XXXIV. Subpart C: Comments on Proposed Sec.  117.165--Verification of
Implementation and Effectiveness

    We proposed that you must verify that the preventive controls are
consistently implemented and are effectively and significantly
minimizing or preventing the significant hazards. We proposed that to
do so you must conduct specified activities (i.e., calibration, product
testing, environmental monitoring, and review of records) as
appropriate to the facility, the food, and the nature of the preventive
control. We also proposed that you must establish and implement written
procedures for the frequency of calibrating process monitoring
instruments and verification instruments, product testing, and
environmental monitoring.
    Some comments that support the proposed provisions suggest
alternative or additional regulatory text (see, e.g., Comment 516,
Comment 519, Comment 539, Comment 540, Comment 544, and Comment 545) or
ask us to clarify how we will interpret the provision (see, e.g.,
Comment 522, Comment 523, Comment 528, and Comment 536). In the
following paragraphs, we discuss comments that ask us to clarify the
proposed requirements or that disagree with, or suggest one or more
changes to, the proposed requirements. After considering these
comments, we have revised the proposed requirements as shown in table
38.

  Table 38--Revisions to the Proposed Requirements for Verification of
                    Implementation and Effectiveness
------------------------------------------------------------------------
           Section                 Description            Revision
------------------------------------------------------------------------
117.165(a)..................  Flexibility in the    Provide that
                               requirement to        activities for
                               conduct activities    verification of
                               to verify             implementation and
                               implementation and    effectiveness take
                               effectiveness.        into account both
                                                     the nature of the
                                                     preventive control
                                                     and its role in the
                                                     facility's food
                                                     safety system.
117.165(a)(1)...............  Verification of       Provide for accuracy
                               implementation and    checks in addition
                               effectiveness for     to calibration.
                               process monitoring
                               instruments and
                               verification
                               instruments.
117.165(a)(4)(i)............  Timeframe for review  Provide for records
                               of records of         review within 7
                               monitoring and        working days after
                               corrective action     the records are
                               records.              created, or within
                                                     or within a
                                                     reasonable
                                                     timeframe, provided
                                                     that the preventive
                                                     controls qualified
                                                     individual prepares
                                                     (or oversees the
                                                     preparation of) a
                                                     written
                                                     justification.
117.165(a)(5)...............  Other activities      Clarify that there
                               appropriate for       could be
                               verification of       alternative
                               implementation and    verification
                               effectiveness.        activities of
                                                     implementation and
                                                     effectiveness other
                                                     than those that we
                                                     specify in the
                                                     rule.
117.165(b)..................  Written procedures    Clarify that written
                               for verification of   procedures for
                               implementation and    verification of
                               effectiveness.        implementation and
                                                     effectiveness are
                                                     established and
                                                     implemented as
                                                     appropriate to the
                                                     role of the
                                                     preventive control
                                                     in the facility's
                                                     food safety system,
                                                     as well as
                                                     appropriate to the
                                                     facility, the food,
                                                     and the nature of
                                                     the preventive
                                                     control.
117.165(b)(1)...............  Written procedures    Require written
                               for verification of   procedures for
                               implementation and    accuracy checks in
                               effectiveness for     addition to
                               process monitoring    calibration.
                               instruments and
                               verification
                               instruments.
------------------------------------------------------------------------

A. Flexibility in the Requirement To Conduct Activities To Verify
Implementation and Effectiveness

    We proposed that you must verify that the preventive controls are
consistently implemented and are effectively and significantly
minimizing or preventing the significant hazards by conducting
specified activities as appropriate to the facility, the food, and the
nature of the preventive control. We proposed to specify the following
verification activities: (1) Calibration; (2) product testing; (3)
environmental monitoring; and (4) review of records.
    In the following paragraphs, we discuss comments generally directed
to the need for a facility to have flexibility to apply these
requirements (particularly the requirements for product testing and
environmental monitoring) in a manner that works best for the facility
in light of its food products and the nature of the preventive controls
that would be verified. In sections XXXIV.B through XXXIV.F, we discuss
the requirements for calibration, product testing, environmental
monitoring, and review of records more specifically.
    (Comment 516) Some comments express support for the flexibility
provided by specifying that verification activities must be conducted
``as appropriate to the facility, the food, and the nature of the
preventive control.'' Some comments state that the proposed provision
means that, based on risk, a fresh fruit packing operation could decide
whether or not to do product testing and, when applicable, the type of
test and the testing frequency. Some comments agree with the proposed

provisions because they address product testing through flexible
written procedures that consider both testing and corrective action
plans rather than through mandatory or prescribed requirements. Other
comments agree with the proposed provisions because they require
facilities to develop and use testing programs that are tailored to
their facility, equipment, processes, products, and other specific
circumstances and do not prescribe specific requirements for testing,
such as finished product testing. Some comments state that product
testing may not be effective in identifying the acceptability of a
specific ingredient or finished product lot on any given day, but it
can help assess and verify the effectiveness of a food safety plan as a
whole and the facility's capability to consistently deliver against it.
    Some comments assert that the preamble discussion in the 2014
supplemental human preventive controls notice is in conflict with the
proposed regulatory text and ask us to modify the regulatory text to
provide the flexibility we signaled in that supplemental notice. These
comments express concern that the term ``must'' (i.e., ``you must
conduct activities that include the following'') could be interpreted
to mean that activities listed in the regulatory text (in particular,
product testing and environmental monitoring) are always required in
some form. Some comments ask us to clarify whether product testing and
environmental monitoring are required or optional. Other comments
assert that facilities should have the flexibility to determine whether
to conduct product testing and environmental monitoring based on a risk
assessment. Some comments assert that there are circumstances (such as
in warehouses and distribution centers; in the production of gases used
in food; in operations that hull and shell nuts; and in the production
of refined vegetable oils) where these tests would not be necessary.
Some comments assert that a determination to conduct environmental
monitoring should be on a case-by-case basis and that other
verification activities may be used (such as process verifications or
testing of intermediates) to verify implementation and effectiveness.
Some comments assert that there would be no reason to conduct
environmental monitoring in the shell egg processing plant, given the
testing in henhouses required by part 118. Other comments ask us to
exempt operations when their hazard analysis appropriately concludes
that there is no foreseeable risk.
    See also Comment 486.
    (Response 516) The provisions for verification provide flexibility
by specifying that they apply as appropriate to the nature of the
preventive control and its role in the facility's food safety system.
As noted by some comments, the provisions address testing through
flexible written procedures that allow facilities to develop and use
testing programs that are tailored to their facility, equipment,
processes, products, and other specific circumstances. We agree that an
appropriate outcome of the hazard analysis for some facilities will be
that product testing and environmental monitoring are not required; it
is not necessary to grant an ``exemption'' to allow a facility to
achieve this outcome. For example, environmental monitoring would be
required to verify effectiveness of sanitation controls when an RTE
food is exposed to the environment prior to packaging and the packaged
food does not receive a treatment or otherwise include a control
measure (such as a formulation lethal to the pathogen) that would
significantly minimize the pathogen because such environmental
monitoring is appropriate to the facility (one manufacturing RTE
foods), the food (an RTE food exposed to the environment), and the
nature of the preventive control (sanitation controls). Foods such as
peanut butter, soft cheeses, dried dairy products for use in RTE foods,
and roasted nuts are among the products for which manufacturing
operations would need to have an environmental monitoring program when
such foods are exposed to the environment. In an FDA memorandum on
environmental monitoring, we discuss several outbreaks of foodborne
illness attributed to contamination from the environment (Ref. 55).
These examples illustrate the severe consequences that can occur when
environmental pathogens contaminate a product as a result of inadequate
preventive controls and how environmental monitoring can be used to
verify the adequacy of the preventive controls.
    We discuss product testing for microbial pathogens in another FDA
memorandum, including the use of pathogens and indicator organisms and
microbial testing of foods for process control and for problem solving
(Ref. 85). The circumstances in which product testing would be required
are dependent on a variety of factors, as described in that memorandum
and in the Appendix to the 2013 proposed human preventive controls rule
(78 FR 3646 at 3818-3820, with reference numbers corrected in 78 FR
17142 at 17149-17151). As with environmental monitoring, product
testing must be conducted as appropriate to the facility, the food, and
the nature of the preventive control. For example, a raw material or
other ingredient added to an RTE food after a pathogen ``kill step''
must be tested before use when the raw material or other ingredient has
been associated with a pathogen and has not been treated to
significantly minimize or prevent that pathogen (e.g., spices added to
snack chips, a food that has been previously involved in an outbreak of
foodborne illness). Product testing would be required because it is
appropriate to the facility (one making an RTE food), the food (spiced
snack chips), and the nature of the preventive control (there is no
control applied to the spices added to the snack chips).
    When process control testing for an indicator organism, or
environmental monitoring for an indicator organism, indicates an RTE
food is reasonably likely to be contaminated with a pathogen, that food
must be tested for the pathogen. For example, if environmental
monitoring reveals food-contact surfaces that are used in the
production of soft cheese are contaminated with Listeria spp. and
additional environmental monitoring following corrective actions
indicates food-contact surfaces are still contaminated with Listeria
spp., product testing would be required because it is appropriate to
the facility (one making an RTE food), the food (soft cheese, which
supports the growth of L. monocytogenes), test results from
environmental monitoring (which show the presence of an indicator
organism for L. monocytogenes on food-contact surfaces in the food
processing environment), and the nature of the preventive control
(sanitation controls to prevent contamination by environmental
pathogens, which appear to be inadequate).
    The word ``must'' specifies the type of activities that a facility
can use to satisfy the requirements for a particular preventive control
management component, and we are retaining the term ``must.'' However,
we agree that the rule should provide flexibility for additional
verification of implementation and effectiveness. To provide that
additional flexibility, we have revised the specific requirements for
verification of implementation and effectiveness to provide for other
activities appropriate for verification of implementation and
effectiveness (see Sec.  117.165(a)(5)). (See also Response 486.)
    (Comment 517) Many comments ask us to issue guidance, rather than

