the regulatory text
would lead a peanut butter manufacturer to conclude that there would be
no RTE food exposed to the environment when peanut butter is hot-filled
into jars. In the production of peanut butter, the kill step (i.e.,
roasting) happens before the rest of the manufacturing process, and the
roasted peanuts are exposed to the environment before the filling step.
At the filling step, the temperature is hot enough to fill the jars but
is not hot enough to act as a kill step to significantly minimize any
pathogens that contaminated the peanuts after they were roasted. As a
result, in contrast to the interpretation of the comments, the peanut
butter production described by the comments does involve RTE food
exposed to the environment, and the facility's hazard analysis must
consider the potential for contamination with environmental pathogens.
However,

when a peanut butter manufacturer concludes that it requires sanitation
controls for environmental pathogens, it is more likely that the peanut
butter manufacturer would conduct environmental monitoring (rather than
product testing) as a verification of its sanitation controls. (The
peanut butter manufacturer may also conclude that product testing is a
useful tool to verify its overall food safety system.) Likewise, a
facility that buys peanut butter for use in an RTE food would need to
consider whether it needs supply-chain controls for the manufacturer
that performed the kill step for Salmonella and whether it needs
sanitation controls for environmental pathogens and environmental
monitoring as verification of its sanitation controls.
    (Comment 458) Some comments state that USDA's regulations (in 7 CFR
205.201(a)(3)) for the NOP include regulatory text to ``ensure the
effectiveness'' of measures in that program and that this regulatory
text is similar to regulatory text in the requirements for preventive
control management components. These comments assert that this type of
regulatory text has created compliance challenges and ask us to consult
with USDA about its experience with implementing effectiveness language
associated with monitoring practices and procedures and ensure that the
final rule uses regulatory text that will be clearly understood and
readily implementable by those subject to its provisions.
    (Response 458) Under the USDA regulation cited by these comments,
an organic production or handling system plan must include a
description of the monitoring practices and procedures to be performed
and maintained, including the frequency with which they will be
performed, to ``verify that the plan is effectively implemented.'' We
have not consulted with USDA regarding its experience in evaluating
compliance with this requirement because we addressed the issue likely
to cause these compliance challenges for monitoring practices and
procedures in an organic production or handling system plan when we
established our requirements for monitoring preventive controls.
Specifically, we require that a facility monitor the preventive
controls with adequate frequency to ``provide assurance that they are
consistently performed,'' not to ``verify that the plan is effectively
implemented.'' Our requirements more clearly distinguish the purpose of
monitoring and verification activities. See our previous discussion of
the relationship between monitoring and verification, and our tentative
conclusion to require monitoring of the performance of the preventive
controls (78 FR 3646 at 3747). We are affirming that conclusion in this
rule (see Response 461).
    (Comment 459) Some comments assert that regulations issued under
the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
would prevent a facility from monitoring employee health if it
establishes a Good Worker Hygiene Program as a preventive control.
    (Response 459) The basis of these comments is unclear. We do not
expect that activities associated with monitoring of employee health
would include activities that would be contrary to provisions of the
Health Insurance Portability and Accountability Act of 1996. Employee
health could be addressed through long-standing CGMP provisions (see
Sec.  117.10(a) and (b)). Specifically, with respect to disease control
there could be supervisory observation of illness or conditions such as
an open lesion, with appropriate action to exclude the worker from
operations in which there is a reasonable possibility of food, food-
contact surfaces, or food-packaging materials becoming contaminated
(Sec.  117.10(a)). Generally, the regulations described in this comment
(commonly referred to as ``the Privacy Rule'') apply to disclosures
made by a health care provider, not to the questions of an employer
(Ref. 80). See 45 CFR 160.103, which defines a ``covered entity'' as a
health plan; a health care clearinghouse; and a health care provider
who transmits any health information in electronic form in connection
with a transaction covered by the Privacy Rule. The Privacy Rule does
not prevent a supervisor, human resources worker or others from asking
an employee for a doctor's note or other information about health if
the employer needs the information to administer sick leave, workers'
compensation, wellness programs, or health insurance (45 CFR
164.512(b)(1)(v)).

B. Proposed Sec.  117.140(b)--Applicability of Preventive Control
Management Components to the Supply-Chain Program

    We proposed that the supplier program (which we now refer to as
``supply-chain program'') is subject to the following preventive
control management components as appropriate to ensure the
effectiveness of the supplier program, taking into account the nature
of the hazard controlled before receipt of the raw material or
ingredient: (1) Corrective actions and corrections, taking into account
the nature of any supplier non-conformance; (2) review of records; and
(3) reanalysis. We address comments on the supply-chain program in
sections XLII through XLIX. We are finalizing the applicability of
preventive control management components to the supply-chain program as
proposed.

C. Proposed Sec.  117.140(c)--Recall Plan Is Not Subject to Preventive
Control Management Components

    We proposed that the recall plan would not be subject to the
preventive control management components.
    (Comment 460) As discussed in Comment 447, some comments ask us to
establish requirements for a written recall plan as a CGMP requirement
in subpart B rather than as a preventive control in subpart C. As a
companion change, some of these comments ask us to delete our proposed
provision that the recall plan would not be subject to the preventive
control management components.
    (Response 460) As discussed in Response 447, we are establishing
the requirements as a preventive control in subpart C as proposed.
Therefore, we are finalizing the provision that the recall plan not be
subject to the preventive control management components.

XXX. Subpart C: Comments on Proposed Sec.  117.145--Monitoring

    We proposed to establish requirements for monitoring the preventive
controls. We also discussed our tentative conclusion that the language
of section 418 of the FD&C Act regarding monitoring is ambiguous and
that it would be appropriate to require monitoring of the
``performance'' of preventive controls.
    Some comments agree with our tentative conclusion regarding the
ambiguous nature of section 418. For example, some comments state that
our interpretation seems appropriate because requiring monitoring of
the ``effectiveness'' of the preventive controls would be redundant
with required verification activities. In addition, requiring
monitoring of the performance of preventive controls is consistent with
applicable domestic and internationally recognized standards.
    Some comments support the proposed provisions without change. For
example, some comments note that the proposed requirement for written
procedures for monitoring is similar to globally recognized food safety
standards and current industry practices and is a proactive measure to
help facilities prevent problems. Some comments that support the
proposed

provisions suggest alternative or additional regulatory text (see,
e.g., Comment 466 and Comment 467) or ask us to clarify how we will
interpret the provision (see, e.g., Comment 465 and Comment 468).
    In the following paragraphs, we discuss comments that disagree with
our tentative conclusion or with the proposed requirements, or ask us
to clarify the proposed requirements or suggest one or more changes to
the proposed requirements. After considering these comments, we are
affirming our tentative conclusion that the language of section 418 of
the FD&C Act regarding monitoring is ambiguous and that it would be
appropriate to require monitoring of the ``performance'' of preventive
controls. We also have revised the proposed requirements as shown in
table 34, with editorial and conforming changes as shown in table 52.

     Table 34--Revisions to the Proposed Requirements for Monitoring
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.145.......................  Flexibility in     Provide that
                                 requirements for   monitoring take into
                                 monitoring.        account both the
                                                    nature of the
                                                    preventive control
                                                    and its role in the
                                                    facility's food
                                                    safety system.
117.145(c)(1).................  Records of         Provide that records
                                 monitoring.        of refrigeration
                                                    temperature during
                                                    storage of food that
                                                    requires time/
                                                    temperature control
                                                    to significantly
                                                    minimize or prevent
                                                    the growth of, or
                                                    toxin production by,
                                                    pathogens may be
                                                    affirmative records
                                                    demonstrating
                                                    temperature is
                                                    controlled or
                                                    exception records
                                                    demonstrating loss
                                                    of temperature
                                                    control.
117.145(c)(2).................  Records of         Provide for exception
                                 monitoring.        records for
                                                    monitoring of
                                                    preventive controls
                                                    other than
                                                    refrigeration.
------------------------------------------------------------------------

A. Our Tentative Conclusion To Require Monitoring of the Performance of
Preventive Controls

    (Comment 461) Some comments disagree with our tentative conclusion
that it would be appropriate to require monitoring of the
``performance'' of preventive controls and assert that the concept of
``performance evaluation'' is too complex to be included in the rule.
    (Response 461) These comments may have misinterpreted what we meant
by ``monitoring performance of preventive controls.'' We used the term
``performance'' to mean ``the execution or accomplishment of an action,
operation, or process undertaken or ordered'' (78 FR 3646 at 3747). We
acknowledge that the definition of ``monitoring'' that we are
establishing in this rule includes that the purpose of observations or
measurements conducted as part of monitoring is to ``assess'' whether
control measures are operating as intended. However, we provided
examples showing that this assessment is a straightforward
determination of whether a process is operating as intended and is not
a complex evaluation as asserted by the comments. (See, e.g., the
discussion of monitoring the temperature of a process for roasting
nuts, 78 FR 3646 at 3746-3747.)
    (Comment 462) Some comments that support monitoring the performance
of preventive controls assert that our proposed definition of
``monitoring'' (proposed Sec.  117.3), and our preamble discussions of
``monitoring,'' have the potential to confuse ``monitoring the
performance of preventive controls'' with verification activities that
address ongoing implementation of control measures.
    (Response 462) See Response 106, in which we discuss comments on
the definition of monitoring and describe the changes we have made to
that definition to address concerns about the potential to confuse
``monitoring the performance of preventive controls'' with verification
activities that address ongoing implementation of control measures.
    (Comment 463) Some comments assert that authority should be
explicitly granted to the States to conduct food safety monitoring and
that we should maintain our responsibilities for product tracing.
    (Response 463) These comments misinterpret the provisions of
section 418 of the FD&C Act and this rule. Section 418 places the
responsibility for establishing and implementing a food safety system
(including hazard analysis, risk-based preventive controls, preventive
control management components (including monitoring, corrective action
procedures, and verification), and recordkeeping) on the owner,
operator, or agent in charge of a facility, not on FDA or any other
regulatory authority. This requirement for monitoring within the
framework of hazard analysis and risk-based preventive controls is
distinct from regulatory oversight of food safety, such as during
inspections and investigations of outbreaks of foodborne illness, which
generally involve product tracing. We agree that it is important to
coordinate regulatory oversight of food safety with the States and
other food safety partners. As discussed in Response 5, we are working
through the PFP to develop and implement a national Integrated Food
Safety System consistent with FSMA's emphasis on establishing
partnerships for achieving compliance (see section 209(b) of FSMA).
    (Comment 464) Some comments express concern about monitoring for
radiological hazards. Some comments claim hardships for fruit
packinghouses required to analyze and monitor radiological hazards.
Some comments object to comprehensive monitoring for radiological
hazards and note that the Codex Principles of Food Hygiene (Ref. 81) do
not address radiological hazards. Some comments from foreign entities
request an exemption from the requirements to monitor radiological
hazards because their government already monitors the food supply for
radiological safety at a national level.
    (Response 464) These comments misinterpret the proposed
requirements for monitoring. In this rule, ``monitoring'' means to
conduct a planned sequence of observations or measurements to assess
whether control measures are operating as intended, such as measuring
temperature during a process in which temperature is critical to
controlling a hazard. The comments seem to be referring to a situation
in which a receiving facility would find it appropriate to test
incoming raw materials or other ingredients to ensure that they are not
contaminated with a radiological hazard. In such a circumstance,
testing the incoming materials would not be monitoring, but rather
would be a preventive control (different from its usual role in
verification). Regardless, whether a facility would need to conduct
such testing (e.g., after an accident at a nuclear facility near one of
the facility's suppliers) would be determined based on the outcome of
its hazard analysis.