requirements, for product testing and environmental monitoring based on
concerns such as the following: The value of environmental monitoring
will be reduced if it becomes a minimum regulatory requirement; in many
cases environmental pathogens can be eliminated by proper preparation
by the consumer; there are well-known limitations to product testing
and negative results from product testing can create a false sense of
security; product testing is not preventive, would put industry into a
reactive mode, and would pull valuable resources from activities
focused on preventing contamination; there is limited technology
available to test fresh produce, and limited time available due to the
perishable nature of the commodity; any regulatory requirement will
soon be outdated as products change and science improves; neither
product testing nor environmental monitoring are required by HACCP
systems; product testing would vastly increase the cost of the rule and
will drive many businesses out of business without necessarily
improving food safety; and requirements for product testing would
require the States to direct resources to respond to non-compliant
product testing results, and such resources would be better directed to
environmental monitoring.
    Some of these comments emphasize the need for flexibility so that
product testing and environmental monitoring are options that are
available to the facility rather than requirements for all facilities.
Other comments assert that guidance provides greater opportunity for
industry innovation and stakeholder participation to determine the
appropriate use of verification measures, and avoids a ``one-size-fits-
all'' approach to regulations. Some of these comments state that we
should encourage environmental monitoring to be conducted ``through
facility specific food safety plans,'' which would provide the
flexibility necessary to monitor risks associated with exposures of RTE
foods. Other comments state that operators should be given the
necessary flexibility to implement any requirements in the most
effective and efficient manner using a risk-based approach and taking
into account the specific conditions of their facilities and
operations. Some comments express concern that including a requirement
makes it difficult for businesses to justify a conclusion that testing
is not necessary.
    Some comments ask us to solicit drafts of proposed guidance
documents from the sustainable agriculture and local/regional food
system community; publish a list of possible topics for future guidance
each year; seek input in advance from the sustainable agriculture and
local/regional food system community before preparing draft guidance
(including public meetings, workshops, and formation of an advisory
committee); hold public meetings on draft guidance after publication;
and present draft guidance to an advisory committee including
representatives from the sustainable agriculture and local/regional
food system community.
    (Response 517) We are retaining the requirements for product
testing and environmental monitoring in the rule, with the revisions,
already discussed, to provide that verification activities depend on
the role of the preventive control in the facility's food safety system
(see Response 455); corrective action procedures depend on the nature
of the hazard (see Response 470); and written procedures for product
testing and environmental monitoring are established and implemented as
appropriate to the role of the preventive control in the facility's
food safety system (see Response 455). These revisions clarify in the
regulatory text the flexibility that we discussed in the 2014
supplemental human preventive controls notice (79 FR 58524 at 58543-
58545). Some of the comments that ask us to issue guidance rather than
requirements appear to believe that only guidance can provide
sufficient flexibility for product testing and environmental
monitoring. This is not the case. See Response 516.
    We disagree that environmental monitoring will be become a minimum
regulatory requirement in all cases; the decision to conduct
environmental monitoring is made by the facility and some comments
discuss specific examples of when environmental monitoring or product
testing would not be warranted (see Comment 516). We acknowledge that
in some cases environmental pathogens can be eliminated by proper
preparation by the consumer, but this rule will not change consumer
behavior (see, e.g., our discussion of a prepackaged, refrigerated
cookie dough that was implicated in an E. coli O157:H7 outbreak that
caused 76 confirmed cases of illness, including 35 hospitalizations (78
FR 3646 at 3665)). Also, as noted in Response 390, we note that many
consumers do not follow some cooking instructions. Moreover, the fact
that consumer preparation would be capable of eliminating an
environmental pathogen is not a reason to not take reasonable measures
to prevent contamination from the environment and to verify that such
measures are effective through environmental monitoring.
    We have acknowledged limitations of product testing (78 FR 3646 at
3819-3820) and agree that a facility should consider such limitations
when determining whether to conduct product testing and keep such
limitations in mind when obtaining negative results from product
testing. We also agree that product testing is not preventive. However,
the mere facts that there are limitations, and that product testing is
itself not a preventive measure, do not eliminate all benefits of
product testing; we agree with comments (described in Comment 516) that
although product testing may not be effective in identifying the
acceptability of a specific ingredient or finished product lot on any
given day, it can help assess and verify the effectiveness of a food
safety plan as a whole and the facility's capability to consistently
deliver against it. We agree that there is limited technology available
to test fresh produce and expect testing of fresh produce by a facility
as a verification of its food safety plan as a whole would be the
exception rather than the norm.
    We disagree that regulatory requirements for product testing and
environmental monitoring will soon be outdated as products change and
science improves; the rule requires reanalysis of the food safety plan
as a whole at least every 3 years, and requires reanalysis of the food
safety plan as a whole, or the applicable preventive control, in light
of new information (see Sec.  117.170(a) and (b)(2)). We disagree that
the lack of specific provisions for product testing and environmental
monitoring in HACCP systems should preclude us from establishing
requirements for product testing and environmental monitoring in this
rule; as previously discussed, not every provision in section 418 of
the FD&C Act is identical to HACCP as described in current literature
(78 FR 3646 at 3660). Moreover, the HACCP systems have provisions for
verification activities, as we consider these to be. We agree that
there are some costs to product testing, but the rule provides
flexibility for the facility to determine when product testing is
appropriate. We acknowledge that the States will be required, in many
cases, to follow up on positive findings obtained during product
testing but disagree that this is a reason to eliminate the proposed
requirements. The States would only be directing resources when the
findings indicate contamination of food, and doing so will protect
public health.

    We will follow the procedures in Sec.  10.115 for issuing guidance
documents. Under Sec.  10.115(f), members of the public can suggest
areas for guidance document development and submit drafts of proposed
guidance documents for FDA to consider. Under Sec.  10.115(g), after we
prepare a draft guidance we may hold public meetings or workshops, or
present the draft guidance document to an advisory committee for
review; doing so is not common and is determined on a case-by-case
basis.
    (Comment 518) Some comments ask us to consider the volume of
product produced in establishing the verification testing requirements
because volume-based testing is a way to address the burden that
testing requirements may create for small facilities.
    (Response 518) We decline this request. Although a facility would
establish the frequency of testing if it determines, through its hazard
analysis, that product testing or environmental monitoring is
warranted, volume does not play a role in most statistical sampling
plans. See the discussion of statistical sampling plans in the Appendix
to the 2013 proposed human preventive controls rule (78 FR 3646 at
3819-3820).

B. Proposed Sec.  117.165(a)(1)--Calibration

    We proposed to require calibration of process monitoring
instruments and verification instruments.
    (Comment 519) Some comments distinguish ``calibration'' from an
accuracy check, which the comments describe as a test to confirm that a
particular equipment or measurement device is accurate. These comments
assert that calibration may not be possible for certain equipment or
measurement devices, and the appropriate corrective action may be
replacement or application of corrective values. These comments ask us
to specify that an accuracy check may be used as a verification
activity in lieu of calibration.
    (Response 519) We have revised the proposed requirements to require
calibration of process monitoring instruments and verification
instruments, or checking them for accuracy. However, if the outcome of
an accuracy check is that a process monitoring instrument or
verification instrument is not accurate, the facility must follow up by
calibrating the device, rather than by applying corrective values, when
it is practical to do so and replace the device when it is not
practical to calibrate it.

C. Comments Directed to Proposed Requirements for Both Product Testing
(Proposed Sec.  117.165(a)(2) and (b)(2)) and Environmental Monitoring
(Proposed Sec.  117.165(a)(3) and (b)(3))

    We proposed that to verify that the preventive controls are
consistently implemented and are effectively and significantly
minimizing or preventing the significant hazards you must conduct
activities that include product testing and environmental monitoring,
as appropriate to the facility, the food, and the nature of the
preventive control (Sec.  117.165(a)(2) and (a)(3)). We also proposed
that you must establish and implement written procedures for product
testing and for environmental monitoring.
    (Comment 520) Some comments ask us to revise the regulatory text to
be explicit that there are circumstances when product testing and
environmental monitoring would not be necessary.
    (Response 520) We decline this request. We discussed examples
relevant to this request in memoranda that we placed in the docket for
this rule as references to the 2014 supplemental human preventive
controls notice (Ref. 55) (Ref. 85). However, the actual decision as to
whether product testing and environmental monitoring are warranted
depend on the actual facility and its food product, as well as the
nature of the preventive control and its role in the facility's food
safety system, and a slight variation on circumstances that would lead
one facility to conclude that such testing programs were not required
could lead a different facility to the opposite conclusion.
    (Comment 521) Some comments discuss topics for us to include in
guidance on procedures for product testing and environmental
monitoring, such as which pathogens to test for; the range of products
that should be tested; circumstances that warrant testing; what a
facility would document and what factors the facility would consider
before determining that product testing is not appropriate for its food
product; frequency of sampling and number of samples to be collected;
actions to take after a positive result; available test methods;
reporting requirements for results; compliance strategies; and criteria
for laboratories conducting the testing.
    (Response 521) The memoranda that we placed in the docket for this
rule as references to the 2014 supplemental human preventive controls
notice (Ref. 55) (Ref. 85) address many of these topics.
    (Comment 522) Some comments ask us to clarify that tests can be
performed by third-party facilities or laboratories, as well as by the
facility itself. Some comments ask us to clarify that we will accept
test results in the same format as the format used for other purposes,
such as third-party certification services.
    (Response 522) The rule places no restrictions on who conducts
testing. However, facilities have a responsibility to choose testing
laboratories that will produce reliable and accurate test results. (See
Response 524.) The rule does not specify the format of test results,
provided that the record documenting testing satisfies the
recordkeeping requirements of subpart F.
    (Comment 523) Some comments express concern about requirements for
product testing and environmental monitoring in light of section 202 of
FSMA (section 422 of the FD&C Act). (Section 422 of the FD&C Act
addresses laboratory accreditation for the analyses of foods, including
use of accredited laboratories in certain circumstances and including
requirements for accredited laboratories to report the results of
laboratory testing to FDA in certain circumstances.) These comments
express concern that requirements for facilities to submit results of
environmental monitoring to us will create an additional disincentive
to looking for pathogens established in the facility. These comments
assert that the results of environmental monitoring tests should be
available to us for inspection but not submitted to us if product has
not been distributed and that submitting the results of routine tests
would be burdensome without benefit. These comments ask us to clarify
whether facilities or laboratories would be required to submit the
results of environmental monitoring tests to us. Likewise, some
comments ask us to clarify whether product testing (including testing
of raw materials or other ingredients as part of supplier controls) is
subject to the requirements of section 422 of the FD&C Act for using
accredited laboratories and for reporting test results to us. Other
comments ask us to establish standards and procedures for certifying
laboratories that would perform the tests. These comments assert that
these standards and procedures are needed to ensure the credibility of
the testing and to provide direction for facilities that establish in-
house testing facilities. Other comments urge us to establish
regulations implementing section 422 of the FD&C Act because they would
complement the requirements of the human preventive controls rule and
because