As part of its hazard analysis, a facility that identifies a
radiological hazard as a hazard requiring a preventive control, and
determines that testing raw materials and other ingredients is an
appropriate preventive control, could consider the extent to which any
testing conducted by its government on raw materials and other
ingredients reduces the need for, or extent of, its own testing.

B. Proposed Sec.  117.145(a)--Flexibility in Requirements for
Monitoring

    We proposed that, as appropriate to the preventive control, you
must establish and implement written procedures, including the
frequency with which they are to be performed, for monitoring the
preventive controls, and monitor the preventive controls with adequate
frequency to provide assurance that they are consistently performed.
    (Comment 465) Some comments assert that some food allergen controls
are not ``monitored'' in the sense that HACCP controls are monitored.
Some comments support a ``visibly clean'' standard for monitoring for
food allergens.
    (Response 465) To the extent that these comments are asserting that
the types of monitoring activities that a facility would establish
likely would be different for food allergen controls than for a control
at a CCP for a product subject to a HACCP plan, we agree. Under the
rule, a facility has flexibility to establish preventive control
management components, including monitoring, as appropriate to the
preventive control, and the nature of any monitoring activity will
depend on the nature of the preventive control and its role in the
facility's food safety system. In addition, a facility could determine,
for example, that it will visually observe food allergen controls as a
verification activity and not establish a separate ``monitoring''
activity within the meaning of Sec.  117.145. For example, a facility
that uses several food allergens as ingredients could store each of the
food allergens in a separate area of the facility, and then ``visually
observe'' that the various food allergens are in their assigned storage
areas. We agree that ``visibly clean'' can be a minimum standard that a
facility could apply during verification of food allergen controls by
visual observation.
    (Comment 466) Some comments ask us to require continuous monitoring
of preventive controls because the NACMCF HACCP guidelines recommend
continuous monitoring of controls where possible.
    (Response 466) We decline this request. The NACMCF HACCP guidelines
characterize continuous monitoring as the ideal situation and
specifically note that continuous monitoring is always preferred ``when
feasible.'' The NACMCF HACCP guidelines also note that continuous
monitoring is possible with many types of physical and chemical
methods. However, as we previously discussed, both the NACMCF HACCP
guidelines and the Codex HACCP Annex acknowledge that continuous
monitoring may not be possible, or even necessary, in all cases (78 FR
3646 at 3748).
    (Comment 467) Some comments agree that frequency and areas to be
tested and monitored need to be determined based on each product and
facility and ask us to allow each individual facility to determine the
frequency and areas to be monitored based on a completed risk
assessment. Some comments ask us to specify that the frequency of
monitoring preventive controls must have a scientific basis.
    (Response 467) It is unclear whether the comment agreeing that
monitoring frequency and areas to be tested need to be determined based
on each product and facility was directed to the monitoring provision
or to environmental monitoring. Regardless, by requiring written
procedures for monitoring, and specifying that the procedures include
the frequency with which the procedures are to be performed, the rule
provides that each facility must determine the frequency of monitoring,
as well as details such as the areas to be monitored. However, we
decline the request to specify that these procedures be based on a
completed ``risk assessment.'' The rule requires the facility to
conduct a hazard analysis, which determines whether there are any
hazards requiring a preventive control, and the facility would
establish preventive controls for such hazards as appropriate to the
facility and the food. The facility must consider factors associated
with risk (i.e., the severity of the illness or injury if the hazard
were to occur and the probability that the hazard will occur in the
absence of preventive controls) in evaluating whether any potential
hazard is a hazard requiring a preventive control (Sec.  117.130(c)).
Risk could be relevant to a facility's identification of appropriate
preventive controls for a particular hazard requiring a preventive
control. However, it is the nature of the preventive control, rather
than the risk associated with the hazard, that is more relevant to the
frequency of monitoring and the areas to be monitored. Accordingly, the
rule specifies that the facility establish written procedures and
conducts monitoring as appropriate to the preventive control, rather
than based on risk associated with the hazard. (See, e.g., the
discussion of monitoring the temperature of a process for roasting
nuts, 78 FR 3646 at 3746-3747.)
    We decline the request to specify that the frequency of monitoring
preventive controls must have a scientific basis. Monitoring should
take place with sufficient frequency to detect a problem in the
performance of a preventive control. The importance of the preventive
control to the safety of the food can be one factor in setting a
frequency. We acknowledge that scientific information may be
appropriate in determining the frequency of monitoring in some cases.
For example, the frequency may be statistically based, such as with
statistical process control. However, in some cases factors other than
scientific information may be appropriate in determining the frequency
of monitoring. For example, historical information on the consistency
of the control measure can be a factor in determining frequency. When
variability of the process is low, the frequency may be less than with
a process that has more variability. As another example, a process that
is operated at a point close to a food safety parameter limit may be
monitored more frequently than one where there is a large safety margin
built into the process.

C. Proposed Sec.  117.145(b)--Records

    We proposed that all monitoring of preventive controls must be
documented in records that are subject to verification and records
review.
    (Comment 468) Some comments point out that table 6 in the 2014
supplemental human preventive controls notice includes an example of a
monitoring activity that generally would not require monitoring records
(i.e., monitoring for foreign material with x-rays) (see 79 FR 58524 at
58542). These comments assert that this example is in conflict with the
proposed regulatory text and ask us to modify the regulatory text to
provide the flexibility we acknowledged in the 2014 supplemental human
preventive controls notice. Other comments ask us to specify that
monitoring must be documented as appropriate to the nature of the
preventive control.
    Some comments ask us to recognize the acceptability of monitoring
systems that exclusively provide exception reports. These comments
describe exception reporting as a structure where

automated systems are designed to alert operators and management on an
exception basis--i.e., only when a deviation from food safety parameter
limits are observed by the system. These comments assert that, in many
cases, monitoring of preventive controls can be done by automated
systems that provide exception reporting in a much more efficient
manner than if performed by operators and that automated monitoring
allows for increased sampling frequency (often continuous) and
reduction of human error. The comments provide an example of a
refrigeration temperature control that notifies on exception (e.g.,
high temperature alarm) and may only record temperatures that exceed
the specified temperature (without recording temperatures that meet
control requirements). These comments acknowledge that such systems
must be validated and periodically verified to ensure they are working
properly. These comments ask us to clarify in the preamble to the final
rule that monitoring systems can work affirmatively or by exception and
that both types of systems and their related documentation are
acceptable.
    (Response 468) We have made several revisions to the regulatory
text, with associated editorial changes, to clarify that monitoring
records may not always be necessary. We agree that the exception
reporting described in these comments, including validation and
periodic verification to ensure that the system is working properly,
would be an acceptable monitoring system in the circumstances provided
in the comments--i.e., for monitoring refrigeration temperature.
Therefore, we have revised the regulatory text to provide that records
of refrigeration temperature during storage of food that requires time/
temperature control to significantly minimize or prevent the growth of,
or toxin production by, pathogens may be affirmative records
demonstrating temperature is controlled or exception records
demonstrating loss of temperature control. Although the comments
specifically requested that we clarify our view on exception records in
the preamble, we believe that clarifying the regulatory text will be
more useful, both to facilities and to regulatory agencies that conduct
inspections for compliance with the rule. If a facility uses
``exception records,'' the facility must have evidence that the system
is working as intended, such as a record that the system has been
challenged by increasing the temperature to a point at which an
``exception record'' is generated. (See also Response 602 and Response
610.)
    We also have revised the regulatory text to provide that exception
records may be adequate in circumstances other than monitoring of
refrigeration temperature. For example, in table 6 of the 2014
supplemental human preventive controls notice the example we provided
of a monitoring activity that generally would not require monitoring
records is monitoring for foreign material with x-rays. We believe that
an x-ray system that monitors for foreign material with x-rays would
result in a record only when the system detects foreign material.

XXXI. Subpart C: Comments on Proposed Sec.  117.150--Corrective Actions
and Corrections

    We proposed to establish requirements for corrective actions and
corrections. Some comments support the proposed requirements without
change. For example, some comments assert that there is virtually no
reason to have a food safety plan unless there are proper corrective
actions in place so the product can be properly disposed of. Some
comments agree that there should be written procedures for corrective
actions and note the importance of identifying and evaluating the
problem, correcting it, and documenting the corrective action. Some
comments express the view that the proposed requirement for clear
corrective action in the event of an unanticipated problem, and
documenting all corrective actions, contributes to a comprehensive
safety plan. Some comments that support the proposed provisions suggest
alternative or additional regulatory text (see, e.g., Comment 469,
Comment 470, Comment 479, Comment 480, and Comment 485).
    In the following paragraphs, we discuss comments that disagree
with, or suggest one or more changes to, the proposed requirements.
After considering these comments, we have revised the proposed
requirements as shown in table 35, with editorial and conforming
changes as shown in table 52.

 Table 35--Revisions to the Proposed Requirements for Corrective Actions
                             and Corrections
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.150(a)....................  Corrective action  Clarify that
                                 procedures.        corrective action
                                                    procedures depend on
                                                    the nature of the
                                                    hazard, as well as
                                                    the nature of the
                                                    preventive control.
117.150(a)(1).................  Corrective action  Clarify that the
                                 procedures.        specified list of
                                                    corrective action
                                                    procedures is not
                                                    intended to be
                                                    exhaustive.
117.150(b)....................  Corrective action  Specify that the
                                 in the event of    requirement applies
                                 an unanticipated   when ``a corrective
                                 food safety        action procedure''
                                 problem.           (rather than ``a
                                                    specific corrective
                                                    action procedure'')
                                                    has not been
                                                    established.
117.150(b)(1)(ii).............  Corrective action  Specify that the
                                 in the event of    requirement applies
                                 an unanticipated   when a preventive
                                 food safety        control, combination
                                 problem.           of preventive
                                                    controls, or the
                                                    food safety plan as
                                                    a whole is found to
                                                    be ineffective
                                                    (rather than just
                                                    when a single
                                                    preventive control
                                                    has been found to be
                                                    ineffective).
117.150(c)(2).................  Corrections......  Provide for
                                                    additional
                                                    circumstances when
                                                    corrections, rather
                                                    than corrective
                                                    actions, are
                                                    warranted.
------------------------------------------------------------------------

A. Proposed Sec.  117.150(a)(1)--Requirement To Establish and Implement
Corrective Action Procedures

    We proposed that, with some exceptions, as appropriate to the
preventive control you must establish and implement written corrective
action procedures that must be taken if preventive controls are not
properly implemented. The corrective action procedures must include
procedures to address, as appropriate, the presence of a pathogen or
appropriate indicator organism in an RTE product detected as a result
of product testing, as well as the presence of an environmental
pathogen or appropriate indicator organism detected through
environmental monitoring.
    (Comment 469) Some comments note that we proposed to list two
circumstances that require written corrective active procedures (i.e.,
product testing and environmental

monitoring) and that it is not clear whether this list is intended to
be exhaustive or not (i.e., whether written corrective action
procedures are required in only these two circumstances, or whether
there may be other circumstances that require written corrective action
procedures). These comments ask us to insert ``but are not limited to''
after ``must include'' if we intend that the list is not exhaustive.
Likewise, other comments state our proposal to specifically require
corrective action procedures may result in a misunderstanding by some
facilities about the need to take corrective actions in circumstances
other than in response to testing results, other non-conformances, or
other types of verification activities. These comments assert that it
would be better for food safety if the regulatory requirements took a
more principled approach and generally required corrective action
procedures, with the importance of corrective action procedures for
testing programs addressed through guidance. If, however, we conclude
that specific requirements for corrective action procedures for testing
programs are necessary, these comments ask us to clarify that the
nature and extent of any corrective actions should be proportional to
the nature of the test findings.
    (Response 469) We have revised the regulatory text, with associated
editorial revisions and redesignations, to clarify that the specified
list of corrective action procedures is not intended to be exhaustive
(i.e., not limited to the two corrective action procedures that we
specified in the proposed human preventive controls rule). The approach
we used in the modified regulatory text (i.e., ``You must establish and
implement written corrective action procedures . . ., including
procedures to address, as appropriate . . .'' is similar to the
approach used in several other provisions of the rule. (See, e.g.,
requirements for allergen controls (Sec.  117.135(c)(2)); sanitation
controls (Sec.  117.135(c)(3)(i)); and monitoring (Sec.  117.145(a).)
We decline the suggestion to modify the regulatory text by adding ``but
is not limited to'' after ``includes.'' The word ``includes'' does not
need to be followed by ``but is not limited to'' to clearly communicate
that a following list is not complete. (See Response 68.) We agree that
the nature and extent of any corrective actions in response to the
findings of testing programs should be proportional to nature of the
test findings. (See Response 470.)
    (Comment 470) Some comments state that the nature and extent of the
corrective actions should be proportional to the nature of the testing
results. These comments ask us to require that a facility establish and
implement corrective action procedures that must be taken if preventive
controls are not properly implemented as appropriate to the nature of
the hazard, the nature of the control measure, and the extent of the
deviation.
    (Response 470) We have revised the regulatory text to specify that
the corrective action procedures are established and implemented based
on the nature of the hazard in addition to the nature of the preventive
control. We agree that the nature of the hazard plays a key role in the
corrective actions that a facility would take. Although a facility's
corrective action procedures likely would specify actions to take based
on the extent of the deviation, we consider this a detail that does not
need to be specified in the rule.
    (Comment 471) Some comments ask us to revise the provisions to
clarify that corrective action procedures are not always necessary when
testing detects the presence of a pathogen or indicator organism. These
comments assert that the extent of the corrective actions should be
proportional to the nature of the testing results themselves because
the level of contamination matters for those microorganisms with
thresholds that need to be taken into account and because the location
of contamination in the food processing environment matters (e.g., the
zone in the facility where the contamination is detected). (For
information about zones associated with environmental monitoring, see
78 FR 3646 at 3816.)
    (Response 471) We decline this request. These comments appear to be
confusing the requirement to establish and implement corrective action
procedures with the content of the corrective action procedures. These
comments also appear to assume that a requirement to have corrective
action procedures (which describe the steps to be taken to ensure that
appropriate action is taken to identify and correct a problem and, when
necessary, to reduce the likelihood that the problem will recur; that
all affected food is evaluated for safety; and that all affected food
is prevented from entering into commerce when appropriate) pre-
determines the outcome of following the corrective action procedures.
This is not the case. If, as the comments assert, a facility concludes,
for example, that the nature of some test results do not warrant steps
to reduce the likelihood that the problem will recur and that affected
food is safe and lawful (or, in the case of finding a pathogen in some
zones in the facility, that no food is affected), then that is what its
corrective action procedures would say. The reason to have corrective
action procedures is to consider the likely scenarios in advance, with
appropriate input from the facility's food safety team and preventive
controls qualified individual, rather than react to these scenarios on
an ad hoc basis.
    (Comment 472) Some comments ask us to require that corrective
actions include an analysis to determine the root cause of a problem,
not only identify it. These comments also ask us to require follow-up
actions to ensure the corrective action was effective and assert that
although the requirements address the need to reanalyze the food safety
plan they do not appear to specifically address a review of the
corrective action.
    (Response 472) The requests of these comments do not require any
revisions to the regulatory text. The rule does not use the term ``root
cause'' but it does require the facility to take appropriate action,
when necessary, to reduce the likelihood that the problem will recur
(see Sec.  117.150(a)(2)(ii)). Root cause analysis is simply part of a
common approach to complying with this requirement. (Knowing the root
cause is key to reducing the likelihood that a problem will happen
again.) The rule also requires a review of records of corrective
actions, but does so as a verification activity rather than as part of
the corrective action procedures (see Sec.  117.165(a)(4)).
    (Comment 473) Some comments ask us to revise the proposed rule to
address corrective actions in a more general way and then outline areas
where specific corrective action procedures would be helpful, such as
for testing programs, in guidance.
    (Response 473) The proposed provisions do not prescribe the outcome
of the corrective action procedures, but merely direct the facility to
the types of actions that the procedures must address. In essence, the
proposed provisions already do, as the comments request, address
corrective actions in a general way.
    (Comment 474) Some comments ask us to specify that the requirements
also apply when a preventive control is found to be ineffective.
    (Response 474) We have not revised the regulatory text as requested
by these comments. The appropriate action when a preventive control is
found to be ineffective is to reanalyze the food safety plan and to
establish and implement a preventive control that is effective, not
follow a corrective action procedure. A corrective action

procedure is intended to address a problem that happens when following
the procedures in a food safety plan that previously was verified to be
valid, not to fix problems on an ongoing basis when a preventive
control is ineffective (and, thus, the food safety plan is not valid).
We agree that some of the steps that apply to corrective actions may
need to be taken, such as evaluating affected food for safety and
ensuring that adulterated food does not enter commerce. This is
addressed by the provisions for corrective actions in the event of an
unanticipated problem (Sec.  117.150(b)(1)(ii)), which require specific
corrective actions to be taken (Sec.  117.150(b)(2)).