model laboratory standards that address quality controls, proficiency
testing, training, and education of laboratory personnel offer the
protections necessary for ensuring reliable, accurate test results.
Other comments assert that if laboratories are not accredited or
samples are not collected in a sanitary manner, there is no guarantee
the results will be scientifically valid.
    (Response 523) Section 422 of the FD&C Act would require, in
relevant part, that food testing be conducted by an accredited
laboratory (and the results of such testing be sent directly to FDA)
whenever such testing is conducted in response to a specific testing
requirement established under the FD&C Act or its implementing
regulations, when applied to address an identified or suspected food
safety problem, or to support admission of a food under an Import Alert
that requires food testing. Although another rulemaking will address
the requirements of section 422 of the FD&C Act, our current thinking
is that routine product testing and environmental monitoring conducted
as a verification activity is not being applied to address an
identified or suspected food safety problem that requires food testing
and would not be subject to requirements to use an accredited
laboratory that would submit the results to FDA. We will review the
results of environmental monitoring and product testing, if any, during
inspections.
    The primary concern expressed in these comments was with respect to
laboratories reporting results to FDA and not with use of accredited
laboratories. The rule requires a facility to establish and implement
written procedures for product testing and environmental monitoring and
that the procedures for such testing be scientifically valid. One way
to comply with the requirement that testing procedures be
scientifically valid is to use an accredited laboratory.
    (Comment 524) Some comments ask us to expand the proposed
requirement to identify the laboratory conducting the testing to also
specify whether that laboratory is accredited and uses the appropriate
standards (such as quality control, proficiency testing, and trained
laboratory staff). These comments assert that such information would be
useful to facilities.
    (Response 524) We decline this request. These comments appear to be
asking us to establish in the human preventive controls rule
requirements related to section 422 of the FD&C Act. Doing so in
advance of regulations implementing section 422 of the FD&C Act is
premature. However, facilities have a responsibility to choose testing
labs that will produce reliable and accurate test results even if the
rule does not require the facility to specify whether the laboratory is
accredited.
    (Comment 525) Some comments express concern about how the
requirements for product testing will apply to the produce industry.
For example, some comments assert that product testing on intact RACs
is not an effective way to ensure food safety and assume that product
testing would apply only to foods we consider to pose a greater risk,
like fresh fruits and vegetables consumed raw. Some comments assert
that product testing would be an excessive and unnecessary cost on
farms and in low-risk facilities that pack and hold RACs. Other
comments strongly object to mandatory product testing for fresh and
fresh-cut produce. These comments assert that the results of product
testing are unlikely to provide useful information for RACs and support
application of GAPs and CGMPs rather than product testing. Some
comments express concern that the fresh-cut produce industry will be
dramatically changed if every lot of product needs to be tested and
that such testing would certainly add expense without making the food
any safer. Other comments assert that produce contamination occurs at
so low a frequency that product testing for produce (including tree
nuts) is not economically feasible through any scientifically valid
sampling protocol. These comments also assert that ``test and hold''
would require building additional cooling operations in all facilities
and that, because of short shelf life, testing of produce would
negatively impact quality and marketing. Other comments assert that
industry data have shown a sporadic and limited finding of pathogens in
product and statistical sampling profiles do not provide sufficient
evidence that product testing is an effective use of time and money.
Other comments assert that facilities handling produce RACs are a
unique type of facility and repeat previous requests that we allow all
produce operations handling RACs to be covered by the produce safety
rule, rather than the human preventive controls rule, to ensure that
such facilities will not be expending resources on testing that could
be better directed to implementation of preventive controls.
    Likewise, some comments express concern about how the requirements
for environmental monitoring will apply to the produce industry. For
example, some comments express concern that off-farm packinghouses
would be subject to environmental monitoring because certain produce
RACs are classified as RTE foods. Other comments reiterate requests
that we not interpret produce held in vented crates to be ``exposed to
the environment,'' so that facilities that only hold food could qualify
for the exemption for facilities solely engaged in the storage of
unexposed packaged food. These comments assert that holding produce in
vented crates presents a low risk of contamination from environmental
pathogens and that environmental pathogens do not qualify as a hazard
requiring preventive controls. Some comments assert that neither
product testing nor environmental monitoring would be warranted for
facilities that hull and dry walnuts because at this stage walnuts are
not a finished commercial commodity or an RTE food.
    Some comments that express concern about the requirements for
environmental monitoring focus on the environmental pathogen L.
monocytogenes. Some of these comments assert that fresh produce poses a
unique challenge in that L. monocytogenes is routinely found in the
outdoor environment and its occasional transient detection on raw
produce in low numbers does not necessarily indicate poor practices,
that a contamination event has occurred due to insanitary conditions,
or that such occasional transient detection presents an elevated public
health risk. These comments assert that the occasional detection of
transient L. monocytogenes in low numbers on food-contact surfaces
where produce is handled is to be expected and must be considered and
addressed in the drafting of environmental monitoring procedures for
produce facilities. Other comments state that not all produce
operations will be susceptible to harborage of L. monocytogenes. Other
comments state that they will not support mandatory environmental
monitoring for facilities that handle RACs until we amend our policies
regarding the regulatory consequences of a single detection of
potentially transient and low levels of L. monocytogenes on a food-
contact surface.
    (Response 525) We acknowledge the limitations of product testing
for produce RACs and fresh-cut produce. As discussed in Response 517,
the product testing that this rule requires as a verification activity
is to help assess and verify the effectiveness of a food safety plan
and the facility's capability to consistently deliver against it, not
as a ``hold and test'' procedure to establish the acceptability of
every lot or batch. We do not expect either product testing or
environmental monitoring to be

common in facilities that process, pack, or hold produce RACs. We agree
that there would be little or no benefit to product testing or
environmental monitoring in facilities that pack or hold produce RACs
that are rarely consumed raw, such as potatoes. We expect that many
facilities that process, pack, or hold produce RACs that are RTE foods
may conclude, as a result of their hazard analysis, that neither
product testing nor environmental monitoring is warranted. We also
expect that many facilities that process, pack, or hold produce RACs
that are RTE foods will conclude that the limitations of product
testing when applied to produce reduce the value of product testing for
their products and would direct their resources to food safety
practices and verification measures other than product testing. In
addition, we expect that some facilities will see benefits in
conducting environmental monitoring as a verification measure and would
direct resources to such activities.
    We disagree that produce held in vented crates is not exposed to
the environment (see Response 170), but agree that holding produce in
vented crates presents a low risk of contamination from environmental
pathogens. We do not expect that facilities that store produce in
vented crates would conclude, as a result of their hazard analysis,
that environmental pathogens are a hazard requiring preventive controls
during storage activities. See Response 25 for a discussion of how this
final rule broadens the number of packinghouses that will be governed
by the provisions of the produce safety rule. See the discussions, in
the 2014 supplemental human preventive controls notice (79 FR at 58535-
536) and in Response 25, of the similarities and differences for off-
farm packing and holding compared to on-farm packing and holding. We
note that some of the comments express concern related to operations
that, as a result of changes in the farm definition, may fall within
that definition (e.g., some walnut hullers and dryers) and would not be
subject to the requirements of this rule.
    We agree that not all produce facilities are susceptible to
harborage with L. monocytogenes. For example, harborage with L.
monocytogenes is more likely to be a potential hazard in certain wet
packing operations (e.g., wet packing operations for cantaloupes) (Ref.
86). Comments that we previously received about our draft guidance
entitled ``Guidance for Industry: Control of Listeria monocytogenes in
Refrigerated or Frozen Ready-To-Eat Foods; Draft Guidance'' (Ref. 87)
have raised issues, similar to the issues described in these comments,
regarding the detection of L. monocytogenes on food-contact surfaces,
and we intend to re-issue that draft guidance for public comment in the
near future.
    The memoranda that we prepared on product testing and environmental
monitoring for the 2014 supplemental human preventive controls notice
(Ref. 55) (Ref. 85) include some examples relevant to facilities that
process, pack, or hold produce. In light of the questions we have
received regarding similarities and differences for off-farm packing
and holding compared to on-farm packing and holding, we are considering
developing a separate guidance on this topic.
    (Comment 526) Some comments express concern about the cost of
testing and suggest creation of a one-time grant program for very small
businesses that would assist them in developing their initial food
safety plans and testing programs.
    (Response 526) Very small businesses are qualified facilities that
are subject to modified requirements, which do not require testing or
development of a food safety plan. We intend that the guidance we are
developing will be helpful to all sizes of businesses that are subject
to the requirements for product testing and environmental monitoring.
(See Response 2.)

D. Proposed Sec.  117.165(a)(2)--Product Testing

    (Comment 527) Some comments ask us to require finished product
testing for food products designated as high-risk, particularly when
the product supports pathogen growth during its shelf life. Other
comments suggest that finished product or ingredient testing should be
implemented as appropriate in situations where a risk has been
identified and an effective preventive control cannot be implemented.
Other comments ask us to require product testing if an environmental
pathogen is identified as a significant hazard.
    (Response 527) We decline these requests. A facility's decision to
conduct product testing, and to establish the frequency of such
testing, will reflect a risk-based approach consistent with its hazard
analysis. Consequently, we expect that facilities that produce foods
that have frequently been associated with outbreaks of foodborne
illness, or produce food for which an effective preventive control
cannot be implemented, would establish product testing programs more
often than facilities that do not produce such foods.
    A facility that identifies an environmental pathogen as a hazard
requiring a preventive control such as sanitation controls would
conduct environmental monitoring. Such a facility would decide what, if
any, role product testing would play as a verification activity, or as
part of a corrective action as a result of positive findings from
environmental monitoring, based on the facility, the food, the nature
of the preventive control, and the role of the preventive control in
the facility's food safety system.
    (Comment 528) Some comments ask us to clarify (or specify) when
product testing would be directed at raw materials and other
ingredients and when product testing would be directed at finished
product. Some comments favor testing raw materials and other
ingredients as part of ``product testing,'' whereas other comments
state that testing raw materials and other ingredients should be
considered part of a supplier program rather than verification of
implementation and effectiveness. Other comments state that it is
unclear what preventive control step would be verified by product
testing and what types of facilities would be required to perform
product testing. One comment from a supplier of produce states that
testing its product (i.e., produce testing) is not an adequate measure
of its cleaning and sanitation program and asks us to clarify that
product testing is not on final product and that final product testing
is not required.
    (Response 528) We use the term ``product testing'' to mean testing
any food product, whether raw materials or other ingredients, in-
process foods, or finished products (Ref. 85) and, thus, product
testing can be directed to any of these food products. For example,
testing raw materials and other ingredients could be verification of a
supplier; testing in-process material after a kill step could be
verification of process control; testing finished product could be
verification of the food safety plan as a whole, and capture a problem
introduced during manufacture, including from contaminated raw
materials and other ingredients. Product testing generally is not the
most effective means of measuring the adequacy of cleaning and
sanitation programs, but such testing is common to track a facility's
overall hygienic production measures.
    (Comment 529) Some comments assert that a facility that implements
supplier verification and environmental monitoring (or other measures)
should not be required to perform product

testing in addition to the other controls and verification measures.
    (Response 529) The facility determines whether product testing is
necessary as appropriate to the facility, the food, and the nature of
the preventive control and its role in the facility's food safety
system. The factors mentioned by the comment are examples of factors
that a facility would consider in making its determination.
    (Comment 530) Some comments ask us to revise the requirement for
product testing to clarify that product testing applies to significant
hazards.
    (Response 530) We decline this request. Product testing is a
verification activity for a preventive control, and a preventive
control is established for a ``significant hazard'' (which we now refer
to as ``hazard requiring a preventive control''). It is not necessary
to repeat, for each type of verification activity, that the activity
applies to hazards requiring a preventive control.
    (Comment 531) Some comments assert that the real point of product
testing is to test all lots or batches. These comments explain that
they would be required to retest every lot of product in order to pass
an analysis of the product on to its customers, even if testing had
already been performed by their vendors (i.e., suppliers), because each
of their customers receives a proprietary blend. These comments further
explain that it is not economically or physically possible to retest
small lots of product already tested by their vendors, and that the
risk has already been mitigated by its vendors.
    (Response 531) The situation described by these comments appears to
be a supplier-customer relationship in that the customer--not this
rule--has established a requirement for a certificate of analysis for
every lot of received product. As discussed in Response 517, the
product testing that this rule requires as a verification activity is
to help assess and verify the effectiveness of a food safety plan and
the facility's capability to consistently deliver against it, not to
establish the acceptability of every lot or batch.
    (Comment 532) Some comments assert that we should set out a
consultation process by which identification of hazards, situations, or
product types that may require finished product testing is undertaken
(noting that there may be significant international differences) before
establishing requirements for product testing in the rule. These
comments also assert that before product testing is mandated as a
potential control step, as opposed to as part of a general verification
program, Competent Authorities are obligated to demonstrate that it
will directly deliver demonstrable food safety benefits. According to
these comments, other than for specific pathogens, random, intermittent
finished product testing should primarily be used as a measure of
process control, not for acceptance testing; product testing should
normally be viewed as a monitoring and review tool, not as a product
conformance verification tool. Testing programs for product conformance
verification should be the exception rather than the rule. Other
comments suggest seeking advice from either the National Advisory
Committee on Microbiological Criteria for Foods or the FDA Food
Advisory Committee on establishing statistically based product testing
programs for process control.
    (Response 532) These comments appear to have misunderstood the
proposed requirements for product testing. Consistent with the views
expressed by these comments, we proposed requirements for product
testing as a verification measure of the food safety plan as a whole,
not for product conformance or lot acceptance. We do not intend to
initiate the consultation process described by these comments; however,
we may consider requesting the assistance of advisory committees on
process control testing in the future.

E. Proposed Sec.  117.165(a)(3)--Environmental Monitoring

    We proposed to require environmental monitoring, for an
environmental pathogen or for an appropriate indicator organism, if
contamination of a ready-to-eat food with an environmental pathogen is
a significant hazard, by collecting and testing environmental samples.
    (Comment 533) Some comments assert that requirements for
environmental monitoring as a verification activity would be
unnecessary in light of proposed revisions to some CGMP requirements,
such as: (1) A requirement to use chemical, microbial, or extraneous-
material testing procedures where necessary to identify sanitation
failures or possible allergen cross-contact and food contamination
(Sec.  117.80(a)(5)); (2) a requirement for raw materials and
ingredients to either not contain levels of microorganisms that may
render the food injurious to the health of humans, or to be pasteurized
or otherwise treated during manufacturing operations so that they no
longer contain levels that would cause the product to be adulterated
(Sec.  117.80(b)(2)); and (3) a requirement for all food manufacturing,
processing, packing, and holding to be conducted under such conditions
and controls as are necessary to minimize the potential for the growth
of microorganisms or for the contamination of food (Sec.
117.80(c)(2)).
    (Response 533) Environmental monitoring would be a verification
activity to ensure that sanitation controls are being implemented and
are effective. The CGMP testing requirement cited by the comments
neither explicitly requires environmental monitoring, nor describes the
circumstances in which environmental monitoring would be needed. The
cited CGMP requirement for raw materials and ingredients would not
negate the need for environmental monitoring to verify that sanitation
controls are preventing environmental pathogens from becoming
established in a ``niche'' or harborage site (78 FR 3646 at 3814). The
cited CGMP requirement to minimize the potential for the growth of
microorganisms or for the contamination of food does not specify that a
food establishment verify that it is meeting this requirement through
environmental monitoring.
    (Comment 534) Some comments ask us to specify that environmental
monitoring of pathogens be executed according to a risk analysis.
    (Response 534) We decline this request. See the discussion in
Response 467, which explains how risk applies to the facility's hazard
analysis and the determination by the facility to establish preventive
controls for hazards requiring a preventive control as appropriate to
the facility and the food. In contrast, the requirements for
environmental monitoring are a verification activity that a facility
would conduct to verify that one or more preventive controls are
consistently implemented and are effectively and significantly
minimizing or preventing the hazards requiring a preventive control and
would be established as appropriate to the facility, the food, and the
nature of the preventive control rather than according to a risk
analysis.
    (Comment 535) Some comments ask us to expand the requirements for
environmental monitoring. For example, comments ask us to broadly
require environmental monitoring in the following circumstances: as a
component of every food safety program; in any facility in which there
is a risk of contamination by an environmental pathogen, not just
facilities that make RTE food; whenever there is a risk of
environmental contamination if a likelihood exists that a person may
consume the food raw; for spores of pathogenic sporeforming

bacteria if there is a possibility the spores could germinate and
multiply in a packaged food or under storage or preparation conditions
in the home; and for unintended food allergens.
    (Response 535) We decline these requests. We are requiring a
facility to evaluate environmental pathogens whenever an RTE food is
exposed to the environment prior to packaging and the packaged food
does not receive a treatment or otherwise include a control measure
(such as a formulation lethal to the pathogen) that would significantly
minimize the pathogen (Sec.  117.130(c)(1)(ii)). This risk-based
requirement is a minimum requirement; a facility can do more if its
preventive controls qualified individual determines that doing so would
be appropriate.
    The definition of RTE food does include food for which it is
reasonably foreseeable that the food will be eaten without further
processing that would significantly minimize biological hazards (Sec.
117.3)). The definition of environmental pathogen (Sec.  117.3)
excludes the spores of pathogenic sporeforming bacteria, and we decline
the request to require environmental monitoring (by revising the
definition of environmental pathogen) for such spores if there is a
possibility the spores could germinate and multiply in a packaged food
or under storage or preparation conditions in the home. As previously
discussed, pathogenic sporeforming bacteria are normally present in
foods and unless the foods are subjected to conditions that allow
multiplication, they present minimal risk of causing illness. Because
pathogenic sporeforming bacteria are so commonly present in food, a
more appropriate approach to the risks presented by pathogenic
sporeforming bacteria would be to focus on their potential presence in
raw materials and other ingredients and implement appropriate measures
to prevent their growth (e.g., formulation, refrigeration) rather than
to monitor for them in the food processing environment.
    We decline the request to expand the requirement to all foods, not
just RTE foods. Although facilities are required to apply CGMPs to
prevent contamination of foods that are not RTE, these foods will
receive a treatment that will significantly minimize or prevent
environmental pathogens at a later stage.
    Environmental monitoring is directed at microbiological hazards,
not chemical hazards such as food allergens. The rule requires a
facility to evaluate known or reasonably foreseeable food allergen
hazards and to establish food allergen controls when the outcome of the
hazard analysis is that a food allergen hazard is a hazard requiring a
preventive control (Sec.  117.130(b)(1)(ii) and (c)). A facility that
determines that a food allergen hazard requires preventive controls
could, for example, establish sanitation controls for food allergens
and a swabbing program to verify those sanitation controls. Even though
the facility would take swabs from the food processing environment,
such swabs would not be considered ``environmental monitoring'' as that
term is used in this rule.
    (Comment 536) Some comments ask us to clarify whether the
requirement for environmental monitoring ``if contamination of an RTE
food with an environmental pathogen is a significant hazard'' refers to
all RTE foods.
    (Response 536) The requirements for environmental monitoring are
addressed to RTE foods (including RACs, as well as processed foods)
that are exposed to the environment unless the packaged RTE food
receives a treatment or otherwise includes a control measure (such as a
formulation lethal to the pathogen) that would significantly minimize
the pathogen. See Sec.  117.130(c)(1)(ii) and the discussion in
Response 406. See also Comment 525 and Response 525 for a discussion of
environmental monitoring as it could apply to the produce industry.
    (Comment 537) Some comments suggest that a mechanism to reduce
costs could be to clarify that environmental testing should only be
done on food-contact surfaces.
    (Response 537) We disagree that it would be appropriate to focus
environmental monitoring only on food-contact surfaces. It is well-
established that successful environmental monitoring programs look to
eliminate environmental pathogens from non-food-contact surfaces as a
means to keep the pathogens from contaminating food-contact surfaces
and thereby contaminating food.

F. Proposed Sec.  117.165(a)(4)--Review of Records

    We proposed to require review of specified records by (or under the
oversight of) a preventive controls qualified individual, to ensure
that the records are complete, the activities reflected in the records
occurred in accordance with the food safety plan, the preventive
controls are effective, and appropriate decisions were made about
corrective actions. We proposed to require review of records of
monitoring and corrective action records within a week after the
records are made, and review of records of calibration, product
testing, environmental monitoring, and supplier verification activities
within a reasonable time after the records are made.
    (Comment 538) Some comments assert that it is not necessary for a
preventive controls qualified individual to conduct or oversee review
of records as a verification activity, noting that review of records in
another food safety regulation (i.e., the LACF requirements in part
113) can be done by persons adequately trained in recordkeeping and
review of records.
    (Response 538) The rule does not preclude review of records by
persons other than the preventive controls qualified individual,
provided that the preventive controls qualified individual provides
oversight for that review. Oversight by a preventive controls qualified
individual is necessary because the review of records is critical to
assessing the facility's application of the preventive controls system
and, thus, is fundamental to ensuring its successful operation (78 FR
3646 at 3757-58). Oversight by a preventive controls qualified
individual is consistent with requirements of Federal HACCP regulations
for seafood, juice, and meat and poultry, and with NACMCF HACCP
guidelines (Ref. 35) (78 FR 3646 at 3757-58).
    (Comment 539) Some comments ask us to provide for a timeframe
longer than one week (such as 7 working days) for review of records of
monitoring and corrective actions. Some comments ask us to provide the
same flexibility for review of records of monitoring and corrective
actions as we proposed for review of records of calibration, product
testing, environmental monitoring, and supplier verification activities
(``within a reasonable time'' after the records are made)--e.g.,
because some preventive controls may be monitored less frequently than
is typical in a traditional HACCP plan dominated with CCPs. Some
comments note that corrective actions may not be fully implemented
within 7 days and ask us to provide for review of these records within
a week or other timeframe determined to be appropriate to ensure that
potentially hazardous goods do not enter commerce. Some comments ask us
to retain the one week timeframe for review of records associated with
perishable foods, but to extend the timeframe to one month for
nonperishable foods.
    Some comments state that some food processors that operate on a
batch production basis (rather than a continuous production basis)
review all records related to a particular batch all at once just
before release of the batch