B. Proposed Sec.  117.150(a)(2)--Content of Corrective Action
Procedures

    We proposed that corrective action procedures must describe the
steps to be taken to ensure that: (1) Appropriate action is taken to
identify and correct a problem that has occurred with implementation of
a preventive control; (2) appropriate action is taken to reduce the
likelihood that the problem will recur; (3) all affected food is
evaluated for safety; and (4) all affected food is prevented from
entering into commerce, if you cannot ensure that the affected food is
not adulterated under section 402 of the FD&C Act or misbranded under
section 403(w) of the FD&C Act.
    (Comment 475) Some comments assert that the corrective action
procedures should not consider food to be ``affected'' if it is
immediately subjected to an additional (or repeat) preventive control
after determining that the initial preventive control was not properly
implemented. These comments discuss an example in which there is a
temperature deviation below accepted parameter limits for a given
process, and the incorrectly processed product is re-processed
correctly, and assert that it would be illogical to consider the food
to be ``affected'' in this circumstance. Other comments ask us to
modify the requirements to specify that they apply to all affected food
``if any.''
    (Response 475) We decline the request to modify the regulatory text
to specify that the requirements apply to all affected food ``if any.''
Food is ``affected'' if a preventive control is not properly
implemented during its production. However, the rule does not pre-
determine the consequences when food is ``affected.'' Instead, the rule
requires the facility to evaluate the affected food for safety. If, as
in the example described by the comments, the facility re-applies the
preventive control such that the food is safe and is not adulterated
under section 402 of the FD&C Act or misbranded under section 403(w) of
the FD&C Act, there would be no need to take steps to prevent that food
from entering commerce.
    (Comment 476) Some comments assert that the proposed regulatory
text could be misunderstood as a requirement to establish a new
preventive control after implementing a corrective action procedure.
These comments also assert that it would be inappropriate to assume
that corrective action procedures always correct a problem with the
implementation of a new or additional preventive control.
    (Response 476) We received these comments before we issued the 2014
supplemental human preventive controls notice. The proposed regulatory
text in the 2014 supplemental human preventive controls notice
addresses the issues identified in these comments by clearly separating
the requirement to take appropriate action to identify and correct a
problem that has occurred from the requirement to take appropriate
action, when necessary, to reduce the likelihood that the problem will
recur.
    (Comment 477) Some comments ask us to provide that requirements for
corrective actions be principle-based (e.g., containment of affected
product, control restored to operation before commencing production)
rather than prescriptive.
    (Response 477) The requirements for corrective actions established
by this rule are principle-based in that they require the facility to
describe the steps that it will take rather than prescribe the steps
that it will take.
    (Comment 478) Some comments ask us to revise the provision to make
re-sampling and/or re-testing one of the first steps in a corrective
action procedure to take into account human error. These comments
assert that mishandling during sampling, transport, and testing can
contribute to a false positive result and that if the results of a
follow-up test are negative, then the previous test could be considered
an anomaly that could be ignored.
    (Response 478) We decline this request. We disagree that an
appropriate approach to positive findings of a test for contamination
is to re-sample and re-test and to consider positive findings to be an
anomaly if subsequent test results are negative. Many food products are
not homogeneous and contamination is localized. Even for homogeneous
food products (such as fluids), the problem could be the sensitivity of
the method if the level of contamination is low. See our guidance
entitled ``Guidance for Industry: Testing for Salmonella Species in
Human Foods and Direct-Human-Contact Animal Foods'' (Ref. 82).

C. Proposed Sec.  117.150(b)--Corrective Action in the Event of an
Unanticipated Problem

    With some exceptions, we proposed that you must take corrective
action to identify and correct a problem, reduce the likelihood that
the problem will recur, evaluate all affected food for safety, and, as
necessary, prevent affected food from entering commerce as would be
done following a corrective action procedure if any of the following
circumstances apply: (1) A preventive control is not properly
implemented and a specific corrective action has not been established;
(2) a preventive control is found to be ineffective; or (3) a review of
records finds that the records are not complete, the activities
conducted did not occur in accordance with the food safety plan, or
appropriate decisions were not made about corrective actions. We also
proposed that if any of these circumstances apply, when appropriate you
must reanalyze the food safety plan to determine whether modification
of the food safety plan is required.
    (Comment 479) Some comments ask us to delete the proposed
requirement that a facility must reanalyze the food safety plan in the
event of an unanticipated problem. These comments argue that FSMA does
not specify reanalysis in the event of an unanticipated problem. In
addition, these comments assert that the proposed requirement for
reanalysis in the event of an unanticipated problem would be redundant
with the proposed requirements for reanalysis as a verification
activity (proposed Sec.  117.170) and would not add value for food
safety. These comments also assert that the term ``problem'' is
ambiguous and ask us to replace ``problem'' with ``food safety issue''
if we retain the provision in the final rule.
    (Response 479) We acknowledge that section 418 of the FD&C Act does
not explicitly specify that a facility must reanalyze its food safety
plan in the event of an unanticipated problem. However, as previously
discussed, requiring reanalysis of the food safety plan after an
unanticipated problem is consistent with the NACMCF HACCP guidelines,
the Codex HACCP Annex, and Federal HACCP regulations for seafood,
juice, and meat and poultry (78 FR 3646 at 3752). In the 2014
supplemental human preventive controls notice, we clarified that
reanalysis would be conducted ``when appropriate.'' For example, if a
problem

occurs because personnel did not understand the procedures or carry out
the procedures correctly, additional training for applicable personnel
may be warranted, but there likely would be no need to reanalyze the
food safety plan.
    We disagree that the term ``problem'' is ambiguous. The term
``problem'' signifies that something is wrong, whereas the term
suggested by the comments (i.e., ``issue'') may or may not signify that
something is wrong. The analogous provisions in the NACMCF HACCP
guidelines (Ref. 34), the Codex HACCP Annex (Ref. 35), and Federal
HACCP regulations for seafood, juice, and meat and poultry is
``deviation.'' We avoided the term ``deviation'' because ``deviation''
has the potential to signify that the requirements of this rule for
corrective actions only apply when a preventive control is at a CCP,
which is not the case. We agree that the requirements are directed to
problems related to food safety, and in the 2014 supplemental human
preventive controls notice we modified the title of the requirement to
be ``Corrective action in the event of an unanticipated food safety
problem.'' However, we continue to use the simpler term ``problem'' in
the remainder of the regulatory text. Specifying that the nature of the
problem is ``food safety'' in the title is sufficient to focus the
requirement on food safety.
    We agree that there is a relationship between the requirements for
corrective actions in the event of an unanticipated food safety problem
and the requirements for reanalysis. To reduce redundant regulatory
text, in the 2014 supplemental human preventive controls notice we
proposed to modify the regulatory text of the requirements for
reanalysis to specify that reanalysis is required when appropriate
after an unanticipated food safety problem, and we are establishing
that modified provision in this final rule. Importantly, the provisions
for reanalysis continue to require reanalysis when a preventive control
is found to be ineffective. We are not aware of any circumstances in
which it would not be appropriate to reanalyze the food safety plan if
a preventive control is found to be ineffective.
    (Comment 480) Some comments assert that the word ``specific'' is
not appropriate as a modifier for ``corrective action procedure''
because many preventive controls will have corrective action procedures
that allow flexibility based on the nature of the hazard and control.
These comments also state that the term ``specific'' in this context is
more appropriate for a CCP control in a HACCP system.
    (Response 480) We have revised the regulatory text to delete the
word ``specific.''
    (Comment 481) Some comments ask us to emphasize that reanalysis is
required only when a combination of two events occurs (i.e., a
preventive control is not properly implemented, and the facility has
not established a corrective action procedure).
    (Response 481) In the 2014 supplemental human preventive controls
notice, we proposed revisions to the regulatory text to clearly specify
the circumstances requiring reanalysis. One such circumstance is when a
preventive control is not properly implemented and a corrective action
procedure has not been established (Sec.  117.150(b)(1)(i)). The final
provision includes the revisions included in the 2014 supplemental
human preventive controls notice and is consistent with the request of
these comments.
    (Comment 482) Some comments ask us to add that corrective actions
in the event of an unanticipated problem also apply when a preventive
control is ``missing.''
    (Response 482) We have revised the regulatory text to require
corrective actions whenever a preventive control, combination of
preventive controls, or the food safety plan as a whole, is
ineffective. (See Sec.  117.150(b)(1)(ii).) In assessing what the
comment might mean by a preventive control that is ``missing,'' we
concluded that an unanticipated problem could, in some cases, mean that
a combination of preventive controls, or the facility's food safety
plan as a whole (rather than a single preventive control), simply was
not effective. If this is the case, reanalysis would be appropriate,
and we also have modified the requirements for reanalysis to specify
that a facility must reanalyze its food safety plan whenever it finds
that a preventive control, combination of preventive controls, or the
food safety plan as a whole is ineffective. (See also Response 556.)
    (Comment 483) Some comments assert that fresh and fresh-cut produce
operations are unlikely to prevent recurrence of occasional detections
of human pathogens (particularly L. monocytogenes, which is a soil
microorganism whose normal habitat is in the field) because there is no
``kill step'' for pathogens and because the source of contamination may
not be identified. These comments point out that we recognize that
preventive controls may only be able to ``significantly minimize''
significant hazards and assert that our acknowledgement that preventive
controls may not always be able to prevent significant hazards is
inconsistent with an expectation to prevent recurrence.
    (Response 483) We disagree that our acknowledgement that preventive
controls may not always be able to prevent significant hazards is
inconsistent with an expectation to prevent recurrence. Even when a
preventive control is not always able to prevent a hazard requiring a
preventive control, it can reduce the likelihood that the hazard will
adulterate the food within the meaning of section 402 of the FD&C Act
or misbrand the food within the meaning of section 403(w) of the FD&C
Act. For example, a facility processing fresh-cut produce can reduce
the likelihood of contamination of incoming fresh produce with L.
monocytogenes through enhanced supply-chain controls for incoming fresh
produce, along with appropriate sanitation controls. As discussed in
Response 470, we have revised the regulatory text to specify that the
corrective action procedures are established and implemented based on
the nature of the hazard in addition to the nature of the preventive
control, because the nature of the hazard plays a key role in the
corrective actions that a facility would take. When a preventive
control is not able to prevent a hazard, the facility must focus on
minimizing the hazard.
    (Comment 484) Some comments ask us to replace the term
``reanalyze'' with the term ``reassess.''
    (Response 484) We decline this request. See Response 551.