for distribution. These comments assert that it would be inefficient,
unnecessary, and needlessly complicated to require management to review
a few production records in advance of the normal complete records
review, particularly when laboratory testing conducted on the batch by
an outside laboratory takes several weeks to complete.
    (Response 539) We have revised the proposed requirement to require
review of records of monitoring and corrective actions within 7 working
days after the records are made or within a reasonable timeframe,
provided that the preventive controls qualified individual prepares (or
oversees the preparation of) a written justification for a timeframe
that exceeds 7 working days. A timeframe that exceeds 7 working days
will be the exception rather than the norm. For example, reviewing
records before release of product may be considered adequate by a
facility, although this may be later than one week after the records
were created. A facility may determine that all records for a lot of
product will be reviewed after product testing or environmental
monitoring records relevant to that lot of product are available, which
may be more than a week after monitoring records were created. We made
a conforming change to the list of responsibilities of the preventive
controls qualified individual to address the requirement for the
preventive controls qualified individual to provide (or oversee the
preparation of) a written justification for such a timeframe (see Sec.
117.180(a)).
    We are not requiring that a facility review records of monitoring
and corrective actions before release of product or that the timeframe
for the review depend on the shelf life of the food. The purpose of
reviewing records is not to determine whether to release product.
Instead, the purpose of reviewing records is to ensure that the records
are complete, the activities reflected in the records occurred in
accordance with the food safety plan, the preventive controls are
effective, and appropriate decisions were made about corrective
actions. However, a facility will have flexibility to review records of
monitoring and corrective actions within a timeframe that exceeds 7
working days, such as before product release, provided that the
facility provides a written justification for doing so. As discussed in
Response 542, depending on the nature of the record, a facility that
reviews these types of records in a timeframe that exceeds 7 working
days, and finds a problem, may be faced with recall decisions for a
relatively large number of affected lots of product.
    (Comment 540) Some comments ask us to revise the provisions for
review of records by more generally referring to records of
``verification testing (e.g., product testing and/or environmental
monitoring as applicable).''
    (Response 540) We have revised the regulatory text to refer to
records of ``testing (e.g., product testing, environmental
monitoring).''
    (Comment 541) Some comments refer to our request for comment on
whether the regulatory text should specify the verification activities
that must be conducted for corrective actions (see the discussion in
Comment 489 and Response 489). These comments assert that if we do not
further specify verification activities for corrective actions then we
should eliminate the proposed requirement to review records of
corrective actions.
    (Response 541) Records are necessary to document all verification
activities (see Sec.  117.155(b)). The fact that the rule provides
flexibility for the facility to appropriately determine the
verification activities for corrective actions, rather than prescribes
these verification activities, has no bearing on the requirement to
document the verification activities.
    (Comment 542) Some comments state that records of calibration
activities are reviewed at the time the calibration is performed. These
comments assert that in most cases a formal scheduled review of
calibration records is not required to ensure the effectiveness of the
control and that records review of calibrations should be based upon
the nature of the control being calibrated.
    (Response 542) The purpose of reviewing records as a verification
activity is to ensure that the records are complete, the activities
reflected in the records occurred in accordance with the food safety
plan, the preventive controls are effective, and appropriate decisions
were made about corrective actions. Although records may be reviewed at
the time they are made, the review of records as a verification
activity includes oversight by a preventive controls qualified
individual (see Response 538). Because the timeframe for review of
calibration records is ``within a reasonable time after the records are
created,'' the facility has flexibility over the frequency of
conducting this review. However, depending on the nature of the control
for which the instrument is being calibrated, a facility that reviews
calibration records infrequently, and finds a problem with calibration
of process monitoring instruments and verification instruments, may be
faced with recall decisions for a relatively large number of affected
lots of product.
    (Comment 543) Some comments emphasize the importance of calibrating
those instruments and monitoring devices that are critical to the
preventive control, and reviewing the associated records, before
validation of a lethality step and as frequently as necessary
thereafter. These comments question whether requiring review of
calibration records ``within a reasonable time'' will be adequate.
    (Response 543) We agree that instruments and monitoring devices
that are critical to a preventive control should be calibrated, and
calibration records should be reviewed, before conducting studies to
validate a lethality step. However, the provision is directed at
verification of implementation and effectiveness of preventive controls
on an ongoing basis. This rule does not prescribe specific steps that a
facility must take before conducting validation studies.
    A facility has flexibility to appropriately determine the frequency
of reviewing calibration records based on the facility, the food, and
the nature of the preventive control. We agree that it would be prudent
to review calibration records of those instruments and monitoring
devices that are critical to the preventive control more frequently
than of those instruments and monitoring devices that are not critical
to the preventive control. As discussed in Response 542, depending on
the nature of the control for which the instrument is being calibrated,
a facility that reviews calibration records infrequently, and finds a
problem with calibration of process monitoring instruments and
verification instruments, may be faced with recall decisions for a
relatively large number of affected lots of product.

G. Proposed Sec.  117.165(b)--Written Procedures

1. Proposed Sec.  117.165(b)(1)--Frequency of Calibration
    We proposed that you must establish and implement written
procedures for the frequency of calibrating process monitoring
instruments and verification instruments.
    (Comment 544) As discussed in Comment 519, some comments ask us to
specify that an accuracy check may be used as a verification activity
in lieu of calibration. These comments also ask us to specify that
written procedures address the frequency of accuracy checks, as well as
calibration.

    (Response 544) Consistent with Response 519, we have revised the
proposed requirement to specify that written procedures address the
frequency of accuracy checks, as well as calibration.
2. Proposed Sec.  117.165(b)(2) and (b)(3)--Product Testing and
Environmental Monitoring
    We proposed that you must establish and implement written
procedures for product testing. We proposed that procedures for product
testing must: (1) Be scientifically valid; (2) identify the test
microorganism(s); (3) specify the procedures for identifying samples,
including their relationship to specific lots of product; (4) include
the procedures for sampling, including the number of samples and the
sampling frequency; (5) identify the test(s) conducted, including the
analytical method(s) used; (6) identify the laboratory conducting the
testing; and (7) include the corrective action procedures required by
Sec.  117.150(a)(1).
    Likewise, we proposed that you must establish and implement written
procedures for environmental monitoring. Procedures for environmental
monitoring must: (1) Be scientifically valid; (2) identify the test
microorganism(s); (3) identify the locations from which the samples
will be collected and the number of sites to be tested during routine
environmental monitoring; (4) identify the timing and frequency for
collecting and testing samples; (5) identify the test(s) conducted,
including the analytical method(s) used; (6) identify the laboratory
conducting the testing; and (7) include the corrective action
procedures required by Sec.  117.150(a)(1).
    (Comment 545) Some comments express concern that the word ``valid''
in the phrase ``scientifically valid'' could be construed to mean
``validated'' because not all testing protocols can be validated within
the traditional meaning of the term. These comments state their belief
that what we intend is for these testing programs to be ``technically
sound.'' Other comments express concern that ``scientifically valid''
may be interpreted to mean that firms are required to develop or
validate analytical methods (either in general or for specific food
matrices).
    (Response 545) We are retaining the term ``scientifically valid''
in these provisions. We disagree that we would interpret
``scientifically valid'' to mean that facilities are required to
develop or validate analytical methods. We discussed our interpretation
of the term ``scientifically valid'' in the Appendix to the 2013
proposed preventive controls rule (78 FR 3646 at 3812 to 3813), and
noted that this interpretation was consistent with our previous
discussion of the term ``scientifically valid'' (in place of
``validated'') in the rulemaking to establish CGMP requirements for
dietary supplements (68 FR 12158 at 12198, March 13, 2003). While
validated methods are considered ``scientifically valid,'' methods that
have not gone through formal validation processes but have been
published in scientific journals, for example, may also be
``scientifically valid.'' We do expect methods used for testing to be
adequate for their intended use.
    We have had several years interpreting the term ``scientifically
valid'' in the context of the requirement, in the dietary supplement
CGMPs, that the manufacturer must ensure that the tests and
examinations that it uses to determine whether the specifications are
met are appropriate, scientifically valid methods (Sec.  111.75(h)(1)).
Although we agree that methods that are ``scientifically valid'' would
also be ``technically sound,'' we disagree that the hypothetical
concern that we would construe ``scientifically valid'' to mean
``validated'' warrants changing ``scientifically valid'' to a new term
(such as ``technically sound'') in light of our previous statements
regarding this term and experience in the context of CGMP requirements.
See the final rule establishing the dietary supplement CGMPs for
additional discussion on the terms ``validated'' and ``scientifically
valid'' (72 FR 34752 at 34853).
    (Comment 546) Some comments support the proposed requirements for
written procedures for environmental monitoring, including providing
flexibility to use indicator organisms and to design the timing,
location, and frequency of environmental monitoring programs in a risk-
based manner, and in not prescribing specific locations (e.g., food-
contact surfaces or ``zone 1'') or sample quantities for testing. Other
comments ask us to add details to the written procedures for product
testing and environmental monitoring regarding when and where sampling
is required and the number of samples to take. Some comments ask us to
make sure the most current ``sampling planning science'' is used for
environmental monitoring by specifying that procedures for
environmental monitoring must employ ``sample quality criteria
objectives.'' Other comments assert that the product testing procedure
requirements are inadequate and ask us to require that procedures for
product testing specify the procedures for identifying samples
(including their relationship to specific lots of product); describe
how sampling was conducted (to establish that the sample obtained
adequately represents the lot of product the sample is intended to
represent); and include the procedures for sample quality control from
field to lab. Other comments assert that the frequency of environmental
monitoring and product testing is unclear and express concern that
frequent swabbing and frequent testing could cause cheeses to be held
past their optimum ripeness if they are fresh or soft ripened.
    (Response 546) We decline the request to prescribe additional
details, such as those described in these comments, in the requirements
for written procedures for product testing and environmental
monitoring. As with other procedures required by the rule, those
relating to environmental monitoring and product testing must be
adequate for their intended purpose. Further, procedures will not be
identical in all circumstances. For example, a facility that produces
products with a short shelf life may choose a different frequency of
swabbing and testing than a facility that produces products with a long
shelf life.
    (Comment 547) Some comments ask us to provide more flexibility in
product testing by not requiring establishments to provide written
procedures for product testing and corrective action procedures.
    (Response 547) These comments are unclear. By requiring that a
facility establish its own procedures, the rule provides facilities
with flexibility to develop a product testing program that works best
for its facility and its products. We are retaining the requirements
for written procedures for product testing, as well as for corrective
action procedures.
    (Comment 548) Some comments ask us to add a provision requiring
that all positive results must result in corrective action being taken.
    (Response 548) We decline this request. The rule requires that a
facility must establish and implement written corrective action
procedures that must be taken if preventive controls are not properly
implemented, including procedures to address, as appropriate, the
presence of a pathogen or appropriate indicator organism in an RTE
product detected as a result of product testing and the presence of an
environmental pathogen or appropriate indicator organism detected
through environmental monitoring (see Sec.  117.150(a)(1)). However,
the rule does not pre-determine what corrective actions a facility must
take when presented with positive results from product testing or
environmental

monitoring. The corrective action procedures that a facility would
develop, and the actual corrective actions that the facility would
take, will depend on the nature of the hazard and the nature of the
preventive control, as well as information relevant to the positive
result (e.g., pathogen or indicator organism, product or environment,
food-contact surface or non-food-contact surface).

XXXV. Subpart C: Comments on Proposed Sec.  117.170--Reanalysis

    We proposed to establish requirements for reanalysis of the food
safety plan. Some comments support the proposed requirements without
change. For example, comments agree that a preventive controls
qualified individual must perform (or oversee) the reanalysis (see
section XXXV.D). Some comments that support the proposed provisions
suggest alternative or additional regulatory text (see, e.g., Comment
549, Comment 550, Comment 552, Comment 553, Comment 557, and Comment
558).
    In the following paragraphs, we discuss comments that disagree
with, or suggest one or more changes to, the proposed requirements.
After considering these comments, we have revised the proposed
requirements as shown in table 39, with editorial and conforming
changes as shown in table 52.

     Table 39--Revisions to the Proposed Requirements for Reanalysis
------------------------------------------------------------------------
            Section                Description            Revision
------------------------------------------------------------------------
117.170(b)....................  Circumstances      Provide for
                                 that require       reanalysis of an
                                 reanalysis.        applicable portion
                                                    of the food safety
                                                    plan (rather than
                                                    the complete food
                                                    safety plan) in
                                                    specified
                                                    circumstances.
117.170(b)(4).................  Circumstances      Require reanalysis of
                                 that require       the food safety plan
                                 reanalysis.        as a whole, or the
                                                    applicable portion
                                                    of the food safety
                                                    plan, whenever a
                                                    preventive control,
                                                    combination of
                                                    preventive controls,
                                                    or the food safety
                                                    plan as a whole is
                                                    found to be
                                                    ineffective.
117.170(c)....................  Timeframe to       Clarify that the
                                 complete the       requirement applies
                                 reanalysis.        to completing the
                                                    reanalysis and
                                                    validating any
                                                    additional
                                                    preventive controls
                                                    (as appropriate to
                                                    the nature of the
                                                    preventive control
                                                    and its role in the
                                                    facility's food
                                                    safety system),
                                                    rather than to
                                                    completing the
                                                    reanalysis and
                                                    implementing any
                                                    additional
                                                    preventive controls
                                                    (emphasis added).
------------------------------------------------------------------------

A. Proposed Sec.  117.170(a)--Circumstances Requiring Reanalysis

    We proposed that you must conduct a reanalysis of the food safety
plan: (1) At least once every 3 years; (2) whenever a significant
change in the activities conducted at your facility creates a
reasonable potential for a new hazard or creates a significant increase
in a previously identified hazard; (3) whenever you become aware of new
information about potential hazards associated with the food; (4)
whenever appropriate after an unanticipated food safety problem; and
(5) whenever you find that a preventive control is ineffective.
    (Comment 549) Some comments assert that the need to reanalyze the
food safety plan will depend on the nature of the preventive control
and its role in the food safety system. These comments also assert that
if a specific preventive control is found to be ineffective, only the
applicable portion of the food safety plan would need to be reanalyzed.
    (Response 549) We agree and have revised the regulatory text, with
associated editorial changes and redesignation, to separate the
requirement to reanalyze the food safety plan as a whole every 3 years
from all other circumstances when reanalysis is required ``for cause.''
When reanalysis is ``for cause,'' the regulatory text provides that
reanalysis is of the food safety plan as a whole, or the applicable
portion of the food safety plan.
    (Comment 550) Some comments ask us to recognize other terminologies
already used by some facilities (e.g., ``reassess'').
    (Response 550) We have acknowledged that the terminology used in
relation to the concept of ``reanalysis'' varies in current regulations
and guidelines for systems such as HACCP (78 FR 3646 at 3759). A
facility may choose to use a term such as ``reassessment'' in its
records--e.g., if it relies on existing records that use the term
``reassessment'' to satisfy some or all of the requirements of this
rule for reanalysis. However, the human preventive controls rule will
use a single term (i.e., reanalyze) to minimize the potential for
confusion about whether different terms have a different meaning for
the purposes of the rule.
    (Comment 551) Some comments ask us to define ``reanalysis'' to mean
``a reassessment of the validity of a preventive control or food safety
plan to control a hazard. Reanalysis may include a system review and,
where necessary, activities to revalidate a control measure or
combination of control measures.''
    (Response 551) We decline this request. Reanalysis goes beyond
assessing the validity of a preventive control or food safety plan to
control a hazard. Reanalysis can also include assessing whether all
hazards have been identified, whether established procedures are
practical and effective, and other factors.
    (Comment 552) Some comments ask us to require reanalysis on an
annual basis, noting that annual reanalysis is required by Federal
HACCP regulations for seafood, juice, and meat and poultry.
    (Response 552) We decline this request. We proposed to require
reanalysis at least once every 3 years as a minimum requirement in the
event that there is no other circumstance warranting reanalysis (see
proposed Sec.  117.170(a)(1)). That 3-year minimum is consistent with
the statute (see section 418(i) of the FD&C Act). As a practical
matter, we expect that reanalysis will occur more frequently as a
result of changes in the activities conducted at a facility (see final
Sec.  117.170(b)(1) through (4)).
    (Comment 553) Some comments suggest editorial changes to improve
the readability of the requirement to conduct reanalysis when there is
a change in a preventive control.
    (Response 553) We are including these editorial changes in the
regulatory text, which now reads whenever ``a significant change in the
activities conducted at your facility creates a reasonable potential .
. .''
    (Comment 554) Some comments assert that the proposed requirement to
conduct reanalysis whenever you become aware of new information about
potential hazards associated with the food does not align with FSMA
statutory language, is ambiguous, and would establish vague compliance
obligations.

    (Response 554) We disagree. See our previous discussion regarding
the emergence of the pathogen L. monocytogenes in the mid-1980's and
the first outbreak of foodborne illness in the United States, in 2006-
2007, caused by consumption of peanut butter contaminated with
Salmonella (78 FR 3646 at 3759). Although we acknowledge that the
proposed requirement is not explicit in section 418(i) of the FD&C Act,
we disagree it is not in alignment with FSMA as a whole. FSMA directs
the owner, operator, or agent in charge of a facility to evaluate the
hazards that could affect food manufactured, processed, packed, or held
by such facility and identify and implement preventive controls to
significantly minimize or prevent the occurrence of those hazards (see
section 418(a) of the FD&C Act). In other words, FSMA focuses on a
system to prevent food safety problems rather than a system to react to
problems after they occur. Requiring that a facility reanalyze its food
safety plan, or the applicable portion of the food safety plan, in
response to information such as the emergence of a new foodborne
pathogen, or an outbreak of foodborne illness from consumption of a
food product not previously associated with foodborne illness from a
well-known pathogen, aligns very well with the statutory direction in
FSMA.
    (Comment 555) Some comments ask us to specify that reanalysis is
required when a preventive control ``fails to be'' properly implemented
rather than when a preventive control ``is not'' properly implemented.
    (Response 555) We decline this request. We see no meaningful
difference between ``fails to be'' and ``is not'' in this context,
except that ``fails to be'' could lead to questions about the meaning
of the term ``fails'' in this context.
    (Comment 556) Some comments ask us to add a requirement to conduct
reanalysis whenever a preventive control is found to be ``missing'' in
addition to whenever a preventive control is found to be
``ineffective.''
    (Response 556) We have revised the regulatory text to require
reanalysis whenever a preventive control, a combination of preventive
controls, or the food safety plan as a whole, is ineffective. (See
Sec.  117.170(b)(4).) A ``missing'' preventive control could be
discovered during verification to establish the validity of the food
safety plan as a whole or as a result of an unanticipated problem. (See
Response 482.) If circumstances lead a facility to conclude that an
additional (or different) preventive control is necessary, the facility
would include that preventive control in its food safety plan along
with associated preventive control management components, including
verification to establish the validity of the food safety plan.

B. Proposed Sec.  117.170(b)--Timeframe To Complete Reanalysis

    We proposed that you must complete the reanalysis and implement any
additional preventive controls needed to address the hazard identified,
if any, before the change in activities at the facility is operative
or, when necessary, during the first 6 weeks of production. We have
clarified that the requirement is to complete the reanalysis and
validate (rather than implement) any additional preventive controls as
appropriate to the nature of the preventive control and its role in the
facility's food safety system.
    (Comment 557) As discussed in Comment 501, some comments question
whether 6 weeks is enough time to perform all applicable validation
studies that would address the execution element of validation.
Likewise, some comments question whether 6 weeks is enough time to
complete reanalysis.
    (Response 557) Consistent with revisions we have made to the
timeframe to complete validation (see Response 501), we have revised
the timeframe to complete the reanalysis and validate, as appropriate
to the nature of the preventive control and its role in the facility's
food safety system, any additional preventive controls to be within 90
days after production of the applicable food first begins or within a
reasonable timeframe, provided that the preventive controls qualified
individual provides (or oversees the preparation of) a written
justification for a timeframe that exceeds 90 days after production of
the applicable food first begins. We made a conforming change to the
list of responsibilities of the preventive controls qualified
individual (see Sec.  117.180(a)).
    (Comment 558) Some comments state that the phrase ``before the
change in activities at the facility is operative'' is ambiguous in
that it is unclear if the phrase is referencing the initial change in
activities that triggered the reanalysis or a change in activities
subsequent to the reanalysis. These comments ask us to clarify the
requirement by substituting the phrase ``before the relevant process is
operative.''
    (Response 558) We agree that there was ambiguity in this phrase,
because changes in activities could result in the need for reanalysis
and reanalysis could result in the need for changes in activities, both
of which can result in a new preventive control. We have made several
revisions to the regulatory text, with associated editorial changes, to
clarify the requirements for reanalysis. First, we have clarified that
reanalysis can be routine (at least every 3 years) or ``for cause''
(i.e., a significant change that creates the potential for a new hazard
or an increase in a previously identified hazard; when you become aware
of new information about potential hazards associated with the food;
when there is an unanticipated food safety problem; or whenever a
preventive control, combination of preventive controls or the food
safety plan as a whole is ineffective). Second, we have specified that
the reanalysis ``for cause'' may be for the entire food safety plan or
only for an applicable portion.
    In addition, as discussed in Response 557, we have clarified that
the reanalysis and the validation, as appropriate to the nature of the
preventive control and its role in the facility's food safety system,
of any additional preventive controls needed to address an identified
hazard would need to be completed before any change in activities
(including any change in preventive controls) is operative. When
additional time is necessary, we have provided for a timeframe within
90 days after production of the applicable food first begins or within
a reasonable timeframe, provided that the preventive controls qualified
individual provides (or oversees the preparation of) a written
justification for a timeframe that exceeds 90 days after production of
the applicable food first begins. In other words, if you decide to make
a change, you should conduct a reanalysis before you make that change
if there is potential for that change to create or increase a hazard; a
reanalysis that results in changes to preventive controls should be
completed and the preventive controls validated, as appropriate to the
nature of the preventive control and its role in the facility's food
safety system, before changes in activities to produce food using a new
preventive control are put into operation. However, we acknowledge that
it may be necessary to produce product to demonstrate a revised
preventive control can be implemented appropriately, and provide for an
extended timeframe to make this assessment.

C. Proposed Sec.  117.170(c)--Requirement To Revise the Written Food
Safety Plan or Document Why Revisions Are Not Needed

    We proposed that you must revise the written food safety plan if a
significant change is made or document the basis

for the conclusion that no revisions are needed. We received no
comments that disagreed with this proposed requirement and are
finalizing it as proposed.

D. Proposed Sec.  117.170(d) --Requirement for Oversight of Reanalysis
by a Preventive Controls Qualified Individual

    We proposed that a preventive controls qualified individual must
perform (or oversee) the reanalysis. We received no comments that
disagreed with this proposed requirement and are finalizing it as
proposed. See section XXXVI.B.1 for comments on the qualifications for
a preventive controls qualified individual who would perform or oversee
the reanalysis.

E. Proposed Sec.  117.170(e)--Reanalysis on the Initiative of FDA

    We proposed that you must conduct a reanalysis of the food safety
plan when FDA determines it is necessary to respond to new hazards and
developments in scientific understanding.
    (Comment 559) Some comments ask us to issue formal, written
communications about new hazards and developments in scientific
understanding. These comments express concern that communications of
this type could be inconsistent if they are communicated by individual
investigators. Other comments ask us to specify in the regulatory text
that it is the Commissioner of Food and Drugs who makes the
determination that it is necessary to conduct a reanalysis of the food
safety plan.
    (Response 559) We agree that a communication from FDA about the
need to reanalyze the food safety plan should be issued in a formal
written manner but disagree that it is necessary to specify that it is
the Commissioner of Food and Drugs who makes the determination that it
is necessary to conduct a reanalysis of the food safety plan. The
comment provides no basis for precluding such a determination by an
organizational component (such as CFSAN or a component of FDA's Office
of Regulatory Affairs) that has operational responsibility for food
safety and subject matter experts to advise the managers in those
organizational components.