D. Proposed Sec.  117.150(c)--Corrections

    We proposed that you do not need to comply with the requirements
for corrective actions and corrections for conditions and practices
that are not consistent with specified food allergen controls or
sanitation controls if you take action, in a timely manner, to correct
such conditions and practices.
    (Comment 485) Some comments support our proposal to provide for
corrections, rather than corrective actions, for sanitation controls
and some food allergen controls in some circumstances. Other comments
assert that situations in which ``corrections'' can be applied are not
limited to sanitation and food allergen controls and could include
actions to address other preventive controls such as preventive
maintenance controls or CGMPs. As discussed in Comment 164, some
comments emphasize the importance of distinguishing between the terms
``correction'' and ``corrective action.''

    (Response 485) We have revised the regulatory text, with associated
editorial revisions and redesignations, to provide for corrections,
rather than corrective actions and corrective action procedures, for
minor and isolated problems that do not directly impact product safety.
As discussed in Response 164, we also have defined the term
``correction'' to mean an action to identify and correct a problem that
occurred during the production of food, without other actions
associated with a corrective action procedure (such as actions to
reduce the likelihood that the problem will recur, evaluate all
affected food for safety, and prevent affected food from entering
commerce).

E. Proposed Sec.  117.150(d)--Records

    We proposed that all corrective actions (and, when appropriate,
corrections) must be documented in records and that these records are
subject to the verification requirements in Sec. Sec.  117.155(a)(3)
and 117.165(a)(4)(i). We received no comments that disagreed with this
proposed requirement and are finalizing it as proposed.

XXXII. Subpart C: Comments on Proposed Sec.  117.155--Verification

    In the 2013 proposed human preventive controls rule, we proposed
verification activities that would include validation, verification of
monitoring, verification of corrective actions, verification of
implementation and effectiveness, written procedures, reanalysis, and
documentation of all verification activities. We also requested comment
on whether we should specify the verification activities that must be
conducted for verification of monitoring (78 FR 3646 at 3756) and for
verification of corrective actions (78 FR 3646 at 3756), and if so,
what verification activities should be required.
    To improve clarity and readability, in the 2014 supplemental human
preventive controls notice we proposed to move the more extensive
verification requirements for validation, implementation and
effectiveness, and reanalysis from the single proposed section
(proposed Sec.  117.150) to separate sections (proposed Sec. Sec.
117.160, 117,165, and 117.170, respectively). In addition, to address
comments that asked us to provide more flexibility to facilities,
including flexibility in determining whether and how to conduct
verification activities, in the 2014 supplemental human preventive
controls notice we proposed that the verification activities be
performed ``as appropriate to the preventive control.''
    In this section, we discuss the proposed requirements for
verification of monitoring, verification of corrective actions, and
documentation of verification activities. See sections XXXIII through
XXXV for comments on the proposed requirements for validation,
verification of implementation and effectiveness, written procedures,
and reanalysis. See table 37, table 38, and table 39 for a summary of
the revisions to those proposed requirements.
    Some comments support the proposed requirements for verification of
monitoring, verification of corrective actions, and documentation of
verification activities without change. For example, comments support
the documentation of verification activities (see section XXXII.C). In
the following paragraphs, we discuss comments on the flexibility
provided for a facility to conduct verification activities as
appropriate to the nature of the preventive control. We also discuss
comments that address our request for comment on whether we should
revise the regulatory text to specify the verification activities that
must be conducted for verification of monitoring and for verification
of corrective actions, or express concern that the requirements as
proposed are too prescriptive. After considering these comments, we
have revised the verification requirements described in Sec.  117.155
as shown in table 36.

    Table 36--Revisions to the Proposed Requirements for Verification
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.155.......................  Flexibility to     Provide that
                                 conduct            verification
                                 verification       activities take into
                                 activities.        account both the
                                                    nature of the
                                                    preventive control
                                                    and its role in the
                                                    facility's food
                                                    safety system.
------------------------------------------------------------------------

A. Flexibility in Requirements for Verification

    (Comment 486) Some comments support the flexibility provided by use
of the phrase ``as appropriate to the preventive control'' in the
requirement that verification activities must include, as appropriate
to the preventive control, specified verification activities (i.e.,
validation, verification that monitoring is being conducted,
verification that appropriate decisions about corrective actions are
being made, verification of implementation and effectiveness, and
reanalysis). These comments emphasize that verification activities must
be tailored to the preventive control and assert that the use of the
word ``must'' is potentially confusing in light of this flexibility--
e.g., because not all preventive controls must be validated for food
safety, and those preventive controls that do not need monitoring would
not need verification of monitoring. Other comments ask us to allow
facilities flexibility to verify that preventive controls are effective
in the manner prescribed by FSMA--i.e., such controls should be deemed
to be effective by an appropriate means as determined and supported by
the facility within its food safety plan.
    (Response 486) The provisions for preventive control management
components make clear that all preventive control management
components, including verification, are required as appropriate to
ensure the effectiveness of the preventive control, taking into account
the nature of the preventive control and its role in the facility's
food safety system (see Sec.  117.140). Likewise, the provisions for
each of the preventive control management components (i.e., monitoring,
corrective actions and corrections, and verification) individually
provide flexibility, either by specifying that the provisions apply as
appropriate to the nature of the preventive control and its role in the
facility's food safety system (i.e., for monitoring and verification)
or both the nature of the preventive control and the nature of the
hazard (i.e., for corrective actions and corrections). The word
``must'' specifies the type of activities that a facility can use to
satisfy the requirements for a particular preventive control management
component.
    We are retaining the term ``must.'' However, we agree that the rule
should provide flexibility for additional verification of
implementation and effectiveness. To provide that additional
flexibility, we have revised the specific requirements for verification
of implementation and effectiveness to provide for other activities
appropriate

for verification of implementation and effectiveness (see Sec.
117.165(a)(5)). As a conforming revision, we have revised the
requirement for review of records to include a review of records of
``other verification activities'' within a reasonable time after the
records are created (see Sec.  117.165(a)(4)(ii)).

B. Proposed Sec.  117.155(a)--Verification Activities

1. Proposed Sec.  117.155(a)(1)--Validation
    We proposed that verification activities must include, as
appropriate to the preventive control, validation in accordance with
Sec.  117.160. See section XXXIII for comments on validation as a
verification activity.
2. Proposed Sec.  117.155(a)(2)--Verification of Monitoring
    We proposed that verification activities must include, as
appropriate to the preventive control, verification that monitoring is
being conducted in accordance with Sec.  117.145. We requested comment
on whether we should specify the verification activities that must be
conducted for monitoring, and, if so, what verification activities
should be required.
    (Comment 487) Comments that address our request for comment on
whether we should specify the verification activities that must be
conducted for monitoring ask us to not do so because this prescriptive
approach would be too limiting. These comments ask us to instead
provide flexibility for the facility to determine the appropriate
verification activities.
    (Response 487) We agree that we should provide flexibility for the
facility to determine these verification activities, and are not
specifying the verification activities that must be conducted for
monitoring.
    (Comment 488) Some comments express concern that the proposed
requirements for verification of monitoring would bring food CGMPs to
the same level as pharmaceutical CGMPs. These comments assert that our
example of how verification of monitoring could be conducted when a
metal detector is a preventive control is impractical (FR 3646 at
3756). These comments explain that a quality control officer is not
likely to go out onto the plant floor every shift to verify the
operator's metal detector readings but would instead document the metal
detector readings, which would be captured as part of the batch record
review. These comments suggest that a more appropriate description of
what a facility would do when a metal detector is a preventive control
would be to ``check'' whether the metal detector is rejecting test
pieces of metal.
    (Response 488) We are establishing the requirements for
verification of monitoring as part of a system for hazard analysis and
risk-based preventive controls, not as a matter of CGMP. As previously
discussed (78 FR 3646 at 3756), verification of monitoring is
consistent with the FSIS HACCP regulation for meat and poultry, which
requires direct observations of monitoring activities as an ongoing
verification activity (9 CFR 417.4(a)(2)(ii)). We disagree that our
example of how verification of monitoring could be conducted when a
metal detector is a preventive control is impractical; observation of
the operator conducting the check with test pieces by a supervisor, or
having a quality assurance person run a test, is not uncommon. However,
in the 2014 supplemental human preventive controls notice, we clarified
that verification that monitoring is being conducted is required as
appropriate to the preventive control. With this added flexibility, a
facility could, for example, determine that it would satisfy the
requirement for verification of monitoring by reviewing records under
Sec.  117.165(a)(4). Doing so would be consistent with the NACMCF HACCP
guidelines (Ref. 35), the Codex HACCP guidelines (Ref. 34), and FDA's
HACCP regulations for seafood and juice, which all address verification
of monitoring through the review of records (78 FR 3646 at 3756).
3. Proposed Sec.  117.155(a)(3)--Verification of Corrective Actions
    We proposed that verification activities must include, as
appropriate to the preventive control, verification that appropriate
decisions about corrective actions are being made in accordance with
Sec.  117.150. We requested comment on whether this section should
specify the verification activities that must be conducted for
corrective actions, and if so, what verification activities should be
required.
    (Comment 489) Some comments ask us not to specify the verification
activities that must be conducted for corrective actions because this
approach would be too limiting. These comments ask us to instead
provide flexibility for the facility to determine the appropriate
verification activities.
    (Response 489) We agree that we should provide flexibility for the
facility to determine the appropriate verification activities for
corrective actions, and are not specifying the verification activities
that must be conducted for corrective actions.
4. Proposed Sec.  117.155(a)(4)--Verification of Implementation and
Effectiveness
    We proposed that verification activities must include, as
appropriate to the preventive control, verification of implementation
and effectiveness in accordance with Sec.  117.165. See section XXXIV
for comments on verification of implementation and effectiveness.
5. Proposed Sec.  117.155(a)(5)--Reanalysis
    We proposed that verification activities must include, as
appropriate to the preventive control, reanalysis in accordance with
Sec.  117.170. See section XXXV for comments on reanalysis as a
verification activity.

C. Proposed Sec.  117.155(b)--Documentation of Verification Activities

    We proposed that all verification activities must be documented in
records. We received no comments that disagreed with this proposed
requirement and are finalizing it as proposed.