XXXVI. Subpart C: Comments on Proposed Sec.  117.180--Requirements
Applicable to a Preventive Controls Qualified Individual and a
Qualified Auditor

    We proposed to establish requirements for the qualifications of a
preventive controls qualified individual and a qualified auditor. Some
comments support the proposed requirements without change. Some
comments that support the proposed provisions suggest alternative or
additional regulatory text (see, e.g., Comment 563 and Comment 568) or
ask us to clarify how we will interpret the provisions (see, e.g.,
Comment 560, Comment 564, and Comment 571).
    In the following paragraphs, we discuss comments that ask us to
clarify the proposed requirements or that disagree with, or suggest one
or more changes to, the proposed requirements. After considering these
comments, we are finalizing the provisions as proposed with conforming
changes as shown in table 52.

A. Proposed Sec.  117.180(a) and (b)--What a Preventive Controls
Qualified Individual or Qualified Auditor Must Do or Oversee

    We proposed to list the functions that must be performed by one or
more preventive controls qualified individuals (i.e., preparation of
the food safety plan; validation of the preventive controls; review of
records for implementation and effectiveness of preventive controls and
appropriateness of corrective actions; and reanalysis of the food
safety plan) or by a qualified auditor (i.e., conduct an onsite audit).
We proposed to list these functions for simplicity (i.e., to make it
easy to see all of the requirements in a single place). We specified
that this list of functions already proposed to be established in
applicable sections of the rule did not in itself impose any additional
requirements.
    (Comment 560) Some comments ask us to clarify whether the
preventive controls qualified individual must be on the premises during
operating hours. Other comments ask us to clarify that the preventive
controls qualified individual is not responsible for performing
laboratory testing, because the preventive controls qualified
individual may not be appropriately educated and trained for laboratory
testing.
    (Response 560) The rule does not require that the preventive
controls qualified individual be onsite during operating hours. The
rule also does not require that the preventive controls qualified
individual be responsible for performing laboratory testing, although
review of testing records (e.g., records of product testing or
environmental testing) must be conducted or overseen by a preventive
controls qualified individual.
    (Comment 561) Some comments ask us to consider the implication of
having the preventive controls qualified individual serve as the
process authority, serve as the auditor, and offer final sign off on a
validation and corrective actions, and suggest that a third party may
be necessary to ensure that uniform standards are applied.
    (Response 561) To the extent that the comment suggests that the
functions of the preventive controls qualified individual create a
conflict of interest, we disagree. The rule focuses on the need for
applicable training and experience to perform certain functions. The
preventive controls qualified individual must develop (or oversee the
development of) the food safety plan that controls the identified
hazards and then ensure through review of records that the plan is
being implemented as designed. The rule does not require that a
facility engage a third party to provide oversight of any individual,
including a preventive controls qualified individual, but does not
preclude a facility from doing so if it chooses.

B. Proposed Sec.  117.180(c)--Qualification Requirements

1. Proposed Sec.  180(c)(1)--Preventive Controls Qualified Individual
    We proposed that to be a preventive controls qualified individual,
the individual must have successfully completed training in the
development and application of risk-based preventive controls at least
equivalent to that received under a standardized curriculum recognized
as adequate by FDA or be otherwise qualified through job experience to
develop and apply a food safety system. We also proposed that this
individual may be, but is not required to be, an employee of the
facility.
    (Comment 562) Some comments ask us to work with industry to
establish a national training curriculum and standards for knowledge
requirements before the final rule is issued. Comments recommend that
curriculum and training requirements be consistent with already
existing standards, including Better Process Control School,
International HACCP, GFSI, Seafood HACCP, and those trainings offered
by Cooperative Extension or State Agriculture departments. Some
comments ask us to allow flexibility for industry to continue current
training programs without receiving express approval from the FSPCA.
Other comments ask that a standardized curriculum for training a
preventive controls qualified individual be harmonized with the GFSI
requirement.
    (Response 562) As discussed in Response 2, the FSPCA is
establishing a

standardized curriculum. The curriculum will focus on the specific
requirements of the human preventive controls rule. Training providers
do not need approval from the FSPCA to use the curriculum.
    (Comment 563) Some comments ask who will assess the qualifications
of a particular preventive controls qualified individual or determine
whether particular individuals are in fact ``qualified.'' Some comments
ask us to use an outcome-based demonstration of competency. Some
comments ask us to specify that all work experience must be comparable
or that a preventive controls qualified individual must pass a
proficiency test. Some comments ask us to establish minimum standards
for competency. Some comments ask us to clarify what job experiences
would be sufficient. Some comments ask how we will verify that reported
training and experience are true.
    (Response 563) We are not establishing minimum standards for
competency and do not intend routinely to directly assess the
qualifications of persons who function as the preventive controls
qualified individual, whether by their training or by their job
experience. Instead, we intend to focus our inspections on the adequacy
of the food safety plan. As necessary and appropriate, we will consider
whether deficiencies we identify in the food safety plan suggest that
the preventive controls qualified individual may not have adequate
training or experience to carry out the assigned functions, including
whether reported training and experience is accurately represented.
    (Comment 564) Some comments ask us to provide for competency
requirements to be met through on-the-job experience in lieu of
traditional classroom training. Some comments ask us to clarify what we
mean by training that is ``at least equivalent'' to that received under
a standardized curriculum recognized as adequate by FDA. Some comments
ask us to clarify whether individuals who have successfully completed
training in the development and application of risk-based preventive
controls through programs delivered and recognized under the
International HACCP Alliance would be considered to have completed
training ``equivalent'' to that recognized by FDA for the development
and application of risk-based preventive controls.
    (Response 564) The requirements do provide for qualification
through appropriate job experience, such as experience with
successfully implementing HACCP systems or other preventive-based food
safety systems. It is the responsibility of the owner, operator, or
agent in charge of the facility to determine whether any individual who
prepares (or oversees the preparation of) the food safety plan has
appropriate qualifications to do so, whether by on-the-job experience
or by training.
    There are some differences in the requirements of the human
preventive controls rule compared to the requirements of HACCP
regulations for seafood, juice, and meat and poultry such that training
provided by the International HACCP Alliance may not be equivalent.
Such an individual may need to obtain supplemental training specific to
the rule. Alternatively, a person who has received the International
HACCP Alliance training and has implemented a HACCP plan may be
qualified through job experience.
    (Comment 565) Some comments ask us to emphasize that a standardized
curriculum in the development and application of risk-based preventive
controls may not provide a preventive controls qualified individual
with sufficient expertise to design and conduct robust, scientific
validation studies to support the adequacy of control measures.
    (Response 565) We acknowledge that a single training course may not
provide adequate training for every function of the preventive controls
qualified individual for the foods produced by a facility. In some
cases an individual may gain the full complement of knowledge and
experience through multiple, specific training courses; in other cases
an individual may gain the full complement of knowledge and experience
through job experience or through a combination of training and job
experience.
    (Comment 566) Some comments ask us not to establish requirements
that are overly strict because there is a finite supply of food safety
experts in the country and many facilities will need multiple
preventive controls qualified individuals.
    (Response 566) We disagree that the requirements applicable to the
preventive controls qualified individual should be designed to match
any current limitations in the number of individuals who have the
knowledge and skill to prepare (or oversee the preparation of) a food
safety plan. We expect that market forces will act to increase the
number of preventive controls qualified individuals to match the demand
generated by this rule. In addition, as discussed in section LVI.A, we
are staggering the compliance dates for the rule, so that only those
businesses that are not small or very small businesses will need to
comply with the rule within one year, and very small businesses are not
required to develop a food safety plan or conduct other activities that
require oversight by a preventive controls qualified individual.
    (Comment 567) Some comments ask us to develop training that
emphasizes the need for appropriate equipment standards.
    (Response 567) The training will focus on the specific requirements
of the human preventive controls rule, which does not establish
requirements for equipment standards.
    (Comment 568) Some comments ask us to provide that the standardized
curriculum can be recognized as adequate by the competent authority for
food safety in each country rather than by FDA. One comment cited a
requirement in one country for training that is consistent with Codex
HACCP.
    (Response 568) We decline this request. The standardized curriculum
will be available to training providers, and we expect market forces
will result in the development in foreign countries of training
consistent with the standardized training curriculum. As noted
previously (see Response 564), HACCP-based training may not be
equivalent to the standardized curriculum because of the specific
requirements of this rule. However, we believe that the flexibility
provided by the alternative that a preventive controls qualified
individual may be otherwise qualified through job experience to develop
and apply a food safety system provides an approach to address the
circumstances in a foreign country with respect to preventive controls
qualified individuals until the training is available. In addition we
will work with partners around the world--including the Alliances,
regulatory counterparts, and multinational organizations--to promote
training to the global community of food suppliers. We intend to meet
both the letter and the spirit of our obligation to the World Trade
Organization to facilitate training on the new regulations,
particularly in developing nations.
2. Proposed Sec.  117.180(c)(2)--Qualified Auditor
    We proposed that to be a qualified auditor, a preventive controls
qualified individual must have technical expertise obtained by a
combination of training and experience appropriate to perform the
auditing function.
    (Comment 569) Some comments object to the proposed requirement that
a qualified auditor must be a preventive

controls qualified individual with certain technical auditing
expertise. One comment asserts that a qualified auditor should not be
required to have the broader skills of a preventive controls qualified
individual.
    (Response 569) We have revised the definition of ``qualified
auditor,'' and the requirements applicable to a ``qualified auditor,''
such that a ``qualified auditor'' means a person who is a ``qualified
individual'' as that term is defined in this final rule, rather than a
``preventive controls qualified individual,'' because some auditors may
be auditing businesses (such as produce farms) that are not subject to
the requirements for hazard analysis and risk-based preventive
controls, and it would not be necessary for such an auditor to be a
``preventive controls qualified individual.''
    (Comment 570) Some comments ask us to consider specifying training
for qualified auditors. These comments also ask us to consider certain
industry documents in any guidance we may issue regarding qualified
auditors.
    (Response 570) At this time, we are not planning to specify a
training curriculum for qualified auditors. If we develop guidance
related to qualified auditors, we will consider industry documents that
are already available.

C. Proposed Sec.  117.180(d)--Records

    We proposed that all applicable training must be documented in
records, including the date of the training, the type of training, and
the person(s) trained. For clarity, we have revised the requirement to
specify the type of training that must be documented--i.e., applicable
training in the development and application of risk-based preventive
controls (see 78 FR 3646 at 3762).
    (Comment 571) Some comments ask us to explain how job experience
should be documented in records to prove qualifications.
    (Response 571) The rule does not require documentation of job
experience. A facility has flexibility to determine whether and how to
document the job experience of a preventive controls qualified
individual. For example, a facility could ask a preventive controls
qualified individual to provide a resume documenting applicable
experience. As discussed in Response 563, we intend to focus our
inspections on the adequacy of the food safety plan. As necessary and
appropriate, we will consider whether deficiencies we identify in the
food safety plan suggest that the preventive controls qualified
individual may not have adequate experience to carry out the assigned
functions.

XXXVII. Subpart C: Comments on Proposed Sec.  117.190--Implementation
Records

    We proposed to list all records documenting implementation of the
food safety plan in Sec.  117.190(a). We noted that proposed Sec.
117.190(a) would not establish any new requirements but merely make it
obvious at a glance what implementation records are required under
proposed part 117, subpart C. We received no comments that disagreed
with this proposed provision and are finalizing it as proposed.
    We proposed that the records that you must establish and maintain
are subject to the requirements of proposed subpart F (Requirements
Applying to Records that Must be Established and Maintained). (Proposed
subpart F would establish requirements that would apply to all records
that would be required by the various proposed provisions of proposed
part 117.) We received no comments that disagreed with this proposed
provision and are finalizing it as proposed.