D. Comments on Potential Requirements Regarding Complaints

    We requested comment on whether and how a facility's review of
complaints, including complaints from consumers, customers, or other
parties, should be required as a component of its activities to verify
that its preventive controls are effectively minimizing the occurrence
of hazards (78 FR 3646 at 3768).
    (Comment 490) Some comments ask us to require review of consumer
complaints as a verification activity and note that our HACCP
regulations for seafood and juice require that verification activities
include a review of consumer complaints to determine whether they
relate to the performance of the HACCP plan or reveal the existence of
unidentified CCPs. Some comments note circumstances in which consumer
complaints have identified food safety problems that resulted in a
company report to the RFR.
    Some comments state that the frequency and type of complaints a
facility receives is a very good indicator of the underlying issues
associated with food production, reviewing these records would provide
valuable insight into the type of issues that should be investigated,
and this type of verification activity could be therefore be extremely
effective with little to no cost because the facility would already be
performing this type of activity. Some comments state that many

foodborne outbreaks have been identified through complaints and a
review of complaints is a critical component of a food safety system.
    Other comments state that a food safety review of complaints is a
prudent part of a food safety program but that the value of such a
review is in providing information and feedback for continuous
improvement of the food safety management system rather than as a
verification of preventive controls. These comments caution against use
of consumer complaints as a regulatory requirement for verification of
the food safety plan because most complaints relate to product quality.
If such a requirement is nonetheless established in the final rule,
these comments recommend that the rule only require follow-up and
documentation for the rare occurrences where consumer complaints relate
to food safety issues.
    Other comments ask us not to require review of complaints as a
verification activity. Some of these comments assert that complaints
rarely relate to food safety or yield information that leads to
discovery of a food safety issue. Some comments assert that requiring
review of consumer complaints could result in unnecessary time and
effort being spent on an activity with a limited correlation to food
safety. Other comments assert that complaints would be acted upon
immediately for business reasons, and that waiting to react to
complaints until conducting a review of records as a verification
activity would be too late. Other comments assert that complaints are
sensitive business information. Other comments assert that some
consumer complaints are false or emotional (rather than factual) and
have no place in development of preventive controls. Some comments
assert that FSMA does not expressly direct us to require review of
complaints. Some comments assert that review of complaints is not a
precise scientific process, and that consumer comments are often open
to different interpretations.
    (Response 490) We are not establishing a requirement for a review
of complaints as a verification activity. We agree that review of
complaints is more likely to be useful in providing information and
feedback for continuous improvement of the food safety system rather
than as a verification of preventive controls. However, we encourage
facilities to do such a review, as they occasionally do uncover food
safety issues such as an undeclared allergen.

XXXIII. Subpart C: Comments on Proposed Sec.  117.160--Validation

    We proposed to establish requirements for validation of preventive
controls. Some comments support the proposed requirements without
change. For example, some comments agree that validation must be
performed by (or overseen by) a preventive controls qualified
individual and that some preventive controls (e.g., food allergen
controls, sanitation controls, and recall plans) do not require
validation. Some comments that support the proposed provisions suggest
alternative or additional regulatory text (see, e.g., Comment 491,
Comment 500, Comment 501, Comment 503, and Comment 513) or ask us to
clarify how we will interpret the provision (see, e.g., Comment 499,
Comment 502, and Comment 508).
    In the following paragraphs, we discuss comments that ask us to
clarify the proposed requirements or that disagree with, or suggest one
or more changes to, the proposed requirements. After considering these
comments, we have revised the proposed requirements as shown in table
37, with editorial and conforming changes as shown in table 52.

     Table 37--Revisions to the Proposed Requirements for Validation
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.160(a)....................  Flexibility for    Provide that
                                 validating         validation be
                                 preventive         conducted as
                                 controls.          appropriate to both
                                                    the nature of the
                                                    preventive control
                                                    and its role in the
                                                    facility's food
                                                    safety system.
117.160(b)(1).................  Circumstances      Provide that, when
                                 requiring          necessary to
                                 validation.        demonstrate the
                                                    control measures can
                                                    be implemented as
                                                    designed, validation
                                                    may be performed:
                                                    (1) Within 90 days
                                                    after production of
                                                    the applicable food
                                                    first begins; or (2)
                                                    within a reasonable
                                                    timeframe, provided
                                                    that the preventive
                                                    controls qualified
                                                    individual prepares
                                                    (or oversees the
                                                    preparation of) a
                                                    written
                                                    justification.
117.160(b)(1).................  Circumstances      Add an additional
                                 requiring          circumstance
                                 validation.        requiring
                                                    validation--i.e.,
                                                    whenever a change to
                                                    a control measure or
                                                    combination of
                                                    control measures
                                                    could impact whether
                                                    the control measure
                                                    or combination of
                                                    control measures,
                                                    when properly
                                                    implemented, will
                                                    effectively control
                                                    the hazards
                                                    requiring a
                                                    preventive control.
117.160(c)....................  Preventive         Clarify that a list
                                 controls that do   of preventive
                                 not require        controls that do not
                                 validation.        require validation
                                                    is not an exhaustive
                                                    list.
------------------------------------------------------------------------

A. Flexibility in the Requirements To Validate Preventive Controls

    With some exceptions (see discussion of proposed Sec.
117.160(b)(3) in section XXXIII.D), we proposed that you must validate
that the preventive controls identified and implemented in accordance
with proposed Sec.  117.135 to control the significant hazards are
adequate to do so (proposed Sec.  117.160(a)).
    (Comment 491) Some comments assert that the regulatory text is in
conflict with the preamble discussion in the 2014 supplemental human
preventive controls notice because the regulatory text (i.e.,
``[e]xcept as provided by . . .'') narrowly provides exceptions only
for validation of food allergen controls, sanitation controls, supplier
controls, and the recall plan, whereas the preamble discussion provides
other examples of preventive controls that would not require validation
(i.e., zoning, training, preventive maintenance, and refrigerated
storage). These comments also assert that although the regulatory text
specifies that validation requirements apply ``as appropriate to the
nature of the preventive control,'' that phrase could be interpreted to
mean that only the validation act itself can be tailored and that the
facility does not have the flexibility to conclude that validation
isn't necessary.
    Some comments assert that the proposed regulatory text would
prevent us from requiring validation of specific allergen or sanitation
controls where it may be prudent to do so, either now or in the future
as a result of a newly

identified hazard, establishment of regulatory allergen threshold(s),
or the development of a tool, such as a test method, that would enable
validation of the control for the specific hazard.
    (Response 491) We have deleted ``except as provided by paragraph
(b)(3) of this section'' from proposed Sec.  117.160(a) to remove the
limitation seen by the comments on the exceptions to the requirement
for validation of preventive controls. We also have revised the
regulatory text of Sec.  117.160(c) to provide that a facility does not
need to validate other preventive controls, if the preventive controls
qualified individual prepares (or oversees the preparation of) a
written justification that validation is not applicable based on
factors such as the nature of the hazard, and the nature of the
preventive control and its role in the facility's food safety system.
We specified that the determination that validation is not required
must be made by the preventive controls qualified individual to
emphasize that specialized experience is necessary to evaluate whether
validation is required. We made a conforming revision to the list of
responsibilities of the preventive controls qualified individual (see
Sec.  117.180(a)).
    (Comment 492) Some comments ask us to separate requirements for
validation from requirements for verification because verification and
validation are two different concepts and combining them is confusing.
Some comments point out that while section 418(f)(1) of the FD&C Act
explicitly requires verification, it does not require validation. Some
of these comments assert that our proposed requirements for validation
exceed the mandate of FSMA while others argue that the lack of explicit
language in section 418 of the FD&C Act gives us legal flexibility in
determining whether and how to require validation.
    (Response 492) Our approach is consistent with section 418 of the
FD&C Act. Section 418(f)(1) of the FD&C Act requires verification of
the preventive controls, and validation is an element of verification
(see both the NACMCF HACCP guidelines (Ref. 35) and our HACCP
regulation for juice (Sec.  120.3(p)). We agree that the purpose of
validation is different from the purpose of other verification
activities, and we have revised the definitions of both terms to make
this clearer. Although we are establishing a separate regulatory
section for the validation requirements, we did so to improve clarity
and readability rather than as a substantive change relevant to the
issues discussed in these comments (See Response 150).
    (Comment 493) Some comments assert that validation is more
appropriate for a HACCP regulation and that requiring the validation of
all preventive controls does not reflect the flexibility mandated by
section 418(n)(3)(A) of FSMA. Other comments assert that effective
preventive measures may be identified in the future that are not
amenable to validation and it would be counterproductive for them not
to be employed in food safety plans because they cannot meet the
validation requirements. These comments explain that certain control
measures are not suitable for validation activities due to the nature
of the activity or previous validation by another entity (e.g., a
supplier).
    (Response 493) The 2013 proposed human preventive controls rule
would not have required the validation of all preventive controls. For
example, we specifically proposed that the validation of preventive
controls need not address food allergen controls, sanitation controls,
and the recall plan. To emphasize that a facility has flexibility in
appropriately determining which other preventive controls require
validation, in the 2014 supplemental human preventive controls notice
we revised the proposed regulatory text to require validation ``as
appropriate to the nature of the preventive control.'' See (Response
491 for additional revisions we have made to the regulatory text to
provide flexibility for a facility to determine that validation is not
necessary.
    (Comment 494) Some comments ask us to allow validation of the whole
system instead of individual controls.
    (Response 494) See the discussion of the definition of validation
in Response 150. Under the definition, validation can be directed to a
control measure, combination of control measures, or the food safety
plan as a whole.
    (Comment 495) Some comments ask us to align validation requirements
with the relative risk of operations.
    (Response 495) Validation requirements apply only to preventive
controls that are established and implemented based on the outcome of a
hazard analysis, which requires consideration of risk. We also require
validation as appropriate to the nature of the preventive control and
its role in the facility's food safety system. This provides
flexibility with respect to validation and allows consideration of
risk.
    (Comment 496) Some comments ask whether we will endorse
certification under GFSI as satisfying the requirements for validation.
    (Response 496) GFSI was established to support improvements in food
safety management systems to ensure confidence in the delivery of safe
food to consumers worldwide (Ref. 83). GFSI has developed a guidance
document that specifies a process by which food safety schemes may gain
recognition by GFSI, the requirements to be put in place for a food
safety scheme seeking recognition by GFSI, and the key elements for
production of safe food or feed, or for service provision (e.g.,
contract sanitation services or food transportation), in relation to
food safety (Ref. 83). We have no plans to endorse certification under
GFSI (or any other standard setting organization) as satisfying the
requirements for validation. However, to the extent that scientific and
technical information available from GFSI or another standard setting
organization provides evidence that a control measure, combination of
control measures, or the food safety plan as a whole is capable of
effectively controlling the identified hazards, a facility may use such
information to satisfy the validation requirements of the rule.
    (Comment 497) Some comments ask us to provide guidance and
clarification on topics relevant to validation, such as commodity-
specific guidance to help facilities understand what preventive
controls are capable of being validated and to design testing to ensure
validation conditions always exceed conditions during production. Some
comments ask us to clarify our expectations for a validated process and
on conducting studies for validation purposes, particularly for
preventive controls applied to fresh and fresh-cut produce (such as
reduction of pathogens in wash water for fresh-cut leafy greens with
the use of sanitizers, which the comments characterize as
scientifically difficult and time consuming). Some comments ask us to
provide resources for validation, noting that some preventive controls
will be difficult to validate and that no scientific research or data
are available for certain controls. Some comments ask us to delay
enforcement for the validation requirements until a readily accessible
repository of validated processes, and scientific and technical
information, can be created to assist stakeholders in complying with
the validation requirements.
    (Response 497) We intend that the guidance we are developing will
address topics such as those recommended in the comments. (See Response
2.) In addition, there is a ``wash water validation group'' with
members from government (including

FDA, USDA and CDC) and industry (including producers, chemical
suppliers, and equipment suppliers) developing information on how to
validate the efficacy of antimicrobial chemicals in wash water for
fresh-cut produce processes to demonstrate that the antimicrobials in
the washing process are effective for minimizing the risk of cross-
contamination. The FSPCA and the Produce Safety Alliance (PSA) are
developing information for training, which may be useful to facilities,
including facilities that process produce. We are not requiring
facilities to comply with the rule, including the validation
requirements, for 1, 2, or 3 years depending on the size of the
facility. We expect that segments of the food industry will work
together and with the FSPCA and the PSA to develop scientific and
technical information that can be used as evidence to validate a
variety of preventive controls, and that this information will be
helpful to facilities.
    (Comment 498) Some comments ask us to develop a mechanism for
industry to make sure their approach and studies meet the requirements
of the rule, such as certification of process authorities or the
establishment of a liaison between FDA and industry to ensure
validation protocols are in compliance.
    (Response 498) As discussed in Response 2, we are developing
several guidance documents within FDA, including guidance on
validation. In addition, as part of a collaborative effort with the
FSPCA we are obtaining technical information useful for developing
commodity/industry sector-specific guidelines for preventive controls
and outreach to industry, and we intend that effort to include guidance
on approaches to satisfy the validation requirements of the rule. We do
not intend to develop a mechanism for certification of process
authorities or establish a liaison between FDA and industry to ensure
validation protocols are in compliance. The guidance we are developing
on validation should help industry determine whether their validation
approaches are likely to be acceptable to us.

B. Proposed Sec.  117.160(b)(1)--When Validation Must Be Performed and
Role of the Preventive Controls Qualified Individual in Validation

    We proposed that validation of the preventive controls must be
performed by (or overseen by) a preventive controls qualified
individual prior to implementation of the food safety plan (or, when
necessary, during the first 6 weeks of production) and whenever a
reanalysis of the food safety plan reveals the need to do so.
    (Comment 499) Some comments ask us to clarify whether an individual
attending food safety training by an entity such as a cooperative
extension or a State department of agriculture could be a ``preventive
controls qualified individual'' for the purpose of performing or
overseeing the validation of preventive controls.
    (Response 499) See the discussion in section XXXVI.B.1 for
additional information about training applicable to a preventive
controls qualified individual. We have not specified additional
requirements for a preventive controls qualified individual with
respect to validation. A person may be a preventive controls qualified
individual through job experience, as well as training. Food safety
training provided by an entity such as a cooperative extension
specialist or a State department of agriculture could be appropriate
training for many of the functions of the preventive controls qualified
individual if the training is consistent with the standardized
curriculum being developed by the FSPCA.
    (Comment 500) Some comments that discuss the distinction between
validation and verification ask us to align with the distinction made
in FSIS' Compliance Guidelines on HACCP Systems Validation (FSIS
Validation Guidelines) (Ref. 84). As discussed in those guidelines,
there are two distinct elements to validation: design and execution.
The design element addresses the scientific or technical support for
the system design, and the execution element addresses the initial,
practical, in-plant demonstration that the system can perform as
expected.
    (Response 500) As discussed in Response 150, the definition of
validation focuses on whether a control measure, combination of control
measures, or the food safety plan as a whole is capable of controlling
the identified hazards and, thus, captures the design element of
validation. We have revised the validation requirements to clarify that
it may be necessary to perform validation during production to
demonstrate the control measures can be implemented as designed.
    (Comment 501) Some comments question whether 6 weeks is enough time
to perform all applicable validation studies that would address the
execution element of validation. Some comments ask us to explain the
basis for the proposed 6-week timeframe. Some comments ask us to align
with the 90-day timeframe in the FSIS Validation Guidelines (Ref. 84).
Some comments note that food additives may only be produced a few times
per year at plants that also produce industrial, cosmetic, and
excipient grade products, and that this production schedule may make it
impractical to meet the proposed 6-week timeframe. Some comments note
that the seasonal nature of production of some food products may make
it impractical to perform all required validations within 6 weeks. Some
comments suggest that validation be performed within a specified number
of production batches, such as 10 production batches. Some comments
emphasize the need for flexibility and ask us to both adopt a 90-day
timeframe and provide for a longer timeframe with a written
justification, or provide for ongoing evidence of process validation.
Some comments ask us to specify that validation be performed within a
reasonable time as justified by the preventive controls qualified
individual. Some comments ask for more time for small businesses to
perform validation studies.
    (Response 501) We note that the 90-day timeframe for validation is
established in FSIS' regulations at 9 CFR 304.3(b) and (c) and 9 CFR
381.22(b) and (c) (Conditions for receiving inspection for meat and
meat products and poultry and poultry products, respectively). The FSIS
Validation Guidelines are a companion to those regulations. We have
revised the regulatory text, with associated editorial changes, to make
two changes to the proposed 6-week timeframe for validation of
preventive controls. First, we have adopted the 90-day timeframe
already established in FSIS' regulations by specifying that when
necessary to demonstrate the control measures can be implemented as
designed, validation may be performed within 90 days after production
of the applicable food first begins. Although we had proposed a 6-week
timeframe based on the 3 to 6-week timeframe suggested in the Codex
Guidelines for the Validation of Food Safety Control Measures (Ref. 39)
(Codex Validation Guidelines), we agree that practical limitations
associated with the production of some food products may make it
difficult to perform validation within 6 weeks. The 90-day timeframe in
FSIS' regulations, and incorporated into the FSIS Validation
Guidelines, reflects more than 15 years of experience with validating
HACCP systems for meat and poultry. Although we have provided for
validation to be performed within 90 days after production of the
applicable food first begins, we do not believe it

would take a full 90 days of production to determine whether the
facility can provide assurances that a control measure is working as
intended to control the hazard.
    Second, we have provided for validation within a reasonable
timeframe, provided that the preventive controls qualified individual
prepares (or oversees the preparation of) a written justification for a
timeframe that exceeds 90 days after production of the applicable food
first begins. We acknowledge that practical limitations such as those
described in the comments could prevent a facility from performing the
validation within 90 days after production of the applicable food first
begins. A timeframe that exceeds 90 days after production of the
applicable food first begins will be the exception rather than the norm
and we are requiring that the preventive controls qualified individual
provide (or oversee the preparation of) a written justification for
such a timeframe. We made a conforming revision to the list of
responsibilities of the preventive controls qualified individual (see
Sec.  117.180(a)).
    (Comment 502) Some comments ask us to clarify that the time period
when validation is performed would be considered as production time
rather than ``down time.'' These comments explain that many farms with
on-farm processing activities conduct those activities sporadically for
a brief period. For a processing activity that may be conducted for
only 2 or 3 days within a six week period, the facility may not have
enough production run time to validate controls.
    (Response 502) As discussed in Response 501, we have provided for
validation within a reasonable timeframe, provided that the preventive
controls qualified individual prepares (or oversees the preparation of)
a written justification for a timeframe that exceeds 90 days after
production of the applicable food first begins. A facility would design
a preventive control that is valid based on scientific and technical
information and then determine that the control can be applied in the
facility. It is unlikely that this will require a full 90 days of
production, and we see no reason for a facility to significantly extend
the validation time--e.g., to a year or more--because it only produces
for 2-3 days every 6 weeks.
    (Comment 503) Some comments ask us to add another circumstance when
validation would be required--i.e., whenever a change is made to the
control being applied.
    (Response 503) We have revised the regulatory text to require
validation whenever a change to a control measure or combination of
control measures could impact whether the control measure or
combination of control measures, when properly implemented, will
effectively control the hazards requiring a preventive control. Under
this provision, a facility would re-validate a preventive control if,
for example, a different type of equipment is used to deliver a heat
process, because it would be necessary to determine that the new
equipment can consistently achieve the required temperature and time of
the process. However, a facility would not need to re-validate a
preventive control if, for example, a thermal process is changed by
increasing the time or temperature, because a less stringent thermal
process would already have been validated.
    (Comment 504) Some comments ask us to require validation both
before production and 6 weeks after production begins.
    (Response 504) We decline this request. A facility has flexibility
to perform validation as appropriate to the nature of the preventive
controls, whether before production (e.g., by obtaining and evaluating
generally available scientific and technical information or by
conducting studies), after production begins (to demonstrate the
control measures can be implemented as designed during full-scale
production), or both.
    (Comment 505) Some comments assert that qualified third parties
should conduct all process validations.
    (Response 505) The critical factor is that the validation be
performed (or overseen) by an individual who has the appropriate
training and experience to validate the control measures. This
preventive controls qualified individual could be a third party or an
employee of the facility. Employees of the facility have a vested
interest in ensuring that the controls are effective, including by
appropriately validating the controls, just as a ``disinterested''
third party would have.