XXXVIII. Subpart D: Comments on Proposed Sec.  117.201--Modified
Requirements That Apply to a Qualified Facility

    As previously discussed (78 FR 3646 at 3769), sections 418(l)(2)(A)
and (B) of the FD&C Act provide that a qualified facility must submit
two types of documentation to us. The first type of required
documentation relates to food safety practices at the facility, with
two options for satisfying this documentation requirement. Under the
first option, the qualified facility may choose to submit documentation
that demonstrates that it has identified potential hazards associated
with the food being produced, is implementing preventive controls to
address the hazards, and is monitoring the preventive controls to
ensure that such controls are effective. Alternatively, under the
second option, the qualified facility may choose to submit
documentation (which may include licenses, inspection reports,
certificates, permits, credentials, certification by an appropriate
agency (such as a State department of agriculture), or other evidence
of oversight), that the facility is in compliance with State, local,
county, or other applicable non-Federal food safety law. The second
type of required documentation relates to whether the facility
satisfies the definition of a qualified facility.
    If a qualified facility does not prepare documentation
demonstrating that it has identified potential hazards associated with
the food being produced, is implementing preventive controls to address
the hazards, and is monitoring the preventive controls to ensure that
such controls are effective, it must provide notification to consumers
of certain facility information by one of two procedures, depending on
whether a food packaging label is required on the food.
    Consistent with the statutory direction of section 418(l) of the
FD&C Act, we proposed the following modified requirements for qualified
facilities: (1) Submission of certain documentation (proposed Sec.
117.201(a)); (2) procedures for submission of the documentation
(proposed Sec.  117.201(b)); (3) the frequency of the submissions
(proposed Sec.  117.201(c)); (4) notification to consumers in certain
circumstances (proposed Sec.  117.201(d)); and (5) applicable records
that a qualified facility must maintain.
    In the 2013 proposed human preventive controls rule, we tentatively
concluded that a certified statement would be acceptable for the
purposes of satisfying the submission requirements of proposed Sec.
117.201(a). We also requested comment on the efficiency and
practicality of submitting the required documentation using the
existing mechanism for registration of food facilities, with added
features to enable a facility to identify whether or not the facility
is a qualified facility.
    Some comments support one or more of the proposed requirements
without change. For example, some comments state that our proposed
interpretation of the statutory term ``business address'' is consistent
with our use of the term ``business address'' in our regulations
regarding information that must be included in a prior notice for
imported food (21 CFR 1.281). Some comments that support the proposed
provisions suggest alternative or additional regulatory text (see,
e.g., Comment 587 through Comment 589, Comment 591 through Comment 593,
and Comment 596 through Comment 598) or ask us to clarify how we will
interpret the provision (see, e.g., Comment 572 and Comment 579 through
Comment 585).
    In this section, we discuss comments that ask us to clarify the
proposed requirements or that disagree with, or suggest one or more
changes to, the proposed requirements. We also address comments
discussing our tentative conclusion regarding the submission of
certified statements to FDA, including submitting certified statements
using the existing mechanism for registration of food facilities. After
considering these comments, we have revised the proposed requirements
as shown in

table 40, with editorial and conforming changes as shown in table 52.
    As discussed in Response 155, we have revised the definition of
very small business to specify that it is based on an average (of sales
plus market value of human food held without sale) during the 3-year
period preceding the applicable calendar year and, as a companion
change, we are explicitly requiring that a facility determine and
document its status as a qualified facility on an annual basis (see
Sec.  117.201(c)(1)).

               Table 40--Revisions to the Proposed Modified Requirements for Qualified Facilities
----------------------------------------------------------------------------------------------------------------
                 Section                          Description                           Revision
----------------------------------------------------------------------------------------------------------------
117.201(a)..............................  Documentation to be           Specify that the submitted
                                           submitted.                   documentation is an ``attestation.''
                                                                        Add ``tribal'' as an example of
                                                                        applicable non-Federal food safety law.
117.201(b)..............................  Procedure for submission...  Update details regarding the electronic
                                                                        and paper submission of a form specific
                                                                        to the attestation requirement.
117.201(c)..............................  Frequency of determination    New requirement to determine and
                                           and submission.              document status as a qualified facility
                                                                        on an annual basis no later than July 1
                                                                        of each calendar year.
                                                                        Specify that a facility that
                                                                        begins manufacturing, processing,
                                                                        packing or holding food after September
                                                                        17, 2018 must submit the attestation
                                                                        before beginning such operations.
                                                                        Specify that a facility must
                                                                        notify FDA of a change in status from
                                                                        ``not a qualified facility'' to
                                                                        ``qualified facility'' by July 31 of the
                                                                        applicable calendar year.
                                                                        Specify that when the status of
                                                                        a facility changes from ``qualified
                                                                        facility'' to ``not a qualified
                                                                        facility'' based on the annual
                                                                        determination, the facility must notify
                                                                        FDA of that change in status using Form
                                                                        3942a by July 31 of the applicable
                                                                        calendar year.
                                                                        Specify that the required
                                                                        biennial submissions of the attestations
                                                                        must be made during a timeframe that
                                                                        will coincide with the required biennial
                                                                        updates to facility registration.
117.201(d)..............................  Timeframe for compliance     When the status of a facility changes
                                           with the requirements of     from ``qualified facility'' to ``not a
                                           subparts C and G.            qualified facility,'' the facility must
                                                                        comply with subparts C and G no later
                                                                        than December 31 of the applicable
                                                                        calendar year unless otherwise agreed to
                                                                        by FDA and the facility.
117.201(e)..............................  Notification to consumers..  Conforming changes associated with the
                                                                        term ``attestation.''
117.201(f)..............................  Records....................  Conforming changes associated with the
                                                                        term ``attestation.''
----------------------------------------------------------------------------------------------------------------

A. Comments on Submission of a Certification Statement

    (Comment 572) Some comments ask us to clarify the distinction
between the documentation that would be submitted to FDA and the
records that a qualified facility relies on to support the submitted
documentation.
    Some comments agree with our tentative conclusion to use certified
statements to satisfy the proposed submission requirements, noting that
it would save time and money and reduce the paperwork burden on
qualified facilities. Some comments ask us to revise the proposed
requirements to make this use of certified statements explicit in the
regulatory text.
    Other comments disagree with our tentative conclusion to use
certified statements to satisfy the submission requirements. These
comments focus on the importance of actual copies of documents in
determining compliance with the documentation requirements and assert
that proof of qualification requires more than a checked box in an on-
line registration database. Some comments ask us to require that a
qualified facility affirm that it has the original documents on file
and available for FDA inspection. Other comments assert that requiring
qualified facilities to submit copies of the actual documentation would
enable us to easily review food safety plans or inspection reports and
to target our compliance and enforcement activities to those qualified
facilities that pose a greater risk because of inadequate prevention
measures or deficient inspections.
    (Response 572) We are affirming our tentative decision that we will
not require a qualified facility to submit to FDA, as part of its
attestation, the underlying documentation that establishes its
compliance. We agree that the underlying records are needed to
determine compliance with the documentation requirements and that a
qualified facility must retain the documents it is relying on to
support its attestation and make them available to us during
inspection. We also agree that the regulatory text needs to be explicit
regarding the required documentation and that we need to clearly
distinguish between the documentation that would be submitted to FDA
and the records that a qualified facility relies on to support the
submitted documentation. Therefore, we have made the following three
revisions to the proposed regulatory text.
    First, we have revised proposed Sec.  117.201(a) to specify that
the submitted documentation is an ``attestation.'' Second, we have
revised proposed Sec.  117.201(b) to update details regarding the
electronic and paper submission of a form specific to this attestation
requirement. Third, we have revised proposed Sec.  117.201(e) (final
Sec.  117.201(f)) to specify that you must maintain those records
relied upon to support the ``attestations'' that are required by Sec.
117.201(a).
    We acknowledge that requiring submission of the actual
documentation would enable us to easily review food safety plans or
inspection reports and to target our compliance activities based on
information that we see in those food safety plans or inspection
reports. However, as discussed in Response 384, we are not requiring
that other facilities submit a ``facility profile'' that would allow us
to more broadly review food safety plans and target our compliance
activities based on information that we see in those food safety plans
and will instead explore other mechanisms to achieve the goals we
described in the 2013 proposed human preventive controls rule for a
facility profile.

B. General Comments on Modified Requirements That Apply to a Qualified
Facility

    (Comment 573) Some comments assert that the proposed modified
requirements would create a costly burden for qualified facilities
(e.g.,

registering and making submissions to FDA) that would not be imposed on
other types of exempted facilities. Some of these comments question
whether the exemption for qualified facilities is meaningful in light
of the significant burden imposed by the proposed modified
requirements. Some comments contrast the proposed modified requirement
for qualified facilities to submit documentation to FDA with proposed
requirements for all other facilities to simply establish and maintain
applicable records.
    (Response 573) The submission requirements that we are establishing
in this rule for qualified facilities reflect the statutory framework
for qualified facilities (section 418(l)(2)(B) of the FD&C Act).
Although the submission requirements only apply to qualified
facilities, the reporting burden associated with submission of an
attestation is much lower than the recordkeeping burden for facilities
that are subject to the requirements for hazard analysis and risk-based
preventive controls (see section LXI).
    (Comment 574) Some comments ask us to minimize setting different
standards even though the modified requirements reflect express
statutory provisions.
    (Response 574) These comments appear to be referring to the
statutory provisions of section 418(n)(3)(C) of the FD&C Act, which
specify that the regulations we establish to implement section 418 of
the FD&C Act acknowledge differences in risk and minimize, as
appropriate, the number of separate standards that apply to separate
foods. We disagree that the statutory provisions of section
418(n)(3)(C) are directly relevant to the submission requirements of
this rule for qualified facilities. The requirements for qualified
facilities, but not other facilities, to submit documentation to FDA
reflect different regulatory requirements. The different regulatory
requirements are directed at different facilities, and do not set
separate standards for particular foods. Regardless, even if the
statutory provisions of section 418(n)(3)(C) were relevant to the
submission requirements of qualified facilities, provisions of this
rule that reflect express statutory provisions would not conflict with
the statutory direction in section 418(n)(3)(C).
    (Comment 575) Some comments ask us to implement the same labeling
requirements that we proposed to establish for farms that would be
eligible for a ``qualified exemption'' in the proposed produce safety
rule, noting that such labeling requirements would allow us to trace
food produced by the facility back through the supply chain if there is
a problem.
    (Response 575) The rule does include a labeling requirement
analogous to the applicable labeling requirement in the proposed
produce safety rule (see Sec.  117.201(e)). However, that labeling
requirement only applies to one of the two options that a qualified
facility has for satisfying the submission requirements (see Sec.
117.201(a)(2) and (e)). Specifically, a labeling requirement applies if
the qualified facility chooses to attest that it is in compliance with
applicable non-Federal food safety laws (Sec.  117.201(a)(2)(ii) and
(e)). However, the labeling requirement does not apply if the qualified
facility chooses to attest that it has identified the potential hazards
associated with the food being produced, is implementing preventive