C. Proposed Sec.  117.160(b)(2)--What Validation Must Include

    We proposed that the validation of preventive controls must include
collecting and evaluating scientific and technical information (or,
when such information is not available or is inadequate, conducting
studies) to determine whether the preventive controls, when properly
implemented, will effectively control the significant hazards.
    (Comment 506) As discussed in Comment 150, some comments ask us to
revise the definition of ``validation'' to be consistent with the Codex
definitions.
    (Response 506) The Codex definition of validation is ``Obtaining
evidence that a control measure or combination of control measures, if
properly implemented, is capable of controlling the hazard to a
specified outcome.'' The definition of ``validation'' we are
establishing in this rule specifies that validation means obtaining and
evaluating scientific evidence that a control measure, combination of
control measures, or the food safety plan as a whole, when properly
implemented, is capable of effectively controlling the identified
hazards, which more closely aligns with the Codex definition. As a
conforming change for consistency with the revisions we made to the
definition, we have revised the proposed requirements for validation of
preventive controls to specify that validation of preventive controls
must include obtaining and evaluating scientific and technical evidence
(or, when such evidence is not available or is inadequate, conducting
studies) to determine whether the preventive controls, when properly
implemented, will effectively control the hazards. (See also Response
150.)
    (Comment 507) Some comments assert that our discussion of
validation refers to ``scientific proof'' for the validation of a
processing step and ask us to define what is and is not considered
scientific proof for validation.
    (Response 507) We used terms such as ``scientific and technical
information'' and ``scientific and technical basis'' rather than
``scientific proof'' when discussing validation. For information about
what we mean by ``scientific and technical information,'' see 78 FR
3646 at 3753-3754.
    (Comment 508) Some comments ask us to clarify expectations of
validations for basic sanitary processes.
    (Response 508) The requirements for validation only apply to
preventive controls. To the extent that the comment is referring to
sanitary practices governed by CGMPs (such as in Sec. Sec.  117.35 and
117.37), the validation requirements would not apply. To the extent
that the comment is referring to sanitation controls established as a
preventive control, those sanitation controls are excluded from the
validation requirements (see Sec.  117.160(a)(3)(ii)).
    (Comment 509) Some comments ask that we not require further
validation of well-accepted preventive controls, such

as refrigeration temperature and roasting coffee.
    (Response 509) A facility may rely on generally available
scientific and technical information to demonstrate the adequacy of
controls such as refrigeration and roasting processes for coffee, but
must obtain that information and establish it as a record (see Sec.
117.155(b)).
    (Comment 510) Some comments express concern that specific methods
are not available to enable validation. Some comments express concern
that the requirement to ``conduct studies'' might be intended, or could
be interpreted, to mean that firms are required to develop or validate
analytical methods (either in general or for specific food matrices).
These comments assert that any such requirement would incur extreme
costs and burdens without delivering commensurate public health
benefits.
    (Response 510) We do not intend the requirement to ``conduct
studies'' to mean that firms are required to develop or validate
analytical methods.
    (Comment 511) Some comments ask us to clarify that dry pasta
facilities would not be required to validate that their extrusion or
drying process provides a 5-log reduction for Salmonella. These
comments assert that a ``kill step'' is not necessary for foods such as
dry pasta because consumers cook the product before consumption and
that validation would be costly, time-consuming, and impractical.
    (Response 511) The rule does not require any specific performance
standards, such as the 5-log reduction standard in our HACCP regulation
for juice (see Sec.  120.24). A dry pasta facility that evaluates
Salmonella as a known or reasonably foreseeable hazard may determine
that the nature of the dry pasta product (and, thus, its reasonably
foreseeable use) makes it unlikely that it would be consumed without a
``kill step'' (i.e., cooking sufficient to adequately reduce
Salmonella) by the consumer and the facility could conclude that its
extrusion or drying process is not a preventive control. In contrast,
when the nature of the product (such as refrigerated cookie dough) is
such that its reasonably foreseeable use includes consumption without
cooking (or without cooking sufficient to adequately reduce Salmonella)
by the consumer, it would not be appropriate to rely on cooking by the
consumer to control a known or reasonably foreseeable biological
hazard.
    (Comment 512) Some comments recommend validation via indirect
methods such as scientific publications, government documents,
predictive modeling, and other technical information from equipment
manufacturers and other sources. These comments assert that the
development of validation data is not appropriate for a number of
preventive controls in fresh-cut operations (e.g., temperature control,
employee hygiene practices, and product separation protocols). Other
comments assert that there are a variety of circumstances in which the
collection and evaluation of scientific and technical information is
not necessary (e.g., the use of sieving or metal detectors to control
physical hazards).
    (Response 512) See Response 491 and Response 493. We agree that not
all preventive controls require validation, and the facility has
flexibility to take into account the nature of the preventive control
when determining whether to perform validation. The regulatory text,
which provides for scientific and technical evidence that a control
measure is capable of effectively controlling the identified hazards,
provides for the use of ``indirect methods'' as recommended by the
comments. However, even when sources such as scientific publications
are the basis for validation, studies may be needed to demonstrate that
the process used can be implemented in the facility to control the
hazard. For example, scientific publications may support use of a
specific concentration of sanitizer in produce wash water to prevent
cross-contamination. The facility would still need to demonstrate it
can consistently maintain that concentration under operating
conditions.

D. Proposed Sec.  117.160(b)(3)--Preventive Controls for Which
Validation Is Not Required

    We proposed that validation need not address food allergen
controls, sanitation controls, the recall plan and the supplier program
(which we now refer to as the ``supply-chain program'').
    (Comment 513) Some comments ask us to eliminate the specific list
of controls that are excluded from the validation requirement and
instead revise the regulatory text to provide the facility with
flexibility to determine when validation is appropriate. (See also
Comment 491.)
    (Response 513) As discussed in Response 491, we have deleted
``except as provided by paragraph (b)(3) of this section'' from
proposed Sec.  117.160(a) to remove the limitation seen by the comments
on the exceptions to the requirement for validation of preventive
controls. We also have revised the regulatory text of Sec.  117.160(c)
to provide that a facility does not need to validate other preventive
controls, if the preventive controls qualified individual prepares (or
oversees the preparation of) a written justification that validation is
not applicable based on factors such as the nature of the hazard, and
the nature of the preventive control and its role in the facility's
food safety system. We see no reason to also eliminate the list of
those controls for which we have already determined that validation is
not necessary, and require each facility to develop its own rationale
for concluding that validation is not necessary based on the nature of
these preventive controls. The rule would not prevent a facility from
validating one of these preventive controls, such as a food allergen
control, if it chooses to do so. (See also Response 514.)
    (Comment 514) Some comments assert that the proposed regulatory
text would prevent us from requiring validation of specific allergen or
sanitation controls where it may be prudent to do so, either now or in
the future as a result of a newly identified hazard, establishment of
regulatory allergen threshold(s), or the development of a tool, such as
a test method, that would enable validation of the control for the
specific hazard. Other comments assert that validation of food allergen
controls for some food allergens is possible now and that we should not
preclude future requirements as it becomes possible to validate food
allergen controls for other allergens in the future. Other comments
state that a preventive controls qualified individual should determine
appropriate validation for food allergen controls. Other comments state
that scientific studies are not needed to validate food allergen
controls because monitoring is sufficient.
    (Response 514) This rule establishes requirements that will apply
when the rule becomes effective. It does not address the potential for
additional requirements that we could establish, through additional
rulemaking, in the future. The rule does not preclude a facility from
validating any of its food allergen controls, and we encourage
facilities to validate food allergen controls as appropriate to the
facility, the food, and the specific food allergen control. However, if
a facility decides to validate any of its food allergen controls, the
rule does not require that such validation be conducted or overseen by
a preventive controls qualified individual.
    As previously discussed, we agree that food allergen controls
generally are not evaluated through scientific studies and that
monitoring (e.g., by visual observation) that these activities do not

result in allergen cross-contact provides sufficient assurance that the
controls are functioning as intended to prevent the hazard of
undeclared food allergens in the food due to allergen cross-contact (78
FR 3646 at 3755).
    (Comment 515) Some comments assert that validation of food allergen
controls and sanitation controls is already possible through sample
swabs and, thus, that reliance strictly on visual observation for
potential allergen cross-contact and sanitation controls does not
appear to be appropriate.
    (Response 515) As discussed in Response 150, validation is directed
to determining whether a control measure, when properly implemented, is
capable of effectively controlling a hazard. Procedures such as sample
swabs (e.g., of equipment used for food containing an allergen to
determine if the allergen protein is present after cleaning, and of
equipment following a dry cleaning procedure to determine microbial
load) are generally directed to verifying that a control measure is
functioning as intended rather than whether the control measure is
capable of effectively controlling the hazard. However, they can also
be part of a validation study to determine whether a sanitation
procedure effectively removes a food allergen from equipment surfaces
if a facility decides to validate such procedures.